www.express.co.uk Open in urlscan Pro
2600:9000:21f3:a000:e:515c:9940:93a1  Public Scan

URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Submission: On October 22 via manual from US

Summary

This website contacted 161 IPs in 14 countries across 100 domains to perform 880 HTTP transactions. The main IP is 2600:9000:21f3:a000:e:515c:9940:93a1, located in United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is www.express.co.uk.
TLS certificate: Issued by Amazon on August 23rd 2019. Valid for: a year.
This is the only time www.express.co.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2600:9000:21f... 16509 (AMAZON-02)
1 143.204.101.62 16509 (AMAZON-02)
81 2600:9000:21f... 16509 (AMAZON-02)
2 2606:2800:135... 15133 (EDGECAST)
1 148.64.56.194 200981 (GRAPESHOT...)
12 152.199.23.241 15133 (EDGECAST)
4 2a00:1450:400... 15169 (GOOGLE)
5 2.18.234.36 16625 (AKAMAI-AS)
3 209.197.3.63 20446 (HIGHWINDS3)
1 13.224.196.129 16509 (AMAZON-02)
3 35.190.72.53 15169 (GOOGLE)
1 142.93.164.210 14061 (DIGITALOC...)
1 2.18.234.122 16625 (AKAMAI-AS)
14 2.18.234.190 16625 (AKAMAI-AS)
7 2.16.106.56 20940 (AKAMAI-ASN1)
1 2.16.106.82 20940 (AKAMAI-ASN1)
1 216.58.207.66 15169 (GOOGLE)
1 1 2606:2800:234... 15133 (EDGECAST)
1 151.101.12.157 54113 (FASTLY)
1 2600:9000:20e... 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 151.139.128.10 20446 (HIGHWINDS3)
1 4 2.18.234.21 16625 (AKAMAI-AS)
2 2600:9000:21f... 16509 (AMAZON-02)
6 13 2.19.43.224 20940 (AKAMAI-ASN1)
4 17 2a00:1450:400... 15169 (GOOGLE)
2 2.16.106.115 20940 (AKAMAI-ASN1)
78 2a00:1450:400... 15169 (GOOGLE)
15 2a00:1450:400... 15169 (GOOGLE)
8 95.216.24.150 24940 (HETZNER-AS)
2 151.101.14.217 54113 (FASTLY)
2 35.190.63.234 15169 (GOOGLE)
1 2a04:4e42:1b:... 54113 (FASTLY)
3 2600:9000:21f... 16509 (AMAZON-02)
9 54.230.203.45 16509 (AMAZON-02)
23 35.244.232.184 15169 (GOOGLE)
1 178.250.2.130 44788 (ASN-CRITE...)
1 2 54.154.79.134 16509 (AMAZON-02)
1 1 185.94.180.128 35220 (SPOTX-AMS)
3 2.18.232.234 16625 (AKAMAI-AS)
19 2a00:1450:400... 15169 (GOOGLE)
18 41 2a00:1450:400... 15169 (GOOGLE)
19 172.217.16.194 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
7 2.18.232.28 16625 (AKAMAI-AS)
6 2.16.106.112 20940 (AKAMAI-ASN1)
12 2.16.106.97 20940 (AKAMAI-ASN1)
1 2.16.106.59 20940 (AKAMAI-ASN1)
1 2a04:4e42:1b:... 54113 (FASTLY)
9 64.202.112.31 22075 (AS-OUTBRAIN)
3 4 2a00:1450:400... 15169 (GOOGLE)
3 4 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 52.0.234.50 14618 (AMAZON-AES)
5 2a00:1450:400... 15169 (GOOGLE)
1 2.16.186.16 20940 (AKAMAI-ASN1)
2 64.74.101.79 18908 (BRIGHTCOV...)
1 159.180.84.2 33047 (INSTART)
18 28 185.94.180.126 35220 (SPOTX-AMS)
1 54.230.95.51 16509 (AMAZON-02)
1 104.244.42.5 13414 (TWITTER)
3 13.225.78.80 16509 (AMAZON-02)
1 104.244.42.195 13414 (TWITTER)
1 2600:9000:200... 16509 (AMAZON-02)
10 72.251.249.9 29791 (VOXEL-DOT...)
4 54.86.231.246 14618 (AMAZON-AES)
1 13.224.196.39 16509 (AMAZON-02)
33 2606:4700:10:... 13335 (CLOUDFLAR...)
14 2.18.235.40 16625 (AKAMAI-AS)
1 13.225.84.133 16509 (AMAZON-02)
1 2600:9000:200... 16509 (AMAZON-02)
5 151.101.14.2 54113 (FASTLY)
1 13.225.78.146 16509 (AMAZON-02)
2 52.216.160.69 16509 (AMAZON-02)
1 3.121.36.175 16509 (AMAZON-02)
3 35.186.220.219 15169 (GOOGLE)
7 185.94.180.123 35220 (SPOTX-AMS)
4 54.246.207.119 16509 (AMAZON-02)
31 167.114.216.54 16276 (OVH)
6 70.42.32.127 22075 (AS-OUTBRAIN)
1 151.101.114.27 54113 (FASTLY)
1 13.224.197.43 16509 (AMAZON-02)
4 2a00:1450:400... 15169 (GOOGLE)
1 37.252.161.184 29990 (ASN-APPNEXUS)
4 184.31.90.250 20940 (AKAMAI-ASN1)
3 93.184.221.64 15133 (EDGECAST)
1 52.212.115.156 16509 (AMAZON-02)
2 3 35.190.72.21 15169 (GOOGLE)
3 3 185.29.135.226 30419 (MEDIAMATH...)
2 3 151.101.14.49 54113 (FASTLY)
3 3 172.217.23.98 15169 (GOOGLE)
1 2a00:1288:110... 34010 (YAHOO-IRD)
1 1 193.0.160.128 54312 (ROCKETFUEL)
2 2 185.33.223.206 29990 (ASN-APPNEXUS)
3 3 52.58.208.187 16509 (AMAZON-02)
1 1 3.121.153.221 16509 (AMAZON-02)
2 2 54.93.38.207 16509 (AMAZON-02)
2 2 35.186.231.222 15169 (GOOGLE)
1 2 37.157.6.252 198622 (ADFORM)
1 1 46.228.164.11 56396 (TURN)
1 52.57.21.24 16509 (AMAZON-02)
1 2 54.194.238.142 16509 (AMAZON-02)
1 2 54.154.151.160 16509 (AMAZON-02)
2 2 147.75.102.200 54825 (PACKET)
1 195.181.174.6 60068 (CDN77)
1 23.67.136.71 20940 (AKAMAI-ASN1)
1 35.177.239.109 16509 (AMAZON-02)
1 13.225.78.78 16509 (AMAZON-02)
1 54.77.188.50 16509 (AMAZON-02)
7 151.101.114.49 54113 (FASTLY)
7 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 19 199.166.0.26 7415 (ADSAFE-1)
1 34.96.112.165 15169 (GOOGLE)
7 18.189.119.248 16509 (AMAZON-02)
17 199.166.0.32 7415 (ADSAFE-1)
33 104.244.37.20 7415 (ADSAFE-1)
2 2.18.233.180 16625 (AKAMAI-AS)
6 185.94.180.111 35220 (SPOTX-AMS)
1 2404:6800:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 172.217.16.130 15169 (GOOGLE)
2 104.109.91.215 20940 (AKAMAI-ASN1)
3 16 34.95.120.147 15169 (GOOGLE)
3 23.58.216.102 16625 (AKAMAI-AS)
1 2600:9000:20e... 16509 (AMAZON-02)
1 185.148.48.57 23539 (TUBEMOGUL)
1 3.9.104.81 16509 (AMAZON-02)
3 213.254.244.22 36062 (DOUBLE-VE...)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 2a05:f500:10:... 14413 (LINKEDIN)
1 2.16.106.57 20940 (AKAMAI-ASN1)
1 2600:9000:21f... 16509 (AMAZON-02)
1 2.16.106.48 20940 (AKAMAI-ASN1)
3 2600:9000:215... 16509 (AMAZON-02)
2 3 37.252.173.27 29990 (ASN-APPNEXUS)
2 62.149.0.72 15497 (COLOCALL ...)
1 35.156.24.221 16509 (AMAZON-02)
3 151.101.13.194 54113 (FASTLY)
3 213.174.135.1 39572 (ADVANCEDH...)
5 12 52.215.211.56 16509 (AMAZON-02)
3 2600:9000:215... 16509 (AMAZON-02)
3 185.3.92.12 63949 (LINODE-AP...)
7 2600:9000:21f... 16509 (AMAZON-02)
8 2a00:1450:400... 15169 (GOOGLE)
1 7 2.18.232.7 16625 (AKAMAI-AS)
1 35.201.78.160 15169 (GOOGLE)
3 213.174.156.165 39572 (ADVANCEDH...)
4 63.32.64.113 16509 (AMAZON-02)
3 69.173.144.141 26667 (RUBICONPR...)
2 2a0c:5c80:502... 55081 (24SHELLS)
2 3.121.26.224 16509 (AMAZON-02)
4 23.45.105.3 20940 (AKAMAI-ASN1)
16 107.178.247.57 15169 (GOOGLE)
8 2606:4700:10:... 13335 (CLOUDFLAR...)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
13 2600:9000:20e... 16509 (AMAZON-02)
2 13.224.199.29 16509 (AMAZON-02)
1 172.217.21.198 15169 (GOOGLE)
1 213.174.135.2 39572 (ADVANCEDH...)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2600:9000:21f... 16509 (AMAZON-02)
1 1 35.227.248.159 15169 (GOOGLE)
1 3 18.184.89.106 16509 (AMAZON-02)
2 23.111.9.35 33438 (HIGHWINDS2)
1 2600:9000:20e... 16509 (AMAZON-02)
1 18.196.104.43 16509 (AMAZON-02)
1 104.16.68.69 13335 (CLOUDFLAR...)
1 34.250.55.69 16509 (AMAZON-02)
2 2a00:1288:f03... 10310 (YAHOO-1)
5 18.194.34.120 16509 (AMAZON-02)
1 76.223.10.122 16509 (AMAZON-02)
2 152.199.23.177 15133 (EDGECAST)
1 1 104.17.119.107 13335 (CLOUDFLAR...)
2 23.21.61.195 14618 (AMAZON-AES)
880 161
Apex Domain
Subdomains
Transfer
83 express.co.uk
www.express.co.uk
cdn.images.express.co.uk
729 KB
78 adsafeprotected.com
vast.adsafeprotected.com
pixel.adsafeprotected.com
vpaid3.adsafeprotected.com
vastpixel2.adsafeprotected.com
static.adsafeprotected.com
dt.adsafeprotected.com
804 KB
64 imonomy.com
tag.imonomy.com
srv.imonomy.com
252 KB
54 googlesyndication.com
pagead2.googlesyndication.com
ade.googlesyndication.com
tpc.googlesyndication.com Failed
3 MB
50 doubleclick.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
googleads4.g.doubleclick.net
ad.doubleclick.net
289 KB
41 spotxchange.com
sync.search.spotxchange.com
search.spotxchange.com
event.spotxchange.com
ams01-event.spotxchange.com
ams01-search.spotxchange.com
25 KB
39 outbrain.com
widgets.outbrain.com
odb.outbrain.com
mcdp-nydc1.outbrain.com
mv.outbrain.com
videoadextradata.outbrain.com
vastcdn.outbrain.com
158 KB
35 brightcove.com
edge.api.brightcove.com
metrics.brightcove.com
secure.brightcove.com
f1.media.brightcove.com
1 MB
34 googletagservices.com
www.googletagservices.com
888 KB
34 spot.im
www.spot.im
recirculation.spot.im
launcher.spot.im
app-cdn.spot.im
api-2-0.spot.im
pix.spot.im
publisher-assets.spot.im
events-collector.spot.im
static-cdn.spot.im
images.spot.im
dynamic-cdn.spot.im
spotops.spot.im
1 MB
24 google.com
adservice.google.com
www.google.com
4 KB
23 google.de
adservice.google.de
www.google.de
4 KB
20 cloudfront.net
d2q1qtsl33ql2r.cloudfront.net
d1azc1qln24ryf.cloudfront.net
d23xwq4myz19mk.cloudfront.net
d2uepos3ef6db0.cloudfront.net
d3lcz8vpax4lo2.cloudfront.net
df80k0z3fi8zg.cloudfront.net
400 KB
19 streamrail.com
sdk.streamrail.com
k.streamrail.com
223 KB
17 google-analytics.com
www.google-analytics.com
38 KB
16 openx.net
imonomy-d.openx.net
eu-u.openx.net
spot-im-d.openx.net
75 KB
16 gstatic.com
fonts.gstatic.com
csi.gstatic.com
161 KB
14 crwdcntrl.net
sync.crwdcntrl.net
bcp.crwdcntrl.net
10 KB
14 googleapis.com
fonts.googleapis.com
imasdk.googleapis.com
maps.googleapis.com
333 KB
13 scorecardresearch.com
sb.scorecardresearch.com
10 KB
12 s-onetag.com
get.s-onetag.com
beacon.s-onetag.com
dfp-gateway.s-onetag.com
onetag-geo.s-onetag.com
onetag-geo-grouping.s-onetag.com
metrics-collector.s-onetag.com
32 KB
12 tiqcdn.com
tags.tiqcdn.com
28 KB
11 everesttech.net
sync-tm.everesttech.net
statsf-tm.everesttech.net
rtb-lb-event-tm-ams-tm.everesttech.net
playtime-tm.everesttech.net
2 KB
10 insticator.com
geoip.insticator.com
b2c.insticator.com
event.insticator.com
cms.insticator.com
5 KB
10 spotim.market
sync.spotim.market
player.spotim.market
hb.spotim.market
vast.spotim.market
99 KB
10 moatads.com
z.moatads.com
px.moatads.com
geo.moatads.com
201 KB
10 lijit.com
ap.lijit.com
60 KB
10 apester.com
static.apester.com
display.apester.com
events.apester.com
renderer.apester.com
312 KB
9 rubiconproject.com
optimized-by.rubiconproject.com
video-ads.rubiconproject.com
stats.aws.rubiconproject.com
47 KB
9 outbrainimg.com
tcheck.outbrainimg.com
log.outbrainimg.com
images.outbrainimg.com
69 KB
9 onthe.io
cdn.onthe.io
tt.onthe.io
22 KB
8 vidible.tv
acds.prod.vidible.tv
cdn-ssl.vidible.tv
trk.vidible.tv
cdn.vidible.tv
116 KB
7 teads.tv
a.teads.tv
t.teads.tv
sync.teads.tv
186 KB
7 firstimpression.io
ecdn.firstimpression.io
cdn.firstimpression.io
192 KB
7 2mdn.net
s0.2mdn.net
gcdn.2mdn.net
r1---sn-4g5ednse.c.2mdn.net
4 MB
6 doubleverify.com
cdn.doubleverify.com
cdn3.doubleverify.com
tps.doubleverify.com
tps20227.doubleverify.com
71 KB
6 adnxs.com
prebid.adnxs.com
ib.adnxs.com
5 KB
5 advertising.com
pixel.advertising.com
ads.adaptv.advertising.com
dtm.advertising.com
4 KB
5 moatpixel.com
spotxchangejsvideo759622536126.s.moatpixel.com
2 KB
5 bidswitch.net
x.bidswitch.net
aws-fr-sync.bidswitch.net
2 KB
5 gigya.com
cdns.gigya.com
cdns2.gigya.com
cdns3.gigya.com
cdns.eu1.gigya.com
136 KB
4 sphere.com
libs.sphere.com
73 KB
4 u5c93.com
c2.u5c93.com
1 KB
4 chartbeat.net
ping.chartbeat.net
672 B
4 northernandshell.co.uk
brightcove.northernandshell.co.uk
cdn.my.northernandshell.co.uk
499 KB
4 iris.tv
ovp.iris.tv
api.iris.tv
133 KB
3 myvisualiq.net
t.myvisualiq.net
1 KB
3 fastly.net
confiant-integrations.global.ssl.fastly.net
83 KB
3 exelator.com
loadm.exelator.com
load77.exelator.com
2 KB
3 mathtag.com
sync.mathtag.com
2 KB
3 rlcdn.com
idsync.rlcdn.com
1 KB
3 tubemogul.com
playtime.tubemogul.com
ud.tubemogul.com
27 KB
3 agkn.com
js.agkn.com
d.agkn.com
aa.agkn.com
4 KB
3 casalemedia.com
as-sec.casalemedia.com
ssum.casalemedia.com
1 KB
3 spotxcdn.com
aka.spotxcdn.com
cdn.spotxcdn.com
236 KB
3 chartbeat.com
static.chartbeat.com
mab.chartbeat.com
23 KB
2 fontawesome.com
use.fontawesome.com
85 KB
2 amazon-adsystem.com
c.amazon-adsystem.com
25 KB
2 researchnow.com
tag.researchnow.com
722 B
2 pubmatic.com
ads.pubmatic.com
2 demdex.net
dpm.demdex.net
1 KB
2 adform.net
c1.adform.net
448 B
2 admedo.com
pool.admedo.com
753 B
2 amazonaws.com
s3.amazonaws.com
9 KB
2 digitru.st
cdn.digitru.st
bsw.digitru.st
12 KB
2 adsrvr.org
match.adsrvr.org
1 KB
2 googletagmanager.com
www.googletagmanager.com
25 KB
2 twitter.com
platform.twitter.com
analytics.twitter.com
955 B
2 oath.com
consent.cmp.oath.com
service.cmp.oath.com
26 KB
1 brealtime.com
edba.brealtime.com
504 B
1 districtm.io
dmx.districtm.io
420 B
1 emxdgt.com
hb.emxdgt.com
309 B
1 tapad.com
tapestry.tapad.com
465 B
1 consensu.org
cmp.teads.mgr.consensu.org
1 adtelligent.com
player.adtelligent.com
1 KB
1 vidiom.net
api.vidiom.net
2 KB
1 linkedin.com
www.linkedin.com
1 facebook.com
graph.facebook.com
669 B
1 rkdms.com
mid.rkdms.com
366 B
1 bluekai.com
tags.bluekai.com
757 B
1 w55c.net
pm.w55c.net
550 B
1 turn.com
ad.turn.com
498 B
1 rfihub.com
p.rfihub.com
702 B
1 yahoo.com
pr-bh.ybp.yahoo.com
290 B
1 krxd.net
beacon.krxd.net
320 B
1 boltdns.net
cf-images.eu-west-1.prod.boltdns.net
7 KB
1 cpx.to
p.cpx.to
2 KB
1 t.co
t.co
448 B
1 akamaihd.net
httpsak-a.akamaihd.net
58 KB
1 spotx.tv
js.spotx.tv
590 B
1 criteo.net
static.criteo.net
27 KB
1 zencdn.net
vjs.zencdn.net
7 KB
1 indexww.com
js-sec.indexww.com
39 KB
1 watchingthat.net
cdn.watchingthat.net
40 KB
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 googleadservices.com
www.googleadservices.com
9 KB
1 brightcove.net
players.brightcove.net
264 KB
1 sharethrough.com
native.sharethrough.com
120 KB
1 grapeshot.co.uk
trinitymirror.grapeshot.co.uk
538 B
1 webcontentassessor.com
scripts.webcontentassessor.com
44 KB
880 100
Domain Requested by
81 cdn.images.express.co.uk www.express.co.uk
consent.cmp.oath.com
www.google-analytics.com
cdn.images.express.co.uk
44 pagead2.googlesyndication.com www.express.co.uk
tag.imonomy.com
pagead2.googlesyndication.com
srv.imonomy.com
34 www.googletagservices.com www.express.co.uk
pagead2.googlesyndication.com
scripts.webcontentassessor.com
securepubads.g.doubleclick.net
33 dt.adsafeprotected.com www.express.co.uk
33 tag.imonomy.com tags.tiqcdn.com
pagead2.googlesyndication.com
www.express.co.uk
31 srv.imonomy.com tag.imonomy.com
www.express.co.uk
imonomy-d.openx.net
srv.imonomy.com
28 sync.search.spotxchange.com 18 redirects www.express.co.uk
23 metrics.brightcove.com www.express.co.uk
21 googleads.g.doubleclick.net 18 redirects www.googleadservices.com
pagead2.googlesyndication.com
20 adservice.google.com www.googletagservices.com
imasdk.googleapis.com
pagead2.googlesyndication.com
scripts.webcontentassessor.com
19 pixel.adsafeprotected.com 1 redirects ud.tubemogul.com
vpaid3.adsafeprotected.com
www.express.co.uk
19 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.express.co.uk
scripts.webcontentassessor.com
19 adservice.google.de www.googletagservices.com
pagead2.googlesyndication.com
scripts.webcontentassessor.com
17 static.adsafeprotected.com www.express.co.uk
pixel.adsafeprotected.com
17 www.google-analytics.com 4 redirects www.express.co.uk
www.google-analytics.com
16 k.streamrail.com
15 fonts.gstatic.com www.express.co.uk
www.google-analytics.com
cdn.images.express.co.uk
static-cdn.spot.im
cdn.doubleverify.com
d3lcz8vpax4lo2.cloudfront.net
14 widgets.outbrain.com www.express.co.uk
widgets.outbrain.com
13 df80k0z3fi8zg.cloudfront.net scripts.webcontentassessor.com
www.express.co.uk
d3lcz8vpax4lo2.cloudfront.net
13 sb.scorecardresearch.com 6 redirects www.express.co.uk
12 bcp.crwdcntrl.net 5 redirects www.express.co.uk
scripts.webcontentassessor.com
12 tags.tiqcdn.com www.express.co.uk
tags.tiqcdn.com
10 imonomy-d.openx.net 2 redirects www.express.co.uk
imonomy-d.openx.net
10 ap.lijit.com get.s-onetag.com
ap.lijit.com
scripts.webcontentassessor.com
df80k0z3fi8zg.cloudfront.net
9 edge.api.brightcove.com players.brightcove.net
8 tpc.googlesyndication.com securepubads.g.doubleclick.net
scripts.webcontentassessor.com
confiant-integrations.global.ssl.fastly.net
8 pix.spot.im launcher.spot.im
static-cdn.spot.im
8 tt.onthe.io cdn.onthe.io
7 dfp-gateway.s-onetag.com get.s-onetag.com
7 vastpixel2.adsafeprotected.com www.express.co.uk
7 vastcdn.outbrain.com libs.sphere.com
7 statsf-tm.everesttech.net www.express.co.uk
7 videoadextradata.outbrain.com libs.sphere.com
6 images.outbrainimg.com www.express.co.uk
6 mcdp-nydc1.outbrain.com widgets.outbrain.com
6 search.spotxchange.com aka.spotxcdn.com
sdk.streamrail.com
6 px.moatads.com www.express.co.uk
6 static-cdn.spot.im launcher.spot.im
6 api-2-0.spot.im launcher.spot.im
static-cdn.spot.im
6 imasdk.googleapis.com players.brightcove.net
imasdk.googleapis.com
vpaid3.adsafeprotected.com
5 trk.vidible.tv www.express.co.uk
5 spotxchangejsvideo759622536126.s.moatpixel.com www.express.co.uk
5 event.spotxchange.com www.express.co.uk
5 ib.adnxs.com 4 redirects df80k0z3fi8zg.cloudfront.net
5 s0.2mdn.net imasdk.googleapis.com
scripts.webcontentassessor.com
www.express.co.uk
s0.2mdn.net
4 event.insticator.com d3lcz8vpax4lo2.cloudfront.net
4 video-ads.rubiconproject.com sdk.streamrail.com
4 cdn.firstimpression.io www.express.co.uk
4 eu-u.openx.net imonomy-d.openx.net
4 libs.sphere.com widgets.outbrain.com
libs.sphere.com
www.express.co.uk
4 maps.googleapis.com static.apester.com
maps.googleapis.com
4 c2.u5c93.com players.brightcove.net
4 odb.outbrain.com widgets.outbrain.com
4 ping.chartbeat.net www.express.co.uk
4 www.google.de www.express.co.uk
4 www.google.com 3 redirects www.express.co.uk
4 stats.g.doubleclick.net 3 redirects www.express.co.uk
4 fonts.googleapis.com www.express.co.uk
recirculation.spot.im
d3lcz8vpax4lo2.cloudfront.net
3 t.myvisualiq.net 1 redirects www.express.co.uk
3 geoip.insticator.com d3lcz8vpax4lo2.cloudfront.net
3 optimized-by.rubiconproject.com sdk.streamrail.com
video-ads.rubiconproject.com
3 hb.spotim.market player.spotim.market
3 a.teads.tv scripts.webcontentassessor.com
a.teads.tv
3 ecdn.firstimpression.io www.express.co.uk
pagead2.googlesyndication.com
3 d3lcz8vpax4lo2.cloudfront.net scripts.webcontentassessor.com
d3lcz8vpax4lo2.cloudfront.net
3 player.spotim.market www.express.co.uk
player.spotim.market
3 confiant-integrations.global.ssl.fastly.net recirculation.spot.im
confiant-integrations.global.ssl.fastly.net
3 sdk.streamrail.com recirculation.spot.im
sdk.streamrail.com
3 x.bidswitch.net 3 redirects
3 cm.g.doubleclick.net 3 redirects
3 sync.mathtag.com 3 redirects
3 idsync.rlcdn.com 2 redirects www.express.co.uk
3 images.spot.im static-cdn.spot.im
pixel.adsafeprotected.com
3 renderer.apester.com static.apester.com
www.express.co.uk
3 z.moatads.com tags.tiqcdn.com
cdn.spotxcdn.com
cdn-ssl.vidible.tv
3 cdn.my.northernandshell.co.uk cdn.images.express.co.uk
cdn.my.northernandshell.co.uk
3 ovp.iris.tv players.brightcove.net
ovp.iris.tv
3 static.apester.com www.express.co.uk
static.apester.com
3 www.spot.im www.express.co.uk
recirculation.spot.im
app-cdn.spot.im
2 stats.aws.rubiconproject.com
2 dtm.advertising.com cdn-ssl.vidible.tv
dtm.advertising.com
2 sync.teads.tv 1 redirects a.teads.tv
2 use.fontawesome.com d3lcz8vpax4lo2.cloudfront.net
www.express.co.uk
2 t.teads.tv
2 c.amazon-adsystem.com scripts.webcontentassessor.com
c.amazon-adsystem.com
2 b2c.insticator.com d3lcz8vpax4lo2.cloudfront.net
2 ads.adaptv.advertising.com sdk.streamrail.com
cdn-ssl.vidible.tv
2 vast.spotim.market sdk.streamrail.com
2 spot-im-d.openx.net 1 redirects
2 tps20227.doubleverify.com cdn.doubleverify.com
2 ssum.casalemedia.com 1 redirects
2 sync.spotim.market
2 cdn.doubleverify.com cdn.spotxcdn.com
www.express.co.uk
2 tag.researchnow.com www.express.co.uk
2 ade.googlesyndication.com www.express.co.uk
2 googleads4.g.doubleclick.net www.express.co.uk
2 ads.pubmatic.com srv.imonomy.com
recirculation.spot.im
2 loadm.exelator.com 2 redirects
2 dpm.demdex.net 1 redirects www.express.co.uk
2 sync.crwdcntrl.net 1 redirects www.express.co.uk
2 c1.adform.net 1 redirects www.express.co.uk
2 pool.admedo.com 2 redirects
2 aws-fr-sync.bidswitch.net 2 redirects
2 sync-tm.everesttech.net 2 redirects
2 playtime.tubemogul.com cdn.spotxcdn.com
playtime.tubemogul.com
2 cdn.spotxcdn.com imasdk.googleapis.com
www.express.co.uk
2 s3.amazonaws.com www.express.co.uk
2 secure.brightcove.com players.brightcove.net
2 log.outbrainimg.com widgets.outbrain.com
2 match.adsrvr.org 1 redirects js-sec.indexww.com
2 events.apester.com static.apester.com
2 display.apester.com static.apester.com
2 app-cdn.spot.im www.spot.im
app-cdn.spot.im
2 static.chartbeat.com tags.tiqcdn.com
2 www.googletagmanager.com www.express.co.uk
www.googletagmanager.com
2 cdns.gigya.com www.express.co.uk
cdns.gigya.com
2 www.express.co.uk cdn.images.express.co.uk
1 edba.brealtime.com 1 redirects
1 cdn.vidible.tv cdn-ssl.vidible.tv
1 metrics-collector.s-onetag.com beacon.s-onetag.com
1 cms.insticator.com d3lcz8vpax4lo2.cloudfront.net
1 cdn-ssl.vidible.tv acds.prod.vidible.tv
1 acds.prod.vidible.tv sdk.streamrail.com
1 dmx.districtm.io df80k0z3fi8zg.cloudfront.net
1 hb.emxdgt.com df80k0z3fi8zg.cloudfront.net
1 onetag-geo-grouping.s-onetag.com beacon.s-onetag.com
1 tapestry.tapad.com 1 redirects
1 onetag-geo.s-onetag.com beacon.s-onetag.com
1 cmp.teads.mgr.consensu.org a.teads.tv
1 player.adtelligent.com player.spotim.market
1 ad.doubleclick.net scripts.webcontentassessor.com
1 api.vidiom.net sdk.streamrail.com
1 pixel.advertising.com
1 spotops.spot.im recirculation.spot.im
1 d2uepos3ef6db0.cloudfront.net
1 dynamic-cdn.spot.im recirculation.spot.im
1 www.linkedin.com cdns3.gigya.com
1 graph.facebook.com cdns3.gigya.com
1 tps.doubleverify.com cdn.doubleverify.com
1 cdn3.doubleverify.com cdn.doubleverify.com
1 geo.moatads.com z.moatads.com
1 playtime-tm.everesttech.net www.express.co.uk
1 rtb-lb-event-tm-ams-tm.everesttech.net www.express.co.uk
1 ams01-search.spotxchange.com www.express.co.uk
1 ams01-event.spotxchange.com www.express.co.uk
1 d23xwq4myz19mk.cloudfront.net cdn.spotxcdn.com
1 r1---sn-4g5ednse.c.2mdn.net www.express.co.uk
1 gcdn.2mdn.net 1 redirects
1 csi.gstatic.com imasdk.googleapis.com
1 vpaid3.adsafeprotected.com www.express.co.uk
1 ud.tubemogul.com playtime.tubemogul.com
1 vast.adsafeprotected.com playtime.tubemogul.com
1 mid.rkdms.com www.express.co.uk
1 aa.agkn.com www.express.co.uk
1 tags.bluekai.com www.express.co.uk
1 load77.exelator.com www.express.co.uk
1 pm.w55c.net www.express.co.uk
1 ad.turn.com 1 redirects
1 bsw.digitru.st 1 redirects
1 p.rfihub.com 1 redirects
1 pr-bh.ybp.yahoo.com www.express.co.uk
1 beacon.krxd.net www.express.co.uk
1 mv.outbrain.com widgets.outbrain.com
1 prebid.adnxs.com cdn.watchingthat.net
1 d1azc1qln24ryf.cloudfront.net static.apester.com
1 f1.media.brightcove.com players.brightcove.net
1 d.agkn.com js.agkn.com
1 cf-images.eu-west-1.prod.boltdns.net ovp.iris.tv
1 js.agkn.com tags.tiqcdn.com
1 d2q1qtsl33ql2r.cloudfront.net www.express.co.uk
1 p.cpx.to tags.tiqcdn.com
1 beacon.s-onetag.com get.s-onetag.com
1 analytics.twitter.com static.ads-twitter.com
1 cdns.eu1.gigya.com cdns.gigya.com
1 t.co www.express.co.uk
1 cdns3.gigya.com cdns.gigya.com
1 brightcove.northernandshell.co.uk players.brightcove.net
1 cdns2.gigya.com www.express.co.uk
1 service.cmp.oath.com cdn.images.express.co.uk
1 cdn.digitru.st aka.spotxcdn.com
1 httpsak-a.akamaihd.net www.express.co.uk
1 api.iris.tv ovp.iris.tv
1 mab.chartbeat.com static.chartbeat.com
1 events-collector.spot.im recirculation.spot.im
1 publisher-assets.spot.im www.express.co.uk
1 tcheck.outbrainimg.com widgets.outbrain.com
1 as-sec.casalemedia.com cdn.watchingthat.net
1 aka.spotxcdn.com www.express.co.uk
1 js.spotx.tv 1 redirects
1 static.criteo.net js-sec.indexww.com
1 vjs.zencdn.net players.brightcove.net
1 js-sec.indexww.com tags.tiqcdn.com
1 cdn.watchingthat.net tags.tiqcdn.com
1 get.s-onetag.com www.express.co.uk
1 static.ads-twitter.com www.express.co.uk
1 platform.twitter.com 1 redirects
1 www.googleadservices.com www.express.co.uk
1 launcher.spot.im www.express.co.uk
1 recirculation.spot.im www.express.co.uk
1 players.brightcove.net www.express.co.uk
1 cdn.onthe.io www.express.co.uk
1 native.sharethrough.com www.express.co.uk
1 trinitymirror.grapeshot.co.uk www.express.co.uk
1 consent.cmp.oath.com www.express.co.uk
1 scripts.webcontentassessor.com www.express.co.uk
880 205
Subject Issuer Validity Valid
express.co.uk
Amazon
2019-08-23 -
2020-09-23
a year crt.sh
*.webcontentassessor.com
Amazon
2019-05-13 -
2020-06-13
a year crt.sh
cdn.images.express.co.uk
Amazon
2019-08-28 -
2020-09-28
a year crt.sh
service.cmp.oath.com
DigiCert SHA2 Secure Server CA
2018-03-22 -
2020-03-26
2 years crt.sh
*.grapeshot.co.uk
DigiCert SHA2 Secure Server CA
2019-03-05 -
2021-03-04
2 years crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2017-10-25 -
2020-05-13
3 years crt.sh
*.googleapis.com
GTS CA 1O1
2019-10-03 -
2019-12-26
3 months crt.sh
cdns.gigya.com
DigiCert SHA2 Secure Server CA
2018-11-06 -
2020-02-05
a year crt.sh
*.spot.im
COMODO RSA Domain Validation Secure Server CA
2017-02-08 -
2020-02-17
3 years crt.sh
*.sharethrough.com
Go Daddy Secure Certificate Authority - G2
2018-09-18 -
2019-11-17
a year crt.sh
static.apester.com
Let's Encrypt Authority X3
2019-10-15 -
2020-01-13
3 months crt.sh
*.onthe.io
Sectigo RSA Domain Validation Secure Server CA
2019-03-04 -
2020-05-02
a year crt.sh
players.brightcove.net
DigiCert SHA2 Secure Server CA
2019-06-11 -
2020-09-09
a year crt.sh
*.outbrain.com
DigiCert SHA2 Secure Server CA
2018-12-14 -
2020-03-14
a year crt.sh
www.googleadservices.com
GTS CA 1O1
2019-10-03 -
2019-12-26
3 months crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2019-08-14 -
2020-08-18
a year crt.sh
*.s-onetag.com
Amazon
2019-06-25 -
2020-07-25
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2019-10-03 -
2019-12-26
3 months crt.sh
*.watchingthat.net
AlphaSSL CA - SHA256 - G2
2019-08-28 -
2020-10-21
a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2019-07-17 -
2020-03-09
8 months crt.sh
*.chartbeat.com
Gandi Standard SSL CA 2
2019-04-10 -
2020-04-10
a year crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA
2018-11-28 -
2019-12-26
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2019-10-03 -
2019-12-26
3 months crt.sh
*.google.com
GTS CA 1O1
2019-10-03 -
2019-12-26
3 months crt.sh
t2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-08-06 -
2020-02-16
6 months crt.sh
events.apester.com
Let's Encrypt Authority X3
2019-10-15 -
2020-01-13
3 months crt.sh
osff.map.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-10-14 -
2020-01-23
3 months crt.sh
iris.tv
Amazon
2018-12-06 -
2020-01-06
a year crt.sh
*.api.brightcove.com
Amazon
2019-10-21 -
2020-11-21
a year crt.sh
metrics.brightcove.com
Let's Encrypt Authority X3
2019-10-01 -
2019-12-30
3 months crt.sh
*.criteo.net
DigiCert ECC Secure Server CA
2019-03-26 -
2020-03-30
a year crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
cdn.spotxcdn.com
GeoTrust RSA CA 2018
2019-04-24 -
2020-05-23
a year crt.sh
*.outbrainimg.com
DigiCert SHA2 Secure Server CA
2019-02-24 -
2020-05-25
a year crt.sh
f6.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-10-17 -
2020-08-07
10 months crt.sh
www.google.de
GTS CA 1O1
2019-10-03 -
2019-12-26
3 months crt.sh
*.doubleclick.net
GTS CA 1O1
2019-10-10 -
2020-01-02
3 months crt.sh
a248.e.akamai.net
DigiCert Secure Site ECC CA-1
2019-08-13 -
2020-08-12
a year crt.sh
*.brightcove.com
COMODO RSA Domain Validation Secure Server CA
2018-04-03 -
2020-05-20
2 years crt.sh
cdn.digitru.st
Sectigo RSA Organization Validation Secure Server CA
2019-05-09 -
2021-05-08
2 years crt.sh
*.search.spotxchange.com
GeoTrust RSA CA 2018
2019-03-20 -
2021-04-21
2 years crt.sh
brightcove.northernandshell.co.uk
Amazon
2019-04-04 -
2020-05-04
a year crt.sh
t.co
DigiCert SHA2 High Assurance Server CA
2019-04-09 -
2020-04-01
a year crt.sh
www.google.com
GTS CA 1O1
2019-10-10 -
2020-01-02
3 months crt.sh
*.my.northernandshell.co.uk
Amazon
2019-08-09 -
2020-09-09
a year crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA
2019-04-09 -
2020-04-01
a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2
2019-03-11 -
2020-05-10
a year crt.sh
*.chartbeat.net
Thawte RSA CA 2018
2018-12-20 -
2020-01-01
a year crt.sh
p.cpx.to
COMODO RSA Domain Validation Secure Server CA
2015-02-10 -
2020-02-09
5 years crt.sh
imonomy.com
CloudFlare Inc ECC CA-2
2019-09-06 -
2020-09-05
a year crt.sh
moatads.com
DigiCert ECC Secure Server CA
2018-11-10 -
2020-02-09
a year crt.sh
*.cloudfront.net
DigiCert Global CA G2
2019-07-17 -
2020-07-05
a year crt.sh
*.agkn.com
RapidSSL RSA CA 2018
2018-06-21 -
2020-09-16
2 years crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-07-30 -
2020-07-25
a year crt.sh
*.prod.boltdns.net
Amazon
2019-01-02 -
2020-02-02
a year crt.sh
s3.amazonaws.com
DigiCert Baltimore CA-2 G2
2019-09-06 -
2020-12-02
a year crt.sh
renderer.apester.com
Let's Encrypt Authority X3
2019-10-15 -
2020-01-13
3 months crt.sh
*.spotxchange.com
GeoTrust RSA CA 2018
2019-03-18 -
2021-03-17
2 years crt.sh
*.p2r14.com
Amazon
2019-04-01 -
2020-05-01
a year crt.sh

COMODO RSA Domain Validation Secure Server CA
2018-12-10 -
2019-12-10
a year crt.sh
brightcove.com
GlobalSign CloudSSL CA - SHA256 - G3
2019-09-10 -
2020-02-26
6 months crt.sh
prebid.adnxs.com
GeoTrust RSA CA 2018
2019-03-25 -
2021-05-20
2 years crt.sh
*.sphere.com
DigiCert SHA2 Secure Server CA
2019-03-15 -
2020-06-13
a year crt.sh
*.tubemogul.com
DigiCert SHA2 Secure Server CA
2018-04-12 -
2020-04-15
2 years crt.sh
*.krxd.net
DigiCert SHA2 Secure Server CA
2019-04-11 -
2020-04-11
a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2019-04-24 -
2020-04-23
a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA
2019-08-07 -
2020-02-03
6 months crt.sh
track.adform.net
DigiCert SHA2 Secure Server CA
2019-09-16 -
2021-09-20
2 years crt.sh
*.w55c.net
Amazon
2019-09-24 -
2020-10-24
a year crt.sh
*.crwdcntrl.net
Go Daddy Secure Certificate Authority - G2
2019-06-13 -
2021-06-28
2 years crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
1605158521.rsc.cdn77.org
Let's Encrypt Authority X3
2019-09-05 -
2019-12-04
3 months crt.sh
odc-prod-01.oracle.com
DigiCert ECC Secure Server CA
2018-12-10 -
2020-03-10
a year crt.sh
*.rkdms.com
Entrust Certification Authority - L1K
2017-10-09 -
2020-10-30
3 years crt.sh
adsafeprotected.com
Amazon
2019-04-25 -
2020-05-25
a year crt.sh
h2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-05-30 -
2020-01-13
7 months crt.sh
*.adsafeprotected.com
COMODO RSA Domain Validation Secure Server CA
2018-08-20 -
2020-09-17
2 years crt.sh
vpaid3.adsafeprotected.com
Let's Encrypt Authority X3
2019-09-26 -
2019-12-25
3 months crt.sh
*.pubmatic.com
DigiCert SHA2 Secure Server CA
2018-12-13 -
2020-03-13
a year crt.sh
*.c.docs.google.com
GTS CA 1O1
2019-10-10 -
2019-12-19
2 months crt.sh
*.researchnow.com
DigiCert SHA2 Secure Server CA
2019-08-16 -
2020-11-14
a year crt.sh
*.openx.net
GeoTrust RSA CA 2018
2018-01-04 -
2020-07-09
3 years crt.sh
*.doubleverify.com
DigiCert ECC Secure Server CA
2019-01-22 -
2020-01-22
a year crt.sh
*.tmogul.com
DigiCert SHA2 High Assurance Server CA
2017-08-10 -
2020-08-05
3 years crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA
2019-03-12 -
2021-06-10
2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-09-22 -
2019-12-20
3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2018-05-30 -
2020-09-01
2 years crt.sh
*.streamrail.com
COMODO RSA Domain Validation Secure Server CA
2018-08-21 -
2020-08-20
2 years crt.sh
sync.spotim.market
Let's Encrypt Authority X3
2019-10-14 -
2020-01-12
3 months crt.sh
pixel.advertising.com
DigiCert SHA2 High Assurance Server CA
2017-06-14 -
2020-06-18
3 years crt.sh
*.freetls.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-01-02 -
2020-01-03
a year crt.sh
player.spotim.market
Let's Encrypt Authority X3
2019-09-14 -
2019-12-13
3 months crt.sh
*.firstimpression.io
COMODO RSA Organization Validation Secure Server CA
2018-11-28 -
2019-12-05
a year crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2019-10-03 -
2019-12-26
3 months crt.sh
teads.tv
Let's Encrypt Authority X3
2019-08-22 -
2019-11-20
3 months crt.sh
*.vidiom.net
Sectigo RSA Domain Validation Secure Server CA
2019-07-24 -
2021-08-22
2 years crt.sh
hb.spotim.market
Let's Encrypt Authority X3
2019-10-20 -
2020-01-18
3 months crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA
2019-01-10 -
2021-01-14
2 years crt.sh
*.unoadsrv.com
COMODO RSA Domain Validation Secure Server CA
2016-12-02 -
2019-12-02
3 years crt.sh
*.adaptv.advertising.com
DigiCert SHA2 High Assurance Server CA
2017-09-20 -
2020-09-18
3 years crt.sh
*.insticator.com
COMODO RSA Organization Validation Secure Server CA
2018-05-25 -
2020-08-26
2 years crt.sh
c.amazon-adsystem.com
Amazon
2019-10-07 -
2020-09-29
a year crt.sh
*.adtelligent.com
COMODO RSA Domain Validation Secure Server CA
2017-11-10 -
2020-11-09
3 years crt.sh
teads.mgr.consensu.org
Let's Encrypt Authority X3
2019-09-23 -
2019-12-22
3 months crt.sh
t.myvisualiq.net
COMODO RSA Domain Validation Secure Server CA
2017-07-05 -
2020-07-28
3 years crt.sh
*.fontawesome.com
DigiCert SHA2 Secure Server CA
2018-09-17 -
2019-11-21
a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
*.emxdgt.com
Go Daddy Secure Certificate Authority - G2
2019-07-17 -
2020-07-17
a year crt.sh
districtm.io
CloudFlare Inc ECC CA-2
2019-03-26 -
2020-03-26
a year crt.sh
acds.prod.vidible.tv
DigiCert SHA2 High Assurance Server CA
2018-01-24 -
2021-01-28
3 years crt.sh
cdn-ycs.vidible.tv
DigiCert SHA2 High Assurance Server CA
2019-09-02 -
2020-02-29
6 months crt.sh
trk.vidible.tv
DigiCert SHA2 High Assurance Server CA
2018-02-21 -
2021-02-25
3 years crt.sh
dtm.advertising.com
DigiCert SHA2 Secure Server CA
2019-03-28 -
2021-04-01
2 years crt.sh
*.aws.rubiconproject.com
DigiCert SHA2 Secure Server CA
2017-11-21 -
2021-01-06
3 years crt.sh

This page contains 117 frames:

Primary Page: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: 916C45B5D6E2EBFE00D88FCE94012A68
Requests: 423 HTTP requests in this frame

Frame: https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.html
Frame ID: 824125B3C95ABE2D987A7FAD568801D4
Requests: 6 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.343.1_en.html
Frame ID: BE3F4CB9E82172750963D5D0C105AFFC
Requests: 1 HTTP requests in this frame

Frame: https://cdns.eu1.gigya.com/gs/webSdk/Api.aspx?apiKey=3_BBXBRC0QUUloJ0Hujw4HOY17aLrL0Uy8FDx59O4-PrYbWWtrnCBKphB69PH9tXSb&version=latest
Frame ID: D052E13F2A787FE0AAD4D5FE5154456D
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/www/delivery/fpi.js?z=598981&width=320&height=50&iv=sf
Frame ID: 158E9541D2B000DCB983D60E1262103E
Requests: 3 HTTP requests in this frame

Frame: https://d.agkn.com/iframe/8613/?che=701816726&gdpr=&gdpr_consent=&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&bpid=northernshelluk&c=%7B%22bpid%22%3A%22northernshelluk%22%2C%22loc%22%3A%22https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest%22%2C%22gdpr%22%3A%22%22%2C%22gdpr_consent%22%3A%22%22%2C%22ref%22%3A%22-1%22%2C%22cid%22%3A%22-1%22%2C%22sid%22%3A%22-1%22%2C%22gen%22%3A%22-1%22%2C%22age%22%3A%22-1%22%2C%22cat%22%3A%22-1%22%2C%22brd%22%3A%22-1%22%7D
Frame ID: E707E2439E233681F5FEBD80B45A4F38
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Frame ID: EB87036C88B0236B5E9460FB2EEC678E
Requests: 1 HTTP requests in this frame

Frame: https://renderer.apester.com/v2/static/main.01ddce667cb7f50778a2.bundle.js
Frame ID: D1D13DF11DDDCBF0962D944951C18080
Requests: 8 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/obPixelFrame/obPixelFrame.htm
Frame ID: DF1B39EEBD48AE7366853D16836F6516
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/obPixelFrame/obPixelFrame.htm
Frame ID: 04652ACF392A4CAD51EDCBA6EF656A09
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/obPixelFrame/obPixelFrame.htm
Frame ID: 46D3B204AD0C4567EE9F780110F69426
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/obPixelFrame/obPixelFrame.htm
Frame ID: 89FD9FBCB9175C78BA5DE94151C9AE4A
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/obPixelFrame/obPixelFrame.htm
Frame ID: 4D28924043E5B6795815DC04D76DAF7C
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/sdkloader/loader.js
Frame ID: DB0F4C2070A8B318EBFA3AD6206F222B
Requests: 37 HTTP requests in this frame

Frame: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/vpaidjsproxy-20190930.js?feedURL=https%3A%2F%2Fasf-tm.everesttech.net%2Ffeed%2Fplacement.js%3Fid%3DWe0nATVNAtvwvrOpbjtB%26tm_auction_id%3Dcb9b9287f4a611e9b2f613ae17dc0006.1%26price%3D1%26bi%3DB087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk%26did%3D%26didtype%3DUNK%26barefeed%3DT%26rand%3D1437732598%26seller_id%3D124576%26tm_user_ip%3D6b7394220b53d16a5ac96d1fe8d2b2b3%26expaId%3D%26q%3DH4sIAAAAAAAAAG2Ry08TURSHvS2WhyGSUhLSuLh2BcSZzp3pvNRIWkGtbaW2IJUNuTNzp710XszclseSmGgwcYHRBYmJa3FlIgv8FzBu1IVrV7oxLF2oRUxMjGdxFr-c37f4zuDowfAq-7l3OPZs6Ymf_tE3NMU2AsI3fb_pEBzQiDd9N2tQyyIhn7fqJOySsEZWOyRiyXd94x8eJDKpRSJ4-fk7t_Ksu9YN5wJjhRUmXr65B8SUawe4tWKIN71iR2vVVVlCa9rbp6_3zhZSQaVsLxSlxl2vUZ4ttpFZ9rUdsFHxN6nj4KzMC3Cigk3qMT9qXYJFjxEH9gI4V4cNiIRllFuWJ2E-CByySIwSZVlZUnlJgROlG_OV8gXo0DaB14nZ9ifh1VbouySr5niBl1RR55Giwzq2cUj_1HYBVAxV0nOiKBiyZCEFy9jUFQvZRLNEQzSkA5AxDd3QRU21c1hBiOiGaCtIwgSplikIgsKjL0AZuP95PJnSqw6do1ZzCUuVQLfCoqjeTg-T9SAk0bFYvtOGQAD6la9prn_zcPoIJJCYk1XlO0hprrNUrW10hZVat6KVGiW5gLZig8zlsBtxCG_HkiEzuJPPcDYNIyYpO7GRf8MXsb6IMvIq1t_x2p6_5h3FLg_9xSQTJ8fp_9Ayoz1XXG2-wIkC0pGAFE5CW_GZodNR4LP1keePPw2n4wv1mczxmjz1e75NX4xTNyicu9bTPbvOSOhhpxpSk9R7pYbZwl6TVAe242cGwAgYBxBMAXE3foI8vz_2cf89ePTwF3zr1nGYAgAA%26psId%3D9PliOidgZa3Mp9drI27Q%26page_url%3Dhttps%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&cpKey=mfpahjb2JnIu8hS7531w&mpKey=We0nATVNAtvwvrOpbjtB&adKey=pMLfUI3XYnXLEIk1cLo8&framework=vpaid&psId=9PliOidgZa3Mp9drI27Q&cd=%7B%22zip%22%3A%22UNKNOWN%22%2C%22fbd%22%3A%7B%22ssb%22%3A%22F%22%2C%22psb%22%3A%22F%22%2C%22pd%22%3A%22express.co.uk%22%2C%22mpw%22%3A%22640%22%2C%22mph%22%3A%22480%22%2C%22aburl%22%3A%22http%3A%2F%2Fsearch.spotxchange.com%2Ftrack%2Ftag%2F6409.4645%2Fimg%3Fdate%3D1571733282981%26pid%3D124576%26cid%3D216448%26provided_url%3D%24%7Bpd%7D%26detected_url%3D%24%7Bdu%7D%22%7D%7D&price=1&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&pt=imp&cpId=694808&plcId=2170284&mpId=99413&adId=4117580621&psIdNum=406023&iasMon=F&env=site&conn=unknown&videoURL=https%3A%2F%2Fvast.adsafeprotected.com%2Fvast%2Ffwjsvid%2Fst%2F331804%2F39018748%2Fskeleton.js%3FincludeFlash%3Dfalse%26originalVast%3Dhttps%3A%2F%2Fad.doubleclick.net%2Fddm%2Fpfadx%2FN7881.2610ADOBESYSTEMSINC.%2FB23075601.253815120%3Bsz%3D0x0%3Bord%3D1437732598%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bdcmt%3Dtext%2Fxml%3Bdc_sdk_apis%3D%5BAPIFRAMEWORKS%5D%3Bdc_omid_p%3D%5BOMIDPARTNER%5D
Frame ID: A51C9E380DDA5D75C0522123427FB55F
Requests: 20 HTTP requests in this frame

Frame: https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=ob6ec111-f4ac-52ed-3899-2715c2a777ff&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5d99a86d2cda08.70371189%3FobOrigUrl%3Dtrue
Frame ID: FB9F6E3ED848F12B0C965E8DE28A2EF5
Requests: 1 HTTP requests in this frame

Frame: https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=obd08560-e8b9-76d8-fcfe-34ffa09f35e9&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5da2be3ec3f3f5.12323041%3FobOrigUrl%3Dtrue
Frame ID: FD14B7105F36551C2EE8C38F271BB6BA
Requests: 1 HTTP requests in this frame

Frame: https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=obc09864-d3c6-58d2-ef56-a7aed7375027&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5da2cfbb925097.92922303%3FobOrigUrl%3Dtrue
Frame ID: 5C19FBE8FA87C910E607595E7BCE3B3B
Requests: 1 HTTP requests in this frame

Frame: https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=obabe3e4-140a-3e6e-dbf0-ee3710164237&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5da2be3ec3f3f5.12323041%3FobOrigUrl%3Dtrue
Frame ID: E521FB9789023E0BB594764F0941D6BC
Requests: 1 HTTP requests in this frame

Frame: https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=ob866686-f578-a701-8ec3-b510efe3d6f2&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5dac1a6ba0f3d8.24617334%3FobOrigUrl%3Dtrue
Frame ID: 32F4BBB378AA4BCA4F053B78339E9A1E
Requests: 1 HTTP requests in this frame

Frame: https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=ob831ff3-af13-c57e-c6d3-d4d255080736&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5d99a8516da008.59972960%3FobOrigUrl%3Dtrue
Frame ID: 00BD48B384FAD966DA39A8C420061D7F
Requests: 1 HTTP requests in this frame

Frame: https://vpaid3.adsafeprotected.com/vpaid-wrapper/4.11.27/vpaid.js
Frame ID: EE09BFD7BA606F84589A3F447EEB6D12
Requests: 5 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/sdkloader/vpaid_adapter.js
Frame ID: 23DB88997DAAA6270A2C4FD58776BD45
Requests: 6 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.95.js
Frame ID: B51EC5EBAE8181DA38D42A70B3D2C943
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.343.1_en.html
Frame ID: C4E03EFE87E577088307C90A1F62A5E1
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156262&predirect=%2F%2Fsrv.imonomy.com%2FUserMatching%2Fpubmatic-kom%2F
Frame ID: 8AAC777411B6E4DEC98D9B548DAECCC7
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 497ACA5D835CC66A2AAF650F3425CE3A
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20191015/r20190131/zrt_lookup.html
Frame ID: BED71BF24AB9B75952C2146F65B25D86
Requests: 1 HTTP requests in this frame

Frame: https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=ob6d5f80-f817-f380-7270-c0bb5d8cfee1&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5d74ea83802cd8.37881136%3FobOrigUrl%3Dtrue
Frame ID: 82C3FA3F2CDA3F5310D12BE0B754D8DB
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 32BA754975EE49B8B4614FEE6D726A1F
Requests: 7 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423124300&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: A5FDBA460F05BD605A1F4C777465B1F3
Requests: 1 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423177667&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: D100A619EC6B9533F088E185CEB175FB
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.95.js
Frame ID: E60CDA08C31E461A66E130E4402563AC
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 87A584A300B6400FD066BD83C4566F09
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 7FE1A203D44C06BB2F03FBA882F5602C
Requests: 7 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423129743&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: 254B7A4EC03370082005804EAE25E83E
Requests: 1 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423150864&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: 41E3F50DB9FCD2DB64831EAF5AB5E087
Requests: 1 HTTP requests in this frame

Frame: https://imonomy-d.openx.net/w/1.0/jstag
Frame ID: A147F713FE1F8F47649E0CC078CAEE8F
Requests: 4 HTTP requests in this frame

Frame: https://z.moatads.com/spotxchangejsvideo759622536126/moatvideo.js
Frame ID: ED7ECA74FE01046DD5097E774ECA9F42
Requests: 1 HTTP requests in this frame

Frame: https://imonomy-d.openx.net/w/1.0/jstag
Frame ID: CA9663ACE8F57FAEB18E816F39DF06E7
Requests: 4 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements289.js
Frame ID: 3F50728658869100B279448EB46B1894
Requests: 4 HTTP requests in this frame

Frame: https://cdn3.doubleverify.com/t2tv7.html
Frame ID: 6599A6271E0221A064E8336546C52DE6
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
Frame ID: 019F41FFF141642AA83CB400A91AF861
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
Frame ID: A4C6A93C6B61E19F37F1259868B78849
Requests: 1 HTTP requests in this frame

Frame: https://dynamic-cdn.spot.im/yad/index.v2.html
Frame ID: FEFAB1C95A56E5BC84D005A05243E689
Requests: 1 HTTP requests in this frame

Frame: https://imonomy-d.openx.net/w/1.0/jstag
Frame ID: 31A146D331639DD7000BDA3ECC0C73D7
Requests: 4 HTTP requests in this frame

Frame: https://imonomy-d.openx.net/w/1.0/jstag
Frame ID: 5229EACF487563874CD302B83BAAE393
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 057E35E3F4E4CF75B500CD10CF26F1D3
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 65952211E5F78A14BAD5984D8F54F66C
Requests: 7 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423385863&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: 0E2F6038CC7A3B17149B06F45D31CEB6
Requests: 1 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423381282&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: A3324BAA45B8E134BA2B76CDF077E2B6
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
Frame ID: B207EA705905B993819B2E3EBF6D84DB
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
Frame ID: 1BB353BBDE20B81AAEC833F264EC93D6
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 104A333FF1511D10B4C48C9FE545E233
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 289B2C47391A1DA6FD1210D85D61FF07
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 9DE947306CCF542D4BB89455BD3021D3
Requests: 9 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423349261&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: 55F58D6E2C3E262840B3AA3DB541616C
Requests: 1 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423379652&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: C0EB302648F060B0CED5813464D52329
Requests: 1 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423558701&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: 34092A56D2C6A736BBDDEEAF0C4F6E1F
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Frame ID: 126C6431F57781711C8880DEC14273CD
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: DD1ECBCC27499B2B940D835E486EBD71
Requests: 7 HTTP requests in this frame

Frame: https://sdk.streamrail.com/blade/sr.bladex.js
Frame ID: 40CC087FDEBCDEDA4DAE0A34CAED53D1
Requests: 31 HTTP requests in this frame

Frame: https://confiant-integrations.global.ssl.fastly.net/w1xQEgMUxjOvHcT3z4FHiGLhJLE/gpt_and_prebid/config.js
Frame ID: F1184E8F3A3D25D6317663C07C78F952
Requests: 18 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423575769&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: 22940E3F9F769C15866B45A3253B216D
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvJ6zxSpRoZIv_25T8_VGtpF2PWTFbgasOciUfKPBPUz8TUAq9zEhtJR6vjCJ6SfoFwmSkyY4sWm4hy7LynGetipg86DOSmLk_zNIPE0n26amSqVItoL5gWNK6gMrwVf14z62ZAXlovWt8ngtPxqrCt7QtMfONZNckSKochjO14HKssfiWbNG4ILDt4_yT6SO25R45jQxR-AeKDM5jLROj4Ve5S6lIfe8shtnNSsOvJp5weyCa_Sd_wj_W8HYL3o9CSH92fjHRFi3VSymNQUT5s-Yx7s223EpPtbg4UHw&sai=AMfl-YSvHZafUtnWO87Fk-nURXysNXHvnLBRlhQIZgfy5nZ6Ia8ErMRfgeoK5WTPoRNCKziV299r4WoB4uGX7PbYbwR3SXASQ1sZgJi6_LFq4Q&sig=Cg0ArKJSzPfHLcMg6aw9EAE&urlfix=1&adurl=
Frame ID: 0FC8DF4B4E450CE25A03627AF9B6768C
Requests: 16 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuwfFisMu9Dd6x0Ue2b89urGCfVcaiUF3xl3HkZ92OaqUiyGsZwBd1Gb8i9jOl4nJJ91enRaJL_3nn_H2rvoXq-4ccJ2CYvo-ag3TY3aaCsrC0F0k2-vQQNMPaa59lrYGaYmYe-G0OIP3dFW47rIvPAdNUu7XB_C9KHn89lG4vlmMq4mR9Gs07zDugRxMbk3tr7bzZOwQidXF-ehsd8i4Vg_qlL28xhqQWGOdJL_lBZN3F84bYmUiPnjTTMNCWF1nlbiSQiTzlNKbe_UdFqtxoxVRisQ-TAvkKFbSBRVw&sai=AMfl-YSFGGJH9ciXbzyPRffRzZERAwQsLL9op0RRcAwEZF-_2Lcdg2RNOjjSVHDBf6QxaWSQkLsAps0Phuy2DDPd3SuBvOXh7be5xoa04WOfAQ&sig=Cg0ArKJSzNZVuz6lM1a1EAE&urlfix=1&adurl=
Frame ID: 317C4757104C5FCEA6FB83D84E823DD8
Requests: 27 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvzHkWw8JOg6BfTfqM6iWiTxuUaDs6wAck0c5BLYQi2c7YunfxY0hBjc8z_Vdph85NJLfZGf7J5_ErfNAsiKImdg_p2vnmLRh2OoWZB-weuMoUThx1Ltb6WCCxBQz4ekCGH8oL_uPCAGgyHG8UntLhl3ZfbVFpJ_ObxpAEknuN6h0CSQ8bdq6G9noYzkhq2fhuQjT3Yz_gRthVrJO0GTmaKaHfwvJpCG-FW-mbt8FKNk14vyhAuzdBjG8e7_LKIJ5j2_eEBtDkZuafTHEnB9HUBjlLAKsw165y5XT1zyA&sai=AMfl-YSDZ1AovRgUVxs58hjW8kcB08WtkJXmokfxw60xtOUzFCq474duXuH7ZjgD4RSWjpxCTm41v8Fx159WJUXBB-ix3ahdGMSorZ1yeouCJA&sig=Cg0ArKJSzEuPW0edb3XpEAE&urlfix=1&adurl=
Frame ID: FC7B3D5C8C424CDA1C9C996C624D28F8
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstlAnKSThj82sRupGPHNlJwl-K4sKWR8caggacSMUPzGDxML9wMRgpLbupkorDbJE7X1o1zfCxlTTKon8gM7RmJLzQ2UFUMuLJ4STyCaSf1FuITSr5jbLhqFKlr5_aCSrDXNT-ovzmjtwRDmJG-2EaHoRVB9P0g3iObWXHth9cC5R3S9SShUCm1AARUVtbF-aFHRy8AGMOJWLPkmPmS3mAZ6YlC93XjKwM_eCvKQdoQ1_IBseQbxytSBU4K_v90_WddwDpbBg3KZoqnZjD6eCFww8yoaXQkVzJglsvEnA&sai=AMfl-YRePrkd_f3sVvV0n9JN58VlCLv9cMkdzlPGcdBO1pbRT5cpKUrihZuKLy2a71PgXEh3DZhwEEuO-Kb0trEDBTw0ETF9Z3PphBea6Wi6HQ&sig=Cg0ArKJSzHdBT0xgjHqaEAE&urlfix=1&adurl=
Frame ID: 0C556A2DAFCFCC22CADD559332E7B0C4
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssU4XAIJOLGpVciRgmL1d_1r8QIdQxahg5KAyHNnCJ4vrtflAOf5y2MLf9HyntQjmt0b8PXfoceuZuX_eLkv4L9wr0DnpycGZq8SuFPSdcQhMUnI2wDlbiMiLbVQdkpuSuH2oULvp2j4Fto0lzCor4x5AQJVJJwUuk_MdzJmaNFfyDeXxvicz2uhFdOeFvd3ZkwXUMFKKhE4F8sY4cQZvMAGvPkCZiQ4mcjywbF09bJPIok46dFvTrcVoroZviACaX4zzvmxNMrunofhZaBuzBsi6hOcXepT5ZswpNy&sai=AMfl-YTvIzLih582bNESH2apHgmE5gziBGnXCB6jwx74X5OAzbSkafqUJj4YJ1gXgQMIQMk8RJ-q-tg1Hhh3sE8-C0gxcNkbAr9GSpDk_bFpYw&sig=Cg0ArKJSzBdNpKyzj9bpEAE&urlfix=1&adurl=
Frame ID: 53A48F34E820496F25558BC293B05045
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu0qbrvklRDOV9zDIZftyZF22vK5jQZEmFBJ4cg6ubDeWTkf6z6NuAZHAn5rSs9PWIixgv5Cii3y14dPWpL81JEfw4ndcVIcWW-UphsLsPY9CQF1eb0hW8_7vI0oAxquBx837ii8qgLKic6lGa1lCofu4cqg6uJy54bOhmhIwqUv2wQpUymEUVmfNsH6CPqQYrdSXzogdCXM6mRVnHVrSjyfWyNvW3sSNyfLNHjkfAwm2mVSWw3AwVpdJMB1rYIzEjpbJQN-NLJHCGDQltHM8RBFzEPVoEM4erh&sai=AMfl-YSK5VRKpA1nYG0BHcewOUC6UvitA8_u5eWolk1IoBVWI-W_Cs8jsVMU6kL0RzJdOMdAvMH3WL0KCJZ1_r9oDn1ZiTu98LK1daJFxL4gGQ&sig=Cg0ArKJSzIcrOXuK4claEAE&adurl=
Frame ID: 5DB5E76B594E947740F64776EA8FA706
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssbZDE0Qk09Gt7hgeYwp5HUiI7Rcp0ygg54uGpAWcLkxgVNMSevDCfL2UJv6CnnuhxMwOe7b9BK2wHxAuvuEMQbAD8IQTpauSik2ygxjhMXrVfcHI-9TOq1AGlw21GrB7teBAueFZHT6xq4wYaVC48l9sApgOD_6cJBfUqKapwu-wdkDxTtEfg-f3jKyh0k1QeL5Aaxiu5i3beGUjxiw7a3wNwGSseqObMoRYAw2k0DhszuLF_4KOrI52XuLiNFni6Jg9I4&sai=AMfl-YTPgC9Buv8F4efrj_zHq95wvNhpoUAKeSjqwK83Jrb7Hc0mkORwxRAbRmfmAv47JEyRXWFX415iLvguftv5TzcEDjOXwWNhvxxwNcWvDg&sig=Cg0ArKJSzNv5dDI0lzZpEAE&urlfix=1&adurl=
Frame ID: DA915D56EB4FA07EB4B893251689925A
Requests: 6 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x600&pubId=127600103&chanId=33750743&placementId=4824781385&pubCreative=138290509209&pubOrder=2406490302&cb=799544936&custom=right&adsafe_par&impId=
Frame ID: BA93B0EF62B7B78F6E1E5E6AE888B005
Requests: 2 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10079&campId=1x1&pubId=107891423&chanId=33750743&placementId=221175503&pubCreative=103020847223&pubOrder=473210903&cb=1519130979&custom=middle&adsafe_par&impId=
Frame ID: 9CC1FE8D8317E2ABEB1A1C6F3A1EF16A
Requests: 2 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10079&campId=8x8&pubId=96678263&chanId=33739823&placementId=5114640715&pubCreative=138275390696&pubOrder=2569795437&cb=828926111&custom=&adsafe_par&impId=
Frame ID: 9F9420A18661DCB74DCED2FDE4311B9F
Requests: 2 HTTP requests in this frame

Frame: https://sdk.streamrail.com/mrail/200/cs.html?tc=5cb74c624b194a0001f77d99&org=587dfc37febaab0002000001&sid=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&ip=144.76.109.30&domain=express.co.uk&pv=1228&sv=
Frame ID: CAA982E6E7BC4568EBD7513A225C8650
Requests: 1 HTTP requests in this frame

Frame: https://b2c.insticator.com/v3/pages/usertracking
Frame ID: FA0D4E73B11141ECD683572BC3338293
Requests: 1 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x250&pubId=36174863&chanId=33750743&placementId=193785863&pubCreative=138238693789&pubOrder=468246743&cb=601301676&custom=right1&adsafe_par&impId=
Frame ID: 333E3EE6C4EB5EF0B7CB8A52FD59471D
Requests: 2 HTTP requests in this frame

Frame: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Frame ID: E0DC0AF9990FFB322EC8B42548C0B2FB
Requests: 27 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.95.js
Frame ID: 21216418D0A6F02E391B0A6DCD607C3D
Requests: 1 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10079&campId=970x250&pubId=4742659370&chanId=33750743&placementId=5187559359&pubCreative=138289531442&pubOrder=2607736224&cb=693241170&custom=top&adsafe_par&impId=
Frame ID: 6DF78676B1368A989B97089D576C33C9
Requests: 2 HTTP requests in this frame

Frame: https://cmp.teads.mgr.consensu.org/index.html
Frame ID: C8BC6B7097D87B0AA92F7E56B54F1362
Requests: 1 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x250&pubId=4635466512&chanId=33750743&placementId=4870730049&pubCreative=138251763494&pubOrder=2435030858&cb=584924900&custom=right2&adsafe_par&impId=
Frame ID: B785B6AA1E19ECF606E3C5AD21A878D3
Requests: 2 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x250&pubId=4635466512&chanId=33750743&placementId=4871301086&pubCreative=138251964595&pubOrder=2435030858&cb=1800158787&custom=right3&adsafe_par&impId=
Frame ID: 2E7C167F17C6F8EDF0D87423C454A9BA
Requests: 2 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.95.js
Frame ID: 773E87DCCC7272D85A3EBF525F402363
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 143E4E11AC6149610FB950D0B3065252
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.95.js
Frame ID: 2C1C6C3A9610EFCB64679A993BA38863
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Frame ID: 105DF964B99B09B60F467CCB6857E36C
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 31E992688127DCB6F24C15FC92553517
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Frame ID: D42A49CDD489AF2B75FE89DC79CA706F
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 956A15C3957912E4AC1583735259965A
Requests: 7 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.95.js
Frame ID: 61C9E1B574902EDD2FF4E0FBF7AFC49C
Requests: 1 HTTP requests in this frame

Frame: https://b2c.insticator.com/v3/pages/usertracking
Frame ID: 2730F8FD98887DAA019494A0701B013B
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 8E66A470F326E0DEB38D79F171C3428C
Requests: 7 HTTP requests in this frame

Frame: https://sync.teads.tv/iframe/redirect?pid=113944&userId=7de66d8d-4ed2-4305-b58d-9e52b565508d&gdprIab=%7B%22status%22:23,%22consent%22:%22%22,%22reason%22:230%7D&env=js-web&1571733293648
Frame ID: BBD2A1D8B83023BA2E65D6843D6A46BA
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: D1C40D2ABE6DE0590FBC8EFF09B6D8E9
Requests: 7 HTTP requests in this frame

Frame: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1250361&orgId=21364&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&vrid=f9912b31-abb9-4398-bb55-2d9ba1040500&pblob=
Frame ID: FF1D1A892D6B7E837321F40297DB53E4
Requests: 10 HTTP requests in this frame

Frame: https://s0.2mdn.net/5474477/1565772407911/PL_CE_NRC-No-Deposit-Free-Spins-Campaign_Reach-Media-970x250-German-animated-637013692065385540-5d53ca70baeb50425c3e0bfd.html
Frame ID: BA6280D5B7FB5DEE95258890F431671D
Requests: 1 HTTP requests in this frame

Frame: https://ecdn.firstimpression.io/postmessage.html?command=passbackFn&group=5
Frame ID: 5C7DD0FCE5FEA76FF2615870B49B5852
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.95.js
Frame ID: 8F8F94A0C7D944FBB4042D3E4950B332
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.95.js
Frame ID: 0051175B2B4BC4725043BD94176FA4AF
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.95.js
Frame ID: 2327F02A5E56E85B8E84A19DE2C88C9C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3622156405313063&output=html&adk=1812271804&adf=3025194257&lmt=1571733294&plat=1%3A32776%2C2%3A16809992%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&npa=1&guci=1.2.0.0.2.1.0.0&format=0x0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1571733293404&bpp=7&bdt=12860&fdt=892&idt=892&shv=r20191015&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=336x280&nras=1&correlator=8649018514736&frm=20&pv=1&ga_vid=1175119503.1571733290&ga_sid=1571733290&ga_hid=2100588899&ga_fc=0&ga_cid=595209818.1571733294&iag=0&icsg=0&dssz=157&mdo=0&mso=128&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199337%2C21062415%2C21063203%2C21064791%2C151527025%2C151527225%2C368226411%2C368226421%2C368226431%2C26835106%2C410075105&oid=3&pvsid=293019804438819&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=10&uci=a.1h1l038rwux7&fsb=1&dtd=907
Frame ID: 1A60229DBBF4D26649223E05C4307F78
Requests: 1 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423515254&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: 0D754120F5BA032071C5E147C03E3680
Requests: 1 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423569456&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: BAAE1249206B5C6DA9C52586AEEA7278
Requests: 1 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424189297&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: C567E64DD98A6A5D7CD590A9F7E3A4C1
Requests: 1 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424142754&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: B7547DB662F0FA986C0B4BFAE29D770D
Requests: 1 HTTP requests in this frame

Frame: https://ecdn.firstimpression.io/postmessage.html?command=passbackFn&group=12
Frame ID: 1DE8A1ECA8584ACE86D8F8E1254CF171
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstfDuRsQ0C0-GgtUI_xsv6GyqQH0MgCo4s6BquTFPHU1R1_6UdKMzMdV2--XYBGrTgeoKuzf4Du_bNvHPiWyjuJKBXvyA4si_8DsMemvimISEvXf2MAbMDpVvKxsAj1D3I_wcnBnJ8VElZ1w_PCU_8v5BcSWjLdE28f7Kr42Ron0elXpryCU0zwz4f3NKwrRY3SiIbGxREjSRg7YXxGwg7vJr6Kv9wgmkLABm2be9gfXhDLOmkGzBRUiuU5pd5gmeqbS7pJWFBaX8K_h64QANVh1BqgeIge2PrT&sig=Cg0ArKJSzFj5pJZYHd6lEAE&urlfix=1&adurl=
Frame ID: 07F77968CD1750B072CA0D2CAF49990E
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstBQzBSERHHiHwRHzzGlXeQHQUZq8M4XTiyzIkYhRHMcEl1C1w34ypetTx4W0GkkQOi3GAMZ8ddBZ2QvrAmOBzQsLlTTKyYBtwDaUtTriJi_FrSr4Xz2OL7DIx7pB7TwFdymIFwpYmvWVo687zj5Jwkii_sb39yexCG4geeu67jQqYF6XpZq8mYVZqemOud5D0gOba3-fBWtTPj-2mUc2-SYZIgbfysv84kEIJG9fWvkm79O8ghX0eYZmnIX8tBn23GRBIm7BNvhgMldZGjOiyaBdYhNTE2FE2L&sig=Cg0ArKJSzPrcrSgASYQlEAE&urlfix=1&adurl=
Frame ID: 9490BA571ADFBCEA197FADEC18E4BC1F
Requests: 4 HTTP requests in this frame

Frame: https://cdn.vidible.tv/prod/player/ad-time/local-storage.html
Frame ID: 6236373C7C7BB146AEA62C10545DA8C6
Requests: 1 HTTP requests in this frame

Frame: https://dtm.advertising.com/ids/411f1e96-3bde-4d85-b17e-63749e5f0695?secure=true
Frame ID: 6F61C9702302B3A034FF6EA950F6AA3B
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: BFE21F91CA06177979CF6B90EF8F7DA7
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 764EB20F0B861846435ACC96C50C45E5
Requests: 7 HTTP requests in this frame

Frame: https://video-ads.rubiconproject.com/video/bridge-30709.js
Frame ID: 8E197CBB3067A20794F361EFFE1138EA
Requests: 3 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424140312&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: 5013A7BCEDCDD1916E70F3C1DDA1AFDF
Requests: 1 HTTP requests in this frame

Frame: https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424151813&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Frame ID: DE6E9609A9EA79BD7282B37F1D32D057
Requests: 1 HTTP requests in this frame

Frame: https://video-ads.rubiconproject.com/video/bridge-30709.js
Frame ID: 3184A1315045EB714BF552AFEAA50F1F
Requests: 3 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i

Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i

Overall confidence: 100%
Detected patterns
  • script /chartbeat\.js/i

Overall confidence: 100%
Detected patterns
  • script /2mdn\.net/i

Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
  • script /2mdn\.net/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Overall confidence: 100%
Detected patterns
  • html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i

Page Statistics

880
Requests

99 %
HTTPS

26 %
IPv6

100
Domains

205
Subdomains

161
IPs

14
Countries

16864 kB
Transfer

36810 kB
Size

13
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64
  • https://platform.twitter.com/oct.js HTTP 301
  • https://static.ads-twitter.com/oct.js
Request Chain 109
  • https://js.spotx.tv/directsdk/v1/216448.js HTTP 307
  • https://aka.spotxcdn.com/integration/directsdk/v1/directsdk.js
Request Chain 117
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035737&ns__t=1571733281676&ns_c=UTF-8&cv=3.1e&c8=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035737&ns__t=1571733281676&ns_c=UTF-8&cv=3.1e&c8=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c9=
Request Chain 132
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2100588899&t=pageview&_s=1&dl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ul=en-us&de=UTF-8&dt=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGBACEAjB~&jid=970065435&gjid=622674384&cid=7843761.1571733282&tid=UA-545303-1&_gid=1331413262.1571733282&_r=1&cd9=0&cd2=Personal%20Finance&cd12=Today&cd13=Jess%20Sheldon&cd14=500-600&z=657961861 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-545303-1&cid=7843761.1571733282&jid=970065435&_gid=1331413262.1571733282&gjid=622674384&_v=j79&z=657961861 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=970065435&_v=j79&z=657961861 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=970065435&_v=j79&z=657961861&slf_rd=1&random=2786677053
Request Chain 133
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2100588899&t=pageview&_s=1&dl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ul=en-us&de=UTF-8&dt=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGDACEAjB~&jid=1309634981&gjid=507566058&cid=7843761.1571733282&tid=UA-123584808-1&_gid=1331413262.1571733282&_r=1&cd9=express&cd2=7843761.1571733282&cd12=1192439&cd13=Tax%20refund%20scam%20warning%3A%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message&cd14=2019-10-22&gtm=2wgaa0NX7XL77&cd4=responsive&cd7=express&cd8=nationals&cd10=article&cd15=Jess%20Sheldon&cd16=text%20scam&cd28=text%20scam%7Chmrc%20tax%20refund%7Chmrc%20tax%20refund%20scam%7Ctext%20scam%20warning%7Ctax%20scam&cd29=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&cd32=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&cd33=07%3A15%3A00&z=383745253 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-123584808-1&cid=7843761.1571733282&jid=1309634981&_gid=1331413262.1571733282&gjid=507566058&_v=j79&z=383745253
Request Chain 147
  • https://sync.search.spotxchange.com/partner?source=dados HTTP 302
  • https://sync.search.spotxchange.com/partner?source=dados&__user_check__=1&sync_id=cb1da821-f4a6-11e9-ae03-11a3cbba0906
Request Chain 320
  • https://sync.search.spotxchange.com/audience_sync/9?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dspotxchange%26partner_uid%3Dcb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 302
  • https://beacon.krxd.net/usermatch.gif?partner=spotxchange&partner_uid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Request Chain 321
  • https://sync.search.spotxchange.com/audience_sync/8?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fidsync.rlcdn.com%2F397806.gif%3Fpartner_uid%3Dcb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 302
  • https://idsync.rlcdn.com/397806.gif?partner_uid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CO6jGBIvCisIARCAdRokY2IxZGE3ZGYtZjRhNi0xMWU5LWFlMDMtMTFhM2NiYmEwOTA2EAAaDQik_rrtBRIFCOgHEABCAEoA HTTP 307
  • https://sync.mathtag.com/sync/img?mt_exid=10017&redir=https%3A%2F%2Fidsync.rlcdn.com%2F47154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%5BMM_UUID%5D HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10017&redir=https%3A%2F%2Fidsync.rlcdn.com%2F47154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%5BMM_UUID%5D&mm_bnc&mm_bct&UUID=d7e25dae-b9ef-4500-b63b-1772e7979cf9 HTTP 302
  • https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=d7e25dae-b9ef-4500-b63b-1772e7979cf9
Request Chain 322
  • https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1&_test=Xa6-IwAAAKKdT36l HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Xa6-IwAAAKKdT36l&img=1&_test=Xa6-IwAAAKKdT36l
Request Chain 323
  • https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_sc HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESELC2lC_mYnVal0MUelRHyWo&google_cver=1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESELC2lC_mYnVal0MUelRHyWo&google_cver=1&__user_check__=1&sync_id=cc5baefb-f4a6-11e9-b18c-1a27ea400806
Request Chain 325
  • https://p.rfihub.com/cm?in=1&pub=935 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=2159827868463151858&img=1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=2159827868463151858&img=1&__user_check__=1&sync_id=cc5f2d1c-f4a6-11e9-a204-1ac054420406
Request Chain 326
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=spotx&ttd_tpi=1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7028&uid=467e77ec-b658-416d-a8cf-ed13ff1cb81f&img=1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7028&uid=467e77ec-b658-416d-a8cf-ed13ff1cb81f&img=1&__user_check__=1&sync_id=cc5bd26e-f4a6-11e9-b03c-18a305862806
Request Chain 327
  • https://ib.adnxs.com/getuid?https://sync.search.spotxchange.com/partner?adv_id=7715&uid=$UID HTTP 302
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D7715%26uid%3D%24UID HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7715&uid=0
Request Chain 328
  • https://x.bidswitch.net/sync?ssp=spotx HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=spotx HTTP 302
  • https://bsw.digitru.st/syncx?ssp=spotx HTTP 302
  • https://aws-fr-sync.bidswitch.net/sync?ssp=spotx&bsw_own_uuid= HTTP 302
  • https://aws-fr-sync.bidswitch.net/ul_cb/sync?ssp=spotx&bsw_own_uuid= HTTP 302
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=spotx&bsw_custom_parameter=fad91eba-f43b-432e-8238-8aebcb6d50d4 HTTP 302
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=spotx&bsw_custom_parameter=fad91eba-f43b-432e-8238-8aebcb6d50d4 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=4925c2c7-7f0d-420b-9ac4-fd913b8ed82d&user_group=1&ssp=spotx&bsw_param=fad91eba-f43b-432e-8238-8aebcb6d50d4 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7310&uid=fad91eba-f43b-432e-8238-8aebcb6d50d4
Request Chain 329
  • https://c1.adform.net/serving/cookie/match?party=30 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=30
Request Chain 330
  • https://ad.turn.com/r/cs?pid=16 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6481&img=1&uid=8251762968779371606 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6481&img=1&uid=8251762968779371606&__user_check__=1&sync_id=cc5f640e-f4a6-11e9-988c-1ce730eb2006
Request Chain 331
  • https://sync.mathtag.com/sync/img?mt_exid=30&redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6653%26uid%3D%5BMM_UUID%5D HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6653&uid=b7785dae-b888-4100-8985-9e07410aaff0 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6653&uid=b7785dae-b888-4100-8985-9e07410aaff0&__user_check__=1&sync_id=cc5fcf7f-f4a6-11e9-bba5-1ebee0f61406
Request Chain 333
  • https://sync.search.spotxchange.com/audience_sync/7?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D4914%2Ftp%3DSPXC%2Ftpid%3Dcb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 302
  • https://sync.crwdcntrl.net/map/c=4914/tp=SPXC/tpid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=4914/tp=SPXC/tpid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Request Chain 334
  • https://sync.search.spotxchange.com/audience_sync/12?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotx%26google_hm%3DY2IxZGE3ZGYtZjRhNi0xMWU5LWFlMDMtMTFhM2NiYmEwOTA2 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=spotx&google_hm=Y2IxZGE3ZGYtZjRhNi0xMWU5LWFlMDMtMTFhM2NiYmEwOTA2 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=spotx&google_hm=Y2IxZGE3ZGYtZjRhNi0xMWU5LWFlMDMtMTFhM2NiYmEwOTA2&google_tc= HTTP 302
  • https://cdn.spotxcdn.com/media/thumbs/pixel/pixel.gif
Request Chain 335
  • https://sync.search.spotxchange.com/audience_sync/13?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D178522%26dpuuid%3Dcb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=178522&dpuuid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=178522&dpuuid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Request Chain 336
  • https://sync.search.spotxchange.com/audience_sync/3?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Floadm.exelator.com%2Fload%2F%3Fp%3D204%26g%3D1135%26j%3D0%26buid%3Dcb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=1135&j=0&buid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=1135&j=0&buid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&xl8blockcheck=1 HTTP 302
  • https://load77.exelator.com/pixel.gif
Request Chain 337
  • https://sync.search.spotxchange.com/audience_sync/2?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Ftags.bluekai.com%2Fsite%2F53296%3Flimit%3D0%26id%3Dcb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 302
  • https://tags.bluekai.com/site/53296?limit=0&id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Request Chain 338
  • https://sync.search.spotxchange.com/audience_sync/15?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Faa.agkn.com%2Fadscores%2Fg.pixel%3Fsid%3D9212291758%26puid%3Dcb1da7df-f4a6-11e9-ae03-11a3cbba0906 HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9212291758&puid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Request Chain 339
  • https://sync.search.spotxchange.com/audience_sync/18?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fmid.rkdms.com%2Fbct%3Fpid%3Dc3a70011-3c5e-43d1-a871-fb23c6b5a44f%26puid%3Dcb1da7df-f4a6-11e9-ae03-11a3cbba0906%26_ct%3Dimg HTTP 302
  • https://mid.rkdms.com/bct?pid=c3a70011-3c5e-43d1-a871-fb23c6b5a44f&puid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&_ct=img
Request Chain 340
  • https://sb.scorecardresearch.com/b?c1=1&c2=6272977&c3=216448&cv=1.3&cj=1 HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=1&c2=6272977&c3=216448&cv=1.3&cj=1
Request Chain 341
  • https://sb.scorecardresearch.com/p?c1=2&c2=6272977&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733283155251&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va&ns_st_cl=30000&ns_st_pt=0&c3=216448&c4=1e6a0.84371.76d2&c6=6409&ns_ts=1571733283155251 HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=6272977&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733283155251&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va&ns_st_cl=30000&ns_st_pt=0&c3=216448&c4=1e6a0.84371.76d2&c6=6409&ns_ts=1571733283155251
Request Chain 390
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90_highFloor&adk=591462414&adf=1174745122&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423124300%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&adsid=NT&dt=1571733285062&bpp=40&bdt=66&fdt=217&idt=218&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=2&ga_vid=2125114885.1571733285&ga_sid=1571733285&ga_hid=533059717&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=8&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&eid=21064523&oid=3&pvsid=2865758524758205&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CoeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.j8ngkh8jpei&fsb=1&dtd=311 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423124300&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 402
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90_highFloor&adk=591462414&adf=1174745135&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423177667%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733285659&bpp=16&bdt=497&fdt=417&idt=417&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=1494136729.1571733286&ga_sid=1571733286&ga_hid=966398729&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=8&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&eid=20040032%2C20199338%2C21064785%2C20040011&oid=3&pvsid=1583996618876387&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CoeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.yg5672ab9ay&fsb=1&dtd=600 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423177667&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 405
  • https://gcdn.2mdn.net/videoplayback/id/c1636bb5f74b9e22/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3713067845/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signature/B154492233211BB720B26A431992BB03472D4E1D.5A9E430CF05291C303A342827690A4F269E14720/key/ck2/file/file.mp4?cpn=xMiCKFJ91s7tzk81 HTTP 302
  • https://r1---sn-4g5ednse.c.2mdn.net/videoplayback/id/c1636bb5f74b9e22/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3713067845/sparams/acao,ctier,expire,id,ip,ipbits,itag,mip,mm,mn,ms,mv,mvi,pl,source/signature/322E4508D380552D5DFAFCC9C1526B20B4631479.5139BD581AA619340FEDDC048054ABD4761CF559/key/cms1/cms_redirect/yes/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5ednse/ms/onc/mt/1571733208/mv/m/mvi/0/pl/41?cpn=xMiCKFJ91s7tzk81&file=file.mp4
Request Chain 418
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90_highFloor&adk=591462414&adf=1174745134&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423129743%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&adsid=NT&dt=1571733286875&bpp=13&bdt=282&fdt=113&idt=113&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=937950374.1571733287&ga_sid=1571733287&ga_hid=1104729289&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=8&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&oid=3&pvsid=1951144885616410&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CoeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.6a5sxsr1lxxl&fsb=1&dtd=145 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423129743&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 420
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90_highFloor&adk=591462414&adf=1174745133&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423150864%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&adsid=NT&dt=1571733286899&bpp=9&bdt=215&fdt=165&idt=165&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=734203487.1571733287&ga_sid=1571733287&ga_hid=1432492261&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=8&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&oid=3&pvsid=257441411442017&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CoeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.8d1fvcyggp82&fsb=1&dtd=171 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423150864&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 426
  • https://pixel.adsafeprotected.com/rfw/st/331804/39018748/skeleton.js?videoId=c87e8378c26582604ae3e9bbe52d6711&xsId=a4634829-fd3e-4a3c-8eae-3cd302cc6984&xmtp=v&xmapp=0&adsafe_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&adsafe_type=abdfq&adsafe_jsinfo=,id:e7cb5fcd-b763-069a-9d06-698b8f48e9ef,c:rLpe1M,sl:outOfView,em:true,fr:true,mn:app05ami,pt:2-5-15,wc:0.0.1600.1200,ac:323.908.590.332,am:v,cc:323.908.590.332,piv:88,obst:0,th:0,reas:v,br:u,abv:na,an:n,vc:jv3,fm:rFCgH2C+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f|1g1*.331804-39018748|1g11|1g12|1g13|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1q|1r|1s11,idMap:1g1*,pl:,rend:1,renddet:env,rmeas:1,es:0,sc:1,ha:1,gm:0,tt:fwjsvid,thd:1,et:33,oid:cd5048f4-f4a6-11e9-8f40-00259086ca74,v:19.8.22,sp:0,wr:1600.1200,sr:1600.1200,ov:0,x_vv:3.6.0,x_vanstag:fw,x_xpc:iask HTTP 302
  • https://static.adsafeprotected.com/skeleton.js
Request Chain 444
  • https://imonomy-d.openx.net/w/1.0/acj?ai=426c21bd-3f18-457f-9470-7ffbcb551859&o=7857192742&callback=OX_7857192742&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&jr=&auid=540666290&dims=1600x1200&adxy=-4500%2C1194&res=1600x1200x24&plg=pm&ch=UTF-8&tz=-120&ws=728x91&ifr=1&tws=1600x1200&mt=1 HTTP 302
  • https://imonomy-d.openx.net/w/1.0/acj?cc=1&ai=426c21bd-3f18-457f-9470-7ffbcb551859&o=7857192742&callback=OX_7857192742&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&jr=&auid=540666290&dims=1600x1200&adxy=-4500%2C1194&res=1600x1200x24&plg=pm&ch=UTF-8&tz=-120&ws=728x91&ifr=1&tws=1600x1200&mt=1
Request Chain 445
  • https://imonomy-d.openx.net/w/1.0/acj?ai=e9dd7785-126c-47d9-9b9b-ce44cc16dcdd&o=9740725079&callback=OX_9740725079&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&jr=&auid=540666290&dims=1600x1200&adxy=-4500%2C1194&res=1600x1200x24&plg=pm&ch=UTF-8&tz=-120&ws=728x91&ifr=1&tws=1600x1200&mt=1 HTTP 302
  • https://imonomy-d.openx.net/w/1.0/acj?cc=1&ai=e9dd7785-126c-47d9-9b9b-ce44cc16dcdd&o=9740725079&callback=OX_9740725079&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&jr=&auid=540666290&dims=1600x1200&adxy=-4500%2C1194&res=1600x1200x24&plg=pm&ch=UTF-8&tz=-120&ws=728x91&ifr=1&tws=1600x1200&mt=1
Request Chain 448
  • https://sb.scorecardresearch.com/p?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_el=0&ns_st_pb=1&ns_st_mp=brightcove&ns_st_mv=6.19.2&ns_st_pn=1&ns_st_tp=1&ns_st_ad=pre-roll&ns_st_ci=16df29ab224&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1571733287461&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=5906&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_vo=100&ns_st_ws=norm&ns_st_ki=1200000&ns_st_pl=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&ns_st_pr=&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=&ns_st_ty=video&ns_st_ct=va11&ns_st_cs=0x0&ns_st_ge=News&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=*null&ns_st_ti=*null&ns_st_ami=pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2&ns_st_amt=3_30s_Desktop_Germany_German_Context_Politics%20%26%20Current%20Affairs_RUK8322_USD&ns_st_ams=ima&c3=northernandshell&c4=expressuk&c6=*null&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c8=*null&c9=*null HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_el=0&ns_st_pb=1&ns_st_mp=brightcove&ns_st_mv=6.19.2&ns_st_pn=1&ns_st_tp=1&ns_st_ad=pre-roll&ns_st_ci=16df29ab224&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1571733287461&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=5906&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_vo=100&ns_st_ws=norm&ns_st_ki=1200000&ns_st_pl=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&ns_st_pr=&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=&ns_st_ty=video&ns_st_ct=va11&ns_st_cs=0x0&ns_st_ge=News&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=*null&ns_st_ti=*null&ns_st_ami=pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2&ns_st_amt=3_30s_Desktop_Germany_German_Context_Politics%20%26%20Current%20Affairs_RUK8322_USD&ns_st_ams=ima&c3=northernandshell&c4=expressuk&c6=*null&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c8=*null&c9=*null
Request Chain 465
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2100588899&t=event&_s=11&dl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ul=en-us&de=UTF-8&dt=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Scroll%20Depth&ea=Article%20Length&el=3872&_u=aGDACEAjB~&jid=1093669952&gjid=505629465&cid=7843761.1571733282&tid=UA-545303-1&_gid=1331413262.1571733282&_r=1&cd9=0&cd2=Personal%20Finance&cd12=Today&cd13=Jess%20Sheldon&cd14=500-600&z=82882176 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-545303-1&cid=7843761.1571733282&jid=1093669952&_gid=1331413262.1571733282&gjid=505629465&_v=j79&z=82882176 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=1093669952&_v=j79&z=82882176 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=1093669952&_v=j79&z=82882176&slf_rd=1&random=2522872485
Request Chain 495
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_2&adk=3586048435&adf=1174745155&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423385863%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733288406&bpp=10&bdt=122&fdt=149&idt=149&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=588952755.1571733289&ga_sid=1571733289&ga_hid=536813224&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&oid=3&pvsid=1950192181433332&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.liajeyfcufiq&fsb=1&dtd=153 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423385863&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 498
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_2&adk=3586048435&adf=1174745164&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423381282%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&adsid=NT&dt=1571733288460&bpp=18&bdt=120&fdt=186&idt=186&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=1790373286.1571733289&ga_sid=1571733289&ga_hid=527395776&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&eid=20040011&oid=3&pvsid=1854004566508471&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.7si4q72gt7qn&fsb=1&dtd=192 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423381282&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 516
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_2&adk=3586048435&adf=1174745165&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423349261%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733289067&bpp=12&bdt=111&fdt=136&idt=136&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=2091625770.1571733289&ga_sid=1571733289&ga_hid=1263684150&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&eid=20040010&oid=3&pvsid=965864205704193&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.g103pvyajz4x&fsb=1&dtd=140 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423349261&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 521
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_2&adk=3586048435&adf=1174745166&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423379652%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733289129&bpp=27&bdt=126&fdt=229&idt=229&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=386470646.1571733289&ga_sid=1571733289&ga_hid=1265612858&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&oid=3&pvsid=3850391196349847&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.z2871s4uc4mr&fsb=1&dtd=234 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423379652&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 527
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_3&adk=550597170&adf=1174745188&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423558701%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733289291&bpp=9&bdt=118&fdt=122&idt=122&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=211148286.1571733289&ga_sid=1571733289&ga_hid=319010703&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&eid=21063355&oid=3&pvsid=2344505417039530&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.l88r3u9htoc5&fsb=1&dtd=126 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423558701&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 532
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D271858%26extuid%3D%24UID HTTP 302
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fsync.spotim.market%252Fcsync%253Ft%253Da%2526ep%253D271858%2526extuid%253D%2524UID HTTP 302
  • https://sync.spotim.market/csync?t=a&ep=271858&extuid=1064964418146934768
Request Chain 533
  • https://sync.search.spotxchange.com/partner?source=211945 HTTP 302
  • https://sync.search.spotxchange.com/partner?source=211945&__user_check__=1&sync_id=cf919c8e-f4a6-11e9-be2a-169e7f671906
Request Chain 535
  • https://sync.search.spotxchange.com/partner?adv_id=8721&redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%2F%3Ft%3Da%26ep%3D301276%26extuid%3D%24SPOTX_USER_ID%20 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=8721&redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%2F%3Ft%3Da%26ep%3D301276%26extuid%3D%24SPOTX_USER_ID%20&__user_check__=1&sync_id=cf8ffac9-f4a6-11e9-b312-156e734c0806 HTTP 302
  • https://sync.spotim.market/csync/?t=a&ep=301276&extuid=cf8ffa89-f4a6-11e9-b312-156e734c0806
Request Chain 536
  • https://ssum.casalemedia.com/usermatch?s=190532&cb=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D301804%26extuid%3D HTTP 302
  • https://ssum.casalemedia.com/usermatch?s=190532&cb=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D301804%26extuid%3D&C=1
Request Chain 555
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_3&adk=550597170&adf=1174745190&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423575769%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733290065&bpp=10&bdt=498&fdt=435&idt=435&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=570128818.1571733291&ga_sid=1571733291&ga_hid=1604027740&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&oid=3&pvsid=2799953280637063&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.f26hqkjfxn6a&fsb=1&dtd=442 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423575769&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 560
  • https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E4742659370%5E2607736224%5E5187559359%5E%5EImpression-5187559359138289531442 HTTP 302
  • https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4742659370%5E2607736224%5E5187559359%5E%5EImpression-5187559359138289531442
Request Chain 565
  • https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E127600103%5E2406490302%5E4824781385%5E%5EImpression-4824781385138290509209 HTTP 302
  • https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E127600103%5E2406490302%5E4824781385%5E%5EImpression-4824781385138290509209
Request Chain 569
  • https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4870730049%5E%5EImpression-4870730049138251763494 HTTP 302
  • https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4870730049%5E%5EImpression-4870730049138251763494
Request Chain 573
  • https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4871301086%5E%5EImpression-4871301086138251964595 HTTP 302
  • https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4871301086%5E%5EImpression-4871301086138251964595
Request Chain 577
  • https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E107891423%5E473210903%5E221175503%5E%5EImpression-221175503103020847223 HTTP 302
  • https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E107891423%5E473210903%5E221175503%5E%5EImpression-221175503103020847223
Request Chain 621
  • https://spot-im-d.openx.net/v/1.0/av?auid=540863609&cb=1571733291883&vwd=400&vht=300&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ip=144.76.109.30 HTTP 302
  • https://spot-im-d.openx.net/v/1.0/av?cc=1&auid=540863609&cb=1571733291883&vwd=400&vht=300&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ip=144.76.109.30
Request Chain 679
  • https://sb.scorecardresearch.com/p?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733292636&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=*null&c4=*null&c6=*null&ns_ts=38794257&cs_ucfr=1 HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733292636&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=*null&c4=*null&c6=*null&ns_ts=38794257&cs_ucfr=1
Request Chain 696
  • https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https://t.myvisualiq.net/sync?prid=1001%26ao=0%26pruuid=TAPAD_${IDS:key} HTTP 302
  • https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_d190b163-f4a6-11e9-bdea-3e74db81f9bb
Request Chain 697
  • https://t.myvisualiq.net/impression_pixel?pt=i&r=[CACHEBUSTER]&et=i&ago=212&ao=788&advt=5474477&pi=253457958&ad=449373252&si=5378468&aca=23047164&ci=120131290&chnl=-7&sz=1833&vndr=115 HTTP 302
  • https://t.myvisualiq.net/ul_cb/impression_pixel?pt=i&r=[CACHEBUSTER]&et=i&ago=212&ao=788&advt=5474477&pi=253457958&ad=449373252&si=5378468&aca=23047164&ci=120131290&chnl=-7&sz=1833&vndr=115
Request Chain 740
  • https://sync.teads.tv/iframe?pid=113944&userId=7de66d8d-4ed2-4305-b58d-9e52b565508d&gdprIab={%22status%22:23,%22consent%22:%22%22,%22reason%22:230}&env=js-web&1571733293648 HTTP 302
  • https://sync.teads.tv/iframe/redirect?pid=113944&userId=7de66d8d-4ed2-4305-b58d-9e52b565508d&gdprIab=%7B%22status%22:23,%22consent%22:%22%22,%22reason%22:230%7D&env=js-web&1571733293648
Request Chain 756
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3622156405313063&output=html&h=280&slotname=6c2b49d.9ca08fd&adk=2807784095&adf=1519143749&w=336&lmt=1571733293&npa=1&guci=1.2.0.0.2.1.0.0&format=336x280&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&flash=0&wgl=1&adsid=NT&dt=1571733293383&bpp=21&bdt=12839&fdt=596&idt=596&shv=r20191015&cbv=r20190131&saldr=aa&abxe=1&correlator=8649018514736&frm=20&pv=2&ga_vid=1175119503.1571733290&ga_sid=1571733290&ga_hid=2100588899&ga_fc=0&ga_cid=595209818.1571733294&iag=0&icsg=0&dssz=157&mdo=0&mso=128&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=323&ady=2002&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199337%2C21062415%2C21063203%2C21064791%2C151527025%2C151527225%2C368226411%2C368226421%2C368226431%2C26835106%2C410075105&oid=3&pvsid=293019804438819&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CoeEbr%7C&abl=NS&pfx=0&fu=16&bc=31&ifi=10&uci=a.wj28sbj7cnjh&fsb=1&xpc=qWEo07BbiT&p=https%3A//www.express.co.uk&dtd=612 HTTP 302
  • https://ecdn.firstimpression.io/postmessage.html?command=passbackFn&group=5
Request Chain 782
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_3&adk=550597170&adf=1174745479&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423515254%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733293858&bpp=18&bdt=553&fdt=677&idt=677&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=595209818.1571733294&ga_sid=1571733295&ga_hid=1446606885&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&oid=3&pvsid=2524614414837649&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.h4au6wxfz2ni&fsb=1&dtd=683 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423515254&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 786
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_3&adk=550597170&adf=1174745483&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D423569456%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733293903&bpp=59&bdt=467&fdt=679&idt=679&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=595209818.1571733294&ga_sid=1571733295&ga_hid=349912451&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&eid=20040012&oid=3&pvsid=1412400589840949&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.qfjl53bwb5ul&fsb=1&dtd=691 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423569456&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 791
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90&adk=1913573300&adf=1174745507&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D424189297%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733294126&bpp=12&bdt=536&fdt=819&idt=819&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=595209818.1571733294&ga_sid=1571733295&ga_hid=645054311&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&oid=3&pvsid=3201737919004055&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.je7qsy1meegp&fsb=1&dtd=826 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424189297&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 795
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90&adk=1913573300&adf=1174745505&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D424142754%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733294251&bpp=16&bdt=578&fdt=1001&idt=1001&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=572151438.1571733295&ga_sid=1571733295&ga_hid=121426584&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&oid=3&pvsid=4476751061519048&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.frn8g1i2t26j&fsb=1&dtd=1015 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424142754&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 816
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3622156405313063&output=html&h=250&slotname=a68b939.2cc54ed&adk=2829789302&adf=2723100192&w=300&lmt=1571733295&npa=1&guci=1.2.0.0.2.1.0.0&format=300x250&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&flash=0&avail_w=590&wgl=1&adsid=NT&dt=1571733295609&bpp=8&bdt=15065&fdt=9&idt=9&shv=r20191015&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=336x280%2C0x0&nras=1&correlator=8649018514736&frm=20&pv=1&ga_vid=1175119503.1571733290&ga_sid=1571733290&ga_hid=2100588899&ga_fc=0&ga_cid=595209818.1571733294&iag=0&icsg=0&dssz=157&mdo=0&mso=128&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=323&ady=2002&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199337%2C21062415%2C21063203%2C21064791%2C151527025%2C151527225%2C368226411%2C368226421%2C368226431%2C26835106%2C410075105&oid=3&pvsid=293019804438819&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CoeEbr%7C&abl=NS&pfx=0&fu=16&bc=31&ifi=11&uci=b.zabhp4stkx5t&fsb=1&xpc=2YKBcEkin6&p=https%3A//www.express.co.uk&dtd=26 HTTP 302
  • https://ecdn.firstimpression.io/postmessage.html?command=passbackFn&group=12
Request Chain 864
  • https://edba.brealtime.com/ HTTP 302
  • https://s3.amazonaws.com/brt-appnexus-cookie-sync/1x1.gif
Request Chain 872
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90&adk=1913573300&adf=1174745505&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D424140312%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&dt=1571733296821&bpp=10&bdt=223&fdt=100&idt=100&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=372833481.1571733297&ga_sid=1571733297&ga_hid=2115401283&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&oid=3&pvsid=2470423986642408&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.i3psz6ljrqzu&fsb=1&dtd=612 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424140312&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 874
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90&adk=1913573300&adf=1174745504&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&alternate_ad_url=https%3A%2F%2Ftag.imonomy.com%2Fscript%2Finternal%2Fpassback%2Fpostmessage.html%3Fid%3D424151813%26target%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&wgl=1&adsid=NT&dt=1571733296860&bpp=12&bdt=154&fdt=614&idt=614&shv=r20191015&cbv=r20190131&saldr=sa&correlator=8649018514736&frm=23&ife=1&pv=1&ga_vid=1275457175.1571733297&ga_sid=1571733297&ga_hid=1495831090&ga_fc=0&iag=3&icsg=170&nhd=1&dssz=7&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&isw=728&ish=91&ifk=694126732&scr_x=0&scr_y=0&eid=21064603%2C36998751&oid=3&pvsid=3408376504618988&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C91&vis=1&rsz=%7C%7CeEr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.tvol9gl8w5da&fsb=1&dtd=619 HTTP 302
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424151813&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Request Chain 877
  • https://sb.scorecardresearch.com/p?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10076&ns_st_cl=30000&ns_st_el=0&ns_st_hc=1&ns_st_mp=brightcove&ns_st_mv=6.19.2&ns_st_pn=1&ns_st_tp=1&ns_st_ad=pre-roll&ns_st_ci=16df29ab224&ns_st_pt=10076&ns_st_dpt=10076&ns_st_ipt=10076&ns_st_et=10076&ns_st_det=10076&ns_st_upc=10076&ns_st_dupc=10076&ns_st_iupc=10076&ns_st_upa=10076&ns_st_dupa=10076&ns_st_iupa=10076&ns_st_lpc=10076&ns_st_dlpc=10076&ns_st_lpa=10076&ns_st_dlpa=10076&ns_st_pa=10076&ns_ts=1571733297537&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_vo=100&ns_st_ws=norm&ns_st_ki=1200000&ns_st_pl=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&ns_st_pr=&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=&ns_st_ty=video&ns_st_ct=va11&ns_st_cs=0x0&ns_st_ge=News&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=*null&ns_st_ti=*null&ns_st_ami=pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2&ns_st_amt=3_30s_Desktop_Germany_German_Context_Politics%20%26%20Current%20Affairs_RUK8322_USD&ns_st_ams=ima&c3=northernandshell&c4=expressuk&c6=*null&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c8=*null&c9=*null HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10076&ns_st_cl=30000&ns_st_el=0&ns_st_hc=1&ns_st_mp=brightcove&ns_st_mv=6.19.2&ns_st_pn=1&ns_st_tp=1&ns_st_ad=pre-roll&ns_st_ci=16df29ab224&ns_st_pt=10076&ns_st_dpt=10076&ns_st_ipt=10076&ns_st_et=10076&ns_st_det=10076&ns_st_upc=10076&ns_st_dupc=10076&ns_st_iupc=10076&ns_st_upa=10076&ns_st_dupa=10076&ns_st_iupa=10076&ns_st_lpc=10076&ns_st_dlpc=10076&ns_st_lpa=10076&ns_st_dlpa=10076&ns_st_pa=10076&ns_ts=1571733297537&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_vo=100&ns_st_ws=norm&ns_st_ki=1200000&ns_st_pl=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&ns_st_pr=&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=&ns_st_ty=video&ns_st_ct=va11&ns_st_cs=0x0&ns_st_ge=News&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=*null&ns_st_ti=*null&ns_st_ami=pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2&ns_st_amt=3_30s_Desktop_Germany_German_Context_Politics%20%26%20Current%20Affairs_RUK8322_USD&ns_st_ams=ima&c3=northernandshell&c4=expressuk&c6=*null&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c8=*null&c9=*null
Request Chain 884
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2100588899&t=event&ni=1&_s=12&dl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ul=en-us&de=UTF-8&dt=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Adblocking&ea=No&el=0.5&_u=aGDACEAjB~&jid=603512821&gjid=713982082&cid=7843761.1571733282&tid=UA-545303-1&_gid=1331413262.1571733282&_r=1&cd9=0&cd2=Personal%20Finance&cd12=Today&cd13=Jess%20Sheldon&cd14=500-600&z=241390402 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-545303-1&cid=7843761.1571733282&jid=603512821&_gid=1331413262.1571733282&gjid=713982082&_v=j79&z=241390402 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=603512821&_v=j79&z=241390402 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=603512821&_v=j79&z=241390402&slf_rd=1&random=3039436926

880 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request text-scam-hmrc-tax-refund-warning-fraud-news-latest
www.express.co.uk/finance/personalfinance/1192439/
138 KB
32 KB
Document
General
Full URL
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:a000:e:515c:9940:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ed00c08c8ff1dd3d7df61272130e7494d1114b164ac78f13fd7892b4f9bf3830
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; default-src 'self' blob: *.brightcove.com ; script-src https: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; img-src https: data: blob: http: *.images.express.co.uk *.images.dailyexpress.co.uk; media-src https: data: blob:; font-src https: data:; frame-src https: data: blob:; connect-src https: wss: blob:; object-src https:;
Strict-Transport-Security max-age=180

Request headers

:method
GET
:authority
www.express.co.uk
:scheme
https
:path
/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
content-type
text/html; charset=UTF-8
date
Tue, 22 Oct 2019 08:34:40 GMT
server
nginx
x-ua-compatible
IE=edge,chrome=1
cache-control
public,max-age=180
content-security-policy
upgrade-insecure-requests; default-src 'self' blob: *.brightcove.com ; script-src https: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; img-src https: data: blob: http: *.images.express.co.uk *.images.dailyexpress.co.uk; media-src https: data: blob:; font-src https: data:; frame-src https: data: blob:; connect-src https: wss: blob:; object-src https:;
strict-transport-security
max-age=180
expires
Tue, 22 Oct 2019 08:37:40 GMT
content-encoding
gzip
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
via
1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
ZQJ3yp___8ejFB_R0-pmUBL9VlDZRqoOhPnLE4k2oYWjt61hywyJlw==
70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
scripts.webcontentassessor.com/scripts/
139 KB
44 KB
Script
General
Full URL
https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.101.62 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-101-62.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7fde2711e90a60cb3d0c6c26679917d77d02ea9d3c29fa910692d6583a7ba5ed

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:27:31 GMT
content-encoding
gzip
last-modified
Tue, 22 Oct 2019 08:19:06 GMT
server
AmazonS3
age
430
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=3600,stale-if-error=86400,stale-while-revalidate=3600
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
McMDwnpRRLLtg_xG0OxBH64P2DgDSEjk5VY4GsHo8MxsSZko7uPaKg==
via
1.1 ee6ddabcc69c6aa1c28ad24a4a8f86b2.cloudfront.net (CloudFront)
vendor-header20190523.min.js
cdn.images.express.co.uk/theme/Responsive/js/dist/
101 KB
36 KB
Script
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/js/dist/vendor-header20190523.min.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1736daaeadfccedf08c180425fc810c77ff528696691940d49a27545cc0ea6e9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:48 GMT
content-encoding
gzip
age
8769833
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 23 May 2019 11:19:10 GMT
server
AmazonS3
vary
Accept-Encoding
access-control-allow-methods
HEAD, GET, POST
content-type
application/javascript
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
VUYZfYXtGrlhgYRquWHNLVhueq9iwyApiMo5WRmzsS2jDzerZVtK3A==
cmp3p.js
consent.cmp.oath.com/
27 KB
10 KB
Script
General
Full URL
https://consent.cmp.oath.com/cmp3p.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:135:155a:23ba:b2a:25ff:122d , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECD (fcn/40D5) /
Resource Hash
5c11bb26581168d3f54fabc865935367fc07e44b7fe24281fbcbe2bca3285a39

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:40 GMT
content-encoding
gzip
x-amz-request-id
4268D899E7FAFA30
x-cache
HIT
status
200
content-length
9429
x-amz-id-2
4gUNSN3a0ZPRA8XP/gP2dY8rIQhNpPJ1lK2b/gO14RDl4Kf+QTOzIDlXp2xyWdAMoD59T9wccRk=
x-amz-expiration
expiry-date="Wed, 11 Nov 2020 00:00:00 GMT", rule-id="aolp-ds-prd-cmp-us-east-1"
last-modified
Mon, 07 Oct 2019 20:24:33 GMT
server
ECD (fcn/40D5)
etag
"9d1f7e90ee569eec2f287969e637a669+gzip"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=300
accept-ranges
bytes
expires
Tue, 22 Oct 2019 08:39:40 GMT
app-init20191017.min.js
cdn.images.express.co.uk/theme/Responsive/js/dist/
14 KB
5 KB
Script
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
81edd9c9c0df311799f4b88da338dd345159a744bc5ac17ba5904ab63448023f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 17 Oct 2019 13:20:45 GMT
content-encoding
gzip
age
414836
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 17 Oct 2019 11:11:52 GMT
server
AmazonS3
vary
Accept-Encoding
access-control-allow-methods
HEAD, GET, POST
content-type
application/javascript
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
rAGFgqemS3Ja-RHlnAYLQdIPKxPUKnlRhcTKUwJ2x3bzUFSHscW_Xw==
channels.cgi
trinitymirror.grapeshot.co.uk/national/
390 B
538 B
Script
General
Full URL
https://trinitymirror.grapeshot.co.uk/national/channels.cgi?url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
148.64.56.194 , United Kingdom, ASN200981 (GRAPESHOT-UK-1, GB),
Reverse DNS
server194.hml.grapeshot.co.uk
Software
/
Resource Hash
b0c68a2243a46fe5208d06e97f63ab23dff7626f026a5fa8bda8dd1577f0993e
Security Headers
Name Value
Strict-Transport-Security max-age=157680000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=157680000
Connection
Keep-Alive
Content-Length
390
Content-Type
application/javascript
utag.sync.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
5 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.sync.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F99) /
Resource Hash
82e92136be291488f0755e572386d60e2e945ca1eb54d55703c5aaa5560b3336

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:40 GMT
content-encoding
gzip
last-modified
Thu, 03 Oct 2019 15:08:54 GMT
server
ECAcc (frc/8F99)
etag
"583176688"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
1713
expires
Tue, 22 Oct 2019 08:39:40 GMT
css
fonts.googleapis.com/
13 KB
929 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?display=swap&family=Open+Sans+Condensed:300,700%7COpen+Sans:300,400,600
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
cf30cedeb987a5fd3ce2c458fe515fecb3e6805c6d364b2c5ef69b4a59cbf90e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Tue, 22 Oct 2019 08:34:40 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Tue, 22 Oct 2019 08:34:40 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:40 GMT
app20191017.min.css
cdn.images.express.co.uk/theme/Responsive/css/dist/
333 KB
59 KB
Stylesheet
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/css/dist/app20191017.min.css
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f2688f97e72f0c4040553f967d8f90a0b3669aeece19e421e987e3c08b30ffb2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 17 Oct 2019 13:20:45 GMT
content-encoding
gzip
age
414836
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 17 Oct 2019 11:11:53 GMT
server
AmazonS3
vary
Accept-Encoding
access-control-allow-methods
HEAD, GET, POST
content-type
text/css
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
0-9UjkU4-0xv9kI65kyIZQ_9JzQtoW3JqC4QuzQ0XmbAoDCGdRvF1Q==
gigya.js
cdns.gigya.com/JS/
248 KB
84 KB
Script
General
Full URL
https://cdns.gigya.com/JS/gigya.js?apiKey=3_BBXBRC0QUUloJ0Hujw4HOY17aLrL0Uy8FDx59O4-PrYbWWtrnCBKphB69PH9tXSb
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.36 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-36.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
05a2710ff0d2757e4ee766eb719963246b525a3569b26b55e73724f1a729a43c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:40 GMT
Content-Encoding
gzip
Content-Type
text/javascript; charset=utf-8
X-Soa
true, Gator
Vary
Accept-Encoding
P3P
CP="IDC COR PSA DEV ADM OUR IND ONL"
Access-Control-Allow-Origin
*
X-CallID
072b1cd0dcea458e9e10e3a90a0eac77
Cache-Control
private, max-age=900
X-Server
us1d-nomad-g12
Connection
keep-alive
X-Robots-Tag
none
X-Gigya-HA-cfg-ver
5
Content-Length
85647
Expires
Tue, 22 Oct 2019 08:49:40 GMT
bundle.js
www.spot.im/embed/modules/launcher/
245 KB
246 KB
Script
General
Full URL
https://www.spot.im/embed/modules/launcher/bundle.js?module=messages-count
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip0x03f.map2.ssl.hwcdn.net
Software
/
Resource Hash
d629949a714b64d9cddb6c0bf7cbf356ddb21821c4a36792c62b0edccba858d6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:40 GMT
Last-Modified
Mon, 24 Jun 2019 15:40:16 GMT
ETag
"1561390816"
X-HW
1571733280.dop006.fr8.t,1571733280.cds070.fr8.shn,1571733280.cds070.fr8.c
Content-Type
application/javascript
Cache-Control
max-age=222
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
251097
sfp.js
native.sharethrough.com/assets/
426 KB
120 KB
Script
General
Full URL
https://native.sharethrough.com/assets/sfp.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.196.129 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-224-196-129.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f2ad40f9e0fb785aa013e7e0c92fe5769aa38002d5425aa1e933223d32411176

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
last-modified
Mon, 21 Oct 2019 14:43:19 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-id
GRYDkLl6_bcMtyjLJBmQrBoqLbFtgLa_W0vgioY14nnsV72y_AUoSg==
via
1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
expires
Mon, 21 Oct 2019 15:43:18 GMT
apester-javascript-sdk.min.js
static.apester.com/js/sdk/v2.0/
196 KB
64 KB
Script
General
Full URL
https://static.apester.com/js/sdk/v2.0/apester-javascript-sdk.min.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.72.53 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
53.72.190.35.bc.googleusercontent.com
Software
nginx/1.17.4 /
Resource Hash
6900ce64240e9aef93c5e413793d186ef2b77d0535a0c8c586a4421b3aba3042

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:28:10 GMT
content-encoding
gzip
last-modified
Sun, 20 Oct 2019 10:36:54 GMT
server
nginx/1.17.4
age
390
etag
W/"5dac38c6-30f2b"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public,s-maxage=900,max-age=900
alt-svc
clear
content-length
65485
via
1.1 google
1eWNpP6x0acZ
cdn.onthe.io/io.js/
62 KB
20 KB
Script
General
Full URL
https://cdn.onthe.io/io.js/1eWNpP6x0acZ
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.93.164.210 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
nginx /
Resource Hash
6f55a5dc4a864122259790ca861842fa67dd29f310bc180ec6c20b0919896c1d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:40 GMT
Content-Encoding
gzip
Last-Modified
Thu, 20 Jun 2019 10:15:43 GMT
Server
nginx
ETag
W/"5d0b5ccf-f997"
Transfer-Encoding
chunked
Content-Type
text/javascript
Cache-Control
max-age=86400, public
Connection
keep-alive
Expires
Sat, 28 Sep 2019 10:17:37 GMT
placeholder-horizontal.gif
cdn.images.express.co.uk/img/page/
43 B
528 B
Image
General
Full URL
https://cdn.images.express.co.uk/img/page/placeholder-horizontal.gif
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4e568073a900787fc46710900fe2556d4a6c7c7469ca1da96def7e8585e032b2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:48 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
8769833
x-cache
Hit from cloudfront
status
200
content-length
43
last-modified
Mon, 03 Jul 2017 10:59:57 GMT
server
AmazonS3
etag
"4fbc394c3a6963668a320c2439494183"
access-control-allow-methods
HEAD, GET, POST
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
fnyX3Mod7Ii9Ck0Rwp4GJWOuGcUB2Q9l8hRZ1yUqvixRzTB2d68y6A==
expires
Mon, 3 Jan 2022 12:08:50 UTC
23.png
cdn.images.express.co.uk/img/dynamic/sections/sponsored/headers/
6 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/sections/sponsored/headers/23.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d94d376774b1d15ce89dd323ce3e0a1944384f4d7d79de25f1b91553d4e15869

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 08 Oct 2019 21:19:56 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
282
x-cache
Hit from cloudfront
status
200
content-length
6194
last-modified
Tue, 14 Mar 2017 17:23:39 GMT
server
AmazonS3
etag
"178dd22040b471d13019e072a8def8b8"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
9uyft1LCCqXog0WM8dDYaIFJRKKCRZm_YQt_dU2NGQLsbC_A9q5dPA==
index.min.js
players.brightcove.net/2540076170001/B1Hli6KCG_default/
1005 KB
264 KB
Script
General
Full URL
https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.122 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-122.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
85e501a456a63328b148c7b8d186b7181f16dec22fd5e7e3b5ea4a35b597196e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
u32DgzPu77OKSKQef5y99tRg0hfoJ5zD
Content-Encoding
gzip
ETag
"04b1a56c18fb005d384f4e5cd0e39369"
x-amz-request-id
62FD8CB2A0FDB4AA
x-amz-replication-status
COMPLETED
Connection
keep-alive
Content-Length
269569
x-amz-id-2
QGeDsBxvpGnHwyKx0s4MJo57h+sr36gMYpdsG1BXiWR3D/96kmovayNgYGDyzYnbLebiZEsKtAI=
X-BCOV-Response-Mode
1
X-Served-By
cache-fra19164-FRA
Last-Modified
Thu, 03 Oct 2019 14:05:48 GMT
Server
AmazonS3
X-Timer
S1570111748.106321,VS0,VE719
Date
Tue, 22 Oct 2019 08:34:40 GMT
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=289
Accept-Ranges
bytes
X-Cache-Hits
0
1190895_1.jpg
cdn.images.express.co.uk/img/dynamic/23/285x190/
11 KB
12 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/285x190/1190895_1.jpg
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
db856c4f0af60b1443fc7f8ed8c23ba9637d7a94a546a3d2214076413f78c7b8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
status
200
content-length
11590
last-modified
Tue, 15 Oct 2019 08:32:31 GMT
server
AmazonS3
etag
"c8021386510c5bd7c82a4372675a5499"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
E9rtKS6sNkZCraBjV4AFeoBxz_6BqULfED4yJzAmeCyKNCOYWWIFpQ==
1192353_1.jpg
cdn.images.express.co.uk/img/dynamic/23/285x190/
9 KB
9 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/285x190/1192353_1.jpg
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6e4566c272234ac42ecdc0aee808ef9964b4ee209afc35b8c59add8f34a344c8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
status
200
content-length
9056
last-modified
Fri, 18 Oct 2019 07:24:42 GMT
server
AmazonS3
etag
"c50b6b12bc3e827b526862e4c4807258"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
CsKa3kE-v56U3vO9B6UERkT2zvh6hbxbE9IZi1J44rUisAvatWSKDg==
Text-scam-warning-Person-on-phone-and-warning-sign-1192439.webp
cdn.images.express.co.uk/img/dynamic/23/590x/
16 KB
17 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/590x/Text-scam-warning-Person-on-phone-and-warning-sign-1192439.webp?r=1571724957365
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
87cf78ac0432f10cd3ad60d62048f97b56fc65ef74c9dc77be40c6b9bbb87bde

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
status
200
content-length
16732
last-modified
Fri, 18 Oct 2019 10:11:59 GMT
server
AmazonS3
etag
"f3624ad517273742b9525d2667b00a2f"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
f8E_YPcoIYOhrN9EiL0GRvrOP7aAjInZFZdTauuxiU58uxrG_50_zQ==
1182875_1.jpg
cdn.images.express.co.uk/img/dynamic/23/285x190/
13 KB
13 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/285x190/1182875_1.jpg
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f4932fd84c133c25db2b4f03a9e800d1ba170c3207c1872a1a30e300cdf0ecce

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
status
200
content-length
13158
last-modified
Thu, 26 Sep 2019 07:44:16 GMT
server
AmazonS3
etag
"f2720925206ef9703bc06296b42735c6"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
Cai8aIlkcQpqXP1QiOiIfb_wPOcQBLK4NLL3FIBjDtF1HrGMT8q8uQ==
1184503_1.jpg
cdn.images.express.co.uk/img/dynamic/23/285x190/
9 KB
9 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/285x190/1184503_1.jpg
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ff2285a1556eefe6f4605b2663674c973492213d144fada4ec669bc9e5ce802c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
status
200
content-length
9186
last-modified
Mon, 30 Sep 2019 13:31:40 GMT
server
AmazonS3
etag
"1b1cfae047d55654566a29ef1e6c4169"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
PLoPhIrK_RJZg-U32PVzeiBXTpumgqFC1i7gRXyRAREasoTr4VobTg==
Text-scam-warning-Person-using-mobile-phone-and-debit-card-2116820.webp
cdn.images.express.co.uk/img/dynamic/23/590x/secondary/
0
0
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/590x/secondary/Text-scam-warning-Person-using-mobile-phone-and-debit-card-2116820.webp?r=1571724957499
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
access-control-allow-methods
HEAD, GET, POST
Text-scam-warning-Hacker-in-pictures-2116821.webp
cdn.images.express.co.uk/img/dynamic/23/590x/secondary/
0
0
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/590x/secondary/Text-scam-warning-Hacker-in-pictures-2116821.webp?r=1571724957554
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
access-control-allow-methods
HEAD, GET, POST
outbrain.js
widgets.outbrain.com/
106 KB
36 KB
Script
General
Full URL
https://widgets.outbrain.com/outbrain.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
afeff1f2f0929ace50d45341a1a1ecb3b4a8012b6ea1f45a8e9fd0d46db1219e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:41 GMT
Content-Encoding
gzip
Last-Modified
Thu, 17 Oct 2019 08:24:25 GMT
Server
Apache
ETag
"e5db8321cc494210a94e16330d037521:1571303766"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=14400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
36707
sp_9LMINbK9
recirculation.spot.im/spot/
413 KB
112 KB
Script
General
Full URL
https://recirculation.spot.im/spot/sp_9LMINbK9
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.56 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-56.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c94a3fcd12f734dc95572525bb21ae54269eaa94037cc149b0599342a2602ec2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
x-spotim-u
spotGroup=EXPRESS_UK / /spot/sp_9LMINbK9
status
200
etag
W/"673c0-xbH10JzbzNESSofqkQzcew"
x-spotim-t
08:11:22 22-10 / 08:54:47 11-9
vary
Accept-Encoding
x-spotim-v
1734 / 3.3.13
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2194, s-maxage=3600
x-spotim-now
Tue Oct 22 2019 08:11:22 GMT+0000 (Coordinated Universal Time)
content-length
113961
expires
Tue, 22 Oct 2019 09:11:15 GMT
sp_9LMINbK9
launcher.spot.im/spot/
227 KB
45 KB
Script
General
Full URL
https://launcher.spot.im/spot/sp_9LMINbK9
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.82 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-82.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
8356ab8d03967d3fac951d2ff5402c7cb4f9b48e0e62e975bd7f841eb61b40aa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
server
istio-envoy
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=73
x-envoy-upstream-service-time
3
content-length
45663
expires
Tue, 22 Oct 2019 08:35:54 GMT
1193927_1.webp
cdn.images.express.co.uk/img/dynamic/79/132x88/
2 KB
3 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/79/132x88/1193927_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
905378579298997ef946e8ed56070c9e839d587629bae12a77904e34f739cb43

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:33 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
9
x-cache
Hit from cloudfront
status
200
content-length
2526
last-modified
Tue, 22 Oct 2019 08:33:44 GMT
server
AmazonS3
etag
"bc1de2282f3de556de150d4e44fd7905"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
IRUOt0mXtAoTfN1zNARq_ivw3ZQ5VWI6vyNGKqX-y6QJWTVN9JNk_g==
1193924_1.webp
cdn.images.express.co.uk/img/dynamic/106/132x88/
3 KB
4 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/106/132x88/1193924_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8ffa7a9f6b4d27659a43e52ecad22cdd82d10a360ce7637a92c1141b4c6ccd6b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:25:44 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
235
x-cache
Hit from cloudfront
status
200
content-length
3470
last-modified
Tue, 22 Oct 2019 08:25:32 GMT
server
AmazonS3
etag
"ecbbb9bc247b3550de46d4c94d1899bd"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
M9l6XmX3Wu-r2_LSRn7_LpNYVLYBRnS8ebOWakzI2PYIoLKl0BVhPA==
1193919_1.webp
cdn.images.express.co.uk/img/dynamic/20/132x88/
3 KB
3 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/20/132x88/1193919_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
512d1e6c120dbb1cad397f824c28f421d5a224b36e2c12c515e94dfcf07dd224

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:22:36 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
117
x-cache
Hit from cloudfront
status
200
content-length
2832
last-modified
Tue, 22 Oct 2019 08:21:10 GMT
server
AmazonS3
etag
"36a8d2901d91170f8020a944ea042525"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
brZ19M0MNo_LsJGNcMSKA6L1vhK9thLIMomRtSwjxjUmCdliddjeZw==
1193914_1.webp
cdn.images.express.co.uk/img/dynamic/151/132x88/
1 KB
2 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/151/132x88/1193914_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
311b291bd38ac9aed28f38b4219d87a492ffceb0453d03203fce5d1759edc7dc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:13:39 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
38
x-cache
Hit from cloudfront
status
200
content-length
1098
last-modified
Tue, 22 Oct 2019 08:13:12 GMT
server
AmazonS3
etag
"00a671f1eee725c0ba228beaf75da4cc"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
SLQtqfLU6tpNz4jmR9P8e6V86VdlR6hv4HmAxTSfPKU2EOL_PFBeWw==
1193913_1.webp
cdn.images.express.co.uk/img/dynamic/11/132x88/
3 KB
3 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/11/132x88/1193913_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
872e92945bf01eb93ba6f0abeb77967200c89436220b543d7a41ce86af13e8ce

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:08:59 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
22
x-cache
Hit from cloudfront
status
200
content-length
2614
last-modified
Tue, 22 Oct 2019 08:08:15 GMT
server
AmazonS3
etag
"055916d7aaf4b7a48f6466c087728c47"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
PkmWiYtHX42NPsaMQBHa2WSZP-t5IH108hIJhsXfjw2rD18aH-8fQg==
1193457_1.webp
cdn.images.express.co.uk/img/dynamic/23/590x/
26 KB
26 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/590x/1193457_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f36464f3791aa4b6611b05166ae3f015bce1dc4905bbf99ff0ec66b8b69e6d55

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:19:16 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
26122
last-modified
Mon, 21 Oct 2019 08:51:13 GMT
server
AmazonS3
etag
"274b0b82a622784ce53048c2e3461688"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
q0qIDrWD1HvUOcB_eubYHRE3uSSYw8WjRLACNnJgDCXNt6-iMqqp2A==
1193494_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1193494_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
20f11c11a29ad9ff1d8838fedeedd99354383ed6c4c25f3fb383dac2003a5075

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:25:18 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
88
x-cache
Hit from cloudfront
status
200
content-length
5544
last-modified
Tue, 22 Oct 2019 06:43:15 GMT
server
AmazonS3
etag
"56446082c2f62b69be7cbeacd8b6bdce"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
htR_pb9lC1sqkZmpPvd4wfuDwrWDit2KOypdgok2pAALLYWM3GPweA==
1192448_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
6 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1192448_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
edf9ccc85631eec0bdb18adee99fcf339dbb1b2d17f47e87abef6f4f1241a72d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:33:14 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
88
x-cache
Hit from cloudfront
status
200
content-length
5744
last-modified
Mon, 21 Oct 2019 08:59:17 GMT
server
AmazonS3
etag
"62b9642e2f0cf32ce9f297af1b213a08"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
1Y8Owu1PlaYRPINklkr0xzKLXcYKvU44CrvtMq45cTQGCzpjqVGgtA==
1193415_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
5 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1193415_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7e43a2782a0568560787ff32b4fe9b893467a42b2b47ce55f789c6a31648507e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 04:32:46 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
283
x-cache
Hit from cloudfront
status
200
content-length
4960
last-modified
Mon, 21 Oct 2019 07:26:48 GMT
server
AmazonS3
etag
"408ff6c0ad7ae657a982f9aac4ee8ac6"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
gsMD8SQx61e97E_nf_TjvnJYMuXo9YVJhemG8E-7xOlIrVimU1MQrw==
1192597_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
7 KB
8 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1192597_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6a6e9c713116a114f45ec8482c08dc48128e396b758951f85a2cb064858002ec

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 19:10:12 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
283
x-cache
Hit from cloudfront
status
200
content-length
7440
last-modified
Fri, 18 Oct 2019 14:37:34 GMT
server
AmazonS3
etag
"10c3b37c84bbdb726a1ba71af4c050db"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
ljJU5BMTVMORpkpX_eHspLghWS2qWKOF6ZUj_tsCHcZ0ETWqUylKrw==
1192514_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
5 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1192514_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eb8624dd6fb8169edf09f31ff314ff8c244638b783924f3fcc89b2c6779fb771

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 20 Oct 2019 14:26:08 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
283
x-cache
Hit from cloudfront
status
200
content-length
5050
last-modified
Fri, 18 Oct 2019 12:37:49 GMT
server
AmazonS3
etag
"a98cf26ad2ddf46fcc11a4dcca2ed9d7"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
UWq8qL71fgNEGUV1-_LEMj6Yr8PhanD3VUBcj81wYPWbHWQpVoHO5Q==
1192353_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
4 KB
4 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1192353_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0ae2c3b752d0c3923ea80b03456ab1564f1ae7040336472ea6f2dca25adb59a1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 16:44:48 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
283
x-cache
Hit from cloudfront
status
200
content-length
3650
last-modified
Fri, 18 Oct 2019 07:24:43 GMT
server
AmazonS3
etag
"89f58411843ff29396501ad04b3b4854"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
YLgXRDHHc4PM03oyw6WETThN3Hfequama6IO7KbmfAFOdxx6P7r82Q==
1192400_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1192400_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
375fe8f768b66df95f452ab64081fcde3f327f764f7ff800a06afc9e80299f72

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:29:59 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
283
x-cache
Hit from cloudfront
status
200
content-length
5560
last-modified
Fri, 18 Oct 2019 10:20:07 GMT
server
AmazonS3
etag
"6ec906ff7c6c8e3ad57ab684030e6681"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
2UDSNWJnKFsYJDP1GzRpwxapzV8FcIYdFKVDY0gmOB3yqqFg1npuSg==
1192381_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
4 KB
5 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1192381_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b5c4c2dc15c504a4caba8854bc7ac9df88b2309a6366d9122065292e6ac3c38c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:53:20 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
283
x-cache
Hit from cloudfront
status
200
content-length
4290
last-modified
Fri, 18 Oct 2019 08:17:47 GMT
server
AmazonS3
etag
"448cd18538ef47cb4d368ce1ae19a662"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
VvLXOjQmwykOpNtKyBAzfCwaSC1FyEY4N3Nl_hQKPccgw6eRi9dUuQ==
1192035_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
7 KB
8 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1192035_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4cc7badf143f41162685c763ee7d306ab1717f9316099170887754c945692e21

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:29:59 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
283
x-cache
Hit from cloudfront
status
200
content-length
7266
last-modified
Thu, 17 Oct 2019 14:37:15 GMT
server
AmazonS3
etag
"990de6fdc2987791e75933e7838e9182"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
yZPmjAIziU6LaH7PD6fXDkxF2bLfwUJi7EcIj3lYZdxwH_99NNQB_w==
1192025_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
5 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1192025_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bc74d041700daa0b55f018f66136d6cab7b761093a6a84426181a58259cdc3fb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 00:50:46 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
4916
last-modified
Thu, 17 Oct 2019 14:10:15 GMT
server
AmazonS3
etag
"3aa3dae384955131560dabc2682d8712"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
qLNkCgcBxUm7i_D1H1zk6pvy7nF1IpFgAJNRwUcWpOJWvrQURFNo1w==
1191031_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191031_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9437f43a82634520a5e44d46216a8384bcb9fc7e13561c16f1000c410187a56c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 20 Oct 2019 19:45:16 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
5558
last-modified
Thu, 17 Oct 2019 06:43:21 GMT
server
AmazonS3
etag
"aa9a2d06c85774a696432ed03b3ddfa8"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
eD4j-CYGOgzWJMnkAXh1YeN9OitrFope0hDx2HwBwXFOuUQDEret-w==
1191004_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
6 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191004_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
53bbcf739b7dddca5a3db1801016fea58b679b47407fc8631b6e84c21973ad90

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 04:40:56 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
6028
last-modified
Tue, 15 Oct 2019 14:21:30 GMT
server
AmazonS3
etag
"487a81f613ac30511cdf38caf38f5383"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
miYau5y2MPKmdJY-0Ezaz-zPjnBNeojcFqj9qH-oMdWPwBNM4Q0WDA==
1191871_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
5 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191871_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1afd1b92401f9c665d8957de5bef4f5ac8d510ce664d559514c77c6ea4ee13ab

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 04:40:55 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
4702
last-modified
Thu, 17 Oct 2019 09:30:15 GMT
server
AmazonS3
etag
"ea62660a9c575a4ca5322fdaac0a35d3"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
9Qy6lgdWYwbLB_oB06zRdtCpOLZgVH6rZBessy6Y7gqLUWQHU6GB0w==
1191971_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
6 KB
7 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191971_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e73e15b86711ab100f6115cbb1c99e0732addc4bb0c070a990c4c6b5b32a6028

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
6544
last-modified
Thu, 17 Oct 2019 12:40:52 GMT
server
AmazonS3
etag
"dfa9ce42be87f38b177562a260392800"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
BNaomFDf-VR-vRES2a93AzfFw0vVCZd8oJy_zkkePIf3mpBrNDXdPQ==
1191826_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
4 KB
5 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191826_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5a86ebfdef13a34b2af0f3aa12c75f9bf900dd158f7e453648daffd2da2da677

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 04:40:56 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
4274
last-modified
Thu, 17 Oct 2019 07:52:50 GMT
server
AmazonS3
etag
"02932e73365840b2031bb0ca8a0e3a36"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
CK450NeeTOr4eyHiFMhn2GVZw97yXK2kQHl25OPaJVjXj6k2TMF0uQ==
1191001_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
6 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191001_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d001753e373dfc1789e335e61eee39f0192707f9d5d10f9a66a1a72b63f42288

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
5738
last-modified
Tue, 15 Oct 2019 14:28:49 GMT
server
AmazonS3
etag
"282ee3244d43aba4afdb1c78c72c3b91"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
l2RIQkkevPscRoadJJ7wtiTohdAhRJQn4xJONGEJzs-psLNpu7hr2A==
1191555_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
6 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191555_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
da507f20462fb8811e74f0467e17cc3ba0b47419496589b08e93edba743a5eb2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
5970
last-modified
Wed, 16 Oct 2019 15:07:40 GMT
server
AmazonS3
etag
"32cb16ed385fe8924fa5e87bd4721507"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
0h_VCbzeIhyzaxP-yTvtMsbwW_SaptsQ5M2g7VFfERhyzkfkDJu3cw==
1191528_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
4 KB
4 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191528_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
dafa636914d006f4a813591eb19fa3a512a658ca2f7018cadc254586e9416196

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
3802
last-modified
Wed, 16 Oct 2019 14:23:59 GMT
server
AmazonS3
etag
"b978c605d7ce9288c711e960ef724085"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
QnPcY-XdGmWciDFytaYqEgx29c-m8rIU-fRUFBOM0Ko5datM3HPJzQ==
1191417_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191417_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8722bb03f2dcc60fbbfaab1c8dc201303695cbc1f2bcf237077acf9dfa2c9e80

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
5456
last-modified
Wed, 16 Oct 2019 10:48:30 GMT
server
AmazonS3
etag
"c3cc901ca084303bc9d9277f7ff8a204"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
cBLFIGkMOqIg8CJ5nCO4VyWmpzmXaoYry_-ycUSDkIOjX1fuVAFYdA==
1191057_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
4 KB
4 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191057_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a38ad295447097ea31684fb067ee13466f8a810797a28c48c658d68a1c53a874

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
3894
last-modified
Tue, 15 Oct 2019 13:57:28 GMT
server
AmazonS3
etag
"3339a18739d6b16e182ffca71a2699fd"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
Hjs7r2LZ3F_PNn-hQWRX0YSka12vJ0-F0B-qJW_MSaerGjnlk-LUMg==
1190593_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
8 KB
8 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1190593_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
28d8bbab44302e9e4657656ba52ec721e55a8fa20e257a7a200a4b2d3caa064a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 04:40:56 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
8080
last-modified
Tue, 15 Oct 2019 13:59:40 GMT
server
AmazonS3
etag
"978204b90de208393d1a9d857241a371"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
xi7upISJpCsWK6YDivOsQ_UNAe9dqFB2UQHRrc7fjjUIR4sX5aB47A==
1190423_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
6 KB
7 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1190423_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
af935e1657b2a6b0f9e82845642ff6d13f621c957ead0e874e71cbb9b978b3b7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
6418
last-modified
Tue, 15 Oct 2019 14:11:41 GMT
server
AmazonS3
etag
"84358baf499ea3585e262841302d3d4c"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
-dq9drT8OOaWW0k3yGmupqeSQxlcYqGR7KjTXb7RdCKwAIaYIGCQ3w==
1191047_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
5 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1191047_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
289e2982f225b4be905970d0c8351f4242b137605bcf998e9b56b768cd85b550

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:53:22 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
4928
last-modified
Tue, 15 Oct 2019 13:43:09 GMT
server
AmazonS3
etag
"a2293db7b76f121778c33d5349d35fc7"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
F6Eq9_jKjmW0csvkE7kmuSBcu8tW93pnhp7ZUpwbirJINxsP1d_V7w==
1190980_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
2 KB
3 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1190980_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
38d3a29ae81bb72d33b76783c4ab591fda8e280fb7b1d0156c4b0f7749e09562

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
2312
last-modified
Tue, 15 Oct 2019 11:28:28 GMT
server
AmazonS3
etag
"e249e1b2c70b21c0b3f417a34052099f"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
PdDw2f1w2Ap6Kb7pXHWgaYXYaNK2s8p1s007_cLikcLy0lspLRzLWA==
1190965_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
6 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1190965_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
95ec3f1e6d6da82a61d034eb85e45f6dd94cc40e48520887f32483caedbfaeaf

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
6152
last-modified
Tue, 15 Oct 2019 10:42:24 GMT
server
AmazonS3
etag
"740369cdf49cae545fb3d87ff98756e0"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
SVf6mvS1STUowXBY5DVYu2pU61RBYZ5DQmijS1brK4PE6gbs9CQZpg==
1190895_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
5 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1190895_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0d661c4b4ac372767351289da7baab9ec0f5e282435d3ba521f2a4503201beec

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
5028
last-modified
Tue, 15 Oct 2019 08:32:32 GMT
server
AmazonS3
etag
"ec0ca34dd19d3c97629e5a68d0473c7a"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
JmCl8gVazUdBnq-hoX9kcJaxRKn5Y9iGCL17CqL1rbeMPEfJcK6Mnw==
1190577_1.webp
cdn.images.express.co.uk/img/dynamic/23/183x122/
5 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/183x122/1190577_1.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7247ab73ad2aae2dc637c2d17bab23522dea07d0a6bc126bfd7dc0ccc7a628ff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 21:12:09 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
status
200
content-length
5342
last-modified
Mon, 14 Oct 2019 13:37:58 GMT
server
AmazonS3
etag
"97cf6bf530b623135200e3db764e082a"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
d24UGQb-HqH9ptc4sCcicN-Z_LzPOD4uxSdpdlkNiLczWnRTOqSxRw==
jquery.scrolldepth.min.js
cdn.images.express.co.uk/theme/Responsive/js/vendor/
3 KB
2 KB
Script
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/js/vendor/jquery.scrolldepth.min.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
327f01ac5f92e7ccabcb54fa03ee98eab899e454ec1fd2fc1cb806878eed437e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:48 GMT
content-encoding
gzip
age
993816
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Mon, 18 Sep 2017 11:11:05 GMT
server
AmazonS3
vary
Accept-Encoding
access-control-allow-methods
HEAD, GET, POST
content-type
application/javascript
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=2592000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
zdyXD-GFN2tAlFA4w3RFv-N8HI2MDhWP0zzHMIoOdH_8nGUX9NNPNg==
expires
Sat, 1 Jan 2022 11:11:00 UTC
front_2019-10-22.jpg
cdn.images.express.co.uk/img/covers/70x91/
2 KB
3 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/covers/70x91/front_2019-10-22.jpg
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b914ed3a33dc477bfbcfaba9dc28f729f6cd478132522f8832d20acc1e7de140

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:55:08 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
263
x-cache
Hit from cloudfront
status
200
content-length
2414
last-modified
Tue, 22 Oct 2019 07:55:03 GMT
server
AmazonS3
etag
"5f6ef6062bbb0c287a4ed2ae2b60f71a"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
co0T6M8_CCv1K3tnlgLFh53MPwLABVcOQJ-umsqwCIQCHIsUxWe9xg==
conversion.js
www.googleadservices.com/pagead/
24 KB
9 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
78a79d5cefe3a91bfccc9d0e3522b756e142d8c2aeba35146f2bc399b71cf4ad
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9385
x-xss-protection
0
server
cafe
etag
14299522277420216331
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:40 GMT
vendor-footer20190523.min.js
cdn.images.express.co.uk/theme/Responsive/js/dist/
112 KB
31 KB
Script
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/js/dist/vendor-footer20190523.min.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
71a1e2ed870b560f3557ed3006ee1b4e8e1e05f3798d56e142bb615f3188212b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:48 GMT
content-encoding
gzip
age
8769833
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 23 May 2019 11:19:10 GMT
server
AmazonS3
vary
Accept-Encoding
access-control-allow-methods
HEAD, GET, POST
content-type
application/javascript
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
Hr6fRDw7ehhugzq1Al0788dWDg6_dtaViWiOD_g9DjGE03pYW5Urkw==
app20191017.min.js
cdn.images.express.co.uk/theme/Responsive/js/dist/
32 KB
10 KB
Script
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/js/dist/app20191017.min.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ce2faa449d2aba085ddcf7a163a35e866bfc02f229139ccfc5406f959f1758fb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 17 Oct 2019 13:20:47 GMT
content-encoding
gzip
age
414834
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 17 Oct 2019 11:11:52 GMT
server
AmazonS3
vary
Accept-Encoding
access-control-allow-methods
HEAD, GET, POST
content-type
application/javascript
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
GlOaEBTyDC_EjrpC9S_SFbdPK89wYCHNN2F2NxT1Rf7xY1blSAzPbA==
oct.js
static.ads-twitter.com/
Redirect Chain
  • https://platform.twitter.com/oct.js
  • https://static.ads-twitter.com/oct.js
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/oct.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:40 GMT
content-encoding
gzip
age
1274
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-fra19147-FRA
last-modified
Tue, 23 Jan 2018 20:09:00 GMT
x-timer
S1571733281.713575,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes

Redirect headers

Access-Control-Allow-Origin
*
Date
Tue, 22 Oct 2019 08:34:40 GMT
Server
ECS (fcn/40E8)
Content-Length
0
Location
https://static.ads-twitter.com/oct.js
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
socketcluster.min.js
cdn.images.express.co.uk/js/vendor/
94 KB
21 KB
Script
General
Full URL
https://cdn.images.express.co.uk/js/vendor/socketcluster.min.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b32285045375aef8395099224e7b6ce5cd08cb9cc9085fd40647d6a82ba1562c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:48 GMT
content-encoding
gzip
age
8769833
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Fri, 12 Oct 2018 13:02:33 GMT
server
AmazonS3
vary
Accept-Encoding
access-control-allow-methods
HEAD, GET, POST
content-type
application/javascript
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
KiPPJ1mxkYJ0KEt7xMttx0rWKCdQ3FYLwHKIUGQFZOtpOkF4nh3jcw==
breaking-news20190509.min.js
cdn.images.express.co.uk/js/dist/
4 KB
2 KB
Script
General
Full URL
https://cdn.images.express.co.uk/js/dist/breaking-news20190509.min.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1c925d301ad8ab1c335bd096b9c622a8b76df99212f6fdee2b1f0591fc84458a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:48 GMT
content-encoding
gzip
age
8769833
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 09 May 2019 10:49:02 GMT
server
AmazonS3
vary
Accept-Encoding
access-control-allow-methods
HEAD, GET, POST
content-type
application/javascript
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
TY9IEwcUqh1sxkYqG73EtqGy4_3bn98gZLYFopO4lf9dNYgn_yWeWw==
tag.min.js
get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/
80 KB
20 KB
Script
General
Full URL
https://get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/tag.min.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:1c00:1f:287:d20a:ce1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c9a0b5e3c7d47198f50124c220ff593348e5d7a62385eff10baf6109f3366c3a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
FTMn6gQAEVLcJ9dPVGwNREasp75H20oJ
content-encoding
gzip
last-modified
Fri, 13 Sep 2019 09:36:49 GMT
server
AmazonS3
age
758
date
Tue, 22 Oct 2019 08:22:47 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
max-age=3600
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
5HmN812Xb3hcrXg_aFrZas_W2xwCjzbJypGiisV0Wtw3cu86bpPDWQ==
via
1.1 dde0b4b1e223fa23670e93078a04c116.cloudfront.net (CloudFront)
gtm.js
www.googletagmanager.com/
75 KB
25 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NX7XL77
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
68bd56445654b09134e401e40a8f65959aa7cfe81c867786cff5f7e6a61bd911
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
br
last-modified
Tue, 22 Oct 2019 06:00:00 GMT
server
Google Tag Manager
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
25983
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:41 GMT
wtat.page-hb3.min.js
cdn.watchingthat.net/
115 KB
40 KB
Script
General
Full URL
https://cdn.watchingthat.net/wtat.page-hb3.min.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3b0279812eb54bc321b3b11fcfdd21360f264236c7259bbdee7d124d8bd78674

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
last-modified
Fri, 26 Oct 2018 11:19:21 GMT
server
AmazonS3
x-amz-request-id
62DD5C09EB962DE3
etag
"17abd14ddde6abefcbed550edf5aeede"
x-hw
1571733281.cds132.fr8.hn,1571733281.cds126.fr8.c
content-type
application/javascript
status
200
cache-control
max-age=1217
content-length
40416
accept-ranges
bytes
access-control-allow-origin
*
x-amz-version-id
null
x-amz-id-2
D8qsOJkib1/W/LyfxtmAGqfKh4DR18eL8qLHOaK5MmVscywrUmMYfC7oGRl8OiPTy991igQmOBY=
183871-280760540362456.js
js-sec.indexww.com/ht/p/
133 KB
39 KB
Script
General
Full URL
https://js-sec.indexww.com/ht/p/183871-280760540362456.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.sync.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
6f42ac86173bcd40e4697a11368ce401930b33dd1cc5d984c5388b0aa16b1cb2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:41 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Oct 2019 07:50:43 GMT
Server
Apache
ETag
"763d0f-2138c-5957b0eab4ab1"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=1110
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
39988
Expires
Tue, 22 Oct 2019 08:53:11 GMT
chartbeat_mab.js
static.chartbeat.com/js/
19 KB
8 KB
Script
General
Full URL
https://static.chartbeat.com/js/chartbeat_mab.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.sync.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6800:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
c1acfa727754dab58bedc79995a642e235c6fde6449824c4fba4318fc060c91c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:08:06 GMT
content-encoding
gzip
last-modified
Wed, 14 Aug 2019 01:44:12 GMT
server
nginx
age
5195
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=7200
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
i7o92FTY68Jgb3VLy4F_UNb-gpxauqElB7a3CA8jXQVDeQojhERpAw==
via
1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
expires
Tue, 22 Oct 2019 09:08:06 GMT
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:41 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Wed, 23 Oct 2019 08:34:41 GMT
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
2432
date
Tue, 22 Oct 2019 07:54:09 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Tue, 22 Oct 2019 09:54:09 GMT
bundle.js
app-cdn.spot.im/modules/messages-count/3.3.435/
28 KB
10 KB
Script
General
Full URL
https://app-cdn.spot.im/modules/messages-count/3.3.435/bundle.js
Requested by
Host: www.spot.im
URL: https://www.spot.im/embed/modules/launcher/bundle.js?module=messages-count
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.115 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-115.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2758c030ad0e7492643f4ca4a7f7f6b4c633e1010707b3afe4742ebf72a7020d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
KWT5b2XWpxa4CLSbfCC7v9g4HxLj4.WI
content-encoding
gzip
last-modified
Mon, 12 Mar 2018 16:33:17 GMT
server
AmazonS3
etag
"4e35ce0f3c86079feb518742b8ae8648"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
public, no-transform, max-age=2592000, s-maxage=31536000
date
Tue, 22 Oct 2019 08:34:41 GMT
accept-ranges
bytes
content-length
10180
x-amz-cf-id
rkEDjO8_DZ5YAnrUsT8daLuC_RV4kTLgYW0pKAXFCOsl3rdzVSF7XA==
expires
Thu, 21 Nov 2019 08:34:41 GMT
gpt.js
www.googletagservices.com/tag/js/
46 KB
15 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
13426ba13e9862a0e6f6e2c9af87cce602482e4fd64aa5419bea6d0f449e7c70
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"314 / 313 of 1000 / last-modified: 1571691975"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14762
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:41 GMT
cmpui.html
cdn.images.express.co.uk/cmp-19.4.4/dx/ Frame 8241
372 B
871 B
Document
General
Full URL
https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.html
Requested by
Host: consent.cmp.oath.com
URL: https://consent.cmp.oath.com/cmp3p.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5ef68f00ee373a2138326e1eda9e2ea1a6c8d301965699d67c82ccdb753ae7e5

Request headers

:method
GET
:authority
cdn.images.express.co.uk
:scheme
https
:path
/cmp-19.4.4/dx/cmpui.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
same-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
content-type
text/html
content-length
372
date
Fri, 27 Sep 2019 06:44:53 GMT
access-control-allow-origin
*
access-control-allow-methods
HEAD, GET, POST
access-control-expose-headers
Access-Control-Allow-Origin
last-modified
Mon, 10 Jun 2019 15:38:20 GMT
etag
"787a5af29b665f46f19f8c27f1b16939"
cache-control
public,max-age=32592000
x-amz-meta-cb-modifiedtime
Thu, 25 Apr 2019 11:42:00 GMT
accept-ranges
bytes
server
AmazonS3
x-cache
Hit from cloudfront
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
ks9yXz2-Ug5S4UZrss9SRn3v970vNnSFkQs91bqT3ouo6pkKApgd_Q==
age
2166589
utag.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
32 KB
9 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8EA5) /
Resource Hash
a4776b92245ca7a79ce8723a83b8e4796fbe3105b139dcea0f3763717f8d71eb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
last-modified
Thu, 03 Oct 2019 15:08:55 GMT
server
ECAcc (frc/8EA5)
etag
"170211693"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
9438
expires
Tue, 22 Oct 2019 08:39:41 GMT
head2_icon_03.png
cdn.images.express.co.uk/img/weather/png/52x52/
563 B
1 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/weather/png/52x52/head2_icon_03.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e08f08223af3fdb140f7aa9e3803f7be89116448acf98be7e9519b8cda825401

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 18 Oct 2019 05:28:04 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
356798
x-amz-meta-cb-modifiedtime
Fri, 12 Oct 2018 10:15:58 GMT
x-cache
Hit from cloudfront
status
200
content-length
563
last-modified
Fri, 12 Oct 2018 12:24:04 GMT
server
AmazonS3
etag
"e4c5ef82c6d92b85d826b67e44d1b605"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
Riy2AOo-Wum-GbBN35s1HBPbbqmlo5oA4s9CLu-RqDDodk5b_3Ax3A==
header.png
cdn.images.express.co.uk/theme/Responsive/img/page/icons/
2 KB
3 KB
Image
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/img/page/icons/header.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2db1636a03ded06c126389ec4c994bc6f2c675ddab40d4b5c6fd9467dd65b5bc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cdn.images.express.co.uk/theme/Responsive/css/dist/app20191017.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:49 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
8769832
x-amz-meta-cb-modifiedtime
Fri, 12 Oct 2018 12:02:46 GMT
x-cache
Hit from cloudfront
status
200
content-length
2305
last-modified
Fri, 12 Oct 2018 12:12:47 GMT
server
AmazonS3
etag
"f56969f913a0f2e4effbe9b9cb809dbc"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
S-2R2n8amhIsLDETaa4dUPuln1JBWWqFEts5RBSXC8ef3x7H-aJdUg==
common.png
cdn.images.express.co.uk/theme/Responsive/img/page/icons/
8 KB
8 KB
Image
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/img/page/icons/common.png?v=437
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
18d224bb28692ee8b1f6415513ff417143e9a5ddc5d7a52e0c233304bf246308

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cdn.images.express.co.uk/theme/Responsive/css/dist/app20191017.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 18 Sep 2019 20:34:44 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
1166339
x-amz-meta-cb-modifiedtime
Tue, 12 Feb 2019 10:27:55 GMT
x-cache
Hit from cloudfront
status
200
content-length
7827
last-modified
Wed, 17 Jul 2019 11:29:24 GMT
server
AmazonS3
etag
"f186db462f51d5cbe9d96a1ae5c24536"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
DKa5GrDsC9EVQ2AZqUrPfY126Z-YU4R2wEZAA8IeLVDcKyItW-fq3g==
box-header.png
cdn.images.express.co.uk/theme/Responsive/img/page/
177 B
704 B
Image
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/img/page/box-header.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c3a17d28471e294f847b267c1cc852dc1f6d564049ffd6e98675ce3a1d67f454

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cdn.images.express.co.uk/theme/Responsive/css/dist/app20191017.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:52 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
993619
x-amz-meta-cb-modifiedtime
Tue, 27 Aug 2013 14:58:51 GMT
x-cache
Hit from cloudfront
status
200
content-length
177
last-modified
Mon, 03 Jul 2017 10:55:17 GMT
server
AmazonS3
etag
"eb4725e116abab15d364b6a038620e59"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
oPebpNpD7v-2xft0XtTP_AXpzL4MXgCdMNipzUlih5bFUTkS_EcEqQ==
expires
Mon, 3 Jan 2022 12:08:50 UTC
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
715 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
178 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3ee0806e69f2ae70a2267a58ac5fc5d52b5aa7aca6f3c0c08adad605fd8fbc16

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
243 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d2d8043c302d3a9da9277374a53e2285c471d5dc8397885b4931b82771d5cae

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
381 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
63271dcce1a2518271ecc2b0bdcc5afc9c5f0968a8635e0f97a4c9747309eb82

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?display=swap&family=Open+Sans+Condensed:300,700%7COpen+Sans:300,400,600
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 08 Oct 2019 17:59:15 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:49 GMT
server
sffe
age
1175726
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9132
x-xss-protection
0
expires
Wed, 07 Oct 2020 17:59:15 GMT
z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDuXMR7eS2Ao.woff2
fonts.gstatic.com/s/opensanscondensed/v14/
10 KB
10 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensanscondensed/v14/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDuXMR7eS2Ao.woff2
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
dbe1042b7290f4f6d73d1e0ebe0b7f8dd9e9d3f8bdde4e749c151f36ac7c42c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?display=swap&family=Open+Sans+Condensed:300,700%7COpen+Sans:300,400,600
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 15:04:41 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:18:28 GMT
server
sffe
age
927000
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10228
x-xss-protection
0
expires
Sat, 10 Oct 2020 15:04:41 GMT
truncated
/
352 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5f3592a8b8037ea064764a2815799612063c6722d314d1d66d3a9391c3c16d66

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
/
tt.onthe.io/
0
287 B
XHR
General
Full URL
https://tt.onthe.io/?k[]=41764:uniques_instantly[domain:www.express.co.uk,url:%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest,page:Tax%20refund%20scam%20warning%3A%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message,author:Jess%20Sheldon,language:en,category:Finance,sub_category:Personal%20Finance,type_article:longread,reference_time:177,pub_date:Tue%2C%2022%20Oct%202019%2007%3A15%3A00%20%2B0100,user_agent:Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36,device:desktop,browser_version:Other%2074,browser:Other,depth:1,user_type:new,user_id:20a99a585.2795d63c1_1571733281435,session_id:85ad6f052.1e0a0f786_1571733281437,cdn_version:97]&s=632ae8d6a623792c016809f53c694b47&1571733281442
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/1eWNpP6x0acZ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.150 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:41 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
/
tt.onthe.io/uniques/
33 B
515 B
Script
General
Full URL
https://tt.onthe.io/uniques/?current=22&holding=d41d8cd98f00b204e9800998ecf8427e&hash_user=20a99a585.2795d63c1_1571733281435&1571733281443
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/1eWNpP6x0acZ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.150 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
166f9390df29e23f9c9c45c50026de3b8ea04605424c6edc8557a3d3e71af7b8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:41 GMT
Server
nginx
Content-Type
text/html
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
33
Expires
Thu, 01 Jan 1970 00:00:01 GMT
/
tt.onthe.io/
0
287 B
XHR
General
Full URL
https://tt.onthe.io/?k[]=41764:visits_instantly[domain:www.express.co.uk,url:%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest,page:Tax%20refund%20scam%20warning%3A%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message,author:Jess%20Sheldon,language:en,category:Finance,sub_category:Personal%20Finance,type_article:longread,reference_time:177,pub_date:Tue%2C%2022%20Oct%202019%2007%3A15%3A00%20%2B0100,user_agent:Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36,device:desktop,browser_version:Other%2074,browser:Other,depth:1,user_type:new,user_id:20a99a585.2795d63c1_1571733281435,session_id:85ad6f052.1e0a0f786_1571733281437,cdn_version:97]&s=632ae8d6a623792c016809f53c694b47&__io=20a99a585.2795d63c1_1571733281435&1571733281446
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/1eWNpP6x0acZ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.150 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:41 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
/
tt.onthe.io/
0
287 B
XHR
General
Full URL
https://tt.onthe.io/?k[]=41764:pageviews[domain:www.express.co.uk,url:%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest,page:Tax%20refund%20scam%20warning%3A%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message,author:Jess%20Sheldon,language:en,category:Finance,sub_category:Personal%20Finance,type_article:longread,reference_time:177,pub_date:Tue%2C%2022%20Oct%202019%2007%3A15%3A00%20%2B0100,user_agent:Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36,device:desktop,browser_version:Other%2074,browser:Other,depth:1,user_type:new,user_id:20a99a585.2795d63c1_1571733281435,session_id:85ad6f052.1e0a0f786_1571733281437,cdn_version:97]&s=632ae8d6a623792c016809f53c694b47&1571733281448
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/1eWNpP6x0acZ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.150 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:41 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
session
display.apester.com/
66 B
505 B
XHR
General
Full URL
https://display.apester.com/session
Requested by
Host: static.apester.com
URL: https://static.apester.com/js/sdk/v2.0/apester-javascript-sdk.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
777c97142579080b16a1c94580f0186d1598ce0cc2542ebd3a42da6689afd208

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
via
1.1 google, 1.1 varnish
x-cache
MISS
status
200
content-length
66
x-served-by
cache-fra19156-FRA
x-timer
S1571733282.629848,VS0,VE108
vary
origin, accept-encoding, Accept-Encoding
access-control-allow-methods
OPTIONS,GET
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, no-store, must-revalidate, private
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
origin, accept, content-type
x-cache-hits
0
event
events.apester.com/
0
229 B
XHR
General
Full URL
https://events.apester.com/event
Requested by
Host: static.apester.com
URL: https://static.apester.com/js/sdk/v2.0/apester-javascript-sdk.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.63.234 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
234.63.190.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

strict-transport-security
max-age=31536000
via
1.1 google
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
date
Tue, 22 Oct 2019 08:34:41 GMT
status
202
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
alt-svc
clear
content-length
0
e6e3666e-660b-4139-8970-2e94afb35864
https://www.express.co.uk/
31 B
0
Other
General
Full URL
blob:https://www.express.co.uk/e6e3666e-660b-4139-8970-2e94afb35864
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Sec-Fetch-Mode
same-origin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
31
Content-Type
application/javascript
vtt.global.min.js
vjs.zencdn.net/vttjs/0.12.5/
20 KB
7 KB
Script
General
Full URL
https://vjs.zencdn.net/vttjs/0.12.5/vtt.global.min.js
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::729 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
aa706c43e8733a58224f514db36f253bed4ea01f56a90b66916c4aa6a656ec2d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
last-modified
Thu, 31 Aug 2017 21:04:55 GMT
status
200
etag
"f30dac97e5c2aaa10a7695b93cc66699"
x-served-by
cache-hhn4072-HHN
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
timing-allow-origin
*
content-length
7231
x-cache-hits
640732
iris.adaptive.js
ovp.iris.tv/libs/adaptive/v2/
121 KB
122 KB
Script
General
Full URL
https://ovp.iris.tv/libs/adaptive/v2/iris.adaptive.js
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:5e00:15:d134:4e40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
94ae718015121a47c1270c8587ded3c42aed3fb63b64961f2ebe56263ce4ee39

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
jqSExA1sdyDFqzlm3DL99c7FNGCQ7E0r
via
1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront)
last-modified
Thu, 03 Oct 2019 05:20:05 GMT
server
AmazonS3
age
4
etag
"58be1df18ebdce56d32a5b9beda95176"
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
date
Tue, 22 Oct 2019 08:34:38 GMT
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
124188
x-amz-cf-id
tckvSf2CvhgaV7Al9XHYDQYOyT509zD40e9IyH9B87BzhtalVf1RTQ==
5798750504001
edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/
3 KB
4 KB
XHR
General
Full URL
https://edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/5798750504001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.203.45 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-203-45.fra50.r.cloudfront.net
Software
/
Resource Hash
108e5e46ad99ff788eec19ead675ea6d1842dd2c274db6ef7ed995e818459efe
Security Headers
Name Value
Strict-Transport-Security max-age=77766000; includeSubDomains

Request headers

Accept
application/json;pk=BCpkADawqM3Dmzg7zRlKEmzcSAqR4vFC4MpyD0075pbeW0d779IrRf-anBPDszKFRm29RtjAGKoEpMIaZ77MCa9sg3FEJvjlzLS_lu0eXl3P-dUfQsoJ3LvMbiGkYL0cJNwEvNhrJy8Fh7TG
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

BCOV-instance
i-04c795b226d05a399, ac55aaf, 2019-10-22 08:34:41.740Z
Via
1.1 f794b89ac7b5d3a7a6b25a236579db6c.cloudfront.net (CloudFront)
BCOV-REQUEST-ID
b0cbef17-c0ab-4f60-927e-a78d9984a26e
X-Amz-Cf-Pop
FRA50
Date
Tue, 22 Oct 2019 08:34:41 GMT
Strict-Transport-Security
max-age=77766000; includeSubDomains
X-Cache
Miss from cloudfront
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
X-Originating-URL
https://edge-elb.api.brightcove.com/playback/v1/accounts/2540076170001/videos/5798750504001
access-control-expose-headers
x-cache,via,bcov-debug-cache-stats,bcov-instance,x-amz-cf-id
Cache-Control
max-age=158
Connection
keep-alive
Content-Length
3089
X-Amz-Cf-Id
WnTa7inPvuzJ15S1mnl9O3c2NZ5lAeJNzHlr2aTsszvt6zKWWnsDMA==
tracker
metrics.brightcove.com/v2/
35 B
178 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=player_init&time=1571733281549&seq=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:41 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_request&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F5798750504001&time=1571733281558&seq=1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:41 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
995 B
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:57:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 21 Apr 2016 03:17:22 GMT
server
sffe
age
2245
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
856
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:57:16 GMT
preloader.gif
cdn.images.express.co.uk/theme/Responsive/img/page/
6 KB
6 KB
Image
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/img/page/preloader.gif
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ef25b9d3d8f48f3a0f8b96f3a287382cf19f23af16546ce72e4bf6f77fb2970b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cdn.images.express.co.uk/theme/Responsive/css/dist/app20191017.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 20:46:29 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
42493
x-amz-meta-cb-modifiedtime
Tue, 12 Feb 2019 10:31:20 GMT
x-cache
Hit from cloudfront
status
200
content-length
6008
last-modified
Tue, 12 Feb 2019 10:31:40 GMT
server
AmazonS3
etag
"88707fd32acdc257d1595193815a3575"
access-control-allow-methods
HEAD, GET, POST
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
UPSDDxB16HUSSY1mqNbojItOBU8xsppYQYYFaumMZveTRuY72FscNg==
quote_mark.gif
cdn.images.express.co.uk/theme/Responsive/img/page/
286 B
773 B
Image
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/img/page/quote_mark.gif
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e0a0973c107379ea3f243805d2dda954827ced2e4b6c69b4559474d303414c54

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cdn.images.express.co.uk/theme/Responsive/css/dist/app20191017.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:31:42 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
8769780
x-cache
Hit from cloudfront
status
200
content-length
286
last-modified
Mon, 18 Sep 2017 11:19:23 GMT
server
AmazonS3
etag
"c3971f76b887cdebc45c65329a11446d"
access-control-allow-methods
HEAD, GET, POST
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
rOarh8RTzLfchZCU9jKIc4eVHlQBzwBcZk1Q4X83zI_tvzC6SosVIw==
expires
Mon, 3 Jan 2022 12:08:50 UTC
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?display=swap&family=Open+Sans+Condensed:300,700%7COpen+Sans:300,400,600
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 19:39:28 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:37 GMT
server
sffe
age
910513
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9016
x-xss-protection
0
expires
Sat, 10 Oct 2020 19:39:28 GMT
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1b03be18e07e94ff40f413fd0a41d6f374b0d3df44e951baa53295099e2c3642

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin
https://www.express.co.uk

Response headers

Content-Type
application/font-woff;charset=utf-8
publishertag.js
static.criteo.net/js/ld/
86 KB
27 KB
Script
General
Full URL
https://static.criteo.net/js/ld/publishertag.js
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183871-280760540362456.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
34c0194deac635fd02a300e11745a72d36b67bddefe58e02de53f5ffd2f70381

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
last-modified
Thu, 10 Oct 2019 07:51:03 GMT
server
nginx
etag
W/"5d9ee2e7-159ee"
status
200
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
timing-allow-origin
*
expires
Wed, 23 Oct 2019 08:34:41 GMT
rid
match.adsrvr.org/track/
109 B
539 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=183871
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183871-280760540362456.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.79.134 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-79-134.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
40e4df9f4457dfadf41313a8d8eb7632bc774bbb3bfeb826c92fa398c2fc22b2

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
x-aspnet-version
4.0.30319
status
200
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.express.co.uk
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Thu, 21 Nov 2019 08:34:41 GMT
directsdk.js
aka.spotxcdn.com/integration/directsdk/v1/
Redirect Chain
  • https://js.spotx.tv/directsdk/v1/216448.js
  • https://aka.spotxcdn.com/integration/directsdk/v1/directsdk.js
391 KB
145 KB
Script
General
Full URL
https://aka.spotxcdn.com/integration/directsdk/v1/directsdk.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.234 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-234.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b201ea1d99d8a0bc66f36c1a230ece4fe4e11cacbf7d8eb0714444e01b462cad

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:41 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Sep 2019 18:36:37 UTC
Server
nginx
Access-Control-Allow-Headers
ETag
8594d84874081a27be889bb178a548e1
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, GET, PATCH, DELETE, OPTIONS
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=255
Connection
keep-alive
Timing-Allow-Origin
*
X-SpotX-Build-Version
1.29.3-20190930.1715
Content-Length
147976

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:41 GMT
Last-Modified
Tue, 22 Oct 2019 08:34:41 UTC
Server
nginx
Location
//aka.spotxcdn.com/integration/directsdk/v1/directsdk.js
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
post-check=0, pre-check=0, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
128
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
cygnus
as-sec.casalemedia.com/
52 B
837 B
Script
General
Full URL
https://as-sec.casalemedia.com/cygnus?v=8&fn=pbjs.handleCygnusResponse&s=181452&r=%7B%22id%22%3A%223ee425f41c669c%22%2C%22imp%22%3A%5B%7B%22id%22%3A%224a68130827b08c%22%2C%22ext%22%3A%7B%22siteID%22%3A181452%2C%22sid%22%3A%22pr_1_1_s%22%7D%2C%22video%22%3A%7B%22protocols%22%3A%5B2%2C5%2C3%2C6%5D%2C%22maxduration%22%3A30%2C%22minduration%22%3A0%2C%22startdelay%22%3A0%2C%22linearity%22%3A1%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%5D%2C%22apiList%22%3A%5B2%5D%2C%22w%22%3A640%2C%22h%22%3A360%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest%22%7D%7D
Requested by
Host: cdn.watchingthat.net
URL: https://cdn.watchingthat.net/wtat.page-hb3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
67dee92456c9d6fae38706eaf11021251c0f127711cb29c8ffb80a142cc628f6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:41 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/javascript
Content-Length
72
Expires
Tue, 22 Oct 2019 08:34:41 GMT
integrator.js
adservice.google.de/adsid/
109 B
323 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
122 B
334 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
7e2bc5e470644233e8d64d8a3d4b14cc16b67c966314f9c51cf48111d35e6b2a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
119
x-xss-protection
0
pubads_impl_2019101401.js
securepubads.g.doubleclick.net/gpt/
156 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
f8800772f0dd827877029d9d634a170a156ff82b6b6bdf251b62c750b73cfe93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 14 Oct 2019 13:08:16 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58589
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:41 GMT
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&usage=inpage-embed&event=player_load&time=1571733281656&qos.performance.memory.jsHeapSizeLimit=4345298944&qos.performance.memory.usedJSHeapSize=20481213&qos.performance.memory.totalJSHeapSize=24728541&qos.performance.navigation.redirectCount=0&qos.performance.navigation.type=0&qos.performance.navigation.directedMigration=false&qos.performance.timing.loadEventEnd=0&qos.performance.timing.loadEventStart=0&qos.performance.timing.domComplete=0&qos.performance.timing.domContentLoadedEventEnd=0&qos.performance.timing.domContentLoadedEventStart=0&qos.performance.timing.domInteractive=0&qos.performance.timing.domLoading=1571733280544&qos.performance.timing.responseEnd=1571733280550&qos.performance.timing.responseStart=1571733280542&qos.performance.timing.requestStart=1571733280429&qos.performance.timing.secureConnectionStart=1571733280419&qos.performance.timing.connectEnd=1571733280429&qos.performance.timing.connectStart=1571733280413&qos.performance.timing.domainLookupEnd=1571733280413&qos.performance.timing.domainLookupStart=1571733280412&qos.performance.timing.fetchStart=1571733280411&qos.performance.timing.redirectEnd=0&qos.performance.timing.redirectStart=0&qos.performance.timing.unloadEventEnd=0&qos.performance.timing.unloadEventStart=0&qos.performance.timing.navigationStart=1571733280411&qos.performance.bcInit=116.70999974012375&qos.player.dimensions=%5B%5B1571733281656%2C%220x0%22%2C%22590x331.875%22%5D%5D&qos.player.pixelratio=%5B%5B1571733281656%2C1%5D%5D&qos.player.screendimensions=%5B%5B1571733281656%2C%221600x1200%22%5D%5D&seq=2
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:41 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
ima3.js
imasdk.googleapis.com/js/sdkloader/
271 KB
92 KB
Script
General
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0765787f1966c35a86910225b871ca49249be9e882aade8899d624b431e7446b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
94100
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:41 GMT
gtm.js
www.googletagmanager.com/
0
0
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5LBKKH6&l=dataLayer
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NX7XL77
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035737&ns__t=1571733281676&ns_c=UTF-8&cv=3.1e&c8=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finan...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035737&ns__t=1571733281676&ns_c=UTF-8&cv=3.1e&c8=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Fina...
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=6035737&ns__t=1571733281676&ns_c=UTF-8&cv=3.1e&c8=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c9=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:41 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=6035737&ns__t=1571733281676&ns_c=UTF-8&cv=3.1e&c8=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c9=
Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:41 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
0.bundle.js
app-cdn.spot.im/modules/messages-count/3.3.435/
31 KB
10 KB
Script
General
Full URL
https://app-cdn.spot.im/modules/messages-count/3.3.435/0.bundle.js
Requested by
Host: app-cdn.spot.im
URL: https://app-cdn.spot.im/modules/messages-count/3.3.435/bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.115 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-115.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
73af65c1e5b508c2579327df5a38c69b31c04297ee49cd98c9ea2820a5674352

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
3Kck8Hj7loxeA_bkR3oiNLXT9nB8uuy8
content-encoding
gzip
last-modified
Sun, 11 Mar 2018 10:18:41 GMT
server
AmazonS3
etag
"c32d53d6a999edbd085563987ce4d5c7"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
public, no-transform, max-age=2592000, s-maxage=31536000
date
Tue, 22 Oct 2019 08:34:41 GMT
accept-ranges
bytes
content-length
9616
x-amz-cf-id
XCA0xc1nVKFhq5081dZ2bbbRZAagvv4niqq5fYMlmFFRKnc0kUQwSA==
expires
Thu, 21 Nov 2019 08:34:41 GMT
d3d3LmV4cHJlc3MuY28udWs=
tcheck.outbrainimg.com/tcheck/check/
16 B
477 B
XHR
General
Full URL
https://tcheck.outbrainimg.com/tcheck/check/d3d3LmV4cHJlc3MuY28udWs=
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
ETag
W/"10-us8lSJutAxKqLzf8c1+n5XstcwY"
Access-Control-Max-Age
43200
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=27768
Date
Tue, 22 Oct 2019 08:34:41 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
false
Content-Length
16
Expires
Tue, 22 Oct 2019 16:17:29 GMT
vendor,init,conversation
api-2-0.spot.im/v1.0.0/config/launcher/sp_9LMINbK9/1192439/
17 KB
4 KB
Fetch
General
Full URL
https://api-2-0.spot.im/v1.0.0/config/launcher/sp_9LMINbK9/1192439/vendor,init,conversation
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.112 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-112.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
cf550f7fac98e2e3d175cc44d678f8152365f322e690b37bd493851b4f69cebd

Request headers

Accept
application/json
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
x-spotim-page-view-id
4f69efd8-3683-4823-aba9-ce1bccb8960f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/json

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
vary
Accept-Encoding
status
200
x-envoy-upstream-service-time
15
content-length
3529
x-request-id
94e52da7-988e-40c0-833f-d3a388f6d116
x-guid
00abf816-86a3-4159-9d1d-e146f010dfc1
server
istio-envoy
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-expose-headers
x-spotim-token, x-spotim-networkid, x-access-token, x-spotim-device-v2
access-control-allow-credentials
true
access-control-allow-headers
content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-spotim-page-view-id,x-spotim-device-v2
pixel
pix.spot.im/api/v1/
16 B
429 B
XHR
General
Full URL
https://pix.spot.im/api/v1/pixel?m=eyJwYWdlX3ZpZXdfaWQiOiI0ZjY5ZWZkOC0zNjgzLTQ4MjMtYWJhOS1jZTFiY2NiODk2MGYiLCJyZWZlcnJlciI6IiIsInNvdXJjZSI6ImxhdW5jaGVyIiwic291cmNlX3ZlcnNpb24iOiJ2MiIsInNwb3RfaWQiOiJzcF85TE1JTmJLOSIsInR5cGUiOiJsb2FkZWQifQ%3D%3D&rnd=0.8601521665589456
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
fasthttp /
Resource Hash
707d4c7f44dd33e874b5a09b6dba4702b12bfd3e19e470d601fcfc1d7009286c

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
x-spotim-device-uuid
undefined
x-spotim-page-view-id
4f69efd8-3683-4823-aba9-ce1bccb8960f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:41 GMT
server
fasthttp
status
200
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
content-length
16
expires
Tue, 22 Oct 2019 08:34:41 GMT
ad-choises.png
publisher-assets.spot.im/yad/
4 KB
4 KB
Image
General
Full URL
https://publisher-assets.spot.im/yad/ad-choises.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.59 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-59.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
f27b4cdbd821100765224a52c7c8d544fa9fdd6d0aba21015eb66c11735e0989

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
last-modified
Mon, 02 Jul 2018 15:08:43 GMT
server
AmazonS3
status
200
etag
"643378ef8a85df26380de21f9beb58ba"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
content-length
4191
x-amz-cf-id
dGZPAf00eZ21UWGWbGrR3mUWpio3iUGgEvoW3nY1p9glFZhM9-t9_A==
expires
Thu, 21 Nov 2019 08:34:41 GMT
device_load
events-collector.spot.im/api/v1/
36 B
472 B
XHR
General
Full URL
https://events-collector.spot.im/api/v1/device_load
Requested by
Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
fasthttp /
Resource Hash
37e5f6d2b6da6f8594ebe59589a01683ca180e5f12d5a38b0c68d128e6c792b9

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:41 GMT
server
fasthttp
status
200
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.express.co.uk
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
content-length
36
expires
Tue, 22 Oct 2019 08:34:41 GMT
sp_9LMINbK9
www.spot.im/api/tracker/spot/
0
827 B
XHR
General
Full URL
https://www.spot.im/api/tracker/spot/sp_9LMINbK9
Requested by
Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_9LMINbK9
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip0x03f.map2.ssl.hwcdn.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
x-spotim-page-view-id
4f69efd8-3683-4823-aba9-ce1bccb8960f
Content-Type
application/json
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
x-spotim-device-uuid

Response headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, POST, DELETE, PUT, PATCH, HEAD, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
https://www.express.co.uk
Access-Control-Expose-Headers
x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid
Access-Control-Allow-Credentials
true
x-spotim-bid
Access-Control-Max-Age
86400
Connection
Keep-Alive
x-spotim-rid
Access-Control-Allow-Headers
x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid, Content-Type
X-HW
1571733280.dop006.fr8.t,1571733282.cds070.fr8.shn,1571733282.dop006.fr8.t,1571733282.cds139.fr8.sc,1571733282.cds139.fr8.p
x-spotim-vid
27e3f2c4-2601-43d3-ad04-2f6272720193
https://www.express.co.uk/
1 KB
0
Media
General
Full URL
blob:https://www.express.co.uk/27e3f2c4-2601-43d3-ad04-2f6272720193
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Sec-Fetch-Mode
no-cors
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

Content-Range
bytes 0-1492/1493
Content-Length
1493
Content-Type
video/mp4
982ed833-ca39-4570-ab5c-bafa812f8876
https://www.express.co.uk/
1 KB
0
Media
General
Full URL
blob:https://www.express.co.uk/982ed833-ca39-4570-ab5c-bafa812f8876
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Sec-Fetch-Mode
no-cors
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

Content-Range
bytes 0-1492/1493
Content-Length
1493
Content-Type
video/mp4
cmpui.js
cdn.images.express.co.uk/cmp-19.4.4/dx/ Frame 8241
381 KB
106 KB
Script
General
Full URL
https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.js
Requested by
Host: cdn.images.express.co.uk
URL: https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
19f6cd03771ec6205cf92aca5fdab1ca31d6aed2815a89ed9356f5d5d3e8b8cb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:55 GMT
content-encoding
gzip
age
8769827
x-amz-meta-cb-modifiedtime
Thu, 25 Apr 2019 11:42:00 GMT
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Mon, 10 Jun 2019 15:38:20 GMT
server
AmazonS3
vary
Accept-Encoding
access-control-allow-methods
HEAD, GET, POST
content-type
application/x-javascript
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
v16DNIzF8xmDUp6Os4gVp9CM8R2slSmoN5avxCoHD1ULYNh2_0E6JA==
cmpui.css
cdn.images.express.co.uk/cmp-19.4.4/dx/ Frame 8241
6 KB
2 KB
Stylesheet
General
Full URL
https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.css
Requested by
Host: cdn.images.express.co.uk
URL: https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3deda9c4104de2f32ed217f4ed0f2a7543c5f2b963fda7f9d20090eedb2432b1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:55 GMT
content-encoding
gzip
age
8769827
x-amz-meta-cb-modifiedtime
Thu, 25 Apr 2019 11:42:00 GMT
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Mon, 10 Jun 2019 15:38:20 GMT
server
AmazonS3
vary
Accept-Encoding
access-control-allow-methods
HEAD, GET, POST
content-type
text/css
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
Ovzhhbyg8wM5nKL-KfMOaijJrx8ZCQ_RiMnKqIW1Jed_nBzm9t17Jw==
/
mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/
243 B
503 B
XHR
General
Full URL
https://mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/?host=express.co.uk&domain=express.co.uk&path=%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: static.chartbeat.com
URL: https://static.chartbeat.com/js/chartbeat_mab.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::714 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
44159966f048107d18a4c62de519864adfcd09219f3cfb838e8fe166b44b923b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
age
0
x-cache
MISS
status
200
x-cache-hits
0
content-length
182
x-served-by
cache-hhn4066-HHN
access-control-allow-origin
*
x-timer
S1571733282.830370,VS0,VE93
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type
application/json
via
1.1 varnish (Varnish/6.0), 1.1 varnish
cache-control
no-store, no-cache, must-revalidate, max-age=0, s-maxage=0
accept-ranges
bytes
expires
Sun, 20 Oct 2019 08:34:41 GMT
dwce_cheq_events
log.outbrainimg.com/loggerServices/
4 B
344 B
XHR
General
Full URL
https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1571733281838&sessionId=f71510c3-4fde-dad8-4e6e-8b042be00cdb&url=www.express.co.uk&cheqSource=1&cheqEvent=0&exitReason=2
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:42 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
X-TraceId
b2417b0b1b5976ae092bdc1f985046ce
Content-Length
4
Expires
0
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_response&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F5798750504001&time=1571733281847&response_time_ms=289&BCOV-instance=i-04c795b226d05a399%2C%20ac55aaf%2C%202019-10-22%2008%3A34%3A41.740Z&X-Cache=Miss%20from%20cloudfront&Via=1.1%20f794b89ac7b5d3a7a6b25a236579db6c.cloudfront.net%20(CloudFront)&X-Amz-Cf-Id=WnTa7inPvuzJ15S1mnl9O3c2NZ5lAeJNzHlr2aTsszvt6zKWWnsDMA%3D%3D&seq=3
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:41 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2100588899&t=pageview&_s=1&dl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-545303-1&cid=7843761.1571733282&jid=970065435&_gid=1331413262.1571733282&gjid=622674384&_v=j79&z=657961861
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=970065435&_v=j79&z=657961861
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=970065435&_v=j79&z=657961861&slf_rd=1&random=2786677053
42 B
109 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=970065435&_v=j79&z=657961861&slf_rd=1&random=2786677053
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:42 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:42 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=970065435&_v=j79&z=657961861&slf_rd=1&random=2786677053
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2100588899&t=pageview&_s=1&dl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-123584808-1&cid=7843761.1571733282&jid=1309634981&_gid=1331413262.1571733282&gjid=507566058&_v=j79&z=383745253
35 B
102 B
Image
General
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-123584808-1&cid=7843761.1571733282&jid=1309634981&_gid=1331413262.1571733282&gjid=507566058&_v=j79&z=383745253
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 22 Oct 2019 08:34:41 GMT
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:41 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
302
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-123584808-1&cid=7843761.1571733282&jid=1309634981&_gid=1331413262.1571733282&gjid=507566058&_v=j79&z=383745253
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
416
expires
Fri, 01 Jan 1990 00:00:00 GMT
IrisUpNext.css
ovp.iris.tv/libs/adaptive/styles/v2/
14 KB
4 KB
Stylesheet
General
Full URL
https://ovp.iris.tv/libs/adaptive/styles/v2/IrisUpNext.css
Requested by
Host: ovp.iris.tv
URL: https://ovp.iris.tv/libs/adaptive/v2/iris.adaptive.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:5e00:15:d134:4e40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
04a74928965ed27c791351d7e70bc0bb40194158a56fd949b19c66f28d4835c1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
wvkxUhCS82NPYaTWHesnpN1q5vhFHa5Q
content-encoding
gzip
last-modified
Mon, 11 Feb 2019 19:50:18 GMT
server
AmazonS3
age
43094
date
Mon, 21 Oct 2019 20:36:28 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
2hml0CgBrmX4gbcZKE61wlj335iYMOwsdgOmEXGX1IK0_e9Iti2CJA==
via
1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront)
IrisButtons.css
ovp.iris.tv/libs/adaptive/styles/
6 KB
4 KB
Stylesheet
General
Full URL
https://ovp.iris.tv/libs/adaptive/styles/IrisButtons.css
Requested by
Host: ovp.iris.tv
URL: https://ovp.iris.tv/libs/adaptive/v2/iris.adaptive.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:5e00:15:d134:4e40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
85fa47de6b71bbce922b3d89b645018063f5d4b1c7ac1383ada0da3729de6702

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
_ElMf2In3Kac4ysR1LTx01V4WFCOWbnt
content-encoding
gzip
last-modified
Fri, 20 Sep 2019 23:35:16 GMT
server
AmazonS3
age
32153
date
Mon, 21 Oct 2019 23:38:49 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
KG2EngpnkjO2-zYVsET7qSVfILQVvnFegBPtZhZNzzfdI_kEVB3wQA==
via
1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront)
watch
api.iris.tv/
2 KB
3 KB
Script
General
Full URL
https://api.iris.tv/watch?number=5&api_url=&base_url=defaultbaseurl&client_token=2540076170001&platform=brightcove&access_token=1d9f05c8b00daddfbffcf5afa8a0691bf6370c0cd9dfc8bc6fb38e13c4474dab&ssl=true&platform_id=5798750504001&player_version=Brightcove.Nextgen&persist_experience=false&disable_mobile_upnext=false&up_next_min_vid_length=23&start_up_next=true&start_up_next_text=UP%20NEXT%3A&start_up_next_time=5&start_up_next_length=7&end_up_next=true&end_up_next_text=UP%20NEXT%3A&end_up_next_time=5&end_up_next_length=7&player_id=video_5798750504001_0&campaign_tracking=true&side_rail=false&related_rail=false&set_cookie=true&carousel_recs=true&user_id=UP-IuDGHxCpUCXBFod&iframe=false&enable_category_ads=true&enable_context_ads=true&enable_category_cust_params_ads=false&recs_only=true&callback=superagentCallback1571733282027
Requested by
Host: ovp.iris.tv
URL: https://ovp.iris.tv/libs/adaptive/v2/iris.adaptive.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.0.234.50 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-0-234-50.compute-1.amazonaws.com
Software
nginx/1.16.1 /
Resource Hash
4b6b1a2cf838b25dbf614c720106071ead2d7d2157cd371505438151a90fdcdc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
X-Content-Type-Options
nosniff
Server
nginx/1.16.1
X-Trace
2B63CCB642C3CBC77C08A4991B13AB0A03957E7246334FEB74AC33D14700
X-IRIS-EXPERIENCE
5daebf22fa4fac06f7234575
Access-Control-Allow-Origin
*
X-IRIS-ACCESS-TOKEN
1d9f05c8b00daddfbffcf5afa8a0691bf6370c0cd9dfc8bc6fb38e13c4474dab
X-IRIS-USER
UP-IuDGHxCpUCXBFod
Connection
keep-alive
Content-Type
application/javascript;charset=utf-8
X-IRIS-CLIENT-TOKEN
2540076170001
Content-Length
2521
X-IRIS-NEXT-REC
bridge3.343.1_en.html
imasdk.googleapis.com/js/core/ Frame BE3F
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.343.1_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.343.1_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
193394
date
Mon, 21 Oct 2019 23:49:30 GMT
expires
Tue, 20 Oct 2020 23:49:30 GMT
last-modified
Thu, 17 Oct 2019 15:13:57 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
31511
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
client.js
s0.2mdn.net/instream/video/
26 KB
11 KB
Script
General
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10523
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:41 GMT
2540076170001_5798751046001_5798750504001-vs.jpg
httpsak-a.akamaihd.net/2540076170001/
58 KB
58 KB
Image
General
Full URL
https://httpsak-a.akamaihd.net/2540076170001/2540076170001_5798751046001_5798750504001-vs.jpg?pubId=2540076170001&videoId=5798750504001
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.16 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-16.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f3864682d9efe5a6ada4d3b3692461f8c251a56b8382b967174363077199f9d9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
Last-Modified
Mon, 18 Jun 2018 10:36:33 GMT
X-Amz-Cf-Pop
FRA56
ETag
"586c52d4f2a120ca0391323dd35cf823"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With
Content-Length
59405
X-Amz-Cf-Id
qOBNcPYKuzasZ32tnANiGMQPyD47Wv0LIto4PiaUplAbuFx0ecp5nw==
social-media-4.png
cdn.images.express.co.uk/theme/Responsive/img/page/icons/
3 KB
3 KB
Image
General
Full URL
https://cdn.images.express.co.uk/theme/Responsive/img/page/icons/social-media-4.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7286b781e94d84e8da08d2ca157255ad70cda39f0158d91859e575891db24255

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cdn.images.express.co.uk/theme/Responsive/css/dist/app20191017.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:50 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
8769832
x-amz-meta-cb-modifiedtime
Fri, 12 Oct 2018 12:02:47 GMT
x-cache
Hit from cloudfront
status
200
content-length
2567
last-modified
Fri, 12 Oct 2018 12:12:48 GMT
server
AmazonS3
etag
"8b65d7995b54cadde751931bd9dc7cfe"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
slEc-vldLkFA4HjVVVdSrgxfgx8mx8Cv7FaEJLPnoQia5PgcnCFGug==
logo_ipso.png
cdn.images.express.co.uk/img/page/
2 KB
2 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/page/logo_ipso.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ce0e0e11e79156df3d3ba198dcc218afc14028fee592fbf2e90a3902e3430b95

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cdn.images.express.co.uk/theme/Responsive/css/dist/app20191017.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:50 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
8769832
x-amz-meta-cb-modifiedtime
Mon, 08 Oct 2018 11:23:11 GMT
x-cache
Hit from cloudfront
status
200
content-length
1596
last-modified
Fri, 12 Oct 2018 13:01:05 GMT
server
AmazonS3
etag
"b6cd56d5e27392960a42ccf7818fcaca"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
Ex2kdz-qGUatmdnnmRXYOHPn21TFKnoTmqjXmhv8-AJlRLtMr7OW7A==
gigya.services.plugins.base.min.js
cdns.gigya.com/js/
157 KB
49 KB
Script
General
Full URL
https://cdns.gigya.com/js/gigya.services.plugins.base.min.js?services=gigya.services.socialize.plugins.reactions&lang=en&version=latest
Requested by
Host: cdns.gigya.com
URL: https://cdns.gigya.com/JS/gigya.js?apiKey=3_BBXBRC0QUUloJ0Hujw4HOY17aLrL0Uy8FDx59O4-PrYbWWtrnCBKphB69PH9tXSb
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.36 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-36.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
893ce9b68611c1d01a66862015ada21c580458e22e434b326eb67343e029719e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
Content-Encoding
gzip
Content-Type
text/javascript; charset=utf-8
X-Soa
true, Gator
Vary
Accept-Encoding
P3P
CP="IDC COR PSA DEV ADM OUR IND ONL"
Access-Control-Allow-Origin
*
X-CallID
791c5b30e44343cab28b4374a6cc8ed2
Cache-Control
private, max-age=900
X-Server
us1d-nomad-g8
Connection
keep-alive
X-Robots-Tag
none
X-Gigya-HA-cfg-ver
5
Content-Length
49378
Expires
Tue, 22 Oct 2019 08:49:42 GMT
cf9381b7-fc13-4587-9789-1cae885ab28c
https://www.express.co.uk/
6 KB
0
Other
General
Full URL
blob:https://www.express.co.uk/cf9381b7-fc13-4587-9789-1cae885ab28c
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9ce15b5438604bf3eb4ff1b92cd0972d7df3940e9bcbd63c6eaac226cb52367e

Request headers

Sec-Fetch-Mode
same-origin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
6143
Content-Type
application/javascript
master.m3u8
secure.brightcove.com/services/mobile/streaming/index/
1 KB
648 B
XHR
General
Full URL
https://secure.brightcove.com/services/mobile/streaming/index/master.m3u8?videoId=5798750504001&pubId=2540076170001&secure=true
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.74.101.79 , United States, ASN18908 (BRIGHTCOVE-AS - Brightcove, Inc., US),
Reverse DNS
secure.brightcove.com
Software
brightcove /
Resource Hash
70cde6486e50fb4f1298da4b0c964583d1d9b6bee4adbe776b1ec065499f75ea

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
Content-Encoding
gzip
X-BC-Connecting-IP
144.76.109.30
Server
brightcove
X-BC-Client-IP
144.76.109.30
Content-Type
application/vnd.apple.mpegurl;charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
must-revalidate,max-age=0
Last-Modified
Fri, 20 Jul 2018 05:45:59 GMT
Content-Length
282
/
tt.onthe.io/
0
287 B
XHR
General
Full URL
https://tt.onthe.io/?k[]=42078:uniques_holding&s=632ae8d6a623792c016809f53c694b47&__io=20a99a585.2795d63c1_1571733281435&1571733282041
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/1eWNpP6x0acZ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.150 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:42 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
digitrust.min.js
cdn.digitru.st/prod/1/
40 KB
11 KB
Script
General
Full URL
https://cdn.digitru.st/prod/1/digitrust.min.js
Requested by
Host: aka.spotxcdn.com
URL: https://aka.spotxcdn.com/integration/directsdk/v1/directsdk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
159.180.84.2 , United States, ASN33047 (INSTART - Instart Logic, Inc, US),
Reverse DNS
Software
DTOrigin /
Resource Hash
26ca840c9d02b5b4c1013bf1e2371ff3e04dea1fb2dc7b60cc7d21345359938d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 06:13:51 GMT
content-encoding
gzip
last-modified
Mon, 23 Sep 2019 14:27:17 GMT
server
DTOrigin
etag
"651f6d3b36aa4bd56fedba685427757f"
status
200
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin
*
cache-control
max-age=86400
x-instart-request-id
13543058624497234938:SEN01-CPVNPPRY17:1571733282:0
x-instart-cache-id
35:13407679001993407642::1571638430
accept-ranges
bytes
content-type
application/javascript
content-length
11230
expires
Tue, 22 Oct 2019 06:13:51 GMT
partner
sync.search.spotxchange.com/
Redirect Chain
  • https://sync.search.spotxchange.com/partner?source=dados
  • https://sync.search.spotxchange.com/partner?source=dados&__user_check__=1&sync_id=cb1da821-f4a6-11e9-ae03-11a3cbba0906
0
563 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?source=dados&__user_check__=1&sync_id=cb1da821-f4a6-11e9-ae03-11a3cbba0906
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-spotx-halt-type
Audience Dsp sync Priority Sync endpoint Source ID is not on enabled source whitelist
Date
Tue, 22 Oct 2019 08:34:42 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
121
Connection
keep-alive
Content-Length
0

Redirect headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
Server
nginx
Location
/partner?source=dados&__user_check__=1&sync_id=cb1da821-f4a6-11e9-ae03-11a3cbba0906
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
32
Connection
keep-alive
Content-Length
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1068671835/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1068671835/?random=1571733282077&cv=9&fst=1571733282077&num=1&label=u9gYCOmHtQYQ28bK_QM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&tiba=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
dfef4a9f22e20b5b62f8e3209f7d19ca77bd628dba254e57b5255d6f6f6cd108
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1069
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
global
service.cmp.oath.com/cmp/v0/vendor_list/ Frame 8241
88 KB
17 KB
XHR
General
Full URL
https://service.cmp.oath.com/cmp/v0/vendor_list/global
Requested by
Host: cdn.images.express.co.uk
URL: https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:135:155a:23ba:b2a:25ff:122d , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECD (fcn/4094) /
Resource Hash
9cbea6255a864f807c0736e9632972403f499b2559339a9389c33665661c9e13
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'none'
content-encoding
gzip
status
200
last-modified
Tue, 22 Oct 2019 08:27:14 GMT
server
ECD (fcn/4094)
x-frame-options
SAMEORIGIN
date
Tue, 22 Oct 2019 08:34:41 GMT
vary
Accept-Encoding
x-cache
HIT
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
16649
buttonCenterImgUp.png
cdns2.gigya.com/gs/i/shareBar/button/
174 B
542 B
Image
General
Full URL
https://cdns2.gigya.com/gs/i/shareBar/button/buttonCenterImgUp.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.36 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-36.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
de34e56163cf7b887c17a511f4fcff7848ed39e769d40f621dfd5422c92471ba

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Version
1
Date
Tue, 22 Oct 2019 08:34:42 GMT
Content-Type
image/png
Last-Modified
Tue, 23 Jul 2019 09:58:05 GMT
P3P
CP="IDC COR PSA DEV ADM OUR IND ONL"
X-LegacyProxy
true
Cache-Control
max-age=86400
X-Server
us1d-web506
Connection
keep-alive
Accept-Ranges
bytes
X-Robots-Tag
none
X-Gigya-HA-cfg-ver
5
Content-Length
174
facebook.png
cdn.images.express.co.uk/img/static/share/
704 B
1 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/static/share/facebook.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eecc9f4abadf636ac0d14d4dd07020b35e2e8686068df77f867ad7e6da2556da

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 04 Sep 2019 00:55:47 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
4174736
x-amz-meta-cb-modifiedtime
Thu, 04 Oct 2018 11:30:24 GMT
x-cache
Hit from cloudfront
status
200
content-length
704
last-modified
Mon, 17 Jun 2019 14:28:54 GMT
server
AmazonS3
etag
"6eb10077e143582485db19c54d2eb793"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
R9n-4g275WKO4wADoHoGYqCtvwrlsfyg5rww6_IuaAhJRiRD8CImkQ==
twitter.png
cdn.images.express.co.uk/img/static/share/
682 B
1 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/static/share/twitter.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9a5f751768fc13fc0def36ae104772a86cc4af4d031ec70951819f89cbed13f6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:51 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
8769831
x-amz-meta-cb-modifiedtime
Thu, 04 Oct 2018 11:30:24 GMT
x-cache
Hit from cloudfront
status
200
content-length
682
last-modified
Mon, 17 Jun 2019 14:28:56 GMT
server
AmazonS3
etag
"ef8d972b5edd8a9bb585fb0b1b964516"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
-EtBbOg3gDsej_fZax7PzNKv0TbiTgoTqzlNwie5DjzSixVer-7tnA==
linkedin.png
cdn.images.express.co.uk/img/static/share/
274 B
775 B
Image
General
Full URL
https://cdn.images.express.co.uk/img/static/share/linkedin.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
874ce89fe959deb46939037d3f5c17fecddada9e22a6027bfecd7d46983ed292

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:51 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
8769831
x-amz-meta-cb-modifiedtime
Thu, 04 Oct 2018 11:16:00 GMT
x-cache
Hit from cloudfront
status
200
content-length
274
last-modified
Mon, 17 Jun 2019 14:28:55 GMT
server
AmazonS3
etag
"50a28e1db7e78e3f67bb2fdcaed4f8e1"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
7YkwPT7JTLYV4nHvovRIn20_sxT287JPvPPIjYKZQPdqdheB_nK-Uw==
gplus.png
cdn.images.express.co.uk/img/static/share/
391 B
891 B
Image
General
Full URL
https://cdn.images.express.co.uk/img/static/share/gplus.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
50d7cea7f74df30e660306c5e40a9e390c5c471488ade8940a20efc43794d553

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:51 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
8769832
x-amz-meta-cb-modifiedtime
Thu, 04 Oct 2018 11:30:24 GMT
x-cache
Hit from cloudfront
status
200
content-length
391
last-modified
Mon, 17 Jun 2019 14:28:55 GMT
server
AmazonS3
etag
"f7a1e4cc92551681f43275177696816a"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
hx8LnFzKmNFPzlER0DHI4JR1Bj45fATX46Q9HIsew3r1PCDHna0NmQ==
pinterest.png
cdn.images.express.co.uk/img/static/share/
442 B
944 B
Image
General
Full URL
https://cdn.images.express.co.uk/img/static/share/pinterest.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
daf4b32a87ae8820092eb9367d3360b045f0379737cd8585ebb97f48177d51fa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:51 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
8769832
x-amz-meta-cb-modifiedtime
Thu, 04 Oct 2018 11:16:00 GMT
x-cache
Hit from cloudfront
status
200
content-length
442
last-modified
Mon, 17 Jun 2019 14:28:55 GMT
server
AmazonS3
etag
"295eb4b09615d837b612c9f13317b673"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
tJEY7BiGJuV8KbiE4jl5QtKZ2Hdh6uknzKLFLZkiACS9UXbXF3WRgQ==
email.png
cdn.images.express.co.uk/img/static/share/
302 B
802 B
Image
General
Full URL
https://cdn.images.express.co.uk/img/static/share/email.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
073899583d7d08709cacbbe3308293db7ebbfc59fc5d9d2a79620cad9ca24d59

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 12 Jul 2019 20:30:51 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
8769832
x-amz-meta-cb-modifiedtime
Thu, 04 Oct 2018 11:30:24 GMT
x-cache
Hit from cloudfront
status
200
content-length
302
last-modified
Mon, 17 Jun 2019 14:28:54 GMT
server
AmazonS3
etag
"99f4cc5cf8a550013f4795fd8e471cec"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
1SsCqiWT4wUS5pUq4CtukVXa_wIvyC8WqoR2AN9_-g0agL07k7xRng==
comment.png
cdn.images.express.co.uk/img/static/share/
221 B
722 B
Image
General
Full URL
https://cdn.images.express.co.uk/img/static/share/comment.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8f51414c30b3370577599ded959cf31abe64c2245101f155d94157059420138e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 04 Sep 2019 00:55:26 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
4174757
x-amz-meta-cb-modifiedtime
Thu, 04 Oct 2018 11:30:24 GMT
x-cache
Hit from cloudfront
status
200
content-length
221
last-modified
Mon, 17 Jun 2019 14:28:54 GMT
server
AmazonS3
etag
"f6e3f2ff31a6af34f0e98b72ec51d968"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
GwM8bx5lMUtrJi_npCmCH__rDovRtWVyGrenDPVPEt-DKDNBKVEWtg==
icomoon.ttf
brightcove.northernandshell.co.uk/fonts/dx/
5 KB
5 KB
Font
General
Full URL
https://brightcove.northernandshell.co.uk/fonts/dx/icomoon.ttf?otg4ti32332
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.95.51 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-51.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
02c851ded2dc8888229b1dd5ecb987d3596f6749985280095bbb598c2bc722ae

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
null
via
1.1 ea71ce4ac4724c3ed76f4816ddddaa6c.cloudfront.net (CloudFront)
etag
"73fd1d03c16d94e1403c58fb74eeca77"
age
49667
x-cache
Hit from cloudfront
status
200
content-length
5160
last-modified
Tue, 30 May 2017 13:51:22 GMT
server
AmazonS3
date
Mon, 21 Oct 2019 18:46:55 GMT
access-control-allow-methods
GET
content-type
application/x-font-ttf
access-control-allow-origin
*
x-amz-cf-pop
FRA2
accept-ranges
bytes
x-amz-cf-id
AJ3CVJoY7c4nL0OJskrkNx59T-Fj1aTn60vx-WTAiLJWmg0RPT8LgA==
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&time=1571733282133&event=play_request&video=5798750504001&video_name=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&video_duration=64&seq=4_-1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
gigya.services.socialize.plugins.shareCounts.min.js
cdns3.gigya.com/js/
4 KB
2 KB
Script
General
Full URL
https://cdns3.gigya.com/js/gigya.services.socialize.plugins.shareCounts.min.js?version=latest
Requested by
Host: cdns.gigya.com
URL: https://cdns.gigya.com/JS/gigya.js?apiKey=3_BBXBRC0QUUloJ0Hujw4HOY17aLrL0Uy8FDx59O4-PrYbWWtrnCBKphB69PH9tXSb
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.36 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-36.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
284b4de0e96bd0ca2dc776d8380a81598b650e85d035c0c3b066db657279e1e4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
Content-Encoding
gzip
Content-Type
text/javascript; charset=utf-8
X-Soa
true, Gator
Vary
Accept-Encoding
P3P
CP="IDC COR PSA DEV ADM OUR IND ONL"
Access-Control-Allow-Origin
*
X-CallID
7e875714c5d1458ca84cede58eb92f4d
Cache-Control
private, max-age=900
X-Server
us1d-nomad-g1
Connection
keep-alive
X-Robots-Tag
none
X-Gigya-HA-cfg-ver
5
Content-Length
1906
Expires
Tue, 22 Oct 2019 08:49:42 GMT
vendor-bundle-bd1b7ba.js
static-cdn.spot.im/production/vendor/
250 KB
80 KB
Script
General
Full URL
https://static-cdn.spot.im/production/vendor/vendor-bundle-bd1b7ba.js
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.56 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-56.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
0a776ab14b51e0c0fa5833e283d9e8fa26343b2ae720fa90b65e69867dbe6c7e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
CESlraxPfPbGgAUkrUHOJrCB0V69yM2z
content-encoding
gzip
last-modified
Wed, 16 Oct 2019 13:05:56 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
date
Tue, 22 Oct 2019 08:34:42 GMT
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31622400
server-timing
cdn-cache; desc=HIT, edge; dur=1
access-control-allow-origin
*
content-length
81854
x-amz-cf-id
QJKWWPt1_xaDDc5oCkkE2Sz3GR75qVO0S-IJU4k74Codq_1zJn-ANg==
expires
Thu, 22 Oct 2020 08:34:42 GMT
adsct
t.co/i/
43 B
448 B
Image
General
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=l4f18&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
115
pragma
no-cache
last-modified
Tue, 22 Oct 2019 08:34:42 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
c21afa76fe33b86fe13752b9f66a9417
x-transaction
00cd8b13006c3291
expires
Tue, 31 Mar 1981 05:00:00 GMT
Text-scam-warning-Person-using-mobile-phone-and-debit-card-2116820.webp
cdn.images.express.co.uk/img/dynamic/23/590x/secondary/
0
0
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/590x/secondary/Text-scam-warning-Person-using-mobile-phone-and-debit-card-2116820.webp?r=1571724957499
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
access-control-allow-methods
HEAD, GET, POST
EN_vendors.json
cdn.images.express.co.uk/vendorlist/19.4.4/dx/ Frame 8241
2 KB
3 KB
XHR
General
Full URL
https://cdn.images.express.co.uk/vendorlist/19.4.4/dx/EN_vendors.json
Requested by
Host: cdn.images.express.co.uk
URL: https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ae7007781238285bd305071452666ffb2b9456d039d43bbacb1228a28469b4dc

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Fri, 12 Jul 2019 20:30:56 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
1166273
x-amz-meta-cb-modifiedtime
Fri, 19 Apr 2019 14:34:22 GMT
x-cache
Hit from cloudfront
status
200
content-length
2273
last-modified
Fri, 19 Apr 2019 14:35:30 GMT
server
AmazonS3
etag
"9705cb852eea48bc02d549fd20282ef0"
access-control-allow-methods
HEAD, GET, POST
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
QLiT-geuzPArWQd19XJ5ZAe4WPYOYCvwclA6XQEruDtzQ7hSlMsnyQ==
/
www.google.com/pagead/1p-user-list/1068671835/
42 B
111 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/1068671835/?random=1571733282077&cv=9&fst=1571731200000&num=1&label=u9gYCOmHtQYQ28bK_QM&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&tiba=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&fmt=3&is_vtc=1&random=196843435&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:42 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1068671835/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/1068671835/?random=1571733282077&cv=9&fst=1571731200000&num=1&label=u9gYCOmHtQYQ28bK_QM&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&tiba=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&fmt=3&is_vtc=1&random=196843435&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:42 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Text-scam-warning-Hacker-in-pictures-2116821.webp
cdn.images.express.co.uk/img/dynamic/23/590x/secondary/
0
0
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/590x/secondary/Text-scam-warning-Hacker-in-pictures-2116821.webp?r=1571724957554
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
access-control-allow-methods
HEAD, GET, POST
ga12h_23.json
cdn.images.express.co.uk/api/articles/recommended/
2 KB
2 KB
XHR
General
Full URL
https://cdn.images.express.co.uk/api/articles/recommended/ga12h_23.json
Requested by
Host: cdn.images.express.co.uk
URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/vendor-header20190523.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ab5122ab360a9afdc2695d4ecfdb5568aaa71fc0ca27c70c4f936307e1c89fdb

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 22 Oct 2019 02:33:28 GMT
via
1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront)
age
79
x-cache
Hit from cloudfront
status
200
content-length
1657
last-modified
Tue, 22 Oct 2019 02:04:42 GMT
server
AmazonS3
etag
"b11f353b022e965d12c77e0747f84a15"
access-control-allow-methods
HEAD, GET, POST
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
_JoLt4jKrFdQpGbzbySS267Nkcw1SXcbDHapkHzJMWSQZz6SS6gUpw==
init.js
cdn.my.northernandshell.co.uk/v0.0.1/
7 KB
7 KB
Script
General
Full URL
https://cdn.my.northernandshell.co.uk/v0.0.1/init.js
Requested by
Host: cdn.images.express.co.uk
URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app20191017.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.78.80 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-225-78-80.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0fc2159485ac7d7159330dd52c143f4569ac349507e8ada36e298d09c47a8f16

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 01:24:36 GMT
Via
1.1 90cf045072373c2c671297de3161846f.cloudfront.net (CloudFront)
Last-Modified
Fri, 04 Jan 2019 17:31:13 GMT
Server
AmazonS3
Age
25807
ETag
"3385e24c13a2d6db45a423eae3fbd7ba"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Connection
keep-alive
X-Amz-Cf-Pop
FRA2-C2
Accept-Ranges
bytes
Content-Length
6691
X-Amz-Cf-Id
HB3oslGkMazrVTCO8TXlVnppe6zVYb8dZlU0tv4Pj2S5lkvVlpEHDQ==
collect
www.google-analytics.com/
35 B
99 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=2100588899&t=event&_s=2&dl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ul=en-us&de=UTF-8&dt=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Comments&ea=On&el=Yes&_u=aGDACEAjB~&jid=&gjid=&cid=7843761.1571733282&tid=UA-545303-1&_gid=1331413262.1571733282&cd9=0&cd2=Personal%20Finance&cd12=Today&cd13=Jess%20Sheldon&cd14=500-600&z=937085654
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 09 Oct 2019 13:15:43 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1106339
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
express_logo.png
cdn.images.express.co.uk/img/page/
5 KB
5 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/page/express_logo.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ae3167c489b881c581eef1dd54aca4dd6d2c55ba305e39cfc3e8b71c05930998

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 27 Sep 2019 06:06:52 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
2168871
x-amz-meta-cb-modifiedtime
Fri, 12 Oct 2018 12:01:15 GMT
x-cache
Hit from cloudfront
status
200
content-length
4865
last-modified
Fri, 12 Oct 2018 12:11:35 GMT
server
AmazonS3
etag
"9995e580cdfe4d850cc53d26f27f3b83"
access-control-allow-methods
HEAD, GET, POST
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=32592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
ZImySxR87Hi6p_NqxWYjsXp3VieUVmZjt8iuhC2iAKkT5ir1le_xBQ==
Api.aspx
cdns.eu1.gigya.com/gs/webSdk/ Frame D052
0
0
Document
General
Full URL
https://cdns.eu1.gigya.com/gs/webSdk/Api.aspx?apiKey=3_BBXBRC0QUUloJ0Hujw4HOY17aLrL0Uy8FDx59O4-PrYbWWtrnCBKphB69PH9tXSb&version=latest
Requested by
Host: cdns.gigya.com
URL: https://cdns.gigya.com/JS/gigya.js?apiKey=3_BBXBRC0QUUloJ0Hujw4HOY17aLrL0Uy8FDx59O4-PrYbWWtrnCBKphB69PH9tXSb
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.36 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-36.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
cdns.eu1.gigya.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Content-Length
30230
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
P3P
CP="IDC COR PSA DEV ADM OUR IND ONL"
X-Soa
true, Gator
X-Server
us1d-nomad-g1
X-CallID
57624abe71ba4424af1b60c5917ef3af
X-Gigya-HA-cfg-ver
5
X-Robots-Tag
none
Cache-Control
private, max-age=86400
Date
Tue, 22 Oct 2019 08:34:42 GMT
Connection
keep-alive
utag.101.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.101.js?utv=ut4.39.201801171132
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F73) /
Resource Hash
5fb3612eff43b581b97b4ca8d65be1e7897ff0b214b74c74398c20a757c85ab7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:27 GMT
content-encoding
gzip
last-modified
Thu, 15 Mar 2018 14:59:06 GMT
server
ECAcc (frc/8F73)
etag
"3533156222"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
920
expires
Wed, 06 Nov 2019 08:34:27 GMT
utag.17.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.17.js?utv=ut4.39.201601281048
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FC3) /
Resource Hash
e5f5d2cdbc00ae1469e2cdb4d7bf88f206267ced9e0e047cffa716e1561a1a33

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:39 GMT
content-encoding
gzip
last-modified
Thu, 15 Mar 2018 14:59:05 GMT
server
ECAcc (frc/8FC3)
etag
"314029662"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1185
expires
Wed, 06 Nov 2019 08:34:39 GMT
utag.86.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.86.js?utv=ut4.39.201611231000
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F32) /
Resource Hash
39a2c2c07937d3b55bb855ed20afe3d6c577a7e69ad3b7c4f61058b8fed7eed6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
last-modified
Thu, 15 Mar 2018 14:59:06 GMT
server
ECAcc (frc/8F32)
etag
"2876518677"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
912
expires
Wed, 06 Nov 2019 08:34:42 GMT
utag.85.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
4 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.85.js?utv=ut4.39.201701180944
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F16) /
Resource Hash
9c78423da5100b27502ec4efd03740d4e3c121202f9dbcefff4c61070c18c04f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:44 GMT
content-encoding
gzip
last-modified
Thu, 15 Mar 2018 14:59:05 GMT
server
ECAcc (frc/8F16)
etag
"2010613445"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1372
expires
Wed, 06 Nov 2019 08:34:44 GMT
utag.96.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
27 KB
8 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.96.js?utv=ut4.39.201910031508
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F92) /
Resource Hash
f21b7aa0d3d0b1295ac9d76d728e3975358e480e272f18c24388ca73ff719faa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
last-modified
Thu, 03 Oct 2019 15:08:55 GMT
server
ECAcc (frc/8F92)
etag
"2753927617+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
7892
expires
Wed, 06 Nov 2019 08:34:41 GMT
utag.98.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
3 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.98.js?utv=ut4.39.201704180849
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FA7) /
Resource Hash
8e91957b3c50d1374f1db1c5a24172c85ce002c3cf1a47a9525cc99554d79d9b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
last-modified
Thu, 15 Mar 2018 14:59:06 GMT
server
ECAcc (frc/8FA7)
etag
"716448211"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1234
expires
Wed, 06 Nov 2019 08:34:42 GMT
utag.99.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
2 KB
926 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.99.js?utv=ut4.39.201706221557
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F99) /
Resource Hash
072013f8289424eaea2a286a164cceeeb1c15038901cfd2c43eaeedbd4439f38

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:41 GMT
content-encoding
gzip
last-modified
Thu, 15 Mar 2018 14:59:05 GMT
server
ECAcc (frc/8F99)
etag
"387424639"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
878
expires
Wed, 06 Nov 2019 08:34:41 GMT
utag.107.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.107.js?utv=ut4.39.201803151720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8E99) /
Resource Hash
3daa5bb872615c3ba820d165f18734b915db9bc86e826019a9bc0bdf809376db

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
last-modified
Thu, 15 Mar 2018 17:20:20 GMT
server
ECAcc (frc/8E99)
etag
"1418848955"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
981
expires
Wed, 06 Nov 2019 08:34:42 GMT
utag.109.js
tags.tiqcdn.com/utag/northern-and-shell/dx/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.109.js?utv=ut4.39.201808201513
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FC4) /
Resource Hash
6d5ffb7a6865f92384727ce1ebf6f65e928617a718ed26e1cba400001a7ff952

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
content-encoding
gzip
last-modified
Wed, 18 Jul 2018 15:10:22 GMT
server
ECAcc (frc/8FC4)
etag
"4188075810"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1016
expires
Wed, 06 Nov 2019 08:34:43 GMT
adsct
analytics.twitter.com/i/
31 B
634 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=l4f18&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=631138519
content-length
57
x-xss-protection
0
x-response-time
119
pragma
no-cache
last-modified
Tue, 22 Oct 2019 08:34:42 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
5774f023c37abfc280f880d9c7a265e1
x-transaction
00048c2800124515
expires
Tue, 31 Mar 1981 05:00:00 GMT
display
display.apester.com/interactions/5da98fcd5b2f780bf6820185/
4 KB
2 KB
XHR
General
Full URL
https://display.apester.com/interactions/5da98fcd5b2f780bf6820185/display?platform=desktop&renderer=true
Requested by
Host: static.apester.com
URL: https://static.apester.com/js/sdk/v2.0/apester-javascript-sdk.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/ Express
Resource Hash
7f5b525210c05e9f2d1e4671c09ce7020d9789ce4f63f259c491ca3a2e9f7de5

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
age
0
x-powered-by
Express
x-cache
MISS
status
200
content-length
1819
x-served-by
cache-fra19126-FRA
access-control-allow-origin
*
x-timer
S1571733282.367877,VS0,VE157
etag
W/"fde-+6yoStks1Zl5hw13ZsYWSMEekSo"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
via
1.1 google, 1.1 varnish
x-cloud-trace-context
5cb689c84dbb7d2b32fd499876773c64/1116864823752549185;o=0
cache-control
public, max-age=1800
accept-ranges
bytes
x-cache-hits
0
pubvendors.json
www.express.co.uk/ Frame 8241
3 KB
1 KB
XHR
General
Full URL
https://www.express.co.uk/pubvendors.json
Requested by
Host: cdn.images.express.co.uk
URL: https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:a000:e:515c:9940:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
3a819ebf9c72c6bc403110067ad8b8cac0deb61d84c0bd4b48aeba78b7410791

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 22 Oct 2019 08:33:13 GMT
content-encoding
gzip
age
82
x-cache
Hit from cloudfront
status
200
x-ua-compatible
IE=edge,chrome=1
access-control-allow-origin
*
server
nginx
vary
Accept-Encoding,User-Agent
access-control-allow-methods
GET, POST, PUT, DELETE, PATCH, OPTIONS
content-type
application/json; charset=UTF-8
via
1.1 91ba7c34719cd9c69e0357c149b94b90.cloudfront.net (CloudFront)
cache-control
public,max-age=180
x-amz-cf-pop
FRA2-C2
access-control-allow-headers
X-Requested-With, Content-Type, Authorization
x-amz-cf-id
b73bavL4FRoC_p2YLY5r0WPmDYhdKYhxubVy1gf6CDyfNU0rAb6mZg==
expires
Tue, 22 Oct 2019 08:36:13 GMT
1192448_1.jpg
cdn.images.express.co.uk/img/dynamic/23/285x190/
14 KB
14 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/285x190/1192448_1.jpg
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c7cab0557ec1903f963ce5d115c0513ae5dda3669ddfd93b488165e2739fe939

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 09:08:38 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
263
x-cache
Hit from cloudfront
status
200
content-length
14068
last-modified
Mon, 21 Oct 2019 08:59:17 GMT
server
AmazonS3
etag
"e788ae2c2f7ff012f579b16ff658ae48"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
DhYs7SO-fHlbkojL605Mw7Tk5-bTlRYqdTNGQC9puyLsdncuzMYiaA==
1192439_1.jpg
cdn.images.express.co.uk/img/dynamic/23/285x190/
11 KB
11 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/285x190/1192439_1.jpg
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
67a7b6680bd437cd630acce9006108088599dae744b51d50fa2af0dcb9f2b43b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:30:20 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
263
x-cache
Hit from cloudfront
status
200
content-length
10927
last-modified
Fri, 18 Oct 2019 10:11:54 GMT
server
AmazonS3
etag
"45e469b08ed80548ddf9b868a360301d"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
WqyPYre_uu5DKlQVpNCSGc29LSnvRubRpd4U7t0lJ-wIxu8DdS-7dA==
1193415_1.jpg
cdn.images.express.co.uk/img/dynamic/23/285x190/
13 KB
13 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/285x190/1193415_1.jpg
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f2aa9698cf19b56a1f31e7285c7628cad14a072790e373985e6195d52ca2e2b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 08:10:39 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
263
x-cache
Hit from cloudfront
status
200
content-length
12806
last-modified
Mon, 21 Oct 2019 07:26:48 GMT
server
AmazonS3
etag
"f0494ab58eb4892db8ac0445a0b4f874"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
CpQuqFVb79sBKUIBD8PvQMaOxO7_mKLVXngs8YcSQ2EMHjbX_91GCQ==
1192025_1.jpg
cdn.images.express.co.uk/img/dynamic/23/285x190/
12 KB
13 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/285x190/1192025_1.jpg
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
49a9a85fdc042175646d84e22fc5e7b203b81bb42a9637c35d535ee31bcc3d4f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 20 Oct 2019 21:26:59 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
263
x-cache
Hit from cloudfront
status
200
content-length
12445
last-modified
Thu, 17 Oct 2019 14:10:15 GMT
server
AmazonS3
etag
"e62454e5e763dc0f7fdc5d2f862e4818"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
V1iPSixyS9KMNHKwrlT3Am8ejktmzoIQLN9z6POrJicc5AlOq-zZMA==
1192597_1.jpg
cdn.images.express.co.uk/img/dynamic/23/285x190/
17 KB
18 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/285x190/1192597_1.jpg
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
da693f489b6d2662014f5d21377dbe57855e74f3e686bc23c9635096f6632a5d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 20 Oct 2019 21:27:01 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
age
263
x-cache
Hit from cloudfront
status
200
content-length
17686
last-modified
Fri, 18 Oct 2019 14:37:34 GMT
server
AmazonS3
etag
"ba2329c82267fdfdaaa4eb139a14c0ad"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
m1qomz0h_O82zRtusyU4C4psBKnS9zkN5FwK2ZTvxQJ-dijXpxAhtw==
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: cdn.images.express.co.uk
URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/vendor-header20190523.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?display=swap&family=Open+Sans+Condensed:300,700%7COpen+Sans:300,400,600
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 14:51:43 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:44 GMT
server
sffe
age
927779
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9180
x-xss-protection
0
expires
Sat, 10 Oct 2020 14:51:43 GMT
beacon.min.js
beacon.s-onetag.com/
18 KB
6 KB
Script
General
Full URL
https://beacon.s-onetag.com/beacon.min.js
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:9e00:5:9a4c:9b00:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
662fa6bcdf71d8f92e29010d3e2e270e0071e5d19b1d14ce205654a78aa0a7a9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
dQ2IPgbwW_sArXQW0CBb3eN5W57SqoQ0
content-encoding
gzip
last-modified
Thu, 04 Apr 2019 09:35:05 GMT
server
AmazonS3
age
1727
date
Tue, 22 Oct 2019 08:05:59 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=3600
x-amz-cf-pop
FRA2
x-amz-cf-id
w8YyeQM-bOQHLlUbalILRBKTKraZM3eur13Gt7TfXAWc5T-wvQQdng==
via
1.1 8602503af95a7bac32a020063ca51410.cloudfront.net (CloudFront)
fpi.js
ap.lijit.com/www/delivery/ Frame 158E
5 KB
3 KB
Script
General
Full URL
https://ap.lijit.com/www/delivery/fpi.js?z=598981&width=320&height=50&iv=sf
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/tag.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
4c2b8d176a8b50e769ee8b8b01b8af3cbe66264c8de47bbf9aab4c285a1b7957

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:42 GMT
Content-Encoding
gzip
Server
nginx
ETag
W/"5d83bac3-1534"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Transfer-Encoding
chunked
X-Sovrn-Pod
ap3ams1
Expires
Thu, 01 Jan 1970 00:00:01 GMT
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=express.co.uk&p=%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&u=kczELBZB4Amk2H9r&d=express.co.uk&g=33715&g0=No%20Section&g1=No%20Author&n=1&f=00001&c=0&x=0&m=0&y=6759&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=1865&t=C-eksfDSSKH4BcQY-8CnIxsFDscYtG&V=116&i=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.c&tz=-120&sn=1&sv=B7NeDNBfky4iB0YOZ0tHo-iw4yCY&sd=1&im=067b9fff&_
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.231.246 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-231-246.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Tue, 22 Oct 2019 08:34:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40express.co.uk&g=33715&p=5798750504001&i=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&u=4CGeMBwG_CvHTlA7&t=CxqehWCHvXj-mpEeHJYXpgBL8G_u&x=0&y=0&V=116&VS=BCN&n=1&b=1867&r=&_vd=-1&_vi=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.c&_vp=express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&_vh=express.co.uk&_pu=kczELBZB4Amk2H9r&_pt=C-eksfDSSKH4BcQY-8CnIxsFDscYtG&_pr=&_vdd=express.co.uk&_vt=ct&_vs=s1&_vcs=0&_vbr=-1&_vvs=0.037&_vpt=0&_vtn=https%3A%2F%2Fhttpsak-a.akamaihd.net%2F2540076170001%2F2540076170001_5798751587001_5798750504001-th.jpg%3FpubId%3D2540076170001%26videoId%3D5798750504001&_vaup=unkn&_vce=0&c=0.01&W=0&R=0&I=1&E=0&j=75&tz=-120&_
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.231.246 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-231-246.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Tue, 22 Oct 2019 08:34:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
main.003c417.css
static-cdn.spot.im/production/conversation/
780 KB
55 KB
Stylesheet
General
Full URL
https://static-cdn.spot.im/production/conversation/main.003c417.css
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.56 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-56.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
a7372a5b2745ca7cb57080a23f81ce1a7e805d22aee90b1a351ebb444f5bce11

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
oaks7ldD9rbG_fSEwBBl9YoPKtnkSUx7
content-encoding
gzip
last-modified
Tue, 22 Oct 2019 07:58:23 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C2
date
Tue, 22 Oct 2019 08:34:42 GMT
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31622400
server-timing
cdn-cache; desc=HIT, edge; dur=1
access-control-allow-origin
*
content-length
55870
x-amz-cf-id
Lz0SPiYY7cuhqF_SOg2seu2FXH-noKLUU0T6haobZzgjl3Fj3XCH3Q==
expires
Thu, 22 Oct 2020 08:34:42 GMT
broadcast-fetcher-bundle-b3c9b893663205a06e63.js
static-cdn.spot.im/production/broadcast/
2 KB
1 KB
Script
General
Full URL
https://static-cdn.spot.im/production/broadcast/broadcast-fetcher-bundle-b3c9b893663205a06e63.js
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.56 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-56.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
bbeffb8ce60bcf715f0b0cf5ab6770dd1d50e65e7645e096fe540e12922b9a83

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
6N_CMwb3queqLOhtXbTfLVJNuOUyVRiM
content-encoding
gzip
last-modified
Tue, 10 Sep 2019 11:46:53 GMT
server
AmazonS3
x-amz-cf-pop
FRA50
date
Tue, 22 Oct 2019 08:34:42 GMT
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31622400
server-timing
cdn-cache; desc=HIT, edge; dur=1
access-control-allow-origin
*
content-length
1159
x-amz-cf-id
lKoYNIC__U1OaHO_YuaA3SjAKO0WT6oBtC-05WUN77wd_U9-a9VrKQ==
expires
Thu, 22 Oct 2020 08:34:42 GMT
conversation-bundle-8c6b9ff.js
static-cdn.spot.im/production/conversation/
2 MB
588 KB
Script
General
Full URL
https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.56 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-56.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
06641cfbd2d9cf7c077cc7fbed92509e4bca0b41e5c6a3b9e0ce1c10dea77cfa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
AZwG5rb_UqVbSWiSVdMkQN_ToLBwYk6S
content-encoding
gzip
last-modified
Tue, 22 Oct 2019 07:58:23 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C2
date
Tue, 22 Oct 2019 08:34:42 GMT
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31622400
server-timing
cdn-cache; desc=HIT, edge; dur=1
access-control-allow-origin
*
content-length
600672
x-amz-cf-id
1Y8JJyHWMapCr8goCQwE-YapsLS-mi9L6-HJZYMJ6hGHvBy_1gKCng==
expires
Thu, 22 Oct 2020 08:34:42 GMT
messages-count-bundle-79a867e5b6b1d29bb91e.js
static-cdn.spot.im/production/messages-count/
35 KB
9 KB
Script
General
Full URL
https://static-cdn.spot.im/production/messages-count/messages-count-bundle-79a867e5b6b1d29bb91e.js
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.56 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-56.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
b399426776ef743fe70063d64cbfb224e6d59a2427df3e46d2ff21ca1d4c772c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
IUx7bHWqmZORw6NEAy3PVa1QLwoJY57h
content-encoding
gzip
last-modified
Wed, 04 Sep 2019 11:00:56 GMT
server
AmazonS3
x-amz-cf-pop
FRA50
date
Tue, 22 Oct 2019 08:34:42 GMT
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31622400
server-timing
cdn-cache; desc=HIT, edge; dur=1
access-control-allow-origin
*
content-length
8842
x-amz-cf-id
gnjR2C8CkhBju95ldFrfyWa0CYKvi1HOjKwg0_Utk9MLjtdLwKQYrg==
expires
Thu, 22 Oct 2020 08:34:42 GMT
messages-count-bundle.css
static-cdn.spot.im/production/messages-count/
217 B
567 B
Stylesheet
General
Full URL
https://static-cdn.spot.im/production/messages-count/messages-count-bundle.css
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.56 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-56.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e99927b117a431d002d016853f9d56ccf53065686c483f8ce0429fa938490271

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
J7T1XjzyLq0zFxoR8NIY_NW9Y11VS.5o
last-modified
Wed, 04 Sep 2019 11:00:56 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
etag
"df2a0de014badf902f703d7e74117ea9"
content-type
text/css
status
200
cache-control
max-age=31622400
date
Tue, 22 Oct 2019 08:34:42 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1
accept-ranges
bytes
access-control-allow-origin
*
content-length
217
x-amz-cf-id
21VWBXJMATAIl1g0PYTXO1QKLDzs31KQo_w9EHLOomvhzZ-KICETCA==
expires
Thu, 22 Oct 2020 08:34:42 GMT
Text-scam-warning-Person-using-mobile-phone-and-debit-card-2116820.jpg
cdn.images.express.co.uk/img/dynamic/23/590x/secondary/
28 KB
29 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/590x/secondary/Text-scam-warning-Person-using-mobile-phone-and-debit-card-2116820.jpg?r=1571724957499
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3130db42a0dfbabc4f30e4b9f550e44ddb5f6c98bee3e75db2f6492199d4d921

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
status
200
content-length
28793
last-modified
Fri, 18 Oct 2019 10:12:00 GMT
server
AmazonS3
etag
"666a2944d42cb5892188b52b1dabd70d"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
VeNOxhYlOIQ6YLY7UiRF3w0b5F1llgqXPpJJqXq0R38rz8bYbuYF8Q==
Text-scam-warning-Hacker-in-pictures-2116821.jpg
cdn.images.express.co.uk/img/dynamic/23/590x/secondary/
18 KB
19 KB
Image
General
Full URL
https://cdn.images.express.co.uk/img/dynamic/23/590x/secondary/Text-scam-warning-Hacker-in-pictures-2116821.jpg?r=1571724957554
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:1800:1d:b722:f80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9f5edbb9a84f4a23ff17b6c8fd646ab7de1ad01df23adb85629a1eec3ba69641

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
status
200
content-length
18845
last-modified
Fri, 18 Oct 2019 10:12:01 GMT
server
AmazonS3
etag
"4116002ceb811a712f7429ec1e3601f5"
access-control-allow-methods
HEAD, GET, POST
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=300
accept-ranges
bytes
x-amz-cf-id
gF74RfCC960E8y9bNPzNXNaczkgDx7obtt4AbGpOgJwOR0BAeoEY1A==
px.js
p.cpx.to/p/11062/
1 KB
2 KB
Script
General
Full URL
https://p.cpx.to/p/11062/px.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.86.js?utv=ut4.39.201611231000
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.196.39 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-224-196-39.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
fbf57280833f63be3a67c650170d8ed7e26714816cb138516c9514b3743517f4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 17 Oct 2019 19:59:39 GMT
Content-Encoding
UTF-8
Connection
keep-alive
Last-Modified
Wed, 10 Oct 2018 10:48:56 GMT
Server
AmazonS3
Age
390904
ETag
"f928b5eedc26676d1d44b05e026025c0"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 96ab38d99b79d57e5c7e9b8a07c0fad3.cloudfront.net (CloudFront)
Cache-Control
max-age=2419200
X-Amz-Cf-Pop
FRA2-C1
Accept-Ranges
bytes
Content-Length
1498
X-Amz-Cf-Id
FA3CpoLRIMVRKz0dvhv1Z3_3F69B2seJ8159LQmtWhY0GDwyoKQrOQ==
preload.js
tag.imonomy.com/script/14567721676/
316 KB
80 KB
Script
General
Full URL
https://tag.imonomy.com/script/14567721676/preload.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.101.js?utv=ut4.39.201801171132
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ba928080ad9fe253e167252201523e5eb97c2a737b0c450c6941f5e2ed064f6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
cf-cache-status
HIT
cf-bgj
minify
server
cloudflare
age
624
etag
W/"aacf9d454d195656c91b21cd7dd9c053d5a7b6f1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=3600
cf-polished
origSize=323087
cf-ray
529a22371ef6cbcc-VIE
moatcontent.js
z.moatads.com/nandscontent759292113/
165 KB
54 KB
Script
General
Full URL
https://z.moatads.com/nandscontent759292113/moatcontent.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.17.js?utv=ut4.39.201601281048
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6a081ef7a0f9d9ad92b6044730ec86ac2e3c9bfe9853fa7bc2c36e0f85bcc942

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
Content-Encoding
gzip
Last-Modified
Tue, 01 Nov 2016 18:25:47 GMT
Server
AmazonS3
x-amz-request-id
833361755D250A6F
ETag
"2a7a49d4b6801003ac99ca358bbe7253"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=12586
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
54852
x-amz-id-2
KD8auOf/7f9tArsw+2aWkd1vQvgSELR2fUap+6tKCbMN9/WlaAsVc6qwpZF8Mn6kS1pDDzQPlWc=
/
d2q1qtsl33ql2r.cloudfront.net/
43 B
523 B
Image
General
Full URL
https://d2q1qtsl33ql2r.cloudfront.net/?a=5b3033e2f4d14cbeb159bce2147902d5
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.84.133 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-225-84-133.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Via
1.1 f0dda47e8f83bee88cb60d3d2e3fa5e5.cloudfront.net (CloudFront)
Last-Modified
Mon, 22 Apr 2013 19:31:32 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA2-C2
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
X-Cache
RefreshHit from cloudfront
Content-Type
image/gif
Cache-Control
no-cache
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
X-Amz-Cf-Id
uHZGiaK_c4guOPk0jOaYU138Dz6rIFIdE-EWK8OrNB3Wk8_cz1mc8Q==
tag.js
js.agkn.com/prod/v0/
3 KB
3 KB
Script
General
Full URL
https://js.agkn.com/prod/v0/tag.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.99.js?utv=ut4.39.201706221557
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:c00:15:efbc:e300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bd30ffd9618eaa423abb4c900f4af01cac18be85d75265ba08d87d5230bf85b8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 11 Jul 2019 15:47:45 GMT
via
1.1 1a483cde6df004748f3e5c80dc46df26.cloudfront.net (CloudFront)
last-modified
Thu, 11 Jul 2019 15:46:11 GMT
server
AmazonS3
age
35793
etag
"a5442c681a576408c25edbf365995343"
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
3167
x-amz-cf-id
9GVNWU3pUk9cKGgv9CPEsiBBZo65nv6EI6027kxKbe1EfR_W9unbLA==
chartbeat.js
static.chartbeat.com/js/
35 KB
14 KB
Script
General
Full URL
https://static.chartbeat.com/js/chartbeat.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.109.js?utv=ut4.39.201808201513
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6800:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
99fd27cd410417b5633d3fc37196751afc4b3f9ffa5853dedb73cfcb3e810d7c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:06:50 GMT
content-encoding
gzip
last-modified
Thu, 01 Aug 2019 01:56:46 GMT
server
nginx
age
1672
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=7200
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
qcsAEQqFbyzSDriu_fC5uE_fFQp-JwvMLw52Z_BkEjPsvojMD3H_qg==
via
1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
expires
Tue, 22 Oct 2019 10:06:50 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
116 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=northern-and-shell/dx/201910031508&cb=1571733282370
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8EA8) /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
last-modified
Thu, 14 Apr 2016 16:59:33 GMT
server
ECAcc (frc/8EA8)
etag
"2243872957"
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Tue, 22 Oct 2019 08:44:42 GMT
main.css
cdn.my.northernandshell.co.uk/v0.0.1/
267 KB
268 KB
Stylesheet
General
Full URL
https://cdn.my.northernandshell.co.uk/v0.0.1/main.css
Requested by
Host: cdn.my.northernandshell.co.uk
URL: https://cdn.my.northernandshell.co.uk/v0.0.1/init.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.78.80 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-225-78-80.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
635eb7149aea502ca1ef78530e72e2baa05e2cdcda7270e0b08f8bfd48eed6f4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 21 Oct 2019 20:45:34 GMT
Via
1.1 90cf045072373c2c671297de3161846f.cloudfront.net (CloudFront)
Last-Modified
Tue, 16 Apr 2019 14:48:06 GMT
Server
AmazonS3
Age
42549
ETag
"551d793f1a53da32df306d0b9826b2fc"
X-Cache
Hit from cloudfront
Content-Type
text/css
Connection
keep-alive
X-Amz-Cf-Pop
FRA2-C2
Accept-Ranges
bytes
Content-Length
273862
X-Amz-Cf-Id
DPoWBdjkWkppMXffmxZ1hsSwp7It_RtAx_Sd8ItjeHs7p3C_y7UwwA==
app.js
cdn.my.northernandshell.co.uk/v0.0.1/
219 KB
219 KB
Script
General
Full URL
https://cdn.my.northernandshell.co.uk/v0.0.1/app.js
Requested by
Host: cdn.my.northernandshell.co.uk
URL: https://cdn.my.northernandshell.co.uk/v0.0.1/init.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.78.80 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-225-78-80.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
51ecd90ee6904a0a5af8404484d755d173e758766b5c84f55e298f7e551a010b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 02:17:28 GMT
Via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
Last-Modified
Fri, 04 Jan 2019 17:31:13 GMT
Server
AmazonS3
Age
22635
ETag
"450b796e96595c5a7ffec507ae6396d7"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Connection
keep-alive
X-Amz-Cf-Pop
FRA2-C2
Accept-Ranges
bytes
Content-Length
223754
X-Amz-Cf-Id
b5wi2do6ExAE3puI2J2PyPDxbH8qr9LUbVeD5FWDbOZw3RqFsoUmrQ==
sync
ap.lijit.com/ Frame 158E
49 KB
16 KB
Script
General
Full URL
https://ap.lijit.com/sync
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/www/delivery/fpi.js?z=598981&width=320&height=50&iv=sf
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
4a270ec2745e615605f9b87bcf390e13a496560e6d846fd618d298c0782d1f88

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
Content-Encoding
gzip
Last-Modified
Thu, 19 Sep 2019 17:28:23 GMT
Server
nginx
ETag
W/"5d83bab7-c373"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=86400, must-revalidate
Transfer-Encoding
chunked
X-Sovrn-Pod
ap3ams1
Expires
Wed, 23 Oct 2019 08:34:42 GMT
get
odb.outbrain.com/utils/
37 KB
10 KB
Script
General
Full URL
https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&srcUrl=https%3A%2F%2Fwww.express.co.uk%2Fposts%2Frss%2F23%2Fyourmoney&settings=true&recs=true&widgetJSId=AR_21&key=NANOWDGT01&idx=0&version=103060&apv=false&sig=kUCKVhKu&format=html&rand=19739&pdobuid=-1&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&secured=true&va=true&cmpStat=1&ref=
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
923a1217f37bae2b930f236d26773da178f8d4559d6fd46c486c7abe3e5e4e4f
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=0; includeSubDomains;
content-encoding
gzip
traffic-path
NYDC1, JFK, FRA, Europe1
x-cache
MISS, MISS
p3p
policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status
200
x-cache-hits
0, 0
x-traceid
798fc07f4101d727caec2f84cc1b5a21
content-length
9545
x-served-by
cache-jfk8121-JFK, cache-fra19132-FRA
pragma
no-cache
x-timer
S1571733282.421880,VS0,VE139
date
Tue, 22 Oct 2019 08:34:42 GMT
vary
Accept-Encoding, User-Agent
content-type
text/x-json; charset=UTF-8
via
1.1 varnish, 1.1 varnish
cache-control
no-cache
backend-ip
104.156.90.21
accept-ranges
bytes, bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
count
api-2-0.spot.im/v1.0.0/conversation/
62 B
2 KB
Fetch
General
Full URL
https://api-2-0.spot.im/v1.0.0/conversation/count
Requested by
Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/messages-count/messages-count-bundle-79a867e5b6b1d29bb91e.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.112 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-112.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
63dccb64c2c75175607b583fe9d09e4834851c04d39f430ae2931577839580e1

Request headers

Sec-Fetch-Mode
cors
x-post-id
default
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json
Accept
application/json
x-spot-id
sp_9LMINbK9
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
x-access-token
null

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
status
200
x-envoy-upstream-service-time
63
x-access-token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6IiIsInVzZXJfaWQiOiJ1XzR4TVlBYWloREdhcSIsImRpc3BsYXlfbmFtZSI6Ikd1ZXN0Nzg5MzI2IiwidXNlcl9uYW1lIjoiR3Vlc3Q3ODkzMjYiLCJyZWdpc3RlcmVkIjpmYWxzZSwiaW1hZ2VfaWQiOiIvdXNlcnMvYXZhdGFycy9EZWZhdWx0Iiwicm9sZXMiOltdLCJzcG90X2lkIjoic3BfOUxNSU5iSzkiLCJsYXN0X2NoZWNrIjoxNTcxNzMzMjgyLCJ2ZXJzaW9uIjoyLCJ4LXNwb3RpbS10b2tlbiI6IjAxMTkxMDIyVjAyMUZ2IiwicGVybWlzc2lvbnMiOm51bGwsInNwb3RpbS1kZXZpY2UtdjIiOiJkX1h2VmpHSERjeW9XUjRnU2EyRERvIiwibmV0d29yayI6eyJuZXR3b3JrX2lkIjoibmV0X2V4cHJlc3MiLCJuZXR3b3JrX25hbWUiOiJFWFBSRVNTIiwibmV0d29ya19pbWFnZV9pZCI6IkV4cHJlc3NfR3JvdXAtMl90aXNyanYiLCJuZXR3b3JrX2NvbG9yIjoiI2JiMWEwMCJ9LCJzcG90X25hbWUiOiIiLCJkb21haW4iOiIiLCJyb2xlc19udW1iZXIiOjAsImV4cCI6MTU3MTgxOTY4Miwic3ViIjoidV80eE1ZQWFpaERHYXEifQ.te0v1qjkBpSxJMwT7iTurasy2pEFPga791TCE994fvI
content-length
62
x-spotim-token
01191022V021Fv
x-request-id
b51d38a4-4071-418a-b484-4fd42c872944
server
istio-envoy
x-spotim-networkid
net_express
x-spotim-device-v2
d_XvVjGHDcyoWR4gSa2DDo
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-expose-headers
x-spotim-token, x-spotim-networkid, x-access-token, x-spotim-device-v2
access-control-allow-credentials
true
access-control-allow-headers
content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-spotim-page-view-id,x-spotim-device-v2
5798750504001
edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/
3 KB
4 KB
XHR
General
Full URL
https://edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/5798750504001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.203.45 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-203-45.fra50.r.cloudfront.net
Software
/
Resource Hash
108e5e46ad99ff788eec19ead675ea6d1842dd2c274db6ef7ed995e818459efe
Security Headers
Name Value
Strict-Transport-Security max-age=77766000; includeSubDomains

Request headers

Accept
application/json;pk=BCpkADawqM3Dmzg7zRlKEmzcSAqR4vFC4MpyD0075pbeW0d779IrRf-anBPDszKFRm29RtjAGKoEpMIaZ77MCa9sg3FEJvjlzLS_lu0eXl3P-dUfQsoJ3LvMbiGkYL0cJNwEvNhrJy8Fh7TG
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Date
Tue, 22 Oct 2019 08:34:41 GMT
Via
1.1 f794b89ac7b5d3a7a6b25a236579db6c.cloudfront.net (CloudFront)
BCOV-REQUEST-ID
b0cbef17-c0ab-4f60-927e-a78d9984a26e
Age
1
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
3089
BCOV-instance
i-04c795b226d05a399, ac55aaf, 2019-10-22 08:34:41.740Z
Strict-Transport-Security
max-age=77766000; includeSubDomains
X-Originating-URL
https://edge-elb.api.brightcove.com/playback/v1/accounts/2540076170001/videos/5798750504001
access-control-allow-origin
*
access-control-expose-headers
x-cache,via,bcov-debug-cache-stats,bcov-instance,x-amz-cf-id
Cache-Control
max-age=158
X-Amz-Cf-Pop
FRA50
Content-Type
application/json; charset=UTF-8
X-Amz-Cf-Id
xI0Ive5gzmuKtDCLmczs0afDSC_2BwogTnDfGToomZ2bKD77a8QQNw==
6090283641001
edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/
3 KB
4 KB
XHR
General
Full URL
https://edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6090283641001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.203.45 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-203-45.fra50.r.cloudfront.net
Software
/
Resource Hash
0a4abba6d7b7d8f7396f2aa74afd583f6670a16b9be6b62fcfee52d69afaafa9
Security Headers
Name Value
Strict-Transport-Security max-age=77766000; includeSubDomains

Request headers

Accept
application/json;pk=BCpkADawqM3Dmzg7zRlKEmzcSAqR4vFC4MpyD0075pbeW0d779IrRf-anBPDszKFRm29RtjAGKoEpMIaZ77MCa9sg3FEJvjlzLS_lu0eXl3P-dUfQsoJ3LvMbiGkYL0cJNwEvNhrJy8Fh7TG
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

BCOV-instance
i-0b955423e92b8c698, ac55aaf, 2019-10-22 08:34:42.677Z
Via
1.1 c76a5a41a8483a9e5dcccdfeb87a16ca.cloudfront.net (CloudFront)
BCOV-REQUEST-ID
2a601767-986c-4ccf-822f-7d0a6035db1d
X-Amz-Cf-Pop
FRA50
Date
Tue, 22 Oct 2019 08:34:42 GMT
Strict-Transport-Security
max-age=77766000; includeSubDomains
X-Cache
Miss from cloudfront
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
X-Originating-URL
https://edge-elb.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6090283641001
access-control-expose-headers
x-cache,via,bcov-debug-cache-stats,bcov-instance,x-amz-cf-id
Cache-Control
max-age=352
Connection
keep-alive
Content-Length
2818
X-Amz-Cf-Id
Zi5Ld6AALAiIRnhflge8W3p895r1mnZq8O6T8WRAODSLluVsICAFOQ==
6085893262001
edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/
3 KB
4 KB
XHR
General
Full URL
https://edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6085893262001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.203.45 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-203-45.fra50.r.cloudfront.net
Software
/
Resource Hash
9910d8e4621441bc75f74314bd41f6e03c2e93971c1431f988d3656b0c48be6c
Security Headers
Name Value
Strict-Transport-Security max-age=77766000; includeSubDomains

Request headers

Accept
application/json;pk=BCpkADawqM3Dmzg7zRlKEmzcSAqR4vFC4MpyD0075pbeW0d779IrRf-anBPDszKFRm29RtjAGKoEpMIaZ77MCa9sg3FEJvjlzLS_lu0eXl3P-dUfQsoJ3LvMbiGkYL0cJNwEvNhrJy8Fh7TG
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

BCOV-instance
i-0d835bef5f23f43fe, ac55aaf, 2019-10-22 08:34:42.744Z
Via
1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
BCOV-REQUEST-ID
f440852f-f519-4f8c-a83d-696d21db6823
X-Amz-Cf-Pop
FRA50
Date
Tue, 22 Oct 2019 08:34:42 GMT
Strict-Transport-Security
max-age=77766000; includeSubDomains
X-Cache
Miss from cloudfront
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
X-Originating-URL
https://edge-elb.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6085893262001
access-control-expose-headers
x-cache,via,bcov-debug-cache-stats,bcov-instance,x-amz-cf-id
Cache-Control
max-age=75
Transfer-Encoding
chunked
Connection
keep-alive
X-Amz-Cf-Id
mz_LyTyToL_QLidD3gT279Nzm9FWiEsBkwN2VecoaHLkGSHfere93Q==
6026718547001
edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/
3 KB
4 KB
XHR
General
Full URL
https://edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6026718547001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.203.45 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-203-45.fra50.r.cloudfront.net
Software
/
Resource Hash
8f6674a9531b0ed0944f50ebc22347234bce6ae47295227effdc78f3b53567c8
Security Headers
Name Value
Strict-Transport-Security max-age=77766000; includeSubDomains

Request headers

Accept
application/json;pk=BCpkADawqM3Dmzg7zRlKEmzcSAqR4vFC4MpyD0075pbeW0d779IrRf-anBPDszKFRm29RtjAGKoEpMIaZ77MCa9sg3FEJvjlzLS_lu0eXl3P-dUfQsoJ3LvMbiGkYL0cJNwEvNhrJy8Fh7TG
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

BCOV-instance
i-000395ce0da57a219, ac55aaf, 2019-10-22 08:34:42.741Z
Via
1.1 f794b89ac7b5d3a7a6b25a236579db6c.cloudfront.net (CloudFront)
BCOV-REQUEST-ID
75df5ba9-7774-4744-873a-1ed4b0c954c5
X-Amz-Cf-Pop
FRA50
Date
Tue, 22 Oct 2019 08:34:42 GMT
Strict-Transport-Security
max-age=77766000; includeSubDomains
X-Cache
Miss from cloudfront
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
X-Originating-URL
https://edge-elb.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6026718547001
access-control-expose-headers
x-cache,via,bcov-debug-cache-stats,bcov-instance,x-amz-cf-id
Cache-Control
max-age=472
Transfer-Encoding
chunked
Connection
keep-alive
X-Amz-Cf-Id
P1dC7WRrDYxlciFAKkbFtOIR_ci2KDUfyjhxRKZ2NDvqEk7O9GBPuA==
6015826911001
edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/
3 KB
4 KB
XHR
General
Full URL
https://edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6015826911001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.203.45 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-203-45.fra50.r.cloudfront.net
Software
/
Resource Hash
c0d878be48df147411bdbd34bde68ce0f065ecd8fd745529bd02667c418d0f9d
Security Headers
Name Value
Strict-Transport-Security max-age=77766000; includeSubDomains

Request headers

Accept
application/json;pk=BCpkADawqM3Dmzg7zRlKEmzcSAqR4vFC4MpyD0075pbeW0d779IrRf-anBPDszKFRm29RtjAGKoEpMIaZ77MCa9sg3FEJvjlzLS_lu0eXl3P-dUfQsoJ3LvMbiGkYL0cJNwEvNhrJy8Fh7TG
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

BCOV-instance
i-0dc283b48a7fc286c, ac55aaf, 2019-10-22 08:34:42.751Z
Via
1.1 f794b89ac7b5d3a7a6b25a236579db6c.cloudfront.net (CloudFront)
BCOV-REQUEST-ID
9452276b-0dc8-4c37-bbf0-6a35c9803902
X-Amz-Cf-Pop
FRA50
Date
Tue, 22 Oct 2019 08:34:42 GMT
Strict-Transport-Security
max-age=77766000; includeSubDomains
X-Cache
Miss from cloudfront
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
X-Originating-URL
https://edge-elb.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6015826911001
access-control-expose-headers
x-cache,via,bcov-debug-cache-stats,bcov-instance,x-amz-cf-id
Cache-Control
max-age=671
Connection
keep-alive
Content-Length
2857
X-Amz-Cf-Id
yyry7FoxqAwJhe3rwDN_tS41ksVEbYKJfZ-n2k71SD-w8FfZUicE7A==
6013182687001
edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/
3 KB
4 KB
XHR
General
Full URL
https://edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6013182687001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.203.45 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-203-45.fra50.r.cloudfront.net
Software
/
Resource Hash
204d5a095fd30ea65540054f069a02685a3fa7ecec64306f588731529d486e6a
Security Headers
Name Value
Strict-Transport-Security max-age=77766000; includeSubDomains

Request headers

Accept
application/json;pk=BCpkADawqM3Dmzg7zRlKEmzcSAqR4vFC4MpyD0075pbeW0d779IrRf-anBPDszKFRm29RtjAGKoEpMIaZ77MCa9sg3FEJvjlzLS_lu0eXl3P-dUfQsoJ3LvMbiGkYL0cJNwEvNhrJy8Fh7TG
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

BCOV-instance
i-01b784ad80a0de352, ac55aaf, 2019-10-22 08:34:42.572Z
Via
1.1 c76a5a41a8483a9e5dcccdfeb87a16ca.cloudfront.net (CloudFront)
BCOV-REQUEST-ID
b6293441-846d-4b54-b369-4d93114f607d
X-Amz-Cf-Pop
FRA50
Date
Tue, 22 Oct 2019 08:34:42 GMT
Strict-Transport-Security
max-age=77766000; includeSubDomains
X-Cache
Miss from cloudfront
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
X-Originating-URL
https://edge-elb.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6013182687001
access-control-expose-headers
x-cache,via,bcov-debug-cache-stats,bcov-instance,x-amz-cf-id
Cache-Control
max-age=62
Connection
keep-alive
Content-Length
2957
X-Amz-Cf-Id
8d07owEiaiF1eK_efQJ-Znz-hNFdOyffZt45TJnA4KZOwwAigX3rtw==
6090283641001
edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/
3 KB
4 KB
XHR
General
Full URL
https://edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6090283641001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.203.45 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-203-45.fra50.r.cloudfront.net
Software
/
Resource Hash
0a4abba6d7b7d8f7396f2aa74afd583f6670a16b9be6b62fcfee52d69afaafa9
Security Headers
Name Value
Strict-Transport-Security max-age=77766000; includeSubDomains

Request headers

Accept
application/json;pk=BCpkADawqM3Dmzg7zRlKEmzcSAqR4vFC4MpyD0075pbeW0d779IrRf-anBPDszKFRm29RtjAGKoEpMIaZ77MCa9sg3FEJvjlzLS_lu0eXl3P-dUfQsoJ3LvMbiGkYL0cJNwEvNhrJy8Fh7TG
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

BCOV-instance
i-0b955423e92b8c698, ac55aaf, 2019-10-22 08:34:42.677Z
Via
1.1 029f15a661be82d29f31e88713b71d65.cloudfront.net (CloudFront)
BCOV-REQUEST-ID
2a601767-986c-4ccf-822f-7d0a6035db1d
X-Amz-Cf-Pop
FRA50
Date
Tue, 22 Oct 2019 08:34:42 GMT
Strict-Transport-Security
max-age=77766000; includeSubDomains
X-Cache
Hit from cloudfront
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
X-Originating-URL
https://edge-elb.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6090283641001
access-control-expose-headers
x-cache,via,bcov-debug-cache-stats,bcov-instance,x-amz-cf-id
Cache-Control
max-age=352
Connection
keep-alive
Content-Length
2818
X-Amz-Cf-Id
AK8gzjrdtdQ8PCEv7btkqDIfXKjcYxk_zcFF0BFChg7C6Srd10JylA==
6090283641001
edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/
3 KB
4 KB
XHR
General
Full URL
https://edge.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6090283641001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.203.45 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-203-45.fra50.r.cloudfront.net
Software
/
Resource Hash
0a4abba6d7b7d8f7396f2aa74afd583f6670a16b9be6b62fcfee52d69afaafa9
Security Headers
Name Value
Strict-Transport-Security max-age=77766000; includeSubDomains

Request headers

Accept
application/json;pk=BCpkADawqM3Dmzg7zRlKEmzcSAqR4vFC4MpyD0075pbeW0d779IrRf-anBPDszKFRm29RtjAGKoEpMIaZ77MCa9sg3FEJvjlzLS_lu0eXl3P-dUfQsoJ3LvMbiGkYL0cJNwEvNhrJy8Fh7TG
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

BCOV-instance
i-0b955423e92b8c698, ac55aaf, 2019-10-22 08:34:42.677Z
Via
1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)
BCOV-REQUEST-ID
2a601767-986c-4ccf-822f-7d0a6035db1d
X-Amz-Cf-Pop
FRA50
Date
Tue, 22 Oct 2019 08:34:42 GMT
Strict-Transport-Security
max-age=77766000; includeSubDomains
X-Cache
Hit from cloudfront
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
X-Originating-URL
https://edge-elb.api.brightcove.com/playback/v1/accounts/2540076170001/videos/6090283641001
access-control-expose-headers
x-cache,via,bcov-debug-cache-stats,bcov-instance,x-amz-cf-id
Cache-Control
max-age=352
Connection
keep-alive
Content-Length
2818
X-Amz-Cf-Id
WnY57y_3m1k2iW0mgtH7SVWst1bQXVP4rP99vyDLtmZk0tWsq09WyQ==
image.jpg
cf-images.eu-west-1.prod.boltdns.net/v1/jit/2540076170001/7b270cca-c18f-48e0-bac8-83297f9db287/main/160x90/27s818ms/match/
6 KB
7 KB
Image
General
Full URL
https://cf-images.eu-west-1.prod.boltdns.net/v1/jit/2540076170001/7b270cca-c18f-48e0-bac8-83297f9db287/main/160x90/27s818ms/match/image.jpg
Requested by
Host: ovp.iris.tv
URL: https://ovp.iris.tv/libs/adaptive/v2/iris.adaptive.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.78.146 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-225-78-146.fra2.r.cloudfront.net
Software
/ BC
Resource Hash
2f9d84e5edaf4d8cfae1461e32d46ef50dc0335384cdd0d51094b80d387addc8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 07:51:18 GMT
Via
1.1 882f747f39885162595630c95dd0012d.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2-C2
X-Powered-From
eu-west-1b
X-Powered-By
BC
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Amz-Cf-Id
OvfvSMFRTh4cFdENcE2xHDijPsvMnKw4UdcYie4HROfDvSFkgsNl7g==
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_request&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F5798750504001&time=1571733282409&seq=5
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_request&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6090283641001&time=1571733282409&seq=6
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_request&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6085893262001&time=1571733282409&seq=7
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_request&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6026718547001&time=1571733282410&seq=8
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_request&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6015826911001&time=1571733282410&seq=9
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_request&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6013182687001&time=1571733282410&seq=10
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
play-button.png
s3.amazonaws.com/cdn.jukeboxu.com/brightcove/nextgen/buttons/
9 KB
9 KB
Image
General
Full URL
https://s3.amazonaws.com/cdn.jukeboxu.com/brightcove/nextgen/buttons/play-button.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.160.69 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
45f08f27c7337d189e8c31e635b5d0a0781b273131135cd77ee8b6f12366e7a2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Last-Modified
Wed, 22 Apr 2015 01:47:56 GMT
Server
AmazonS3
x-amz-request-id
3F81918D10FAB716
ETag
"182516d4ba61695d505ca0bd246f63fb"
Content-Type
image/png
x-amz-version-id
null
Accept-Ranges
bytes
Content-Length
8810
x-amz-id-2
qB87fXOvmiOltd6jNuOeOsAFTNCSOG6ZJi2C6l0glQSZo04uTrO4GgedWlaIKgunMcHG8mGBy0o=
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_request&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6090283641001&time=1571733282411&seq=11
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_request&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6090283641001&time=1571733282412&seq=12
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
sp_9LMINbK9
api-2-0.spot.im/v1.0.0/broadcasts/broadcasts/
25 B
604 B
XHR
General
Full URL
https://api-2-0.spot.im/v1.0.0/broadcasts/broadcasts/sp_9LMINbK9
Requested by
Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/broadcast/broadcast-fetcher-bundle-b3c9b893663205a06e63.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.112 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-112.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
b15adda52043ab41ba5663be05a91676db5ff3ad95e82dfafe7c5047eedc3f26

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
x-guid
d885f097-887d-4c5b-865c-a54ea49bd6e4
server
istio-envoy
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.express.co.uk
access-control-expose-headers
x-spotim-token, x-spotim-networkid, x-access-token, x-spotim-device-v2
access-control-allow-credentials
true
x-envoy-upstream-service-time
5
access-control-allow-headers
content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-spotim-page-view-id,x-spotim-device-v2
content-length
25
x-request-id
3bef8b11-35a5-458a-96e2-39fc4b006324
adcfg
ap.lijit.com/ Frame 158E
158 B
566 B
Script
General
Full URL
https://ap.lijit.com/adcfg?zoneid=598981&tid=20981dff6bdd45519ebbe24a78d3854f5681a8d9&mode=1&dmn=www.express.co.uk
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/sync
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
0eb43c7748056d757b5b5c51b1479f9483ea8443b68a27ab03933c9cb58df8d2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ap3ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
css
fonts.googleapis.com/
10 KB
801 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600,700,800
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
15b54d408557488fd7cc7fc3c6240046813d492b9d2b936a0bee8b8fe1597853
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Tue, 22 Oct 2019 08:34:42 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Tue, 22 Oct 2019 08:34:42 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:42 GMT
Cookie set /
d.agkn.com/iframe/8613/ Frame E707
0
0
Document
General
Full URL
https://d.agkn.com/iframe/8613/?che=701816726&gdpr=&gdpr_consent=&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&bpid=northernshelluk&c=%7B%22bpid%22%3A%22northernshelluk%22%2C%22loc%22%3A%22https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest%22%2C%22gdpr%22%3A%22%22%2C%22gdpr_consent%22%3A%22%22%2C%22ref%22%3A%22-1%22%2C%22cid%22%3A%22-1%22%2C%22sid%22%3A%22-1%22%2C%22gen%22%3A%22-1%22%2C%22age%22%3A%22-1%22%2C%22cat%22%3A%22-1%22%2C%22brd%22%3A%22-1%22%7D
Requested by
Host: js.agkn.com
URL: https://js.agkn.com/prod/v0/tag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.121.36.175 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-121-36-175.eu-central-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash

Request headers

Host
d.agkn.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Cache-Control
no-cache, must-revalidate
Content-Type
text/html;charset=UTF-8
Date
Tue, 22 Oct 2019 08:34:41 GMT
Expires
Sat, 01 Jan 2000 00:00:00 GMT
P3P
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma
no-cache
Server
Apache-Coyote/1.1
Set-Cookie
ab=0001%3AH9zDZylGaiRxXHkJ6NHARzUcYmByLQgi;Max-Age=31536000;domain=agkn.com;path=/ u=C|0AEAlQXuiJUF7ogAAAAAAAg1RAQCADVIBAIA;Max-Age=31536000;domain=agkn.com;path=/
Content-Length
481
Connection
keep-alive
read
api-2-0.spot.im/v1.0.0/conversation/
2 KB
3 KB
Fetch
General
Full URL
https://api-2-0.spot.im/v1.0.0/conversation/read
Requested by
Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.112 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-112.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
9538cc2a4764f38462d2daab3e66676e0178312dc8cd76b8893b74f4b7024214

Request headers

Sec-Fetch-Mode
cors
x-spot-id
sp_9LMINbK9
x-spotim-page-view-id
4f69efd8-3683-4823-aba9-ce1bccb8960f
x-post-id
1192439
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
status
200
access-control-max-age
86400
x-envoy-upstream-service-time
69
x-access-token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6IiIsInVzZXJfaWQiOiJ1XzR4TVlBYWloREdhcSIsImRpc3BsYXlfbmFtZSI6Ikd1ZXN0Nzg5MzI2IiwidXNlcl9uYW1lIjoiR3Vlc3Q3ODkzMjYiLCJyZWdpc3RlcmVkIjpmYWxzZSwiaW1hZ2VfaWQiOiIvdXNlcnMvYXZhdGFycy9EZWZhdWx0Iiwicm9sZXMiOltdLCJzcG90X2lkIjoic3BfOUxNSU5iSzkiLCJsYXN0X2NoZWNrIjoxNTcxNzMzMjgyLCJ2ZXJzaW9uIjoyLCJ4LXNwb3RpbS10b2tlbiI6IjAxMTkxMDIyVjAyMUZ2IiwicGVybWlzc2lvbnMiOm51bGwsInNwb3RpbS1kZXZpY2UtdjIiOiJkX1h2VmpHSERjeW9XUjRnU2EyRERvIiwibmV0d29yayI6eyJuZXR3b3JrX2lkIjoibmV0X2V4cHJlc3MiLCJuZXR3b3JrX25hbWUiOiJFWFBSRVNTIiwibmV0d29ya19pbWFnZV9pZCI6IkV4cHJlc3NfR3JvdXAtMl90aXNyanYiLCJuZXR3b3JrX2NvbG9yIjoiI2JiMWEwMCJ9LCJzcG90X25hbWUiOiIiLCJkb21haW4iOiIiLCJyb2xlc19udW1iZXIiOjAsImV4cCI6MTYwMDE1NTI4Miwic3ViIjoidV80eE1ZQWFpaERHYXEifQ.bf-bbKHfofoI6JoEg9QsHU8RB4D2hf5y0F3zVBXdhiM
content-length
740
x-spotim-token
01191022V021Fv
x-request-id
8b6d7036-2eaa-4a1d-8c81-3b5b2b674abb
server
istio-envoy
x-spotim-networkid
net_express
x-spotim-device-v2
d_XvVjGHDcyoWR4gSa2DDo
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-expose-headers
x-spotim-token, x-spotim-networkid, x-access-token, x-spotim-device-v2
access-control-allow-credentials
true
access-control-allow-headers
content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-spotim-page-view-id,x-spotim-device-v2
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=NANDSCONTENT1&hp=1&pl=1&cm=1&kq=1&bq=0&f=0&j=&o=3&t=1571733282459&de=867175706853&m=0&ar=de60227-clean&q=0&cb=0&cu=1571733282459&ll=2&ln=0&em=0&en=0&d=express.co.uk%3ATax%20refund%20scam%20warning%20-%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message%3A__page__%3A-&qs=1&gw=nandscontent759292113&fd=1&ac=1&it=500&fs=98334&na=2144049664&cs=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:42 GMT
rendition.m3u8
secure.brightcove.com/services/mobile/streaming/index/
1 KB
578 B
XHR
General
Full URL
https://secure.brightcove.com/services/mobile/streaming/index/rendition.m3u8?assetId=5798749556001&secure=true&pubId=2540076170001&videoId=5798750504001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.74.101.79 , United States, ASN18908 (BRIGHTCOVE-AS - Brightcove, Inc., US),
Reverse DNS
secure.brightcove.com
Software
brightcove /
Resource Hash
f09b17140f8a24035fe930dae0ff63f5d11398ccc430ebe7b35b9a1b6ed2b993

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:41 GMT
Content-Encoding
gzip
X-BC-Connecting-IP
144.76.109.30
Server
brightcove
X-BC-Client-IP
144.76.109.30
Content-Type
application/vnd.apple.mpegurl;charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
must-revalidate,max-age=0
Last-Modified
Tue, 03 Sep 2019 07:47:10 GMT
Content-Length
212
event
events.apester.com/
0
55 B
XHR
General
Full URL
https://events.apester.com/event
Requested by
Host: static.apester.com
URL: https://static.apester.com/js/sdk/v2.0/apester-javascript-sdk.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.63.234 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
234.63.190.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

strict-transport-security
max-age=31536000
via
1.1 google
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
date
Tue, 22 Oct 2019 08:34:42 GMT
status
202
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
alt-svc
clear
content-length
0
loader_100x100.gif
static.apester.com/js/assets/
57 KB
54 KB
Image
General
Full URL
https://static.apester.com/js/assets/loader_100x100.gif
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.72.53 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
53.72.190.35.bc.googleusercontent.com
Software
nginx/1.17.4 /
Resource Hash
efd7bcb3ff9569f6d0379e80d3f3a347cad0544208c8e56632544397129f9f92

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 12 Oct 2019 07:04:02 GMT
content-encoding
gzip
last-modified
Thu, 03 Oct 2019 13:15:07 GMT
server
nginx/1.17.4
age
869440
etag
W/"5d95f45b-e2be"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=315360000,public
alt-svc
clear
content-length
55437
via
1.1 google
expires
Thu, 31 Dec 2037 23:55:55 GMT
5da98fcd5b2f780bf6820185
renderer.apester.com/v2/
12 KB
5 KB
XHR
General
Full URL
https://renderer.apester.com/v2/5da98fcd5b2f780bf6820185?sdk=3.6.0s&canonicalUrl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&type=editorial&iframeType=friendlyIframe&platform=desktop
Requested by
Host: static.apester.com
URL: https://static.apester.com/js/sdk/v2.0/apester-javascript-sdk.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.186.220.219 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
219.220.186.35.bc.googleusercontent.com
Software
/ Express
Resource Hash
53f0fb3c6fcec2e85bb140165dc428f87be5ce97dd8ef32b6ab5eb7b5784cb1d

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

date
Tue, 22 Oct 2019 07:43:16 GMT
content-encoding
gzip
etag
W/"2ed4-W8EoKOaqN36qULsQOl8dTWqo1pI"
age
3086
status
200
x-powered-by
Express
vary
Accept-Encoding
content-type
text/html; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
1f51d55fccf2a1a044617fe2a8f4a2de/6446516363741238038;o=0
cache-control
public, max-age=3600
alt-svc
clear
content-length
4497
via
1.1 google
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_response&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6013182687001&time=1571733282821&response_time_ms=&BCOV-instance=i-01b784ad80a0de352%2C%20ac55aaf%2C%202019-10-22%2008%3A34%3A42.572Z&X-Cache=Miss%20from%20cloudfront&Via=1.1%20c76a5a41a8483a9e5dcccdfeb87a16ca.cloudfront.net%20(CloudFront)&X-Amz-Cf-Id=8d07owEiaiF1eK_efQJ-Znz-hNFdOyffZt45TJnA4KZOwwAigX3rtw%3D%3D&seq=13
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
216448
search.spotxchange.com/openrtb/2.3/dados/
1 KB
2 KB
XHR
General
Full URL
https://search.spotxchange.com/openrtb/2.3/dados/216448
Requested by
Host: aka.spotxcdn.com
URL: https://aka.spotxcdn.com/integration/directsdk/v1/directsdk.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.123 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
3cbe89a32e276e2db1fe0b32f614658d36af7dee6305dd8383d6c464801c715d

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
x-openrtb-version
2.3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Content-Encoding
gzip
X-SpotX-Timing-Transform
0.002538
X-SpotX-Timing-SpotMarket
0.237477
X-SpotX-Timing-Page-Mux
0.000257
X-SpotX-Timing-Page-Require
0.000322
X-fe
043
Connection
keep-alive
X-SpotX-Timing-Page-Cookie
0.000028
Content-Length
635
X-SpotX-Timing-Page
0.243224
Pragma
no-cache
X-SpotX-Timing-Page-Context
0.000250
Last-Modified
Tue, 22 Oct 2019 08:34:43 GMT
Server
nginx
Cache-Control
no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Methods
POST, GET, PATCH, DELETE, OPTIONS
Vary
Accept-Encoding
X-SpotX-Timing-SpotMarket-Primary
0.055898
Content-Type
application/json
Access-Control-Allow-Origin
https://www.express.co.uk
X-SpotX-Timing-Page-Misc
0.002336
X-SpotX-Timing-Page-Exception
0.000001
X-SpotX-Timing-SpotMarket-Secondary
0.181579
X-SpotX-Timing-Page-URI
0.000015
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Expires
Thu, 01 Jan 1970 00:00:00 GMT
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_response&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F5798750504001&time=1571733282826&response_time_ms=&BCOV-instance=i-04c795b226d05a399%2C%20ac55aaf%2C%202019-10-22%2008%3A34%3A41.740Z&X-Cache=Hit%20from%20cloudfront&Via=1.1%20f794b89ac7b5d3a7a6b25a236579db6c.cloudfront.net%20(CloudFront)&X-Amz-Cf-Id=xI0Ive5gzmuKtDCLmczs0afDSC_2BwogTnDfGToomZ2bKD77a8QQNw%3D%3D&seq=14
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
in
c2.u5c93.com/v5/
2 B
361 B
Other
General
Full URL
https://c2.u5c93.com/v5/in
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.246.207.119 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-246-207-119.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundary2ClTbhbI21z0yvwl

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
status
200
x-powered-by
Express
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary
Origin
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
content-length
2
messages-count
www.spot.im/api/open-api/v1/
56 B
913 B
XHR
General
Full URL
https://www.spot.im/api/open-api/v1/messages-count?spot_id=sp_9LMINbK9&posts_ids=1192439
Requested by
Host: app-cdn.spot.im
URL: https://app-cdn.spot.im/modules/messages-count/3.3.435/0.bundle.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip0x03f.map2.ssl.hwcdn.net
Software
/
Resource Hash
23689a90002be26bd4891f568bb0e62a4507e85dee64ede6d60830d949fae475
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
x-spotim-bid
Access-Control-Allow-Methods
GET, POST, DELETE, PUT, PATCH, HEAD, OPTIONS
Connection
Keep-Alive
x-spotim-rid
x-spotim-vid
Access-Control-Max-Age
86400
X-HW
1571733282.dop006.fr8.shc,1571733282.dop006.fr8.t,1571733282.cds131.fr8.sc,1571733283.cds131.fr8.p
Content-Type
application/json
Access-Control-Allow-Origin
https://www.express.co.uk
Access-Control-Expose-Headers
x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid, Content-Type
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_response&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6090283641001&time=1571733282840&response_time_ms=&BCOV-instance=i-0b955423e92b8c698%2C%20ac55aaf%2C%202019-10-22%2008%3A34%3A42.677Z&X-Cache=Miss%20from%20cloudfront&Via=1.1%20c76a5a41a8483a9e5dcccdfeb87a16ca.cloudfront.net%20(CloudFront)&X-Amz-Cf-Id=Zi5Ld6AALAiIRnhflge8W3p895r1mnZq8O6T8WRAODSLluVsICAFOQ%3D%3D&seq=15
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_response&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6090283641001&time=1571733282843&response_time_ms=&BCOV-instance=i-0b955423e92b8c698%2C%20ac55aaf%2C%202019-10-22%2008%3A34%3A42.677Z&X-Cache=Hit%20from%20cloudfront&Via=1.1%20029f15a661be82d29f31e88713b71d65.cloudfront.net%20(CloudFront)&X-Amz-Cf-Id=AK8gzjrdtdQ8PCEv7btkqDIfXKjcYxk_zcFF0BFChg7C6Srd10JylA%3D%3D&seq=16
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_response&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6026718547001&time=1571733282844&response_time_ms=&BCOV-instance=i-000395ce0da57a219%2C%20ac55aaf%2C%202019-10-22%2008%3A34%3A42.741Z&X-Cache=Miss%20from%20cloudfront&Via=1.1%20f794b89ac7b5d3a7a6b25a236579db6c.cloudfront.net%20(CloudFront)&X-Amz-Cf-Id=P1dC7WRrDYxlciFAKkbFtOIR_ci2KDUfyjhxRKZ2NDvqEk7O9GBPuA%3D%3D&seq=17
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_response&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6090283641001&time=1571733282845&response_time_ms=&BCOV-instance=i-0b955423e92b8c698%2C%20ac55aaf%2C%202019-10-22%2008%3A34%3A42.677Z&X-Cache=Hit%20from%20cloudfront&Via=1.1%20017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net%20(CloudFront)&X-Amz-Cf-Id=WnY57y_3m1k2iW0mgtH7SVWst1bQXVP4rP99vyDLtmZk0tWsq09WyQ%3D%3D&seq=18
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_response&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6085893262001&time=1571733282846&response_time_ms=&BCOV-instance=i-0d835bef5f23f43fe%2C%20ac55aaf%2C%202019-10-22%2008%3A34%3A42.744Z&X-Cache=Miss%20from%20cloudfront&Via=1.1%202d2eb60d814c8202a5a69fa957cd569d.cloudfront.net%20(CloudFront)&X-Amz-Cf-Id=mz_LyTyToL_QLidD3gT279Nzm9FWiEsBkwN2VecoaHLkGSHfere93Q%3D%3D&seq=19
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=catalog_response&url=https%3A%2F%2Fedge.api.brightcove.com%2Fplayback%2Fv1%2Faccounts%2F2540076170001%2Fvideos%2F6015826911001&time=1571733282847&response_time_ms=&BCOV-instance=i-0dc283b48a7fc286c%2C%20ac55aaf%2C%202019-10-22%2008%3A34%3A42.751Z&X-Cache=Miss%20from%20cloudfront&Via=1.1%20f794b89ac7b5d3a7a6b25a236579db6c.cloudfront.net%20(CloudFront)&X-Amz-Cf-Id=yyry7FoxqAwJhe3rwDN_tS41ksVEbYKJfZ-n2k71SD-w8FfZUicE7A%3D%3D&seq=20
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:42 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
serve
srv.imonomy.com/script/layer/
17 KB
6 KB
Script
General
Full URL
https://srv.imonomy.com/script/layer/serve?v=2&format=1&img=true&cid=layer_fr&isps=false&cbs=0.6355104669027092&ln=en&sid=14567721676&terms=&httpsite=true&keywords=&dm=express.co.uk&charset=UTF-8&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&ln=en&ct=0&w=1600&h=1200&pxr=1&ppi=96&adl=true&loc=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=www.express.co.uk&rtb_highest_price=
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/14567721676/preload.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
e2d1dec485bdae92432e5f17ec18a35954cb0da197908630d4019c93387a6e41

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Content-Encoding
gzip
Server
nginx
Etag
"d7e216e3d04f569b5829a32d0d7c6b896637af28"
Vary
Accept-Encoding
P3p
CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-Control
public, max-age=360
Connection
keep-alive
Content-Type
application/javascript
Content-Length
5717
l
mcdp-nydc1.outbrain.com/
4 B
377 B
XHR
General
Full URL
https://mcdp-nydc1.outbrain.com/l?token=a233098567df623ee714f857106df455_511_1571733282504&tm=1118&eT=0&widgetWidth=940&widgetHeight=78&widgetX=323&widgetY=240&wRV=103060&pVis=0&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&eIdx=&cheq=0&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.127 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
content-encoding
gzip
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
content-range
Connection
close
X-TraceId
c88dc766e64aa1c1d9513ed845f7fd32
Content-Length
30
obUserSync.html
widgets.outbrain.com/widgetOBUserSync/ Frame EB87
0
0
Document
General
Full URL
https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Cookie
akacd_widgets_routing=3749186080~rv=96~id=400a1d00d8ed0017e02406657b2e333c; obuid=671c8e7d-0e61-4695-a071-c8d9af998cd8; recs_84e1ae4254e08b1a4b6fe54bfe9f17bd=0B2392105173A2394926007A2364930029A2442757534A2418968807ACD0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Server
Apache
ETag
"ffb9673982ad30f3adf618bf8ca88653:1571732011"
Last-Modified
Tue, 22 Oct 2019 08:11:39 GMT
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-Control
max-age=604800
Date
Tue, 22 Oct 2019 08:34:42 GMT
Content-Length
3735
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
get
odb.outbrain.com/utils/
66 KB
23 KB
Script
General
Full URL
https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&srcUrl=https%3A%2F%2Fwww.express.co.uk%2Fposts%2Frss%2F23%2Fyourmoney&settings=true&recs=true&widgetJSId=AR_22&key=NANOWDGT01&idx=1&version=103060&apv=false&sig=kUCKVhKu&format=html&rand=6706&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&lsdt=1571733282851&pdobuid=0&osLang=en-US&t=YTIzMzA5ODU2N2RmNjIzZWU3MTRmODU3MTA2ZGY0NTU=&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&secured=true&va=true&cmpStat=1&ref=
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
f698136a98282629b98902dc7249fbcf3383d547df08350e907991dff4f61c75
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=0; includeSubDomains;
content-encoding
gzip
traffic-path
NYDC1, JFK, FRA, Europe1
x-cache
MISS, MISS
p3p
policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status
200
x-cache-hits
0, 0
x-traceid
bb07351b74ae712f2aa31e4581ce61f8
content-length
22578
x-served-by
cache-jfk8138-JFK, cache-fra19132-FRA
pragma
no-cache
x-timer
S1571733283.867992,VS0,VE225
date
Tue, 22 Oct 2019 08:34:43 GMT
vary
Accept-Encoding, User-Agent
content-type
text/x-json; charset=UTF-8
via
1.1 varnish, 1.1 varnish
cache-control
no-cache
backend-ip
104.156.90.38
accept-ranges
bytes, bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
eyJpdSI6Ijk2MDNlOTNlODIwNGU0ZGFhNjgxZmIwZmM0N2Y3MmQ3N2YzODEzMGM5OWQ4YTk1ZWFiYmVkNjVmYjJjZDc4YjAiLCJ3IjoxNzUsImgiOjEzNCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
14 KB
14 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6Ijk2MDNlOTNlODIwNGU0ZGFhNjgxZmIwZmM0N2Y3MmQ3N2YzODEzMGM5OWQ4YTk1ZWFiYmVkNjVmYjJjZDc4YjAiLCJ3IjoxNzUsImgiOjEzNCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a93b797b21c47a6843fd99dbfdebaefa14f9a12bfab34b49cb3e164791e2a7f7
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Mon, 14 Oct 2019 13:03:03 GMT
Date
Tue, 22 Oct 2019 08:34:42 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=2300615
Connection
keep-alive
X-TraceId
344e41165edb26ed9ce29efc089e1b3d
Timing-Allow-Origin
*
Content-Length
14342
video_icon.png
widgets.outbrain.com/images/videoIcons/
2 KB
2 KB
Image
General
Full URL
https://widgets.outbrain.com/images/videoIcons/video_icon.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b5b1e5b3772768841777a8b7189a2a0fe67e8c74cc21952b41b882771ceba1b8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:42 GMT
Last-Modified
Thu, 17 Oct 2019 08:24:25 GMT
Server
Apache
ETag
"2c665e0617f8f71299bc1f02305f7e19:1571303612"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1650
eyJpdSI6ImRjZDZhNWNjMTYxYjEwODFmNzA2ZDA3ZTJmZTQyYWM1ZjViNzRmNjgyMWVkZjAwMjBmNjIzYjZjMmFhMGJiMTgiLCJ3IjoxNzUsImgiOjEzNCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
9 KB
10 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6ImRjZDZhNWNjMTYxYjEwODFmNzA2ZDA3ZTJmZTQyYWM1ZjViNzRmNjgyMWVkZjAwMjBmNjIzYjZjMmFhMGJiMTgiLCJ3IjoxNzUsImgiOjEzNCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5bae4ea6b8c1a2c8054109c0173dd5fb9ce6fbe3ef5a88ec9a6098c0b44e8898
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 15 Oct 2019 08:27:37 GMT
Date
Tue, 22 Oct 2019 08:34:42 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=2344465
Connection
keep-alive
X-TraceId
6212e118bf19a3afc5fcdb33cac05b5
Timing-Allow-Origin
*
Content-Length
9352
eyJpdSI6IjJmY2Y2MWFiMGJhODhhZGUyN2NmMTcyNjFkNjI4ZjE4MmQ0NjhmYjk5OGM3OTMzNmY2Y2ZhZTBhYjc5ZGRhOTIiLCJ3IjoxNzUsImgiOjEzNCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
12 KB
13 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjJmY2Y2MWFiMGJhODhhZGUyN2NmMTcyNjFkNjI4ZjE4MmQ0NjhmYjk5OGM3OTMzNmY2Y2ZhZTBhYjc5ZGRhOTIiLCJ3IjoxNzUsImgiOjEzNCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d3514819861026568dd0f01af2b86e14e6107da507743592627330fb01466808
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Sun, 22 Sep 2019 10:49:17 GMT
Date
Tue, 22 Oct 2019 08:34:42 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=842592
Connection
keep-alive
X-TraceId
ef462cccf0fcd945e0410505268d845e
Timing-Allow-Origin
*
Content-Length
12742
eyJpdSI6ImM5YTgwNjJlZTk1OGJkMzE1Mzk1MmJkMTA1NmNmYjY3NmQzYzJmYmYyNzAyNGIyNzBhNjc1OWY0MjkyYzUwZjQiLCJ3IjoxNzUsImgiOjEzNCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
12 KB
13 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6ImM5YTgwNjJlZTk1OGJkMzE1Mzk1MmJkMTA1NmNmYjY3NmQzYzJmYmYyNzAyNGIyNzBhNjc1OWY0MjkyYzUwZjQiLCJ3IjoxNzUsImgiOjEzNCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
92b6ce5aeea591dae741bfcc175b130351ca025dc47a604c51bc4bafc5079211
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Mon, 21 Oct 2019 02:38:13 GMT
Date
Tue, 22 Oct 2019 08:34:42 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=2360355
Connection
keep-alive
X-TraceId
548fd8fc07ffd06957fd3de6e434bcd9
Timing-Allow-Origin
*
Content-Length
12420
eyJpdSI6IjY4N2JkODE4NzI3OTc3Y2EzNzdjODRlNDQ1YzNkNTA4ZWMwOWQxNzU2YmU2MDRiNjA1NzJjNGUyNWExYjk4ZjQiLCJ3IjoxNzUsImgiOjEzNCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
11 KB
11 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjY4N2JkODE4NzI3OTc3Y2EzNzdjODRlNDQ1YzNkNTA4ZWMwOWQxNzU2YmU2MDRiNjA1NzJjNGUyNWExYjk4ZjQiLCJ3IjoxNzUsImgiOjEzNCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
20e8607f169a2994deb82d0b9621f119ad85041835664bdd5842443a6f357227
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Wed, 09 Oct 2019 11:38:28 GMT
Date
Tue, 22 Oct 2019 08:34:42 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1372529
Connection
keep-alive
X-TraceId
95bc4a34b23f9b6190352795605428cd
Timing-Allow-Origin
*
Content-Length
11286
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=34&ud=false&qa=1600&qb=1200&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qi=1600&qj=1200&ql=&qo=0&qm=-120&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%5B)1xfq_GUKB%7BJ9AKqD(ao%5DDXx2Tlw4%26ExM_1g%2Bk6%40QV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y5iC%3Dn%3CG.xpG%24czixape4tE0b15%7CQjw%60.%7BiO%23Ly*rdB%3Evq%2F9N%7CQEXp%2B3W%60R%23ItxO%2B%7BQZt%7Bx1b~tW%24n%7BF%5BZR64oD3PP%23wJD3%25B%3AUgiOJ%5D*P1R27%2Bmu7RDX%2B%2Cy_*hUUp%2FVNkUW!%40b%2FoT%23%3CFr4TmyU~%2B..%5Eh%5EH%40G%23(d9IUjDux1bWuqEd%5E95SpGl)17*BT2z.%5BOCDT%3FW4BKm55Y%25F3%2FNdLlDxAjT%3CUmfB.%26Y%3BRZ.%60)_Q%234kE5p(taEn%26%5BNLU%25%2F%22%3Bh%2C%25%3BbEW%3Ckk!LvRjy1%5Du!%3CFo%40NFdS97evb%5Dmc9!4O7P7D%3B%3FdKHapzrIw(%60*MVu%2Fs1S*qks!o%7B25jAbj19SUF%60(a~M%3Ai%60K%25_9.rV0%2F%60E%60%60%2CH%24%26x%5EAbgkN%3Df%3CU%3CekO2m%2F%26u~q%60RP%3CG.FTVGX%5E8Y.N%2CzKydjXB3UN%5EMk3okt%24b_o4i6yz40b_QnwoD%2CYood%23D3lBG&qp=00000&qq=000000000000&qr=0&gz=0&hh=0&hn=0&qt=0&i=NANDSCONTENT1&hp=1&pl=1&cm=1&kq=1&bq=0&f=0&j=&o=3&t=1571733282459&de=867175706853&m=0&ar=de60227-clean&q=1&cb=0&cu=1571733282459&ll=2&ln=0&em=0&en=0&d=express.co.uk%3ATax%20refund%20scam%20warning%20-%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message%3A__page__%3A-&qs=1&gw=nandscontent759292113&fd=1&ac=1&it=500&fs=98334&na=259580022&cs=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:42 GMT
collect
www.google-analytics.com/
35 B
122 B
Other
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:42 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
102 B
Other
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:42 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
102 B
Other
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:42 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
widgetGlobalEvent
log.outbrainimg.com/loggerServices/
4 B
344 B
XHR
General
Full URL
https://log.outbrainimg.com/loggerServices/widgetGlobalEvent?rId=a233098567df623ee714f857106df455&pvId=a233098567df623ee714f857106df455&sid=5569174&pid=511&idx=0&wId=186&pad=0&org=5&tm=1151&eT=3&wRV=103060&pVis=0&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&eIdx=0&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:43 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
X-TraceId
668b803e8799b399e3c68c277b8aa550
Content-Length
4
Expires
0
cJZKeOuBrn4kERxqtaUH3ZBw1xU1rKptJj_0jans920.woff2
fonts.gstatic.com/s/opensans/v13/
10 KB
10 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3ZBw1xU1rKptJj_0jans920.woff2
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
732d5765c33eff81c7825dcc5e8cd1eda32dc04f39da7cae66accf9580b1e3a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://static-cdn.spot.im/production/conversation/main.003c417.css
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 07:26:48 GMT
x-content-type-options
nosniff
last-modified
Mon, 27 Apr 2015 23:45:29 GMT
server
sffe
age
954474
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10352
x-xss-protection
0
expires
Sat, 10 Oct 2020 07:26:48 GMT
DXI1ORHCpsQm3Vp6mXoaTRampu5_7CjHW5spxoeN3Vs.woff2
fonts.gstatic.com/s/opensans/v13/
10 KB
10 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v13/DXI1ORHCpsQm3Vp6mXoaTRampu5_7CjHW5spxoeN3Vs.woff2
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a51690a59260fd30a04d20955e8e5432f7f05f90c13f04c953789d67548a66b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://static-cdn.spot.im/production/conversation/main.003c417.css
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 19:46:48 GMT
x-content-type-options
nosniff
last-modified
Mon, 27 Apr 2015 23:46:24 GMT
server
sffe
age
910074
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10200
x-xss-protection
0
expires
Sat, 10 Oct 2020 19:46:48 GMT
MTP_ySUJH_bn48VBG8sNShampu5_7CjHW5spxoeN3Vs.woff2
fonts.gstatic.com/s/opensans/v13/
10 KB
10 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v13/MTP_ySUJH_bn48VBG8sNShampu5_7CjHW5spxoeN3Vs.woff2
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
417e156e282af4b7d146d16b8fc9505255de2d8d085d40e37afe5089b8fe9b77
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://static-cdn.spot.im/production/conversation/main.003c417.css
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 19:37:27 GMT
x-content-type-options
nosniff
last-modified
Mon, 27 Apr 2015 23:45:49 GMT
server
sffe
age
910635
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10328
x-xss-protection
0
expires
Sat, 10 Oct 2020 19:37:27 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&kq=1&lo=0&qs=1&ak=https%3A%2F%2Fwww.express.co.uk%2F%2Ffinance%2Fpersonalfinance%2F1192439%2F-&i=NANDSCONTENT1&ud=false&qm=-120&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%5B)1xfq_GUKB%7BJ9AKqD(ao%5DDXx2Tlw4%26ExM_1g%2Bk6%40QV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y5iC%3Dn%3CG.xpG%24czixape4tE0b15%7CQjw%60.%7BiO%23Ly*rdB%3Evq%2F9N%7CQEXp%2B3W%60R%23ItxO%2B%7BQZt%7Bx1b~tW%24n%7BF%5BZR64oD3PP%23wJD3%25B%3AUgiOJ%5D*P1R27%2Bmu7RDX%2B%2Cy_*hUUp%2FVNkUW!%40b%2FoT%23%3CFr4TmyU~%2B..%5Eh%5EH%40G%23(d9IUjDux1bWuqEd%5E95SpGl)17*BT2z.%5BOCDT%3FW4BKm55Y%25F3%2FNdLlDxAjT%3CUmfB.%26Y%3BRZ.%60)_Q%234kE5p(taEn%26%5BNLU%25%2F%22%3Bh%2C%25%3BbEW%3Ckk!LvRjy1%5Du!%3CFo%40NFdS97evb%5Dmc9!4O7P7D%3B%3FdKHapzrIw(%60*MVu%2Fs1S*qks!o%7B25jAbj19SUF%60(a~M%3Ai%60K%25_9.rV0%2F%60E%60%60%2CH%24%26x%5EAbgkN%3Df%3CU%3CekO2m%2F%26u~q%60RP%3CG.FTVGX%5E8Y.N%2CzKydjXB3UN%5EMk3okt%24b_o4i6yz40b_QnwoD%2CYood%23D3lBG&qp=00000&qq=000000000000&qr=0&gz=0&hh=0&hn=0&qt=0&bq=0&g=0&pl=1&fl=1&sr=0&sb=0&sq=0&sa=0&sn=0&sj=0&sm=0&si=0&md=0&mc=0&lb=6987&la=0&ld=0&lc=0&cw=-1&cx=-1&sh=undefined&xa=0&xb=0&xc=0&h=4&w=4&cm=1&f=0&j=&o=3&t=1571733282459&de=867175706853&cu=1571733282459&m=251&ar=de60227-clean&cb=0&ll=2&ln=0&gh=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1600&qe=1200&qh=1600&qg=1200&lk=undefined&le=1&gm=1&io=1&ch=0&as=0&ag=0&an=0&gf=0&gg=0&pg=0&pf=0&cc=0&bw=0&bx=0&em=0&en=0&bu=1&cd=0&ah=1&am=0&re=0&wb=1&cl=0&at=0&d=express.co.uk%3ATax%20refund%20scam%20warning%20-%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message%3A__page__%3A-&gw=nandscontent759292113&ab=1&ac=1&fd=1&kt=strict&it=500&fs=98334&na=1137381029&cs=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:42 GMT
9dba51d8-8a08-443e-b934-68470003022e
https://www.express.co.uk/
49 KB
0
Other
General
Full URL
blob:https://www.express.co.uk/9dba51d8-8a08-443e-b934-68470003022e
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
978e26ab0df85582cbfb7243910b85841d7acc3d44712913ea30dfbf2e0373b2

Request headers

Sec-Fetch-Mode
same-origin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
50581
Content-Type
application/javascript
2540076170001_5798749556001_s-1.ts
f1.media.brightcove.com/1/2540076170001/5798749556001/
1 MB
1 MB
XHR
General
Full URL
https://f1.media.brightcove.com/1/2540076170001/5798749556001/2540076170001_5798749556001_s-1.ts?pubId=2540076170001&videoId=5798750504001
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.27 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
a23f1a465fcd2f938fb8149cddb19ae75c16a276193c79516aefe65b5c0d56b8

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
via
1.1 0173aeb09060ae0dd8c77e399d9e5634.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish
age
952244
x-cache
Miss from cloudfront, HIT, HIT
status
200
content-length
1055996
x-served-by
cache-iad2123-IAD, cache-hhn4034-HHN
last-modified
Mon, 18 Jun 2018 10:36:44 GMT
x-timer
S1571733283.029668,VS0,VE3
etag
"3ba8f3183ebc87d7ee1b1dc2376a6f1d"
content-type
video/MP2T
access-control-allow-origin
*
cache-control
max-age=0
x-amz-cf-pop
IAD79-C1
accept-ranges
bytes
access-control-allow-headers
X-Requested-With
x-amz-cf-id
GWIC7gO4vQMe0BfR0kNAAG0Pa3QX3WVBo0n4DRZfnmeLX7OOkhPLHg==
x-cache-hits
33, 1
main.01ddce667cb7f50778a2.bundle.js
renderer.apester.com/v2/static/ Frame D1D1
616 KB
184 KB
Script
General
Full URL
https://renderer.apester.com/v2/static/main.01ddce667cb7f50778a2.bundle.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.186.220.219 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
219.220.186.35.bc.googleusercontent.com
Software
/ Express
Resource Hash
ca498a0544c33a82ef0bb0ae018dbe98fa5143d50a8d05d518212ff9683fb93e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 05:09:18 GMT
content-encoding
gzip
age
98725
x-powered-by
Express
status
200
alt-svc
clear
content-length
187779
access-control-allow-origin
*
last-modified
Tue, 15 Oct 2019 14:08:19 GMT
etag
W/"99fcd-16dcfbf8838"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
via
1.1 google
x-cloud-trace-context
126f2ef4b574ced8ad0fe7cf591839c8/13711982930520149127;o=0
cache-control
public, max-age=21600, s-maxage=604800
accept-ranges
bytes
runtime.01ddce667cb7f50778a2.js
renderer.apester.com/v2/static/ Frame D1D1
5 KB
2 KB
Script
General
Full URL
https://renderer.apester.com/v2/static/runtime.01ddce667cb7f50778a2.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.186.220.219 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
219.220.186.35.bc.googleusercontent.com
Software
/ Express
Resource Hash
6d54e11e9e0a4dfe77082dca8b931af5cdb50e00ff7b63161f5944c3c4674344

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 06:04:08 GMT
content-encoding
gzip
age
95435
x-powered-by
Express
status
200
alt-svc
clear
content-length
1969
access-control-allow-origin
*
last-modified
Tue, 15 Oct 2019 14:08:19 GMT
etag
W/"1358-16dcfbf8838"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
via
1.1 google
x-cloud-trace-context
f866643137e723b09cd844711ca53f5b/10856496490295909107;o=0
cache-control
public, max-age=21600, s-maxage=604800
accept-ranges
bytes
fonts.general.css
static.apester.com/fonts/ Frame D1D1
3 KB
541 B
Stylesheet
General
Full URL
https://static.apester.com/fonts/fonts.general.css
Requested by
Host: static.apester.com
URL: https://static.apester.com/js/sdk/v2.0/apester-javascript-sdk.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.72.53 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
53.72.190.35.bc.googleusercontent.com
Software
nginx/1.17.4 /
Resource Hash
523f7d71c6077dd4fc06bd8663ebedbb4719ac9a3c9385a6fdc43eea20a89553

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 15 Oct 2019 14:57:42 GMT
content-encoding
gzip
last-modified
Thu, 10 Oct 2019 14:18:09 GMT
server
nginx/1.17.4
age
581821
status
200
etag
W/"5d9f3da1-b53"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=315360000,public
alt-svc
clear
content-length
425
via
1.1 google
expires
Thu, 31 Dec 2037 23:55:55 GMT
style-cf.css
d1azc1qln24ryf.cloudfront.net/124741/ApesterPlayer/ Frame D1D1
3 KB
1 KB
Stylesheet
General
Full URL
https://d1azc1qln24ryf.cloudfront.net/124741/ApesterPlayer/style-cf.css?i91nr4
Requested by
Host: static.apester.com
URL: https://static.apester.com/js/sdk/v2.0/apester-javascript-sdk.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.197.43 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-224-197-43.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1dac4741dcb38d6db66482eb97f40a7a62a12e9d4b4b726941673b144ccf43d7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 02 Oct 2019 07:56:31 GMT
content-encoding
gzip
last-modified
Wed, 02 Oct 2019 07:56:25 GMT
server
AmazonS3
age
1730293
etag
"6468c96939a933ea13dac1dcbe1b2954"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=31000000
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
686
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
x-amz-cf-id
ETc5cDMdqLWP-eR7wllgnTzptUXkmb5tHLzS_PR-awQvcQ4yG-Sl9Q==
js
maps.googleapis.com/maps/api/ Frame D1D1
117 KB
38 KB
Script
General
Full URL
https://maps.googleapis.com/maps/api/js?key=AIzaSyDDSM5Fd4ukbvXhmJD11asM4CDnQOZnbHs&libraries=places&language=en
Requested by
Host: static.apester.com
URL: https://static.apester.com/js/sdk/v2.0/apester-javascript-sdk.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
mafe /
Resource Hash
c62021d50570366181641d49ce550aa1767a2142c672e3435b043d32f92d583d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest?sdk=3.6.0s&canonicalUrl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&type=editorial&iframeType=friendlyIframe&platform=desktop
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:21:01 GMT
content-encoding
gzip
server
mafe
age
822
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
public, max-age=1800
server-timing
gfet4t7; dur=21
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
38587
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:51:01 GMT
collect
www.google-analytics.com/
35 B
102 B
Other
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:43 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
Default
images.spot.im/image/upload/q_70,fl_lossy,dpr_3,h_44,w_44,c_thumb,g_face/v200//users/avatars/
2 KB
1 KB
Image
General
Full URL
https://images.spot.im/image/upload/q_70,fl_lossy,dpr_3,h_44,w_44,c_thumb,g_face/v200//users/avatars/Default
Requested by
Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
5efa1b5e5972e10b92416a0ce3304688ad78216582c3eebe930a37771f729fc1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
content-encoding
gzip
status
200
content-disposition
attachment; filename="Default"
content-length
774
surrogate-key
268046594891881248488411371492607257864 178551663207821390187664705009242933206 5dae0ce85ee661e931f6926af99c713d
last-modified
Thu, 31 Aug 2017 06:15:21 GMT
server
cloudinary
etag
W/"cc57e66349097d7cfb1a1a369e01f9bc"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
expires
Wed, 21 Oct 2020 08:34:43 GMT
wmippuzpu5jovqxsamqh
images.spot.im/image/upload/q_70,fl_lossy,dpr_3,h_44,w_44,c_thumb,g_face/v200/p/u/
1 KB
2 KB
Image
General
Full URL
https://images.spot.im/image/upload/q_70,fl_lossy,dpr_3,h_44,w_44,c_thumb,g_face/v200/p/u/wmippuzpu5jovqxsamqh
Requested by
Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
9949092e6802e3091dd4e866626045e22ed46324cc30360abdd4c15a1673705e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
content-encoding
gzip
status
200
server-timing
akam;dur=32;start=2019-10-10T11:48:06.007Z;total=92;desc=miss,rtt;dur=0
content-length
1201
surrogate-key
237028733593231405011577372773726513752 178551663207821390187664705009242933206 5dae0ce85ee661e931f6926af99c713d
last-modified
Tue, 17 Sep 2019 06:36:39 GMT
server
cloudinary
etag
"4698af040e29dd8bb7f89db223c41884"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
expires
Wed, 21 Oct 2020 08:34:43 GMT
k3k702ZOKiLJc3WVjuplzBampu5_7CjHW5spxoeN3Vs.woff2
fonts.gstatic.com/s/opensans/v13/
10 KB
10 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzBampu5_7CjHW5spxoeN3Vs.woff2
Requested by
Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c7c63b43903d698f7c8b28360ce19c81b574db3288a8db01a29ac72ffba1327b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://static-cdn.spot.im/production/conversation/main.003c417.css
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 19:04:48 GMT
x-content-type-options
nosniff
last-modified
Mon, 27 Apr 2015 23:45:53 GMT
server
sffe
age
912595
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10284
x-xss-protection
0
expires
Sat, 10 Oct 2020 19:04:48 GMT
async
api-2-0.spot.im/v1.0.0/conversation/
3 B
532 B
Fetch
General
Full URL
https://api-2-0.spot.im/v1.0.0/conversation/async
Requested by
Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.112 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-112.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Sec-Fetch-Mode
cors
x-post-id
1192439
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json
Accept
application/json
x-spot-id
sp_9LMINbK9
x-spotim-page-view-id
4f69efd8-3683-4823-aba9-ce1bccb8960f
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
x-access-token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6IiIsInVzZXJfaWQiOiJ1XzR4TVlBYWloREdhcSIsImRpc3BsYXlfbmFtZSI6Ikd1ZXN0Nzg5MzI2IiwidXNlcl9uYW1lIjoiR3Vlc3Q3ODkzMjYiLCJyZWdpc3RlcmVkIjpmYWxzZSwiaW1hZ2VfaWQiOiIvdXNlcnMvYXZhdGFycy9EZWZhdWx0Iiwicm9sZXMiOltdLCJzcG90X2lkIjoic3BfOUxNSU5iSzkiLCJsYXN0X2NoZWNrIjoxNTcxNzMzMjgyLCJ2ZXJzaW9uIjoyLCJ4LXNwb3RpbS10b2tlbiI6IjAxMTkxMDIyVjAyMUZ2IiwicGVybWlzc2lvbnMiOm51bGwsInNwb3RpbS1kZXZpY2UtdjIiOiJkX1h2VmpHSERjeW9XUjRnU2EyRERvIiwibmV0d29yayI6eyJuZXR3b3JrX2lkIjoibmV0X2V4cHJlc3MiLCJuZXR3b3JrX25hbWUiOiJFWFBSRVNTIiwibmV0d29ya19pbWFnZV9pZCI6IkV4cHJlc3NfR3JvdXAtMl90aXNyanYiLCJuZXR3b3JrX2NvbG9yIjoiI2JiMWEwMCJ9LCJzcG90X25hbWUiOiIiLCJkb21haW4iOiIiLCJyb2xlc19udW1iZXIiOjAsImV4cCI6MTU3MTgxOTY4Miwic3ViIjoidV80eE1ZQWFpaERHYXEifQ.te0v1qjkBpSxJMwT7iTurasy2pEFPga791TCE994fvI

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
status
202
x-envoy-upstream-service-time
18
x-spotim-networkid
net_express
content-length
3
x-spotim-token
01191022V021Fv
x-request-id
88d8f721-6202-417b-a457-a83995331faf
server
istio-envoy
x-spotim-device-v2
d_XvVjGHDcyoWR4gSa2DDo
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-expose-headers
x-spotim-token, x-spotim-networkid, x-access-token, x-spotim-device-v2
access-control-allow-credentials
true
access-control-allow-headers
content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-spotim-page-view-id,x-spotim-device-v2
pixel
pix.spot.im/api/v1/
16 B
360 B
XHR
General
Full URL
https://pix.spot.im/api/v1/pixel?m=eyJzb3VyY2UiOiJjb252ZXJzYXRpb24iLCJzb3VyY2VfdmVyc2lvbiI6InYyIiwidHlwZSI6ImxvYWRlZCIsImRvbWFpbiI6Ind3dy5leHByZXNzLmNvLnVrIiwidXJsIjoiaHR0cHM6Ly93d3cuZXhwcmVzcy5jby51ay9maW5hbmNlL3BlcnNvbmFsZmluYW5jZS8xMTkyNDM5L3RleHQtc2NhbS1obXJjLXRheC1yZWZ1bmQtd2FybmluZy1mcmF1ZC1uZXdzLWxhdGVzdCIsInJlZmVycmVyIjoiIiwibGFuZyI6ImVuLVVTIiwidGltZV9kZWx0YSI6MjU5OSwidWlkIjoiYWY4MjQ5ZDAwOGUwMzY4OWVlZDZkM2NmODVmZDI3ZGEiLCJ2aXNpdF9pZCI6ImFhZTBhYjJiZWY1YWM3ZDEzYjZmY2I0NzM5ZGIwYzJmIiwiZHVyYXRpb24iOjEsImliX2Jyb3dzZXJfaWQiOiI2NzU1MTE0MGRhY2YwNjRmMGZlMjdiM2NiM2ZiZGNjNCIsInNwb3RfaWQiOiJzcF85TE1JTmJLOSIsInBhZ2Vfdmlld19pZCI6IjRmNjllZmQ4LTM2ODMtNDgyMy1hYmE5LWNlMWJjY2I4OTYwZiIsImd1aWQiOiJlNjU0YmZmNC0yODc0LTQwYTYtODdiYi0wYTRmNzNhN2I2Y2YiLCJwb3N0X2lkIjoiMTE5MjQzOSIsImNvbnZlcnNhdGlvbl9pZCI6InNwXzlMTUlOYks5XzExOTI0MzkiLCJ0b3RhbF9jb21tZW50cyI6MSwiaXNfcmVnaXN0ZXJlZCI6ZmFsc2V9&rnd=0.015887906394133067
Requested by
Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
fasthttp /
Resource Hash
707d4c7f44dd33e874b5a09b6dba4702b12bfd3e19e470d601fcfc1d7009286c

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
x-spotim-device-uuid
e654bff4-2874-40a6-87bb-0a4f73a7b6cf
x-spotim-page-view-id
4f69efd8-3683-4823-aba9-ce1bccb8960f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:43 GMT
server
fasthttp
status
200
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
content-length
16
expires
Tue, 22 Oct 2019 08:34:43 GMT
ob_smartFeedLogo.min.svg
widgets.outbrain.com/images/widgetIcons/
7 KB
7 KB
Image
General
Full URL
https://widgets.outbrain.com/images/widgetIcons/ob_smartFeedLogo.min.svg
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8050f05c230d74be333b63cef230e786094e9100f55fa19c6c0831e95870768d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Last-Modified
Thu, 17 Oct 2019 08:24:25 GMT
Server
Apache
ETag
"f370d19306add072a726e7f4ade8dc57:1571303637"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
7090
achoice.svg
widgets.outbrain.com/images/widgetIcons/
3 KB
2 KB
Image
General
Full URL
https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Content-Encoding
gzip
Last-Modified
Thu, 17 Oct 2019 08:24:25 GMT
Server
Apache
ETag
"9d26fa4e7238ed94f1d0d92afb453b3e:1571303614"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1368
l
mcdp-nydc1.outbrain.com/
4 B
377 B
XHR
General
Full URL
https://mcdp-nydc1.outbrain.com/l?token=ac8f92ccdee5e14113f564f5c29e3e98_511_1571733283031&tm=1456&eT=0&widgetWidth=590&widgetHeight=1044&widgetX=323&widgetY=4770&wRV=103060&pVis=1&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&eIdx=&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.127 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
content-encoding
gzip
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
content-range
Connection
close
X-TraceId
a2206c5fc16f308d75b2a6f1fce7fc04
Content-Length
30
NVPInjector.min.js
widgets.outbrain.com/nativeVideoPlayer/
13 KB
5 KB
Script
General
Full URL
https://widgets.outbrain.com/nativeVideoPlayer/NVPInjector.min.js
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2e5db12b7bc11cb638f81918df0b68bc7026a2c1e29ac02f2e056dba2cf7303b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Content-Encoding
gzip
Last-Modified
Wed, 01 May 2019 09:33:13 GMT
Server
Apache
ETag
"5cce9fcde7926b25032da388b4c2be7f:1556703193"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=345600
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
4726
streamFeed.js
widgets.outbrain.com/nanoWidget/103060/module/
37 KB
13 KB
Script
General
Full URL
https://widgets.outbrain.com/nanoWidget/103060/module/streamFeed.js
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1d8da6f57df5358c5f6dc10170fb0e043a83ccad4bfa26b2763c0f27bd611b3f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Content-Encoding
gzip
Last-Modified
Thu, 17 Oct 2019 08:24:25 GMT
Server
Apache
ETag
"cefbc9ad5a248cb497690a9d4b00fc00:1571303676"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=345600
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
12665
get
odb.outbrain.com/utils/
62 KB
23 KB
Script
General
Full URL
https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&srcUrl=https%3A%2F%2Fwww.express.co.uk%2Fposts%2Frss%2F23%2Fyourmoney&settings=true&recs=true&widgetJSId=SB_1&key=NANOWDGT01&idx=2&version=103060&apv=true&sig=kUCKVhKu&format=html&rand=18180&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&lsdt=1571733282851&pdobuid=0&osLang=en-US&t=YTIzMzA5ODU2N2RmNjIzZWU3MTRmODU3MTA2ZGY0NTU=&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&secured=true&va=true&cmpStat=1&ref=
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
5eac6edeadda690d9079926e2158acef5ae9d851e217eb27598deeae8f67412e
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=0; includeSubDomains;
content-encoding
gzip
traffic-path
NYDC1, JFK, FRA, Europe1
x-cache
MISS, MISS
p3p
policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status
200
x-cache-hits
0, 0
x-traceid
55c247d8116597895cb7643701381400
content-length
23354
x-served-by
cache-jfk8145-JFK, cache-fra19132-FRA
pragma
no-cache
x-timer
S1571733283.205461,VS0,VE250
date
Tue, 22 Oct 2019 08:34:43 GMT
vary
Accept-Encoding, User-Agent
content-type
text/x-json; charset=UTF-8
via
1.1 varnish, 1.1 varnish
cache-control
no-cache
backend-ip
104.156.90.45
accept-ranges
bytes, bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
play_100x100.png
widgets.outbrain.com/images/widgetIcons/
9 KB
10 KB
Image
General
Full URL
https://widgets.outbrain.com/images/widgetIcons/play_100x100.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bbcd8c21e24392c2c8ef2c5df39578e95b2bff035be4930cbc53b996087783a6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Last-Modified
Thu, 17 Oct 2019 08:24:25 GMT
Server
Apache
ETag
"25a69b3019e3b959aef033482762080f:1571303645"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9422
cache
prebid.adnxs.com/pbc/v1/
63 B
484 B
XHR
General
Full URL
https://prebid.adnxs.com/pbc/v1/cache
Requested by
Host: cdn.watchingthat.net
URL: https://cdn.watchingthat.net/wtat.page-hb3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.252.161.184 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
prebid.ams1.adnexus.net
Software
nginx/1.13.10 /
Resource Hash
824fe3f702b288802cd91adbc0fb5cb289335c2ee754ee0718955c1276d77d5f

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

X-Rate-Limit-Request-Remote-Addr
172.16.87.0:36752
Date
Tue, 22 Oct 2019 08:34:45 GMT
X-Rate-Limit-Request-Forwarded-For
144.76.109.30
X-Rate-Limit-Limit
200
Server
nginx/1.13.10
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://www.express.co.uk
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
63
X-Rate-Limit-Duration
1s
get
mv.outbrain.com/Multivac/api/
37 KB
10 KB
Script
General
Full URL
https://mv.outbrain.com/Multivac/api/get?url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&settings=true&recs=true&widgetJSId=AR_22&key=NANOWDGT01&version=103060&apv=true&sig=kUCKVhKu&format=html&rand=48198&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&lsdt=1571733282851&pdobuid=0&osLang=en-US&va=true&cmpStat=1&srcUrl=https%3A%2F%2Fwww.express.co.uk%2Fposts%2Frss%2F23%2Fyourmoney&scrW=1600&scrH=1200&t=YTIzMzA5ODU2N2RmNjIzZWU3MTRmODU3MTA2ZGY0NTU=&winW=1600&winH=1200&adblck=false&secured=true&feedIdx=1&lastIdx=3&lastCardIdx=0&fAB=no_abtest
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nanoWidget/103060/module/streamFeed.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
f1a85b93b66af4ae83cf7c891b9ebe92bcdcf729bc8f9ba786112d2f2d555761

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
content-encoding
gzip
traffic-path
NYDC1, JFK, FRA, Europe1
x-cache
MISS, MISS
p3p
policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status
200
x-cache-hits
0, 0
x-traceid
ce17cb1ed887723461afbb983694a669
content-length
10105
x-served-by
cache-jfk8146-JFK, cache-fra19132-FRA
pragma
no-cache
x-timer
S1571733283.305187,VS0,VE370
vary
Accept-Encoding, User-Agent
content-type
application/json; charset=UTF-8
via
1.1 varnish, 1.1 varnish
cache-control
no-cache
backend-ip
104.156.90.46
accept-ranges
bytes, bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=express.co.uk&p=%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&u=kczELBZB4Amk2H9r&d=express.co.uk&g=33715&g0=Finance%2C%20Personal%20Finance&g1=Jess%20Sheldon&n=1&f=00001&c=0.02&x=0&m=0&y=7202&o=1585&w=1200&j=30&R=1&W=0&I=0&E=1&e=1&r=&b=1865&t=C-eksfDSSKH4BcQY-8CnIxsFDscYtG&V=116&tz=-120&_vi=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&_vp=5798750504001&_vdd=video%40express.co.uk&_vs=s1&_vt=ct&_vap=&_vtn=https%3A%2F%2Fhttpsak-a.akamaihd.net%2F2540076170001%2F2540076170001_5798751587001_5798750504001-th.jpg%3FpubId%3D2540076170001%26videoId%3D5798750504001&_vd=-1&sn=2&sv=B7NeDNBfky4iB0YOZ0tHo-iw4yCY&sd=1&im=067b9fff&_
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.231.246 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-231-246.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Tue, 22 Oct 2019 08:34:43 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
obp.min.js
libs.sphere.com/video/outbrain-player/current/
92 KB
20 KB
Script
General
Full URL
https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nativeVideoPlayer/NVPInjector.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.250 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-250.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c516fb70b94293a61d199ee79bd1f7c82d3b907ec92586bf7d0271ec24cc94d6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Content-Encoding
gzip
Connection
keep-alive
Content-Length
19884
Pragma
no-cache
Last-Modified
Sun, 06 Oct 2019 11:34:06 GMT
Server
Apache
ETag
"cf08dad7fff31a66b0228975e5523249:1570361646"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Tue, 22 Oct 2019 08:34:43 GMT
collect
www.google-analytics.com/
35 B
102 B
Other
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:43 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
102 B
Other
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:43 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
102 B
Other
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:43 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
102 B
Other
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:43 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
obp.min.css
libs.sphere.com/video/outbrain-player/current/
1 KB
1 KB
Stylesheet
General
Full URL
https://libs.sphere.com/video/outbrain-player/current/obp.min.css
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.250 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-250.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1185ac7ee0922936a46115cf79bf1d9d704792bef6dc6dccf96215d874e9f706

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Content-Encoding
gzip
Connection
keep-alive
Content-Length
470
Pragma
no-cache
Last-Modified
Sun, 06 Oct 2019 11:34:26 GMT
Server
Apache
ETag
"6990dba1bfaa593cddc30001b4d27ad4:1570361666"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Tue, 22 Oct 2019 08:34:43 GMT
/
tt.onthe.io/
0
287 B
XHR
General
Full URL
https://tt.onthe.io/?k[]=41764:video_view[title:Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer,type:Video%20JS,reference_time:64,image:httpsak-a.akamaihd.net%2F2540076170001%2F2540076170001_5798751046001_5798750504001-vs.jpg%3FpubId%3D2540076170001%26videoId%3D5798750504001,video_id:videojs5798750504001,domain:www.express.co.uk,url:%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest,page:Tax%20refund%20scam%20warning%3A%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message,author:Jess%20Sheldon,language:en,category:Finance,sub_category:Personal%20Finance,type_article:longread,pub_date:Tue%2C%2022%20Oct%202019%2007%3A15%3A00%20%2B0100,user_agent:Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36,device:desktop,browser_version:Other%2074,browser:Other,depth:1,user_type:new,user_id:20a99a585.2795d63c1_1571733281435,session_id:85ad6f052.1e0a0f786_1571733281437,cdn_version:97]&s=632ae8d6a623792c016809f53c694b47&1571733283456
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/1eWNpP6x0acZ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.150 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:43 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
/
tt.onthe.io/
0
287 B
XHR
General
Full URL
https://tt.onthe.io/?k[]=43050:video_view[title:Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer,type:Video%20JS,reference_time:64,image:httpsak-a.akamaihd.net%2F2540076170001%2F2540076170001_5798751046001_5798750504001-vs.jpg%3FpubId%3D2540076170001%26videoId%3D5798750504001,video_id:videojs5798750504001,domain:www.express.co.uk,url:%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest,page:Tax%20refund%20scam%20warning%3A%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message,author:Jess%20Sheldon,language:en,category:Finance,sub_category:Personal%20Finance,type_article:longread,pub_date:Tue%2C%2022%20Oct%202019%2007%3A15%3A00%20%2B0100,user_agent:Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36,device:desktop,browser_version:Other%2074,browser:Other,depth:1,user_type:new,user_id:20a99a585.2795d63c1_1571733281435,session_id:85ad6f052.1e0a0f786_1571733281437,cdn_version:97]&s=d7d1d30ce6b0d876b9a7aa6742d7b2fe&1571733283456
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/1eWNpP6x0acZ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.150 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:43 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
obPixelFrame.htm
widgets.outbrain.com/nanoWidget/externals/obPixelFrame/ Frame DF1B
0
0
Document
General
Full URL
https://widgets.outbrain.com/nanoWidget/externals/obPixelFrame/obPixelFrame.htm
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Cookie
akacd_widgets_routing=3749186080~rv=96~id=400a1d00d8ed0017e02406657b2e333c; obuid=671c8e7d-0e61-4695-a071-c8d9af998cd8; recs_84e1ae4254e08b1a4b6fe54bfe9f17bd=0B2392105173A2394926007A2364930029A2442757534A2418968807AC1B1925901673A2366231923A2413432385A1982720339A1970793917A2315245902A1982720374A1970793916A2361454795A2422474680A2398983124A2432761580AC2B1982720461A2428320348A2380735754A2368226925A2016203537A1267563729A2385909899A2375221828A2398301143A2132681214A1989890602A2401032443A2363312899A2436705111ACD1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Server
Apache
ETag
"06266b158cc1a0b89268d5a7103a27c4:1503211501"
Last-Modified
Sun, 20 Aug 2017 06:45:01 GMT
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
271
Cache-Control
max-age=604800
Date
Tue, 22 Oct 2019 08:34:43 GMT
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
obPixelFrame.htm
widgets.outbrain.com/nanoWidget/externals/obPixelFrame/ Frame 0465
0
0
Document
General
Full URL
https://widgets.outbrain.com/nanoWidget/externals/obPixelFrame/obPixelFrame.htm
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Cookie
akacd_widgets_routing=3749186080~rv=96~id=400a1d00d8ed0017e02406657b2e333c; obuid=671c8e7d-0e61-4695-a071-c8d9af998cd8; recs_84e1ae4254e08b1a4b6fe54bfe9f17bd=0B2392105173A2394926007A2364930029A2442757534A2418968807AC1B1925901673A2366231923A2413432385A1982720339A1970793917A2315245902A1982720374A1970793916A2361454795A2422474680A2398983124A2432761580AC2B1982720461A2428320348A2380735754A2368226925A2016203537A1267563729A2385909899A2375221828A2398301143A2132681214A1989890602A2401032443A2363312899A2436705111ACD1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Server
Apache
ETag
"06266b158cc1a0b89268d5a7103a27c4:1503211501"
Last-Modified
Sun, 20 Aug 2017 06:45:01 GMT
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
271
Cache-Control
max-age=604800
Date
Tue, 22 Oct 2019 08:34:43 GMT
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
obPixelFrame.htm
widgets.outbrain.com/nanoWidget/externals/obPixelFrame/ Frame 46D3
0
0
Document
General
Full URL
https://widgets.outbrain.com/nanoWidget/externals/obPixelFrame/obPixelFrame.htm
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Cookie
akacd_widgets_routing=3749186080~rv=96~id=400a1d00d8ed0017e02406657b2e333c; obuid=671c8e7d-0e61-4695-a071-c8d9af998cd8; recs_84e1ae4254e08b1a4b6fe54bfe9f17bd=0B2392105173A2394926007A2364930029A2442757534A2418968807AC1B1925901673A2366231923A2413432385A1982720339A1970793917A2315245902A1982720374A1970793916A2361454795A2422474680A2398983124A2432761580AC2B1982720461A2428320348A2380735754A2368226925A2016203537A1267563729A2385909899A2375221828A2398301143A2132681214A1989890602A2401032443A2363312899A2436705111ACD1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Server
Apache
ETag
"06266b158cc1a0b89268d5a7103a27c4:1503211501"
Last-Modified
Sun, 20 Aug 2017 06:45:01 GMT
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
271
Cache-Control
max-age=604800
Date
Tue, 22 Oct 2019 08:34:43 GMT
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
obPixelFrame.htm
widgets.outbrain.com/nanoWidget/externals/obPixelFrame/ Frame 89FD
0
0
Document
General
Full URL
https://widgets.outbrain.com/nanoWidget/externals/obPixelFrame/obPixelFrame.htm
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Cookie
akacd_widgets_routing=3749186080~rv=96~id=400a1d00d8ed0017e02406657b2e333c; obuid=671c8e7d-0e61-4695-a071-c8d9af998cd8; recs_84e1ae4254e08b1a4b6fe54bfe9f17bd=0B2392105173A2394926007A2364930029A2442757534A2418968807AC1B1925901673A2366231923A2413432385A1982720339A1970793917A2315245902A1982720374A1970793916A2361454795A2422474680A2398983124A2432761580AC2B1982720461A2428320348A2380735754A2368226925A2016203537A1267563729A2385909899A2375221828A2398301143A2132681214A1989890602A2401032443A2363312899A2436705111ACD1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Server
Apache
ETag
"06266b158cc1a0b89268d5a7103a27c4:1503211501"
Last-Modified
Sun, 20 Aug 2017 06:45:01 GMT
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
271
Cache-Control
max-age=604800
Date
Tue, 22 Oct 2019 08:34:43 GMT
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
obPixelFrame.htm
widgets.outbrain.com/nanoWidget/externals/obPixelFrame/ Frame 4D28
0
0
Document
General
Full URL
https://widgets.outbrain.com/nanoWidget/externals/obPixelFrame/obPixelFrame.htm
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Cookie
akacd_widgets_routing=3749186080~rv=96~id=400a1d00d8ed0017e02406657b2e333c; obuid=671c8e7d-0e61-4695-a071-c8d9af998cd8; recs_84e1ae4254e08b1a4b6fe54bfe9f17bd=0B2392105173A2394926007A2364930029A2442757534A2418968807AC1B1925901673A2366231923A2413432385A1982720339A1970793917A2315245902A1982720374A1970793916A2361454795A2422474680A2398983124A2432761580AC2B1982720461A2428320348A2380735754A2368226925A2016203537A1267563729A2385909899A2375221828A2398301143A2132681214A1989890602A2401032443A2363312899A2436705111ACD1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Server
Apache
ETag
"06266b158cc1a0b89268d5a7103a27c4:1503211501"
Last-Modified
Sun, 20 Aug 2017 06:45:01 GMT
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
271
Cache-Control
max-age=604800
Date
Tue, 22 Oct 2019 08:34:43 GMT
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
ob_logo_67x12.png
widgets.outbrain.com/images/widgetIcons/
2 KB
3 KB
Image
General
Full URL
https://widgets.outbrain.com/images/widgetIcons/ob_logo_67x12.png
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-190.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Last-Modified
Thu, 17 Oct 2019 08:24:25 GMT
Server
Apache
ETag
"c52b07e749f7a09fa7b97b7e195e06ce:1571303630"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
2326
l
mcdp-nydc1.outbrain.com/
4 B
377 B
XHR
General
Full URL
https://mcdp-nydc1.outbrain.com/l?token=76fc292bd6d3199602bd46e53c30fbe8_511_1571733283386&tm=1727&eT=0&widgetWidth=330&widgetHeight=1778&widgetX=933&widgetY=2088&wRV=103060&pVis=1&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&eIdx=&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.127 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
content-encoding
gzip
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
content-range
Connection
close
X-TraceId
598398b03ad96ec6d842a527fbbde724
Content-Length
30
get
odb.outbrain.com/utils/
18 KB
6 KB
Script
General
Full URL
https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&srcUrl=https%3A%2F%2Fwww.express.co.uk%2Fposts%2Frss%2F23%2Fyourmoney&settings=true&recs=true&widgetJSId=AR_2&key=NANOWDGT01&idx=3&version=103060&apv=true&sig=kUCKVhKu&format=html&rand=48801&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&lsdt=1571733282851&pdobuid=0&osLang=en-US&t=YTIzMzA5ODU2N2RmNjIzZWU3MTRmODU3MTA2ZGY0NTU=&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&secured=true&va=true&cmpStat=1&ref=
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
57841cac3489f419acc7b6d6ad1c741350957f7d06926564b4ef8fcc4ec3673b
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=0; includeSubDomains;
content-encoding
gzip
traffic-path
NYDC1, JFK, FRA, Europe1
x-cache
MISS, MISS
p3p
policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status
200
x-cache-hits
0, 0
x-traceid
59e6f37699209bfa4d614bc94ba51abc
content-length
5418
x-served-by
cache-jfk8132-JFK, cache-fra19132-FRA
pragma
no-cache
x-timer
S1571733283.476862,VS0,VE202
date
Tue, 22 Oct 2019 08:34:43 GMT
vary
Accept-Encoding, User-Agent
content-type
text/x-json; charset=UTF-8
via
1.1 varnish, 1.1 varnish
cache-control
no-cache
backend-ip
104.156.90.32
accept-ranges
bytes, bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
loader.js
imasdk.googleapis.com/js/sdkloader/ Frame DB0F
37 KB
13 KB
Script
General
Full URL
https://imasdk.googleapis.com/js/sdkloader/loader.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
85850ffc2439a5e355eb034d9f76c4af14dcce62a7fa6cf88f0ba52111412e9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:22:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 17 Oct 2019 15:18:55 GMT
server
sffe
age
711
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13669
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:37:52 GMT
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&event=ad_start&video=5798750504001&video_name=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&video_duration=64&time=1571733283649&seq=21_-1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:43 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
tracker
metrics.brightcove.com/v2/
35 B
97 B
Image
General
Full URL
https://metrics.brightcove.com/v2/tracker?domain=videocloud&platform=video-js&session=7212fe8d312ee78b9d50c1bc&account=2540076170001&destination=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&platform_version=6.19.2&player=players.brightcove.com%2F2540076170001%2FB1Hli6KCG_default&player_name=%5BEXPRESS%5D%20-%20v3.3%20Autoplay%20Prebid.js&source=&time=1571733283549&event=video_impression&web_ad_info=%7B%22plugin%22%3A%22ima3%22%2C%22pluginVersion%22%3A%223.2.1%22%2C%22adTech%22%3A%22html5%22%2C%22requestMode%22%3A%22onplay%22%2C%22timeout%22%3A12000%7D&video=5798750504001&video_name=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&video_duration=64&autoplay=false&preload=auto&seq=22_0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.232.184 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
184.232.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300; includeSubDomains
via
1.1 google
date
Tue, 22 Oct 2019 08:34:43 GMT
content-type
image/gif
status
200
cache-control
must-revalidate,no-cache,no-store
alt-svc
clear
content-length
35
instreamadbroker.js
cdn.spotxcdn.com/integration/instreamadbroker/v1/ Frame DB0F
228 KB
90 KB
Script
General
Full URL
https://cdn.spotxcdn.com/integration/instreamadbroker/v1/instreamadbroker.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/loader.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.234 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-234.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
01c417e4ea52cd6bcf4926f6a407ab12c995b851798a0301845fd5b1dc15cdbb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 Sep 2019 21:51:01 UTC
Server
nginx
ETag
30ae9e9e8a811b786763dc871c323013
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, GET, PATCH, DELETE, OPTIONS
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=114
X-SpotX-Build-Version
2.28.0-20190920.2115
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Headers
Content-Length
91647
l
mcdp-nydc1.outbrain.com/
4 B
377 B
XHR
General
Full URL
https://mcdp-nydc1.outbrain.com/l?token=a8c57b95221faf8e437779e2cccc7c30_511_1571733283496&tm=1968&eT=0&widgetWidth=590&widgetHeight=907&widgetX=323&widgetY=5852&wRV=103060&pVis=1&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&eIdx=&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.127 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
content-encoding
gzip
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
content-range
Connection
close
X-TraceId
7d6d92868082593ce62ce9c433994566
Content-Length
30
l
mcdp-nydc1.outbrain.com/
4 B
377 B
XHR
General
Full URL
https://mcdp-nydc1.outbrain.com/l?token=987f559b0c935984fefe496e291f0819_511_1571733283618&tm=1970&eT=0&widgetWidth=590&widgetHeight=298&widgetX=323&widgetY=6779&wRV=103060&pVis=1&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&eIdx=&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.127 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
content-encoding
gzip
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
content-range
Connection
close
X-TraceId
2182f4e147c16d094a7779a6fce7a9c4
Content-Length
30
l
mcdp-nydc1.outbrain.com/
4 B
377 B
XHR
General
Full URL
https://mcdp-nydc1.outbrain.com/l?token=e9708ebaf6eac8c3b5b0811176076561_511_1571733283625&tm=1995&eT=0&widgetWidth=590&widgetHeight=150&widgetX=323&widgetY=1886&wRV=103060&pVis=1&lsd=671c8e7d-0e61-4695-a071-c8d9af998cd8&eIdx=&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.127 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
content-encoding
gzip
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
content-range
Connection
close
X-TraceId
ea9242063af107cab81bba3a0d0b34b5
Content-Length
30
eyJpdSI6ImM5YjZjNzgxOWM2NTBkY2UxZGU0MzU4MzA0M2UzNDkzODgyNjNiNDQ4ZjM0ZjQzZDc5Y2QzYzQ0MmQzYjEwMDYiLCJ3IjoxNzAsImgiOjExMywiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
7 KB
7 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6ImM5YjZjNzgxOWM2NTBkY2UxZGU0MzU4MzA0M2UzNDkzODgyNjNiNDQ4ZjM0ZjQzZDc5Y2QzYzQ0MmQzYjEwMDYiLCJ3IjoxNzAsImgiOjExMywiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.28 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
96412e391f09be493b55f981abf34177f77d26762a18e7b6b87c0293a5c088c9
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Mon, 07 Oct 2019 08:15:30 GMT
Date
Tue, 22 Oct 2019 08:34:43 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1240997
Connection
keep-alive
X-TraceId
ea4fe65a644fc3aa82bc256379c7e334
Timing-Allow-Origin
*
Content-Length
7262
vpaidjsproxy-20190930.js
playtime.tubemogul.com/ud/prod/ad_plugins/release/ Frame A51C
50 KB
17 KB
Script
General
Full URL
https://playtime.tubemogul.com/ud/prod/ad_plugins/release/vpaidjsproxy-20190930.js?feedURL=https%3A%2F%2Fasf-tm.everesttech.net%2Ffeed%2Fplacement.js%3Fid%3DWe0nATVNAtvwvrOpbjtB%26tm_auction_id%3Dcb9b9287f4a611e9b2f613ae17dc0006.1%26price%3D1%26bi%3DB087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk%26did%3D%26didtype%3DUNK%26barefeed%3DT%26rand%3D1437732598%26seller_id%3D124576%26tm_user_ip%3D6b7394220b53d16a5ac96d1fe8d2b2b3%26expaId%3D%26q%3DH4sIAAAAAAAAAG2Ry08TURSHvS2WhyGSUhLSuLh2BcSZzp3pvNRIWkGtbaW2IJUNuTNzp710XszclseSmGgwcYHRBYmJa3FlIgv8FzBu1IVrV7oxLF2oRUxMjGdxFr-c37f4zuDowfAq-7l3OPZs6Ymf_tE3NMU2AsI3fb_pEBzQiDd9N2tQyyIhn7fqJOySsEZWOyRiyXd94x8eJDKpRSJ4-fk7t_Ksu9YN5wJjhRUmXr65B8SUawe4tWKIN71iR2vVVVlCa9rbp6_3zhZSQaVsLxSlxl2vUZ4ttpFZ9rUdsFHxN6nj4KzMC3Cigk3qMT9qXYJFjxEH9gI4V4cNiIRllFuWJ2E-CByySIwSZVlZUnlJgROlG_OV8gXo0DaB14nZ9ifh1VbouySr5niBl1RR55Giwzq2cUj_1HYBVAxV0nOiKBiyZCEFy9jUFQvZRLNEQzSkA5AxDd3QRU21c1hBiOiGaCtIwgSplikIgsKjL0AZuP95PJnSqw6do1ZzCUuVQLfCoqjeTg-T9SAk0bFYvtOGQAD6la9prn_zcPoIJJCYk1XlO0hprrNUrW10hZVat6KVGiW5gLZig8zlsBtxCG_HkiEzuJPPcDYNIyYpO7GRf8MXsb6IMvIq1t_x2p6_5h3FLg_9xSQTJ8fp_9Ayoz1XXG2-wIkC0pGAFE5CW_GZodNR4LP1keePPw2n4wv1mczxmjz1e75NX4xTNyicu9bTPbvOSOhhpxpSk9R7pYbZwl6TVAe242cGwAgYBxBMAXE3foI8vz_2cf89ePTwF3zr1nGYAgAA%26psId%3D9PliOidgZa3Mp9drI27Q%26page_url%3Dhttps%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&cpKey=mfpahjb2JnIu8hS7531w&mpKey=We0nATVNAtvwvrOpbjtB&adKey=pMLfUI3XYnXLEIk1cLo8&framework=vpaid&psId=9PliOidgZa3Mp9drI27Q&cd=%7B%22zip%22%3A%22UNKNOWN%22%2C%22fbd%22%3A%7B%22ssb%22%3A%22F%22%2C%22psb%22%3A%22F%22%2C%22pd%22%3A%22express.co.uk%22%2C%22mpw%22%3A%22640%22%2C%22mph%22%3A%22480%22%2C%22aburl%22%3A%22http%3A%2F%2Fsearch.spotxchange.com%2Ftrack%2Ftag%2F6409.4645%2Fimg%3Fdate%3D1571733282981%26pid%3D124576%26cid%3D216448%26provided_url%3D%24%7Bpd%7D%26detected_url%3D%24%7Bdu%7D%22%7D%7D&price=1&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&pt=imp&cpId=694808&plcId=2170284&mpId=99413&adId=4117580621&psIdNum=406023&iasMon=F&env=site&conn=unknown&videoURL=https%3A%2F%2Fvast.adsafeprotected.com%2Fvast%2Ffwjsvid%2Fst%2F331804%2F39018748%2Fskeleton.js%3FincludeFlash%3Dfalse%26originalVast%3Dhttps%3A%2F%2Fad.doubleclick.net%2Fddm%2Fpfadx%2FN7881.2610ADOBESYSTEMSINC.%2FB23075601.253815120%3Bsz%3D0x0%3Bord%3D1437732598%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bdcmt%3Dtext%2Fxml%3Bdc_sdk_apis%3D%5BAPIFRAMEWORKS%5D%3Bdc_omid_p%3D%5BOMIDPARTNER%5D
Requested by
Host: cdn.spotxcdn.com
URL: https://cdn.spotxcdn.com/integration/instreamadbroker/v1/instreamadbroker.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FAE) /
Resource Hash
401c91003752594ba259739d54f6431c01fee188d115306d95bf42846e053163

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
content-encoding
gzip
last-modified
Mon, 30 Sep 2019 22:39:49 GMT
server
ECAcc (frc/8FAE)
status
200
etag
"3897803204"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
16776
expires
Wed, 23 Oct 2019 08:34:43 GMT
usermatch.gif
beacon.krxd.net/ Frame DB0F
Redirect Chain
  • https://sync.search.spotxchange.com/audience_sync/9?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dspotxchange%2...
  • https://beacon.krxd.net/usermatch.gif?partner=spotxchange&partner_uid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
0
320 B
Image
General
Full URL
https://beacon.krxd.net/usermatch.gif?partner=spotxchange&partner_uid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.212.115.156 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-212-115-156.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:44 GMT
cache-control
private, no-cache, no-store
x-request-time
D=28 t=1571733284
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-served-by
beacon-n016-dub-prod.krxd.net

Redirect headers

Date
Tue, 22 Oct 2019 08:34:43 GMT
Server
nginx
Location
https://beacon.krxd.net/usermatch.gif?partner=spotxchange&partner_uid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
85
Connection
keep-alive
Content-Length
0
47154.gif
idsync.rlcdn.com/ Frame DB0F
Redirect Chain
  • https://sync.search.spotxchange.com/audience_sync/8?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fidsync.rlcdn.com%2F397806.gif%3Fpartner_uid%3Dcb1da7df-f4...
  • https://idsync.rlcdn.com/397806.gif?partner_uid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
  • https://idsync.rlcdn.com/1000.gif?memo=CO6jGBIvCisIARCAdRokY2IxZGE3ZGYtZjRhNi0xMWU5LWFlMDMtMTFhM2NiYmEwOTA2EAAaDQik_rrtBRIFCOgHEABCAEoA
  • https://sync.mathtag.com/sync/img?mt_exid=10017&redir=https%3A%2F%2Fidsync.rlcdn.com%2F47154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%5BMM_UUID%5D
  • https://sync.mathtag.com/sync/img?mt_exid=10017&redir=https%3A%2F%2Fidsync.rlcdn.com%2F47154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%5BMM_UUID%5D&mm_bnc&mm_bct&UUID=d7e25dae-b9ef-4500-b63b-177...
  • https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=d7e25dae-b9ef-4500-b63b-1772e7979cf9
42 B
336 B
Image
General
Full URL
https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=d7e25dae-b9ef-4500-b63b-1772e7979cf9
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
21.72.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:44 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
status
200
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
clear
content-length
42

Redirect headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
MT3 1796 9706391 master cdg-pixel-x16
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=d7e25dae-b9ef-4500-b63b-1772e7979cf9
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 22 Oct 2019 08:34:43 GMT
partner
sync.search.spotxchange.com/ Frame DB0F
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
  • https://sync-tm.everesttech.net/ct/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1&_test=Xa6-IwAAAKKdT36l
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Xa6-IwAAAKKdT36l&img=1&_test=Xa6-IwAAAKKdT36l
43 B
525 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Xa6-IwAAAKKdT36l&img=1&_test=Xa6-IwAAAKKdT36l
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
30
Connection
keep-alive
Content-Length
43

Redirect headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:44 GMT
via
1.1 varnish
server
Varnish
x-timer
S1571733284.186120,VS0,VE0
x-served-by
cache-fra19138-FRA
status
302
x-cache
HIT
location
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Xa6-IwAAAKKdT36l&img=1&_test=Xa6-IwAAAKKdT36l
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
partner
sync.search.spotxchange.com/ Frame DB0F
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_sc
  • https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESELC2lC_mYnVal0MUelRHyWo&google_cver=1
  • https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESELC2lC_mYnVal0MUelRHyWo&google_cver=1&__user_check__=1&sync_id=cc5baefb-f4a6-11e9-b18c-1a27ea400806
43 B
525 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESELC2lC_mYnVal0MUelRHyWo&google_cver=1&__user_check__=1&sync_id=cc5baefb-f4a6-11e9-b18c-1a27ea400806
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
63
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Location
/partner?adv_id=7025&uid=CAESELC2lC_mYnVal0MUelRHyWo&google_cver=1&__user_check__=1&sync_id=cc5baefb-f4a6-11e9-b18c-1a27ea400806
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
26
Connection
keep-alive
Content-Length
0
cb1da7df-f4a6-11e9-ae03-11a3cbba0906
pr-bh.ybp.yahoo.com/sync/spotx/ Frame DB0F
43 B
290 B
Image
General
Full URL
https://pr-bh.ybp.yahoo.com/sync/spotx/cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c205::2000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
status
200
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
partner
sync.search.spotxchange.com/ Frame DB0F
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=935
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=2159827868463151858&img=1
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=2159827868463151858&img=1&__user_check__=1&sync_id=cc5f2d1c-f4a6-11e9-a204-1ac054420406
43 B
525 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=2159827868463151858&img=1&__user_check__=1&sync_id=cc5f2d1c-f4a6-11e9-a204-1ac054420406
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
70
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Location
/partner?adv_id=7180&uid=2159827868463151858&img=1&__user_check__=1&sync_id=cc5f2d1c-f4a6-11e9-a204-1ac054420406
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
125
Connection
keep-alive
Content-Length
0
partner
sync.search.spotxchange.com/ Frame DB0F
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=spotx&ttd_tpi=1
  • https://sync.search.spotxchange.com/partner?adv_id=7028&uid=467e77ec-b658-416d-a8cf-ed13ff1cb81f&img=1
  • https://sync.search.spotxchange.com/partner?adv_id=7028&uid=467e77ec-b658-416d-a8cf-ed13ff1cb81f&img=1&__user_check__=1&sync_id=cc5bd26e-f4a6-11e9-b03c-18a305862806
43 B
525 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?adv_id=7028&uid=467e77ec-b658-416d-a8cf-ed13ff1cb81f&img=1&__user_check__=1&sync_id=cc5bd26e-f4a6-11e9-b03c-18a305862806
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
61
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Location
/partner?adv_id=7028&uid=467e77ec-b658-416d-a8cf-ed13ff1cb81f&img=1&__user_check__=1&sync_id=cc5bd26e-f4a6-11e9-b03c-18a305862806
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
58
Connection
keep-alive
Content-Length
0
partner
sync.search.spotxchange.com/ Frame DB0F
Redirect Chain
  • https://ib.adnxs.com/getuid?https://sync.search.spotxchange.com/partner?adv_id=7715&uid=$UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D7715%26uid%3D%24UID
  • https://sync.search.spotxchange.com/partner?adv_id=7715&uid=0
43 B
526 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?adv_id=7715&uid=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
129
Connection
keep-alive
Content-Length
43

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:46 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 301.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.102:80
AN-X-Request-Uuid
4cc3b971-b492-4b78-ada1-389cc19e9f52
Server
nginx/1.13.4
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://sync.search.spotxchange.com/partner?adv_id=7715&uid=0
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
partner
sync.search.spotxchange.com/ Frame DB0F
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=spotx
  • https://x.bidswitch.net/ul_cb/sync?ssp=spotx
  • https://bsw.digitru.st/syncx?ssp=spotx
  • https://aws-fr-sync.bidswitch.net/sync?ssp=spotx&bsw_own_uuid=
  • https://aws-fr-sync.bidswitch.net/ul_cb/sync?ssp=spotx&bsw_own_uuid=
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=spotx&bsw_custom_parameter=fad91eba-f43b-432e-8238-8aebcb6d50d4
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=spotx&bsw_custom_parameter=fad91eba-f43b-432e-8238-8aebcb6d50d4
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=4925c2c7-7f0d-420b-9ac4-fd913b8ed82d&user_group=1&ssp=spotx&bsw_param=fad91eba-f43b-432e-8238-8aebcb6d50d4
  • https://sync.search.spotxchange.com/partner?adv_id=7310&uid=fad91eba-f43b-432e-8238-8aebcb6d50d4
43 B
526 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?adv_id=7310&uid=fad91eba-f43b-432e-8238-8aebcb6d50d4
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
103
Connection
keep-alive
Content-Length
43

Redirect headers

status
302
date
Tue, 22 Oct 2019 08:34:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
location
//sync.search.spotxchange.com/partner?adv_id=7310&uid=fad91eba-f43b-432e-8238-8aebcb6d50d4
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
match
c1.adform.net/serving/cookie/ Frame DB0F
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=30
  • https://c1.adform.net/serving/cookie/match?CC=1&party=30
35 B
187 B
Image
General
Full URL
https://c1.adform.net/serving/cookie/match?CC=1&party=30
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:44 GMT
server
nginx
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
expires
-1

Redirect headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:43 GMT
server
nginx
status
302
location
https://c1.adform.net/serving/cookie/match?CC=1&party=30
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
content-length
0
expires
-1
partner
sync.search.spotxchange.com/ Frame DB0F
Redirect Chain
  • https://ad.turn.com/r/cs?pid=16
  • https://sync.search.spotxchange.com/partner?adv_id=6481&img=1&uid=8251762968779371606
  • https://sync.search.spotxchange.com/partner?adv_id=6481&img=1&uid=8251762968779371606&__user_check__=1&sync_id=cc5f640e-f4a6-11e9-988c-1ce730eb2006
43 B
526 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?adv_id=6481&img=1&uid=8251762968779371606&__user_check__=1&sync_id=cc5f640e-f4a6-11e9-988c-1ce730eb2006
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
100
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Location
/partner?adv_id=6481&img=1&uid=8251762968779371606&__user_check__=1&sync_id=cc5f640e-f4a6-11e9-988c-1ce730eb2006
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
140
Connection
keep-alive
Content-Length
0
partner
sync.search.spotxchange.com/ Frame DB0F
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=30&redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6653%26uid%3D%5BMM_UUID%5D
  • https://sync.search.spotxchange.com/partner?adv_id=6653&uid=b7785dae-b888-4100-8985-9e07410aaff0
  • https://sync.search.spotxchange.com/partner?adv_id=6653&uid=b7785dae-b888-4100-8985-9e07410aaff0&__user_check__=1&sync_id=cc5fcf7f-f4a6-11e9-bba5-1ebee0f61406
43 B
526 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?adv_id=6653&uid=b7785dae-b888-4100-8985-9e07410aaff0&__user_check__=1&sync_id=cc5fcf7f-f4a6-11e9-bba5-1ebee0f61406
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
132
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Location
/partner?adv_id=6653&uid=b7785dae-b888-4100-8985-9e07410aaff0&__user_check__=1&sync_id=cc5fcf7f-f4a6-11e9-bba5-1ebee0f61406
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
92
Connection
keep-alive
Content-Length
0
ping_match.gif
pm.w55c.net/ Frame DB0F
0
550 B
Image
General
Full URL
https://pm.w55c.net/ping_match.gif?st=SPOTX&rurl=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6465%26uid%3D_wfivefivec_%26img%3D1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.21.24 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-21-24.eu-central-1.compute.amazonaws.com
Software
PingMatch/v2.0.30-356-g385303a#rel-ec2-master i-02648ec96f4ac53e3@eu-central-1a@dxedge-app_eu-central-1_prod_asg /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:43 GMT
Cache-Control
no-cache, must-revalidate
Server
PingMatch/v2.0.30-356-g385303a#rel-ec2-master i-02648ec96f4ac53e3@eu-central-1a@dxedge-app_eu-central-1_prod_asg
Connection
keep-alive
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Expires
Fri, 01 Jan 1990 00:00:00 GMT
tpid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
sync.crwdcntrl.net/map/ct=y/c=4914/tp=SPXC/ Frame DB0F
Redirect Chain
  • https://sync.search.spotxchange.com/audience_sync/7?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D4914%2Ftp%3DSPXC%2Ftpid%3D...
  • https://sync.crwdcntrl.net/map/c=4914/tp=SPXC/tpid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
  • https://sync.crwdcntrl.net/map/ct=y/c=4914/tp=SPXC/tpid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
49 B
947 B
Image
General
Full URL
https://sync.crwdcntrl.net/map/ct=y/c=4914/tp=SPXC/tpid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.194.238.142 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-194-238-142.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:44 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Access-Control-Allow-Origin
*
Cache-Control
no-cache
X-Server
10.45.27.119
Connection
keep-alive
Content-Type
image/gif
Content-Length
49
Expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:44 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://sync.crwdcntrl.net/map/ct=y/c=4914/tp=SPXC/tpid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Cache-Control
no-cache
X-Server
10.45.14.163
Connection
keep-alive
Content-Length
0
Expires
0
pixel.gif
cdn.spotxcdn.com/media/thumbs/pixel/ Frame DB0F
Redirect Chain
  • https://sync.search.spotxchange.com/audience_sync/12?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotx%26goog...
  • https://cm.g.doubleclick.net/pixel?google_nid=spotx&google_hm=Y2IxZGE3ZGYtZjRhNi0xMWU5LWFlMDMtMTFhM2NiYmEwOTA2
  • https://cm.g.doubleclick.net/pixel?google_nid=spotx&google_hm=Y2IxZGE3ZGYtZjRhNi0xMWU5LWFlMDMtMTFhM2NiYmEwOTA2&google_tc=
  • https://cdn.spotxcdn.com/media/thumbs/pixel/pixel.gif
43 B
509 B
Image
General
Full URL
https://cdn.spotxcdn.com/media/thumbs/pixel/pixel.gif
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.234 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-234.deploy.static.akamaitechnologies.com
Software
Apache/2.2.23 (Unix) mod_ssl/2.2.23 OpenSSL/1.0.1e-fips /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Last-Modified
Thu, 26 May 2011 15:59:36 UTC
Server
Apache/2.2.23 (Unix) mod_ssl/2.2.23 OpenSSL/1.0.1e-fips
Access-Control-Allow-Methods
POST, GET, PATCH, DELETE, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.familyeducation.com
Cache-Control
max-age=190985
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Content-Length
43

Redirect headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:44 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cdn.spotxcdn.com/media/thumbs/pixel/pixel.gif
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
250
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
demconf.jpg
dpm.demdex.net/ Frame DB0F
Redirect Chain
  • https://sync.search.spotxchange.com/audience_sync/13?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D178522%26dpuuid%3Dcb1da7df...
  • https://dpm.demdex.net/ibs:dpid=178522&dpuuid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=178522&dpuuid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
42 B
840 B
Image
General
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=178522&dpuuid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-151-160.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v048-0c291008f.edge-irl1.demdex.com 5.61.0.20191015084456 2ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
sX0KULCcT9U=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
p2FlGTPRRIM=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=178522&dpuuid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel.gif
load77.exelator.com/ Frame DB0F
Redirect Chain
  • https://sync.search.spotxchange.com/audience_sync/3?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Floadm.exelator.com%2Fload%2F%3Fp%3D204%26g%3D1135%26j%3D0...
  • https://loadm.exelator.com/load/?p=204&g=1135&j=0&buid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
  • https://loadm.exelator.com/load/?p=204&g=1135&j=0&buid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&xl8blockcheck=1
  • https://load77.exelator.com/pixel.gif
43 B
273 B
Image
General
Full URL
https://load77.exelator.com/pixel.gif
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
195.181.174.6 Frankfurt am Main, Germany, ASN60068 (CDN77, GB),
Reverse DNS
frankfurt-1.cdn77.com
Software
CDN77-Turbo /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:44 GMT
last-modified
Wed, 25 Oct 2017 17:03:56 GMT
server
CDN77-Turbo
x-edge-location
frankfurtDE
etag
"59f0c3fc-2b"
status
200
x-cache
HIT
content-type
image/gif
access-control-allow-origin
*
x-edge-ip
195.181.174.1
x-age
1008550
accept-ranges
bytes
content-length
43

Redirect headers

date
Tue, 22 Oct 2019 08:34:44 GMT
server
nginx/1.14.0
x-powered-by
Undertow/1
status
302
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location
https://load77.exelator.com/pixel.gif
cache-control
no-cache
access-control-allow-credentials
true
content-type
image/gif
content-length
0
53296
tags.bluekai.com/site/ Frame DB0F
Redirect Chain
  • https://sync.search.spotxchange.com/audience_sync/2?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Ftags.bluekai.com%2Fsite%2F53296%3Flimit%3D0%26id%3Dcb1da7...
  • https://tags.bluekai.com/site/53296?limit=0&id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
62 B
757 B
Image
General
Full URL
https://tags.bluekai.com/site/53296?limit=0&id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.67.136.71 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-71.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Connection
keep-alive
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length
62
BK-Server
a93c
Content-Type
image/gif

Redirect headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Location
https://tags.bluekai.com/site/53296?limit=0&id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
10
Connection
keep-alive
Content-Length
0
g.pixel
aa.agkn.com/adscores/ Frame DB0F
Redirect Chain
  • https://sync.search.spotxchange.com/audience_sync/15?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Faa.agkn.com%2Fadscores%2Fg.pixel%3Fsid%3D9212291758%26pu...
  • https://aa.agkn.com/adscores/g.pixel?sid=9212291758&puid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
43 B
331 B
Image
General
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212291758&puid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.239.109 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-239-109.eu-west-2.compute.amazonaws.com
Software
AAWebServer /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:44 GMT
server
AAWebServer
p3p
policyref="http://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0

Redirect headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Location
https://aa.agkn.com/adscores/g.pixel?sid=9212291758&puid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
43
Connection
keep-alive
Content-Length
0
bct
mid.rkdms.com/ Frame DB0F
Redirect Chain
  • https://sync.search.spotxchange.com/audience_sync/18?spotx_push=1&spotx_audience_id=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&redir=https%3A%2F%2Fmid.rkdms.com%2Fbct%3Fpid%3Dc3a70011-3c5e-43d1-a871-fb23...
  • https://mid.rkdms.com/bct?pid=c3a70011-3c5e-43d1-a871-fb23c6b5a44f&puid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&_ct=img
43 B
366 B
Image
General
Full URL
https://mid.rkdms.com/bct?pid=c3a70011-3c5e-43d1-a871-fb23c6b5a44f&puid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&_ct=img
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.78.78 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-225-78-78.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 20:38:40 GMT
via
1.1 04ce5a607a98db6d08257633417b84d7.cloudfront.net (CloudFront)
last-modified
Fri, 24 Aug 2018 18:08:57 GMT
server
AmazonS3
age
43046
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
x-cache
Hit from cloudfront
content-type
image/gif
status
200
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
43
x-amz-cf-id
IH5aw4l6YSDJD6-YAp5P4HBPIssx66aDFDk3-KVVBWQDfuhvB6s73A==

Redirect headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Location
https://mid.rkdms.com/bct?pid=c3a70011-3c5e-43d1-a871-fb23c6b5a44f&puid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&_ct=img
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
80
Connection
keep-alive
Content-Length
0
b2
sb.scorecardresearch.com/ Frame DB0F
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=1&c2=6272977&c3=216448&cv=1.3&cj=1
  • https://sb.scorecardresearch.com/b2?c1=1&c2=6272977&c3=216448&cv=1.3&cj=1
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=1&c2=6272977&c3=216448&cv=1.3&cj=1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:44 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=1&c2=6272977&c3=216448&cv=1.3&cj=1
Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:44 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
p2
sb.scorecardresearch.com/ Frame DB0F
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=6272977&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733283155251&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=6272977&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733283155251&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&n...
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=6272977&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733283155251&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va&ns_st_cl=30000&ns_st_pt=0&c3=216448&c4=1e6a0.84371.76d2&c6=6409&ns_ts=1571733283155251
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:44 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=6272977&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733283155251&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va&ns_st_cl=30000&ns_st_pt=0&c3=216448&c4=1e6a0.84371.76d2&c6=6409&ns_ts=1571733283155251
Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:44 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
reporter
srv.imonomy.com/internal/
43 B
599 B
Image
General
Full URL
https://srv.imonomy.com/internal/reporter?v=2&subid=none_personalized_ads&format=0&ai=990&ctxu=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&fb=false&cid=11,12,15,22,26,30&ab=&cbs=0.34152851311759114&sid=14567721676&terms=&httpsite=true&keywords=&dm=express.co.uk&charset=UTF-8&timepreload=1571733282726&ptaken=1433&ttaken=1433&ttkan_x=0&sum_ttkan_x=0&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&cqt=11,12,15,22,26,30&ln=en&ct=0&w=1600&h=1200&pxr=1&ppi=96&loc=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=www.express.co.uk&subid=none_personalized_ads&rtb_highest_price=&rim=true
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
9327663db171e3c01e351f3f5562ee5ed8f3d6bde6a7da57d966997f1a4b7a57

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Server
nginx
Etag
"ad6fdcd6bc9b5969566123ca061bde27f6f197cf"
Vary
Accept-Encoding
Content-Type
image/gif
Cache-Control
public, max-age=86400
Connection
keep-alive
Content-Length
43
in
c2.u5c93.com/v5/
2 B
364 B
Other
General
Full URL
https://c2.u5c93.com/v5/in
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.246.207.119 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-246-207-119.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundarykvqwxKDfHBPJyqXA

Response headers

date
Tue, 22 Oct 2019 08:34:44 GMT
status
200
x-powered-by
Express
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary
Origin
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
content-length
2
obp-slide-center.css
libs.sphere.com/video/outbrain-player/current/
717 B
846 B
XHR
General
Full URL
https://libs.sphere.com/video/outbrain-player/current/obp-slide-center.css
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.250 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-250.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
76f037243db426f4e0d4e74c809969c610b4cab9555c2e14a4472a9f2c449366

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Connection
keep-alive
Content-Length
264
Pragma
no-cache
Last-Modified
Sun, 06 Oct 2019 11:35:28 GMT
Server
Apache
ETag
"73ca457e68e30047fdef6d92886f8b71:1570361728"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
text/css
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Tue, 22 Oct 2019 08:34:44 GMT
aac_viewability-4d4dfa.js
playtime.tubemogul.com/ud/prod/pullins/ Frame A51C
13 KB
5 KB
Script
General
Full URL
https://playtime.tubemogul.com/ud/prod/pullins/aac_viewability-4d4dfa.js
Requested by
Host: playtime.tubemogul.com
URL: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/vpaidjsproxy-20190930.js?feedURL=https%3A%2F%2Fasf-tm.everesttech.net%2Ffeed%2Fplacement.js%3Fid%3DWe0nATVNAtvwvrOpbjtB%26tm_auction_id%3Dcb9b9287f4a611e9b2f613ae17dc0006.1%26price%3D1%26bi%3DB087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk%26did%3D%26didtype%3DUNK%26barefeed%3DT%26rand%3D1437732598%26seller_id%3D124576%26tm_user_ip%3D6b7394220b53d16a5ac96d1fe8d2b2b3%26expaId%3D%26q%3DH4sIAAAAAAAAAG2Ry08TURSHvS2WhyGSUhLSuLh2BcSZzp3pvNRIWkGtbaW2IJUNuTNzp710XszclseSmGgwcYHRBYmJa3FlIgv8FzBu1IVrV7oxLF2oRUxMjGdxFr-c37f4zuDowfAq-7l3OPZs6Ymf_tE3NMU2AsI3fb_pEBzQiDd9N2tQyyIhn7fqJOySsEZWOyRiyXd94x8eJDKpRSJ4-fk7t_Ksu9YN5wJjhRUmXr65B8SUawe4tWKIN71iR2vVVVlCa9rbp6_3zhZSQaVsLxSlxl2vUZ4ttpFZ9rUdsFHxN6nj4KzMC3Cigk3qMT9qXYJFjxEH9gI4V4cNiIRllFuWJ2E-CByySIwSZVlZUnlJgROlG_OV8gXo0DaB14nZ9ifh1VbouySr5niBl1RR55Giwzq2cUj_1HYBVAxV0nOiKBiyZCEFy9jUFQvZRLNEQzSkA5AxDd3QRU21c1hBiOiGaCtIwgSplikIgsKjL0AZuP95PJnSqw6do1ZzCUuVQLfCoqjeTg-T9SAk0bFYvtOGQAD6la9prn_zcPoIJJCYk1XlO0hprrNUrW10hZVat6KVGiW5gLZig8zlsBtxCG_HkiEzuJPPcDYNIyYpO7GRf8MXsb6IMvIq1t_x2p6_5h3FLg_9xSQTJ8fp_9Ayoz1XXG2-wIkC0pGAFE5CW_GZodNR4LP1keePPw2n4wv1mczxmjz1e75NX4xTNyicu9bTPbvOSOhhpxpSk9R7pYbZwl6TVAe242cGwAgYBxBMAXE3foI8vz_2cf89ePTwF3zr1nGYAgAA%26psId%3D9PliOidgZa3Mp9drI27Q%26page_url%3Dhttps%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&cpKey=mfpahjb2JnIu8hS7531w&mpKey=We0nATVNAtvwvrOpbjtB&adKey=pMLfUI3XYnXLEIk1cLo8&framework=vpaid&psId=9PliOidgZa3Mp9drI27Q&cd=%7B%22zip%22%3A%22UNKNOWN%22%2C%22fbd%22%3A%7B%22ssb%22%3A%22F%22%2C%22psb%22%3A%22F%22%2C%22pd%22%3A%22express.co.uk%22%2C%22mpw%22%3A%22640%22%2C%22mph%22%3A%22480%22%2C%22aburl%22%3A%22http%3A%2F%2Fsearch.spotxchange.com%2Ftrack%2Ftag%2F6409.4645%2Fimg%3Fdate%3D1571733282981%26pid%3D124576%26cid%3D216448%26provided_url%3D%24%7Bpd%7D%26detected_url%3D%24%7Bdu%7D%22%7D%7D&price=1&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&pt=imp&cpId=694808&plcId=2170284&mpId=99413&adId=4117580621&psIdNum=406023&iasMon=F&env=site&conn=unknown&videoURL=https%3A%2F%2Fvast.adsafeprotected.com%2Fvast%2Ffwjsvid%2Fst%2F331804%2F39018748%2Fskeleton.js%3FincludeFlash%3Dfalse%26originalVast%3Dhttps%3A%2F%2Fad.doubleclick.net%2Fddm%2Fpfadx%2FN7881.2610ADOBESYSTEMSINC.%2FB23075601.253815120%3Bsz%3D0x0%3Bord%3D1437732598%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bdcmt%3Dtext%2Fxml%3Bdc_sdk_apis%3D%5BAPIFRAMEWORKS%5D%3Bdc_omid_p%3D%5BOMIDPARTNER%5D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FE8) /
Resource Hash
31d08ec38a8dfab082676503b6085ca78829c45d05b4002534b5281cd7185310

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:44 GMT
content-encoding
gzip
last-modified
Fri, 27 Sep 2019 22:50:37 GMT
server
ECAcc (frc/8FE8)
status
200
etag
"3978623453"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
4685
expires
Wed, 23 Oct 2019 08:34:44 GMT
skeleton.js
vast.adsafeprotected.com/vast/fwjsvid/st/331804/39018748/ Frame A51C
42 KB
11 KB
XHR
General
Full URL
https://vast.adsafeprotected.com/vast/fwjsvid/st/331804/39018748/skeleton.js?includeFlash=false&originalVast=https://ad.doubleclick.net/ddm/pfadx/N7881.2610ADOBESYSTEMSINC./B23075601.253815120;sz=0x0;ord=1437732598;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;dcmt=text/xml;dc_sdk_apis=[APIFRAMEWORKS];dc_omid_p=[OMIDPARTNER]
Requested by
Host: playtime.tubemogul.com
URL: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/vpaidjsproxy-20190930.js?feedURL=https%3A%2F%2Fasf-tm.everesttech.net%2Ffeed%2Fplacement.js%3Fid%3DWe0nATVNAtvwvrOpbjtB%26tm_auction_id%3Dcb9b9287f4a611e9b2f613ae17dc0006.1%26price%3D1%26bi%3DB087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk%26did%3D%26didtype%3DUNK%26barefeed%3DT%26rand%3D1437732598%26seller_id%3D124576%26tm_user_ip%3D6b7394220b53d16a5ac96d1fe8d2b2b3%26expaId%3D%26q%3DH4sIAAAAAAAAAG2Ry08TURSHvS2WhyGSUhLSuLh2BcSZzp3pvNRIWkGtbaW2IJUNuTNzp710XszclseSmGgwcYHRBYmJa3FlIgv8FzBu1IVrV7oxLF2oRUxMjGdxFr-c37f4zuDowfAq-7l3OPZs6Ymf_tE3NMU2AsI3fb_pEBzQiDd9N2tQyyIhn7fqJOySsEZWOyRiyXd94x8eJDKpRSJ4-fk7t_Ksu9YN5wJjhRUmXr65B8SUawe4tWKIN71iR2vVVVlCa9rbp6_3zhZSQaVsLxSlxl2vUZ4ttpFZ9rUdsFHxN6nj4KzMC3Cigk3qMT9qXYJFjxEH9gI4V4cNiIRllFuWJ2E-CByySIwSZVlZUnlJgROlG_OV8gXo0DaB14nZ9ifh1VbouySr5niBl1RR55Giwzq2cUj_1HYBVAxV0nOiKBiyZCEFy9jUFQvZRLNEQzSkA5AxDd3QRU21c1hBiOiGaCtIwgSplikIgsKjL0AZuP95PJnSqw6do1ZzCUuVQLfCoqjeTg-T9SAk0bFYvtOGQAD6la9prn_zcPoIJJCYk1XlO0hprrNUrW10hZVat6KVGiW5gLZig8zlsBtxCG_HkiEzuJPPcDYNIyYpO7GRf8MXsb6IMvIq1t_x2p6_5h3FLg_9xSQTJ8fp_9Ayoz1XXG2-wIkC0pGAFE5CW_GZodNR4LP1keePPw2n4wv1mczxmjz1e75NX4xTNyicu9bTPbvOSOhhpxpSk9R7pYbZwl6TVAe242cGwAgYBxBMAXE3foI8vz_2cf89ePTwF3zr1nGYAgAA%26psId%3D9PliOidgZa3Mp9drI27Q%26page_url%3Dhttps%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&cpKey=mfpahjb2JnIu8hS7531w&mpKey=We0nATVNAtvwvrOpbjtB&adKey=pMLfUI3XYnXLEIk1cLo8&framework=vpaid&psId=9PliOidgZa3Mp9drI27Q&cd=%7B%22zip%22%3A%22UNKNOWN%22%2C%22fbd%22%3A%7B%22ssb%22%3A%22F%22%2C%22psb%22%3A%22F%22%2C%22pd%22%3A%22express.co.uk%22%2C%22mpw%22%3A%22640%22%2C%22mph%22%3A%22480%22%2C%22aburl%22%3A%22http%3A%2F%2Fsearch.spotxchange.com%2Ftrack%2Ftag%2F6409.4645%2Fimg%3Fdate%3D1571733282981%26pid%3D124576%26cid%3D216448%26provided_url%3D%24%7Bpd%7D%26detected_url%3D%24%7Bdu%7D%22%7D%7D&price=1&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&pt=imp&cpId=694808&plcId=2170284&mpId=99413&adId=4117580621&psIdNum=406023&iasMon=F&env=site&conn=unknown&videoURL=https%3A%2F%2Fvast.adsafeprotected.com%2Fvast%2Ffwjsvid%2Fst%2F331804%2F39018748%2Fskeleton.js%3FincludeFlash%3Dfalse%26originalVast%3Dhttps%3A%2F%2Fad.doubleclick.net%2Fddm%2Fpfadx%2FN7881.2610ADOBESYSTEMSINC.%2FB23075601.253815120%3Bsz%3D0x0%3Bord%3D1437732598%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bdcmt%3Dtext%2Fxml%3Bdc_sdk_apis%3D%5BAPIFRAMEWORKS%5D%3Bdc_omid_p%3D%5BOMIDPARTNER%5D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.188.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-77-188-50.eu-west-1.compute.amazonaws.com
Software
nginx / Express
Resource Hash
cb5ba38bc7f23598a4cd121c2179848aad23c8256f9a5fb992a0750e494070d9

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Server
nginx
X-Powered-By
Express
ETag
W/"a7de-zRUSBTg+Kai0i9g3QOItHg"
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET
Content-Type
text/xml; charset=utf-8
Access-Control-Allow-Origin
https://www.express.co.uk
x-processing-time
36
Access-Control-Expose-Headers
x-processing-time
Access-Control-Allow-Credentials
true
Connection
keep-alive
getFocusExtraData
videoadextradata.outbrain.com/VideoAdExtraData/api/
660 B
522 B
Script
General
Full URL
https://videoadextradata.outbrain.com/VideoAdExtraData/api/getFocusExtraData?adId=139647100&callback=obpExtraDataCallback0
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
a0e4b80e263f2fafbe88f70eb88374499318008574642c1bb4812ffd3bcc74d9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Connection
close
ETag
W/"294-rsfJpvMwBpQg1fpZCcOPbWsMzxg"
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
getFocusExtraData
videoadextradata.outbrain.com/VideoAdExtraData/api/
1 KB
966 B
Script
General
Full URL
https://videoadextradata.outbrain.com/VideoAdExtraData/api/getFocusExtraData?adId=140477159&callback=obpExtraDataCallback1
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
9ada1473bc761f4e90b850a3eaf49e6ff4a57a344ad90f4522fa61e46b5be803

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Connection
close
ETag
W/"55a-j2l4r6w8ySFBYcnx1GjuepFdh40"
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
getFocusExtraData
videoadextradata.outbrain.com/VideoAdExtraData/api/
2 KB
1 KB
Script
General
Full URL
https://videoadextradata.outbrain.com/VideoAdExtraData/api/getFocusExtraData?adId=138842724&callback=obpExtraDataCallback2
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
b6c2e81ea7fc3dcea125585c1ec8e78e9826f0fef1c1255d2caf451fff49b54c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Connection
close
ETag
W/"749-zj6AcX9bpVDYr8aKYnxCBhYRUMk"
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
getFocusExtraData
videoadextradata.outbrain.com/VideoAdExtraData/api/
1 KB
966 B
Script
General
Full URL
https://videoadextradata.outbrain.com/VideoAdExtraData/api/getFocusExtraData?adId=140477159&callback=obpExtraDataCallback3
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
363e141b8355e99fd7a23028f29ebe543d98277b697c48d37267112c3214a6e2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Connection
close
ETag
W/"55a-rh4gWEsDfztJcEoUDYTkjTmqHcM"
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
getFocusExtraData
videoadextradata.outbrain.com/VideoAdExtraData/api/
2 KB
1 KB
Script
General
Full URL
https://videoadextradata.outbrain.com/VideoAdExtraData/api/getFocusExtraData?adId=140796283&callback=obpExtraDataCallback4
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
3ba16530b9e71bf07fc28a2cc7eda8b4d52722da6a7436bb0a959ef02ede8c9f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Connection
close
ETag
W/"72a-buXFthrf+ic1qC6o08jwT34cFiU"
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
getFocusExtraData
videoadextradata.outbrain.com/VideoAdExtraData/api/
660 B
522 B
Script
General
Full URL
https://videoadextradata.outbrain.com/VideoAdExtraData/api/getFocusExtraData?adId=139647042&callback=obpExtraDataCallback5
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
665b38c7f6c657c0c37829c761d90aa26fd2bed0021af10f93d04ece02c3617f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Connection
close
ETag
W/"294-N/mtrSYZu1PetGuHDW4HdeCHdL4"
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
getFocusExtraData
videoadextradata.outbrain.com/VideoAdExtraData/api/
660 B
521 B
Script
General
Full URL
https://videoadextradata.outbrain.com/VideoAdExtraData/api/getFocusExtraData?adId=136172119&callback=obpExtraDataCallback6
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
58b32efe6b4ca06cba67576965064fded60fe48a436fa665cbf0d10a2fa748aa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Connection
close
ETag
W/"294-UCe7Ti6rKNfoiw7pOpL3jo+hBpk"
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
serve
srv.imonomy.com/internal/
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?v=2&format=6&img=true&cid=imonomy_stripmyEdge_auto&ab=&isps=false&rdn=imonomy_image_$$fid$$&fid=0&cb=imonomy.strips.hook_strip_action($$fid$$,%20imonomy_image_$$fid$$,%20false%20,undefined%20,%200%20,%20-1)&sid=14567721676&terms=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&httpsite=true&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&dm=express.co.uk&charset=UTF-8&timepreload=1571733282726&ptaken=1512&ttaken=1512&ttkan_x=0&sum_ttkan_x=0&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&cqt=11,12,15,22,26,30&ln=en&ct=0&w=1600&h=1200&pxr=1&ppi=96&loc=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=www.express.co.uk&subid=none_personalized_ads&rtb_highest_price=
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/14567721676/preload.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
d53f3cdaef8e7ce21a5761cf218c5e2728aef8c9efa371bf0cd37592aa748c9a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Server
nginx
Etag
"2f7850a6fac6164ec8ffe768381606efcb3042ef"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2515
serve
srv.imonomy.com/internal/
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?v=2&format=6&img=true&cid=imonomy_stripmyEdge_auto&ab=&isps=false&rdn=imonomy_image_$$fid$$&fid=1&cb=imonomy.strips.hook_strip_action($$fid$$,%20imonomy_image_$$fid$$,%20false%20,undefined%20,%201%20,%20-1)&sid=14567721676&terms=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&httpsite=true&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&dm=express.co.uk&charset=UTF-8&timepreload=1571733282726&ptaken=1515&ttaken=1515&ttkan_x=0&sum_ttkan_x=0&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&cqt=11,12,15,22,26,30&ln=en&ct=0&w=1600&h=1200&pxr=1&ppi=96&loc=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=www.express.co.uk&subid=none_personalized_ads&rtb_highest_price=
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/14567721676/preload.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
7cf05625f92f72679fe5a35540960375172fb2b6a3ba498b5c33ba8e82a1f5e7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:45 GMT
Content-Encoding
gzip
Server
nginx
Etag
"7cf405408d4ccc2c70b225bfefc464998d2406bf"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2515
serve
srv.imonomy.com/internal/
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?v=2&format=6&img=true&cid=imonomy_stripmyEdge_auto&ab=&isps=false&rdn=imonomy_image_$$fid$$&fid=2&cb=imonomy.strips.hook_strip_action($$fid$$,%20imonomy_image_$$fid$$,%20false%20,undefined%20,%202%20,%20-1)&sid=14567721676&terms=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&httpsite=true&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&dm=express.co.uk&charset=UTF-8&timepreload=1571733282726&ptaken=1517&ttaken=1517&ttkan_x=0&sum_ttkan_x=0&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&cqt=11,12,15,22,26,30&ln=en&ct=0&w=1600&h=1200&pxr=1&ppi=96&loc=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=www.express.co.uk&subid=none_personalized_ads&rtb_highest_price=
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/14567721676/preload.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
5627412d3e69206acf1e8296f17c0fcaa034f24fdca2d881229d9c1ca458b98a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:46 GMT
Content-Encoding
gzip
Server
nginx
Etag
"bce2bcbebf4b450915854e504711096fca358267"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2365
serve
srv.imonomy.com/internal/
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?v=2&format=6&img=true&cid=imonomy_stripmyEdge_auto&ab=&isps=false&rdn=imonomy_image_$$fid$$&fid=3&cb=imonomy.strips.hook_strip_action($$fid$$,%20imonomy_image_$$fid$$,%20false%20,undefined%20,%203%20,%20-1)&sid=14567721676&terms=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&httpsite=true&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&dm=express.co.uk&charset=UTF-8&timepreload=1571733282726&ptaken=1518&ttaken=1518&ttkan_x=0&sum_ttkan_x=0&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&cqt=11,12,15,22,26,30&ln=en&ct=0&w=1600&h=1200&pxr=1&ppi=96&loc=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=www.express.co.uk&subid=none_personalized_ads&rtb_highest_price=
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/14567721676/preload.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
65e2ac95ed2aca1533db461d2ddadf4692915655bfa2ef8221f0c7740000586a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:46 GMT
Content-Encoding
gzip
Server
nginx
Etag
"c0ebcd3e72688d55580421ed6971028379a4f0fa"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2365
renderstart
statsf-tm.everesttech.net/stats/1/ Frame A51C
85 B
357 B
Image
General
Full URL
https://statsf-tm.everesttech.net/stats/1/renderstart?didtype=UNK&date=1571733282983&psId=9PliOidgZa3Mp9drI27Q&vinst=t&seller_id=124576&s=H4sIAAAAAAAAAAGwAE__RTQDlWVdllgdzqSv8hGJ21JikMzkCdzqYvGCvGDpDaMuJGZrJUWnfEA235N60LBFOJ8rZXLRjnkcv-RqyVWHNTZm9hrdR1OMpbWHACH2Ew9olN_HkZhLWO4AMz3QFGBi1qqM7b2j3UPEbpFxTNhRouWrPIvdLfnVTPvx2y52W8yJ1uM8pcHsWGaAkUzNLdpojhE791Tn_so3VFr-oAg0qaqsfnsrpFDWPGKdQFvccG9VxQcBsAAAAA&did=&auth=fcd8207c1c7cd28dbffd35b554ef2a19&conn=unknown&sessId=cb9b9287f4a611e9b2f613ae17dc0006.1&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&mpKey=We0nATVNAtvwvrOpbjtB&price=1&env=site&cpKey=mfpahjb2JnIu8hS7531w&adKey=pMLfUI3XYnXLEIk1cLo8&rt=HTML5&apv=J20190930&burl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&rurl=https%3A%2F%2Fwww.express.co.uk&pw=590&ph=332&w=590&h=332&wd=1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Jetty(9.4.z-SNAPSHOT) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:44 GMT
via
1.1 varnish
x-pt
P=147
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status
200
x-cache-hits
0
x-region
EU-East
content-length
85
x-served-by
cache-hhn4033-HHN
pragma
no-cache
server
Jetty(9.4.z-SNAPSHOT)
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
expires
Tue, 22 Oct 2019 03:34:44 -05:00
reporter
srv.imonomy.com/internal/
43 B
368 B
Image
General
Full URL
https://srv.imonomy.com/internal/reporter?v=2&subid=none_personalized_ads&format=728x90&ai=983&ctxu=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&fb=false&cid=imonomy_strip_auto&ab=&cbs=0.41275995955575384&tier=872&sid=14567721676&terms=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&httpsite=true&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&dm=express.co.uk&charset=UTF-8&timepreload=1571733282726&ptaken=1912&ttaken=1912&ttkan_x=0&sum_ttkan_x=0&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&cqt=11,12,15,22,26,30&ln=en&ct=0&w=1600&h=1200&pxr=1&ppi=96&loc=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=www.express.co.uk&subid=none_personalized_ads&rtb_highest_price=&rim=true
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
9327663db171e3c01e351f3f5562ee5ed8f3d6bde6a7da57d966997f1a4b7a57

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:45 GMT
Server
nginx
Etag
"ad6fdcd6bc9b5969566123ca061bde27f6f197cf"
Vary
Accept-Encoding
Content-Type
image/gif
Cache-Control
public, max-age=86400
Connection
keep-alive
Content-Length
43
loader.gif
libs.sphere.com/video/outbrain-player/assets/
51 KB
51 KB
Image
General
Full URL
https://libs.sphere.com/video/outbrain-player/assets/loader.gif
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.250 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-250.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d05d164843ec0e47ddf7fca61f0e4bed73c23280c7eeb0fd0e9dc0c618b8eb90

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Last-Modified
Sun, 17 Dec 2017 09:28:08 GMT
Server
Apache
ETag
"c753233e9ae7214419baca2aedd1c4b9:1513502888"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
52226
frame
vastcdn.outbrain.com/ Frame FB9F
0
0
Document
General
Full URL
https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=ob6ec111-f4ac-52ed-3899-2715c2a777ff&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5d99a86d2cda08.70371189%3FobOrigUrl%3Dtrue
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28a::2a83 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Host
vastcdn.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Content-Type
text/html; charset=utf-8
ETag
W/"10fc-hHf2vLctPDtE1LaMRh8V7ugMmVs"
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Content-Length
1457
Vary
Accept-Encoding
Cache-Control
max-age=3600
Expires
Tue, 22 Oct 2019 09:34:44 GMT
Date
Tue, 22 Oct 2019 08:34:44 GMT
Connection
keep-alive
frame
vastcdn.outbrain.com/ Frame FD14
0
0
Document
General
Full URL
https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=obd08560-e8b9-76d8-fcfe-34ffa09f35e9&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5da2be3ec3f3f5.12323041%3FobOrigUrl%3Dtrue
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28a::2a83 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Host
vastcdn.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Content-Type
text/html; charset=utf-8
ETag
W/"10f7-/FE8HMLqozJ0fIOhzO+yUN4ZDx4"
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Content-Length
1418
Vary
Accept-Encoding
Cache-Control
max-age=3600
Expires
Tue, 22 Oct 2019 09:34:44 GMT
Date
Tue, 22 Oct 2019 08:34:44 GMT
Connection
keep-alive
frame
vastcdn.outbrain.com/ Frame 5C19
0
0
Document
General
Full URL
https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=obc09864-d3c6-58d2-ef56-a7aed7375027&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5da2cfbb925097.92922303%3FobOrigUrl%3Dtrue
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28a::2a83 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Host
vastcdn.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Content-Type
text/html; charset=utf-8
ETag
W/"1100-jV3/fr1SC0n3qlOotqMdWr8XCwk"
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Content-Length
1421
Vary
Accept-Encoding
Cache-Control
max-age=3600
Expires
Tue, 22 Oct 2019 09:34:44 GMT
Date
Tue, 22 Oct 2019 08:34:44 GMT
Connection
keep-alive
frame
vastcdn.outbrain.com/ Frame E521
0
0
Document
General
Full URL
https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=obabe3e4-140a-3e6e-dbf0-ee3710164237&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5da2be3ec3f3f5.12323041%3FobOrigUrl%3Dtrue
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28a::2a83 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Host
vastcdn.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Content-Type
text/html; charset=utf-8
ETag
W/"10f7-/FE8HMLqozJ0fIOhzO+yUN4ZDx4"
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Content-Length
1418
Vary
Accept-Encoding
Cache-Control
max-age=3600
Expires
Tue, 22 Oct 2019 09:34:44 GMT
Date
Tue, 22 Oct 2019 08:34:44 GMT
Connection
keep-alive
frame
vastcdn.outbrain.com/ Frame 32F4
0
0
Document
General
Full URL
https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=ob866686-f578-a701-8ec3-b510efe3d6f2&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5dac1a6ba0f3d8.24617334%3FobOrigUrl%3Dtrue
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28a::2a83 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Host
vastcdn.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Content-Type
text/html; charset=utf-8
ETag
W/"10fb-GN0a+GD68+dLpOzxGyUPwZa5h5g"
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Content-Length
1418
Vary
Accept-Encoding
Cache-Control
max-age=3600
Expires
Tue, 22 Oct 2019 09:34:44 GMT
Date
Tue, 22 Oct 2019 08:34:44 GMT
Connection
keep-alive
Ias_3.2.1.js
ud.tubemogul.com/js/lib/3rdparty/ Frame A51C
6 KB
6 KB
Script
General
Full URL
https://ud.tubemogul.com/js/lib/3rdparty/Ias_3.2.1.js
Requested by
Host: playtime.tubemogul.com
URL: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/vpaidjsproxy-20190930.js?feedURL=https%3A%2F%2Fasf-tm.everesttech.net%2Ffeed%2Fplacement.js%3Fid%3DWe0nATVNAtvwvrOpbjtB%26tm_auction_id%3Dcb9b9287f4a611e9b2f613ae17dc0006.1%26price%3D1%26bi%3DB087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk%26did%3D%26didtype%3DUNK%26barefeed%3DT%26rand%3D1437732598%26seller_id%3D124576%26tm_user_ip%3D6b7394220b53d16a5ac96d1fe8d2b2b3%26expaId%3D%26q%3DH4sIAAAAAAAAAG2Ry08TURSHvS2WhyGSUhLSuLh2BcSZzp3pvNRIWkGtbaW2IJUNuTNzp710XszclseSmGgwcYHRBYmJa3FlIgv8FzBu1IVrV7oxLF2oRUxMjGdxFr-c37f4zuDowfAq-7l3OPZs6Ymf_tE3NMU2AsI3fb_pEBzQiDd9N2tQyyIhn7fqJOySsEZWOyRiyXd94x8eJDKpRSJ4-fk7t_Ksu9YN5wJjhRUmXr65B8SUawe4tWKIN71iR2vVVVlCa9rbp6_3zhZSQaVsLxSlxl2vUZ4ttpFZ9rUdsFHxN6nj4KzMC3Cigk3qMT9qXYJFjxEH9gI4V4cNiIRllFuWJ2E-CByySIwSZVlZUnlJgROlG_OV8gXo0DaB14nZ9ifh1VbouySr5niBl1RR55Giwzq2cUj_1HYBVAxV0nOiKBiyZCEFy9jUFQvZRLNEQzSkA5AxDd3QRU21c1hBiOiGaCtIwgSplikIgsKjL0AZuP95PJnSqw6do1ZzCUuVQLfCoqjeTg-T9SAk0bFYvtOGQAD6la9prn_zcPoIJJCYk1XlO0hprrNUrW10hZVat6KVGiW5gLZig8zlsBtxCG_HkiEzuJPPcDYNIyYpO7GRf8MXsb6IMvIq1t_x2p6_5h3FLg_9xSQTJ8fp_9Ayoz1XXG2-wIkC0pGAFE5CW_GZodNR4LP1keePPw2n4wv1mczxmjz1e75NX4xTNyicu9bTPbvOSOhhpxpSk9R7pYbZwl6TVAe242cGwAgYBxBMAXE3foI8vz_2cf89ePTwF3zr1nGYAgAA%26psId%3D9PliOidgZa3Mp9drI27Q%26page_url%3Dhttps%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&cpKey=mfpahjb2JnIu8hS7531w&mpKey=We0nATVNAtvwvrOpbjtB&adKey=pMLfUI3XYnXLEIk1cLo8&framework=vpaid&psId=9PliOidgZa3Mp9drI27Q&cd=%7B%22zip%22%3A%22UNKNOWN%22%2C%22fbd%22%3A%7B%22ssb%22%3A%22F%22%2C%22psb%22%3A%22F%22%2C%22pd%22%3A%22express.co.uk%22%2C%22mpw%22%3A%22640%22%2C%22mph%22%3A%22480%22%2C%22aburl%22%3A%22http%3A%2F%2Fsearch.spotxchange.com%2Ftrack%2Ftag%2F6409.4645%2Fimg%3Fdate%3D1571733282981%26pid%3D124576%26cid%3D216448%26provided_url%3D%24%7Bpd%7D%26detected_url%3D%24%7Bdu%7D%22%7D%7D&price=1&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&pt=imp&cpId=694808&plcId=2170284&mpId=99413&adId=4117580621&psIdNum=406023&iasMon=F&env=site&conn=unknown&videoURL=https%3A%2F%2Fvast.adsafeprotected.com%2Fvast%2Ffwjsvid%2Fst%2F331804%2F39018748%2Fskeleton.js%3FincludeFlash%3Dfalse%26originalVast%3Dhttps%3A%2F%2Fad.doubleclick.net%2Fddm%2Fpfadx%2FN7881.2610ADOBESYSTEMSINC.%2FB23075601.253815120%3Bsz%3D0x0%3Bord%3D1437732598%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bdcmt%3Dtext%2Fxml%3Bdc_sdk_apis%3D%5BAPIFRAMEWORKS%5D%3Bdc_omid_p%3D%5BOMIDPARTNER%5D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FD0) /
Resource Hash
ae8652bef5db9166b582124f35c50287050244b14cc2a98d0e99c4866e525164

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:43 GMT
x-amz-request-id
05F9FE1B398927FE
x-cache
HIT
status
200
content-length
5907
x-amz-id-2
x46RHxTGN7YY+tPs4ZIqcb0DDpu5OMKmjGvugq+FAsWxWSWOxP+bKI7GJW+bUvxM1JjFveRHz+Q=
last-modified
Wed, 30 Nov 2016 00:55:53 GMT
server
ECAcc (frc/8FD0)
etag
"26aca74449e539d0769e09ee50093408"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
expires
Wed, 23 Oct 2019 08:34:43 GMT
frame
vastcdn.outbrain.com/ Frame 00BD
0
0
Document
General
Full URL
https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=ob831ff3-af13-c57e-c6d3-d4d255080736&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5d99a8516da008.59972960%3FobOrigUrl%3Dtrue
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28a::2a83 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Host
vastcdn.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Content-Type
text/html; charset=utf-8
ETag
W/"10ff-m/oMw2wc3/UDZTk17nyw3UN6/5A"
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Content-Length
1428
Vary
Accept-Encoding
Cache-Control
max-age=3600
Expires
Tue, 22 Oct 2019 09:34:44 GMT
Date
Tue, 22 Oct 2019 08:34:44 GMT
Connection
keep-alive
mon
pixel.adsafeprotected.com/
43 B
475 B
XHR
General
Full URL
https://pixel.adsafeprotected.com/mon?anId=10173&campId=7203&pubId=vans-js_cminit
Requested by
Host: ud.tubemogul.com
URL: https://ud.tubemogul.com/js/lib/3rdparty/Ias_3.2.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:44 GMT
X-Server-Name
app38ami.ami.303net.pvt
Timing-Allow-Origin
*
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Access-Control-Allow-Origin
https://www.express.co.uk
Access-Control-Expose-Headers
X-Server-Name
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
jsvid
pixel.adsafeprotected.com/
197 KB
67 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/jsvid?videoId=20edce92b9ddb5d9826e2ca1ae9c31da&pubId=406023&campId=694808&advId=undefined&bidurl=https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&chanId=We0nATVNAtvwvrOpbjtB&placementId=2170284&anId=F&uId=cb9b9287f4a611e9b2f613ae17dc0006.1&adsafe_par=
Requested by
Host: ud.tubemogul.com
URL: https://ud.tubemogul.com/js/lib/3rdparty/Ias_3.2.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
f95ea8dc46d24e09af6f519e481fad2c42d03cedc808b64c3033da3b2b583795

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
X-Server-Name
app05ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
vpaid.js
vpaid3.adsafeprotected.com/vpaid-wrapper/4.11.27/ Frame EE09
65 KB
19 KB
Script
General
Full URL
https://vpaid3.adsafeprotected.com/vpaid-wrapper/4.11.27/vpaid.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.96.112.165 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
165.112.96.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
38b8696323d24ce56253d95467444b809f0309f94ea77212800a0fd3d306f97d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 07:24:00 GMT
content-encoding
gzip
age
90644
x-guploader-uploadid
AEnB2UqFYce2hu6queEr_x0cEVVUIqeV-doavPvYtGm4R_4GtQ8Q41cwOvRHZln3DH5A-jzWpQki5wkX7DL8_fkUQlcq2hS3bQ
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
3
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
19385
last-modified
Sat, 12 Oct 2019 10:23:50 GMT
server
UploadServer
etag
"c578f67b5f8d6569f89aa6edde1a7ac9"
vary
Accept-Encoding
x-goog-hash
crc32c=IRRLhw==, md5=xXj2e1+NZWn4mqbt3hp6yQ==
x-goog-generation
1570875830891778
cache-control
public, max-age=604800
x-goog-stored-content-length
19385
accept-ranges
bytes
content-type
application/javascript
expires
Mon, 28 Oct 2019 07:24:00 GMT
noop
statsf-tm.everesttech.net/stats/1/ Frame A51C
85 B
130 B
Image
General
Full URL
https://statsf-tm.everesttech.net/stats/1/noop?apv=J20190930&s=H4sIAAAAAAAAAAGwAE__RTQDlWVdllgdzqSv8hGJ21JikMzkCdzqYvGCvGDpDaMuJGZrJUWnfEA235N60LBFOJ8rZXLRjnkcv-RqyVWHNTZm9hrdR1OMpbWHACH2Ew9olN_HkZhLWO4AMz3QFGBi1qqM7b2j3UPEbpFxTNhRouWrPIvdLfnVTPvx2y52W8yJ1uM8pcHsWGaAkUzNLdpojhE791Tn_so3VFr-oAg0qaqsfnsrpFDWPGKdQFvccG9VxQcBsAAAAA&sessId=cb9b9287f4a611e9b2f613ae17dc0006.1&adKey=pMLfUI3XYnXLEIk1cLo8&cpKey=mfpahjb2JnIu8hS7531w&mpKey=We0nATVNAtvwvrOpbjtB&psId=9PliOidgZa3Mp9drI27Q&rt=HTML5&burl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&rurl=https%3A%2F%2Fwww.express.co.uk&w=590&pw=590&h=332&ph=332&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&price=1&date=1571733284803&env=site&conn=unknown&wd=1&vinst=t&proxyHost=vast.adsafeprotected.com&pixelGen=adunit
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Jetty(9.4.z-SNAPSHOT) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:44 GMT
via
1.1 varnish
x-pt
P=203
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status
200
x-cache-hits
0
x-region
EU-East
content-length
85
x-served-by
cache-hhn4033-HHN
pragma
no-cache
server
Jetty(9.4.z-SNAPSHOT)
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
expires
Tue, 22 Oct 2019 03:34:44 -05:00
vpaid_adapter.js
imasdk.googleapis.com/js/sdkloader/ Frame 23DB
39 KB
14 KB
Script
General
Full URL
https://imasdk.googleapis.com/js/sdkloader/vpaid_adapter.js
Requested by
Host: vpaid3.adsafeprotected.com
URL: https://vpaid3.adsafeprotected.com/vpaid-wrapper/4.11.27/vpaid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
13bb93a8b98944d49afe0a369ed52484db89f9f50aa50fb508575ab250cc4e80
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:23:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 17 Oct 2019 15:18:55 GMT
server
sffe
age
690
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14363
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:38:14 GMT
event-vpaid
vastpixel2.adsafeprotected.com/ Frame EE09
15 B
15 B
Image
General
Full URL
https://vastpixel2.adsafeprotected.com/event-vpaid?cid=5c4c420560131b5189fcf2e7&rid=a4634829-fd3e-4a3c-8eae-3cd302cc6984&apos=0&clr=false&vt=vpaid-omit&vwv=4.11.27&cvvnd=double-click&vpvnd=Google%20IMA&mode=ott%3A0%2Csingle_tag%3A0%2Cdoublewrapped%3A0%2Ccsw%3A0%2Ccm%3A0%2Cfw%3A1&ts=1571733284340&t=initAd&cb=52328052&d=csw%3Dfalse%26safeIframe%3Dfalse%26msg%3D%26file%3Dhttps%253A%252F%252Fimasdk.googleapis.com%252Fjs%252Fsdkloader%252Fvpaid_adapter.js%26dt%3D0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.189.119.248 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-189-119-248.us-east-2.compute.amazonaws.com
Software
nginx / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:45 GMT
Server
nginx
X-Powered-By
Express
ETag
W/"f-sfeWUgIhIQAHyyjp/cGfmg"
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
15
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame 23DB
271 KB
92 KB
Script
General
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/vpaid_adapter.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0765787f1966c35a86910225b871ca49249be9e882aade8899d624b431e7446b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
94100
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:44 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 23DB
0
219 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=vpaid_adapter_js&event=init&vps=0.2663142261372684&wt=1571733284858&sdkv=h.3.343.1&xai=AKAOjstNTwLlZoizVU1ZnQcMYF30SvZA95u2ppYU2gzgEyADxi1W9IP5nHvdX6pFiwAGGAWFCSqvGbKqcad7-0YOCtxVBhqQQlh673Y21IreCtKW0bLq_IAoJD0FuQFYfyRy&url=3,https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest$0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sca.17.4.95.js
static.adsafeprotected.com/ Frame B51E
81 KB
20 KB
Script
General
Full URL
https://static.adsafeprotected.com/sca.17.4.95.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
149c8d10677f2f6979fa28c078cf832f575ee53c397d791b739e7c4c687fe7bc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:44 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Jun 2018 17:20:43 GMT
X-Server-Name
app06ami.ami.303net.pvt
ETag
"5b293b6b-4fda"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
20442
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
bridge3.343.1_en.html
imasdk.googleapis.com/js/core/ Frame C4E0
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.343.1_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.343.1_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
193394
date
Mon, 21 Oct 2019 23:49:30 GMT
expires
Tue, 20 Oct 2020 23:49:30 GMT
last-modified
Thu, 17 Oct 2019 15:13:57 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
31514
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
client.js
s0.2mdn.net/instream/video/ Frame 23DB
26 KB
10 KB
Script
General
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10523
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:44 GMT
integrator.js
adservice.google.com/adsid/ Frame 23DB
109 B
174 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=-1&asId=b4a6952a-52c9-e720-8a9d-f56f2c87d69d&tv={c:rLpdF5,pingTime:-2,time:101,type:a,im:{sf:0,pom:1,prf:{beA:4463,beZ:4465,mfA:4467,cmA:4467,inA:4468,inZ:4473,prA:4473,prZ:4480,si:4486,poA:4486,poZ:4493,cmZ:4493,mfZ:4493,loA:4542,loZ:4543,ltA:4563,ltZ:4563}},env:{gca:1},clog:[{piv:88,vs:o,r:v,w:590,h:332,t:22}],ve:{vEventCount:2,vEvents:[{t:-76,tp:perfCheckpoint,sl:o,type:vans,code:10,timestamp:1571733284798},{t:-76,tp:perfCheckpoint,sl:o,type:vans,code:20,timestamp:1571733284798}]},vv:3.3.0,es:0,sc:1,ha:1,gm:0,slTimes:{i:0,o:101,n:0,pp:0,pm:0},slEvents:[{sl:o,t:22,wc:0.0.1600.1200,ac:323.908.590.332,am:v,cc:323.908.590.334,piv:88,obst:0,th:0,reas:v,bkn:{piv:[94~75],as:[94~590.332]}}],slEventCount:1,em:false,fr:true,e:,tt:jsvid,dtt:0,fm:rFCgGEO+1*.-|11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f|1g11|1g12|1h|1i|1j|1k|1l|1m,idMap:1*,rend:1,renddet:env,rmeas:1,slid:[video_5798750504001_0,singleArticle,maincontainer],sinceFw:77,readyFired:true}&br=u
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:45 GMT
X-Server-Name
dt91dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 8AAC
0
0
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156262&predirect=%2F%2Fsrv.imonomy.com%2FUserMatching%2Fpubmatic-kom%2F
Requested by
Host: srv.imonomy.com
URL: https://srv.imonomy.com/internal/serve?v=2&format=6&img=true&cid=imonomy_stripmyEdge_auto&ab=&isps=false&rdn=imonomy_image_$$fid$$&fid=0&cb=imonomy.strips.hook_strip_action($$fid$$,%20imonomy_image_$$fid$$,%20false%20,undefined%20,%200%20,%20-1)&sid=14567721676&terms=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&httpsite=true&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&dm=express.co.uk&charset=UTF-8&timepreload=1571733282726&ptaken=1512&ttaken=1512&ttkan_x=0&sum_ttkan_x=0&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&cqt=11,12,15,22,26,30&ln=en&ct=0&w=1600&h=1200&pxr=1&ppi=96&loc=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=www.express.co.uk&subid=none_personalized_ads&rtb_highest_price=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Last-Modified
Fri, 26 Jul 2019 09:40:01 GMT
ETag
"1300708-26ca-58e92538a370a"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
3860
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=42682
Expires
Tue, 22 Oct 2019 20:26:07 GMT
Date
Tue, 22 Oct 2019 08:34:45 GMT
Connection
keep-alive
Vary
Accept-Encoding
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 497A
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/14567721676/preload.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:45 GMT
integrator.js
adservice.google.de/adsid/ Frame 497A
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 497A
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 497A
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:45 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20191015/r20190131/ Frame BED7
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20191015/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20191015/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUkM4pMbaf7tRXYXi5aMr-hQTLg3znEWGSKoAFp18dz3vE67SLk9nI00NKsT
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Mon, 21 Oct 2019 23:50:47 GMT
expires
Mon, 04 Nov 2019 23:50:47 GMT
content-type
text/html; charset=UTF-8
etag
8648543205226238674
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
7402
x-xss-protection
0
cache-control
public, max-age=1209600
age
31438
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
frame
vastcdn.outbrain.com/ Frame 82C3
0
0
Document
General
Full URL
https://vastcdn.outbrain.com/frame?h=https%3A%2F%2Fwww.express.co.uk&id=ob6d5f80-f817-f380-7270-c0bb5d8cfee1&url=https%3A%2F%2Frtr.innovid.com%2Fr1.5d74ea83802cd8.37881136%3FobOrigUrl%3Dtrue
Requested by
Host: libs.sphere.com
URL: https://libs.sphere.com/video/outbrain-player/current/obp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28a::2a83 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Host
vastcdn.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Content-Type
text/html; charset=utf-8
ETag
W/"10fd-u70cJzBwhJylyU+Q+os5m3Tz6eo"
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Content-Length
1428
Vary
Accept-Encoding
Cache-Control
max-age=3600
Expires
Tue, 22 Oct 2019 09:34:45 GMT
Date
Tue, 22 Oct 2019 08:34:45 GMT
Connection
keep-alive
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 32BA
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/14567721676/preload.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:45 GMT
event-vpaid
vastpixel2.adsafeprotected.com/ Frame EE09
15 B
15 B
Image
General
Full URL
https://vastpixel2.adsafeprotected.com/event-vpaid?cid=5c4c420560131b5189fcf2e7&rid=a4634829-fd3e-4a3c-8eae-3cd302cc6984&apos=0&clr=false&vt=vpaid-omit&vwv=4.11.27&cvvnd=double-click&vpvnd=Google%20IMA&mode=ott%3A0%2Csingle_tag%3A0%2Cdoublewrapped%3A0%2Ccsw%3A0%2Ccm%3A0%2Cfw%3A1&ts=1571733284340&t=adLoaded&cb=26280199&d=csw%3Dfalse%26safeIframe%3Dfalse%26msg%3D%26file%3Dhttps%253A%252F%252Fimasdk.googleapis.com%252Fjs%252Fsdkloader%252Fvpaid_adapter.js%26dt%3D360
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.189.119.248 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-189-119-248.us-east-2.compute.amazonaws.com
Software
nginx / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:45 GMT
Server
nginx
X-Powered-By
Express
ETag
W/"f-sfeWUgIhIQAHyyjp/cGfmg"
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
15
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame A5FD
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90_highFloor&adk=591462414&adf=1174745122&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423124300&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423124300&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423124300&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:45 GMT
content-type
text/html
set-cookie
__cfduid=db0c3bc5b0478a1549087eff7c72dab271571733285; expires=Wed, 21-Oct-20 08:34:45 GMT; path=/; domain=.imonomy.com; HttpOnly a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:16:28 GMT
cache-control
max-age=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a224c2927cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423124300&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:45 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 497A
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:45 GMT
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=-1&asId=b4a6952a-52c9-e720-8a9d-f56f2c87d69d&tv={c:rLpdQ5,pingTime:-10,time:783,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.95v220002022020220000022002222000022220202020222220222220002222022002222200002220222022222222222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002002202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022222220020222222000220000222202222202222000002002002222222222220022202200022002220222202,sd:MTcuNC45NXYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNC45NXZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8MTZ8fG58fDB8fG58fExpbnV4IHg4Nl82NHx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzQuMC4zNzI5LjE2OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1571733285656||70a86f10bfd1eb60fe1dd5ebb6689528||675c74d5f114ba25a49fb0f4cb02f70f||435625738a0b498481f9d59640976b29||a00543dd27838f0941ec3270c7cb32ea||b140459176b53e6ade6a22f8b77b5835||291bf0b0915e7c2197131e90bbce715b||2735fba3bd0cb431a760a62244cd3802||1529428597}
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:46 GMT
X-Server-Name
dt39dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
integrator.js
adservice.google.de/adsid/ Frame 32BA
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 32BA
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 32BA
220 KB
83 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl_fy2019.js?cache=bust
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
f4b8023577f74f9e9ea6380f20ac14f9d711b0b54a5477b5f08c2557b76f881f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
84537
x-xss-protection
0
server
cafe
etag
18006964463555445718
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:45 GMT
skeleton.js
pixel.adsafeprotected.com/fwjsvid/st/331804/39018748/ Frame A51C
197 KB
67 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/fwjsvid/st/331804/39018748/skeleton.js?videoId=c87e8378c26582604ae3e9bbe52d6711&xsId=a4634829-fd3e-4a3c-8eae-3cd302cc6984&xmtp=v&xmapp=0
Requested by
Host: vpaid3.adsafeprotected.com
URL: https://vpaid3.adsafeprotected.com/vpaid-wrapper/4.11.27/vpaid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
ca7e29d98e78392b39cb22bd9558dabda300c7216ad9e54f61c109ea374de798

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:45 GMT
Content-Encoding
gzip
X-Server-Name
app05ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
d
event.spotxchange.com/event/ Frame DB0F
0
348 B
Image
General
Full URL
https://event.spotxchange.com/event/d?_x=WzE1NzE3MzMyODIsImNiOWI5Mjg3ZjRhNjExZTliMmY2MTNhZTE3ZGMwMDA2IiwiMjE2NDQ4IiwiMWU2YTAuODQzNzEuNzZkMiIsIjY0MDkiLCIxZTZhMC44NDM3MS43NmQyIiwicE1MZlVJM1hZblhMRUlrMWNMbzgiLCJjYmJlYThjYmY0YTYxMWU5YjJmNjEzYWUxN2RjMDAwNiJdJnNldGVjPU5ERmpObVJoTURobE9XRXdaVEU0TWpRNVlUTmxNMlV6T0RBM1l6ZzRaVGc9&es=JSAdBroker&ts=1571733283.752&eid=12
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.111 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:45 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
true
X-fe
47
Connection
keep-alive
Content-Length
0
d
event.spotxchange.com/event/ Frame DB0F
0
348 B
Image
General
Full URL
https://event.spotxchange.com/event/d?_x=WzE1NzE3MzMyODIsImNiOWI5Mjg3ZjRhNjExZTliMmY2MTNhZTE3ZGMwMDA2IiwiMjE2NDQ4IiwiMWU2YTAuODQzNzEuNzZkMiIsIjY0MDkiLCIxZTZhMC44NDM3MS43NmQyIiwicE1MZlVJM1hZblhMRUlrMWNMbzgiLCJjYmJlYThjYmY0YTYxMWU5YjJmNjEzYWUxN2RjMDAwNiJdJnNldGVjPU5ERmpObVJoTURobE9XRXdaVEU0TWpRNVlUTmxNMlV6T0RBM1l6ZzRaVGc9&es=JSAdBroker&ts=1571733283.752&eid=11
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.111 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:45 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
true
X-fe
78
Connection
keep-alive
Content-Length
0
d
event.spotxchange.com/event/ Frame DB0F
0
349 B
Image
General
Full URL
https://event.spotxchange.com/event/d?_x=WzE1NzE3MzMyODIsImNiOWI5Mjg3ZjRhNjExZTliMmY2MTNhZTE3ZGMwMDA2IiwiMjE2NDQ4IiwiMWU2YTAuODQzNzEuNzZkMiIsIjY0MDkiLCIxZTZhMC44NDM3MS43NmQyIiwicE1MZlVJM1hZblhMRUlrMWNMbzgiLCJjYmJlYThjYmY0YTYxMWU5YjJmNjEzYWUxN2RjMDAwNiJdJnNldGVjPU5ERmpObVJoTURobE9XRXdaVEU0TWpRNVlUTmxNMlV6T0RBM1l6ZzRaVGc9&es=JSAdBroker&ts=1571733285.759&eid=14
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.111 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:45 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
true
X-fe
116
Connection
keep-alive
Content-Length
0
event-vpaid
vastpixel2.adsafeprotected.com/ Frame EE09
15 B
15 B
Image
General
Full URL
https://vastpixel2.adsafeprotected.com/event-vpaid?cid=5c4c420560131b5189fcf2e7&rid=a4634829-fd3e-4a3c-8eae-3cd302cc6984&apos=0&clr=false&vt=vpaid-omit&vwv=4.11.27&cvvnd=double-click&vpvnd=Google%20IMA&mode=ott%3A0%2Csingle_tag%3A0%2Cdoublewrapped%3A0%2Ccsw%3A0%2Ccm%3A0%2Cfw%3A1&ts=1571733284340&t=startAd&cb=91247799&d=csw%3Dfalse%26safeIframe%3Dfalse%26msg%3D%26file%3Dhttps%253A%252F%252Fimasdk.googleapis.com%252Fjs%252Fsdkloader%252Fvpaid_adapter.js%26dt%3D928
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.189.119.248 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-189-119-248.us-east-2.compute.amazonaws.com
Software
nginx / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:45 GMT
Server
nginx
X-Powered-By
Express
ETag
W/"f-sfeWUgIhIQAHyyjp/cGfmg"
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
15
csi
csi.gstatic.com/ Frame 23DB
0
56 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~k21lf0an&c=8649018514736&slotId=4324509257368&eee=missing-element&bi=missing-id
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4006:809::2003 Sydney, Australia, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:46 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame D100
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90_highFloor&adk=591462414&adf=1174745135&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423177667&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423177667&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl_fy2019.js?cache=bust
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423177667&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
__cfduid=db0c3bc5b0478a1549087eff7c72dab271571733285
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:46 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:17:33 GMT
cache-control
max-age=86400
set-cookie
a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a225099c1cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423177667&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:46 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 32BA
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl_fy2019.js?cache=bust
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:46 GMT
sca.17.4.95.js
static.adsafeprotected.com/ Frame E60C
81 KB
20 KB
Script
General
Full URL
https://static.adsafeprotected.com/sca.17.4.95.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
149c8d10677f2f6979fa28c078cf832f575ee53c397d791b739e7c4c687fe7bc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:46 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Jun 2018 17:20:43 GMT
X-Server-Name
app06ami.ami.303net.pvt
ETag
"5b293b6b-4fda"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
20442
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
41
r1---sn-4g5ednse.c.2mdn.net/videoplayback/id/c1636bb5f74b9e22/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3713067845/sparams/acao,ctier,expire,id,ip,ipbits,itag,mip,...
Redirect Chain
  • https://gcdn.2mdn.net/videoplayback/id/c1636bb5f74b9e22/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3713067845/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/sig...
  • https://r1---sn-4g5ednse.c.2mdn.net/videoplayback/id/c1636bb5f74b9e22/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3713067845/sparams/acao,ctier,expire,id,ip,ipbits,i...
4 MB
4 MB
Media
General
Full URL
https://r1---sn-4g5ednse.c.2mdn.net/videoplayback/id/c1636bb5f74b9e22/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3713067845/sparams/acao,ctier,expire,id,ip,ipbits,itag,mip,mm,mn,ms,mv,mvi,pl,source/signature/322E4508D380552D5DFAFCC9C1526B20B4631479.5139BD581AA619340FEDDC048054ABD4761CF559/key/cms1/cms_redirect/yes/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5ednse/ms/onc/mt/1571733208/mv/m/mvi/0/pl/41?cpn=xMiCKFJ91s7tzk81&file=file.mp4
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:69::6 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
ac9e4dfe7f4962cdfb0103aa466da363695acc8e8957ec5b248fa132ad3a8558
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:46 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 16 Sep 2019 07:44:04 GMT
Server
gvs 1.0
Content-Type
video/mp4
Content-Range
bytes 0-4010734/4010735
Cache-Control
private, max-age=86400
Connection
close
Accept-Ranges
bytes
Alt-Svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
Content-Length
4010735
Expires
Tue, 22 Oct 2019 08:34:46 GMT

Redirect headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:46 GMT
server
ClientMapServer
status
302
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
location
https://r1---sn-4g5ednse.c.2mdn.net/videoplayback/id/c1636bb5f74b9e22/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3713067845/sparams/acao,ctier,expire,id,ip,ipbits,itag,mip,mm,mn,ms,mv,mvi,pl,source/signature/322E4508D380552D5DFAFCC9C1526B20B4631479.5139BD581AA619340FEDDC048054ABD4761CF559/key/cms1/cms_redirect/yes/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5ednse/ms/onc/mt/1571733208/mv/m/mvi/0/pl/41?cpn=xMiCKFJ91s7tzk81&file=file.mp4
cache-control
no-cache, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
668
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
main.js
tag.imonomy.com/script/ Frame 497A
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15862
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a22506977cbcc-VIE
content-length
5239
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=331804&asId=e7cb5fcd-b763-069a-9d06-698b8f48e9ef&tv={c:rLpe58,pingTime:-2,time:240,type:a,im:{sf:0,pom:1,prf:{beA:2585,beZ:2586,mfA:2588,cmA:2589,inA:2589,inZ:2594,prA:2594,prZ:2611,si:2617,poA:2617,poZ:2623,cmZ:2623,mfZ:2623,loA:2729,loZ:2730,ltA:2823,ltZ:2823}},sca:{dfp:{df:4,sz:590.332,dom:body}},env:{gca:1},clog:[{piv:88,vs:o,r:v,w:590,h:332,t:32}],vv:3.6.0,es:0,sc:1,ha:1,gm:0,slTimes:{i:0,o:240,n:0,pp:0,pm:0},slEvents:[{sl:o,t:32,wc:0.0.1600.1200,ac:323.908.590.332,am:v,cc:323.908.590.332,piv:88,obst:0,th:0,reas:v,bkn:{piv:[233~75],as:[233~590.332]}}],slEventCount:1,em:true,fr:true,e:,tt:fwjsvid,dtt:0,fm:rFCgGEO+1.-|11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f|1g1*.331804-39018748|1g11|1g12|1g13|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1q|1r|1s11,idMap:1g1*,rend:1,renddet:env,rmeas:1,slid:[video_5798750504001_0,singleArticle,maincontainer],sinceFw:205,readyFired:true}&br=u
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:46 GMT
X-Server-Name
dt37dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 87A5
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/14567721676/preload.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:46 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 7FE1
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/14567721676/preload.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:46 GMT
main.js
tag.imonomy.com/script/ Frame 32BA
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15862
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a22529e14cbcc-VIE
content-length
5239
integrator.js
adservice.google.de/adsid/ Frame 87A5
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 87A5
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 87A5
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:46 GMT
integrator.js
adservice.google.de/adsid/ Frame 7FE1
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 7FE1
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 7FE1
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:46 GMT
serve
srv.imonomy.com/internal/ Frame 497A
7 KB
2 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=4130&ttkan_x=1849&sum_ttkan_x=1849&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=818&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673388&tr=2&trs=1&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=8077&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
d083cc000a794634cd8d17bf239fd28479835cb25ec1be65ed101eb2b89903ab

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Encoding
gzip
Server
nginx
Etag
"e833bfeca8b91ca73e0df8154cc1f894db022971"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2184
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame 254B
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90_highFloor&adk=591462414&adf=1174745134&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423129743&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423129743&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423129743&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:47 GMT
content-type
text/html
set-cookie
__cfduid=d542aba9da4f5c84420859e3e9174cd5e1571733287; expires=Wed, 21-Oct-20 08:34:47 GMT; path=/; domain=.imonomy.com; HttpOnly a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:28:10 GMT
cache-control
max-age=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a2254ca45cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423129743&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:47 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 87A5
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:47 GMT
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame 41E3
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90_highFloor&adk=591462414&adf=1174745133&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423150864&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423150864&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423150864&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:47 GMT
content-type
text/html
set-cookie
__cfduid=d542aba9da4f5c84420859e3e9174cd5e1571733287; expires=Wed, 21-Oct-20 08:34:47 GMT; path=/; domain=.imonomy.com; HttpOnly a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:24:12 GMT
cache-control
max-age=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a2254ca42cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423150864&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:47 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 7FE1
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:47 GMT
serve
srv.imonomy.com/internal/ Frame 32BA
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=4252&ttkan_x=1811&sum_ttkan_x=1811&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=202&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673388&tr=2&trs=1&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=9731&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
fb5161d5056eb7e4fe34ee1f83f4f9678146f6eb94417547b2eefac74c1b0eb0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Encoding
gzip
Server
nginx
Etag
"797dd97792f48dc2344cd88a3741c15dd06425c0"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2185
event
vastpixel2.adsafeprotected.com/ Frame A51C
15 B
15 B
Image
General
Full URL
https://vastpixel2.adsafeprotected.com/event?vh=fa509523a03883ffa8d1622624d02e03bb42a956&cid=5c4c420560131b5189fcf2e7&vs=0&vt=vpaid-omit&apos=0&rid=a4634829-fd3e-4a3c-8eae-3cd302cc6984&cvvnd=double-click&vpvnd=Google%20IMA&vphld=234712b5&clr=0&mode=ott%3A0%2Csingle_tag%3A0%2Cdoublewrapped%3A0%2Ccsw%3A0%2Ccm%3A0%2Cfw%3A1&mas=0&st=1571733284335&t=impression&z=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.189.119.248 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-189-119-248.us-east-2.compute.amazonaws.com
Software
nginx / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Server
nginx
X-Powered-By
Express
ETag
W/"f-sfeWUgIhIQAHyyjp/cGfmg"
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
15
view
googleads4.g.doubleclick.net/pcs/ Frame A51C
0
644 B
Image
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstNTwLlZoizVU1ZnQcMYF30SvZA95u2ppYU2gzgEyADxi1W9IP5nHvdX6pFiwAGGAWFCSqvGbKqcad7-0YOCtxVBhqQQlh673Y21IreCtKW0bLq_IAoJD0FuQFYfyRy&sig=Cg0ArKJSzHKQDGT0GrRNEAE&urlfix=1&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:47 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:47 GMT
imp
statsf-tm.everesttech.net/stats/1/ Frame A51C
85 B
179 B
Image
General
Full URL
https://statsf-tm.everesttech.net/stats/1/imp?didtype=UNK&date=1571733282983&psId=9PliOidgZa3Mp9drI27Q&vinst=t&seller_id=124576&s=H4sIAAAAAAAAAAGwAE__RTQDlWVdllgdzqSv8hGJ21JikMzkCdzqYvGCvGDpDaMuJGZrJUWnfEA235N60LBFOJ8rZXLRjnkcv-RqyVWHNTZm9hrdR1OMpbWHACH2Ew9olN_HkZhLWO4AMz3QFGBi1qqM7b2j3UPEbpFxTNhRouWrPIvdLfnVTPvx2y52W8yJ1uM8pcHsWGaAkUzNLdpojhE791Tn_so3VFr-oAg0qaqsfnsrpFDWPGKdQFvccG9VxQcBsAAAAA&did=&auth=fcd8207c1c7cd28dbffd35b554ef2a19&conn=unknown&sessId=cb9b9287f4a611e9b2f613ae17dc0006.1&ssb=F&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&mpKey=We0nATVNAtvwvrOpbjtB&price=1&env=site&cpKey=mfpahjb2JnIu8hS7531w&adKey=pMLfUI3XYnXLEIk1cLo8&rt=HTML5&ias_vid_mon=tm&vver=20190927&udat=vpaidjs_proxy_js&apv=J20190930&burl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&rurl=https%3A%2F%2Fwww.express.co.uk&pw=590&ph=332&w=590&h=332&wd=1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Jetty(9.4.z-SNAPSHOT) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
via
1.1 varnish
x-pt
P=109
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status
200
x-cache-hits
0
x-region
EU-East
content-length
85
x-served-by
cache-hhn4033-HHN
pragma
no-cache
server
Jetty(9.4.z-SNAPSHOT)
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes, bytes
expires
Tue, 22 Oct 2019 03:34:47 -05:00
skeleton.js
static.adsafeprotected.com/
Redirect Chain
  • https://pixel.adsafeprotected.com/rfw/st/331804/39018748/skeleton.js?videoId=c87e8378c26582604ae3e9bbe52d6711&xsId=a4634829-fd3e-4a3c-8eae-3cd302cc6984&xmtp=v&xmapp=0&adsafe_url=https%3A%2F%2Fwww.e...
  • https://static.adsafeprotected.com/skeleton.js
17 B
17 B
Image
General
Full URL
https://static.adsafeprotected.com/skeleton.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Last-Modified
Thu, 19 Dec 2013 18:10:33 GMT
X-Server-Name
app06ami.ami.303net.pvt
ETag
"52b33699-11"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
17
Server
nginx

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:47 GMT
X-Server-Name
app25ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Location
https://static.adsafeprotected.com/skeleton.js
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Server
nginx
event-vpaid
vastpixel2.adsafeprotected.com/ Frame EE09
15 B
15 B
Image
General
Full URL
https://vastpixel2.adsafeprotected.com/event-vpaid?cid=5c4c420560131b5189fcf2e7&rid=a4634829-fd3e-4a3c-8eae-3cd302cc6984&apos=0&clr=false&vt=vpaid-omit&vwv=4.11.27&cvvnd=double-click&vpvnd=Google%20IMA&mode=ott%3A0%2Csingle_tag%3A0%2Cdoublewrapped%3A0%2Ccsw%3A0%2Ccm%3A0%2Cfw%3A1&ts=1571733284340&t=adStarted&cb=48690617&d=csw%3Dfalse%26safeIframe%3Dfalse%26msg%3D%26file%3Dhttps%253A%252F%252Fimasdk.googleapis.com%252Fjs%252Fsdkloader%252Fvpaid_adapter.js%26dt%3D2347
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.189.119.248 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-189-119-248.us-east-2.compute.amazonaws.com
Software
nginx / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Server
nginx
X-Powered-By
Express
ETag
W/"f-sfeWUgIhIQAHyyjp/cGfmg"
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
15
rendercomplete
statsf-tm.everesttech.net/stats/1/ Frame A51C
85 B
131 B
Image
General
Full URL
https://statsf-tm.everesttech.net/stats/1/rendercomplete?didtype=UNK&date=1571733282983&psId=9PliOidgZa3Mp9drI27Q&vinst=t&seller_id=124576&s=H4sIAAAAAAAAAAGwAE__RTQDlWVdllgdzqSv8hGJ21JikMzkCdzqYvGCvGDpDaMuJGZrJUWnfEA235N60LBFOJ8rZXLRjnkcv-RqyVWHNTZm9hrdR1OMpbWHACH2Ew9olN_HkZhLWO4AMz3QFGBi1qqM7b2j3UPEbpFxTNhRouWrPIvdLfnVTPvx2y52W8yJ1uM8pcHsWGaAkUzNLdpojhE791Tn_so3VFr-oAg0qaqsfnsrpFDWPGKdQFvccG9VxQcBsAAAAA&did=&auth=fcd8207c1c7cd28dbffd35b554ef2a19&conn=unknown&sessId=cb9b9287f4a611e9b2f613ae17dc0006.1&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&mpKey=We0nATVNAtvwvrOpbjtB&price=1&env=site&cpKey=mfpahjb2JnIu8hS7531w&adKey=pMLfUI3XYnXLEIk1cLo8&rt=HTML5&apv=J20190930&burl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&rurl=https%3A%2F%2Fwww.express.co.uk&pw=590&ph=332&w=590&h=332&wd=1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Jetty(9.4.z-SNAPSHOT) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
via
1.1 varnish
x-pt
P=108
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status
200
x-cache-hits
0
x-region
EU-East
content-length
85
x-served-by
cache-hhn4033-HHN
pragma
no-cache
server
Jetty(9.4.z-SNAPSHOT)
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes, bytes
expires
Tue, 22 Oct 2019 03:34:47 -05:00
d
event.spotxchange.com/event/ Frame DB0F
0
349 B
Image
General
Full URL
https://event.spotxchange.com/event/d?_x=WzE1NzE3MzMyODIsImNiOWI5Mjg3ZjRhNjExZTliMmY2MTNhZTE3ZGMwMDA2IiwiMjE2NDQ4IiwiMWU2YTAuODQzNzEuNzZkMiIsIjY0MDkiLCIxZTZhMC44NDM3MS43NmQyIiwicE1MZlVJM1hZblhMRUlrMWNMbzgiLCJjYmJlYThjYmY0YTYxMWU5YjJmNjEzYWUxN2RjMDAwNiJdJnNldGVjPU5ERmpObVJoTURobE9XRXdaVEU0TWpRNVlUTmxNMlV6T0RBM1l6ZzRaVGc9&es=JSAdBroker&ts=1571733287.182&eid=16
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.111 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
true
X-fe
141
Connection
keep-alive
Content-Length
0
dc_oe=ChMIsM_f4Lqv5QIVMcTmCh1_zQkrEAAYACCc1fs5;met=1;ecn1=1;etm1=0;eid1=11;
ade.googlesyndication.com/ddm/activity/ Frame A51C
42 B
109 B
Image
General
Full URL
https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIsM_f4Lqv5QIVMcTmCh1_zQkrEAAYACCc1fs5;met=1;ecn1=1;etm1=0;eid1=11;
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:47 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
beacon
tag.researchnow.com/t/ Frame A51C
42 B
361 B
Image
General
Full URL
https://tag.researchnow.com/t/beacon?adn=3&ca=23075601&cr=121563804_Start&ord=568494396&pl=253815120&pr=284008&si=4958750
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.91.215 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-91-215.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:47 GMT
Last-Modified
Thu, 11 Dec 2014 18:19:06 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
42
Expires
Tue, 22 Oct 2019 08:34:47 GMT
event
vastpixel2.adsafeprotected.com/ Frame A51C
15 B
15 B
Image
General
Full URL
https://vastpixel2.adsafeprotected.com/event?vh=fa509523a03883ffa8d1622624d02e03bb42a956&cid=5c4c420560131b5189fcf2e7&vs=0&vt=vpaid-omit&apos=0&rid=a4634829-fd3e-4a3c-8eae-3cd302cc6984&cvvnd=double-click&vpvnd=Google%20IMA&vphld=234712b5&clr=0&mode=ott%3A0%2Csingle_tag%3A0%2Cdoublewrapped%3A0%2Ccsw%3A0%2Ccm%3A0%2Cfw%3A1&mas=0&st=1571733284335&t=start&z=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.189.119.248 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-189-119-248.us-east-2.compute.amazonaws.com
Software
nginx / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Server
nginx
X-Powered-By
Express
ETag
W/"f-sfeWUgIhIQAHyyjp/cGfmg"
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
15
view
statsf-tm.everesttech.net/stats/1/ Frame A51C
85 B
130 B
Image
General
Full URL
https://statsf-tm.everesttech.net/stats/1/view?didtype=UNK&date=1571733282983&psId=9PliOidgZa3Mp9drI27Q&vinst=t&seller_id=124576&s=H4sIAAAAAAAAAAGwAE__RTQDlWVdllgdzqSv8hGJ21JikMzkCdzqYvGCvGDpDaMuJGZrJUWnfEA235N60LBFOJ8rZXLRjnkcv-RqyVWHNTZm9hrdR1OMpbWHACH2Ew9olN_HkZhLWO4AMz3QFGBi1qqM7b2j3UPEbpFxTNhRouWrPIvdLfnVTPvx2y52W8yJ1uM8pcHsWGaAkUzNLdpojhE791Tn_so3VFr-oAg0qaqsfnsrpFDWPGKdQFvccG9VxQcBsAAAAA&did=&pvId=1&auth=fcd8207c1c7cd28dbffd35b554ef2a19&conn=unknown&sessId=cb9b9287f4a611e9b2f613ae17dc0006.1&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&mpKey=We0nATVNAtvwvrOpbjtB&price=1&env=site&cpKey=mfpahjb2JnIu8hS7531w&adKey=pMLfUI3XYnXLEIk1cLo8&rt=HTML5&ias_vid_mon=tm&vol=0&dur=30&apv=J20190930&burl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&rurl=https%3A%2F%2Fwww.express.co.uk&pw=590&ph=332&w=590&h=332&wd=1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Jetty(9.4.z-SNAPSHOT) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
via
1.1 varnish
x-pt
P=115
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status
200
x-cache-hits
0
x-region
EU-East
content-length
85
x-served-by
cache-hhn4033-HHN
pragma
no-cache
server
Jetty(9.4.z-SNAPSHOT)
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes, bytes
expires
Tue, 22 Oct 2019 03:34:47 -05:00
jstag
imonomy-d.openx.net/w/1.0/ Frame A147
47 KB
17 KB
Script
General
Full URL
https://imonomy-d.openx.net/w/1.0/jstag
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash
6046670d0853c2ed5b1db6cfd830673ed1374365be0b224e78ca17d9dc54e9d3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
content-encoding
gzip
server
OXGW/16.164.0
vary
Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
status
200
cache-control
max-age=3600
content-type
text/javascript
alt-svc
clear
content-length
17547
via
1.1 google
expires
Tue, 22 Oct 2019 09:34:47 GMT
dvtp_src.js
cdn.doubleverify.com/ Frame DB0F
18 KB
6 KB
Script
General
Full URL
https://cdn.doubleverify.com/dvtp_src.js?ctx=484047&cmp=2228897&sid=593588&plc=22288971&num=&adid=&advid=484048&adsrv=15&btreg=&btadsrv=&crt=&crtname=&chnl=&unit=&pid=&uid=&dvtagver=6.1.src&DVP_CHANNELID=216448&DVP_DEALID=1e6a0.84371.76d2&DVP_CMPID=1e6a0.84371.76d2&turl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&DVPX_SX_UID=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&DVPX_SX_MID=cb9b9287f4a611e9b2f613ae17dc0006&DVPX_IP=144.76.109.30&DVPX_UA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&DVP_PUBLISHERID=124576&DVP_PUBNAME=Reach%20PLC%20%28previously%20Express%20Newspaper%29&DVP_DEVICETYPE=2&DVP_MAKE=&DVP_MODEL=&DVP_OS=2
Requested by
Host: cdn.spotxcdn.com
URL: https://cdn.spotxcdn.com/integration/instreamadbroker/v1/instreamadbroker.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.216.102 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-216-102.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 /
Resource Hash
ec9f555293783e1fc77da97dbabfb27b29c2495be2bf735229482e2a0f14766f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Oct 2019 18:19:34 GMT
Server
Microsoft-IIS/10.0
ETag
W/"0fffc53b7dd51:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=30534
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5776
sxtb.js
d23xwq4myz19mk.cloudfront.net/ Frame DB0F
2 KB
1 KB
Script
General
Full URL
https://d23xwq4myz19mk.cloudfront.net/sxtb.js?ctx=484047&cmp=2228897&sid=593588&plc=22288971&num=&adid=&advid=484048&adsrv=15&btreg=&btadsrv=&crt=&crtname=&chnl=&unit=&pid=&uid=&dvtagver=6.1.src&DVP_CHANNELID=216448&DVP_DEALID=1e6a0.84371.76d2&DVP_CMPID=1e6a0.84371.76d2&turl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&DVPX_SX_UID=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&DVPX_SX_MID=cb9b9287f4a611e9b2f613ae17dc0006&DVPX_IP=144.76.109.30&DVPX_UA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36
Requested by
Host: cdn.spotxcdn.com
URL: https://cdn.spotxcdn.com/integration/instreamadbroker/v1/instreamadbroker.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:bc00:14:3684:7f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4d15cd27dd3458e7e819b9215ae5b7c1be3a1324df4626ce8262ef4fb40853bf

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 05:32:28 GMT
content-encoding
gzip
last-modified
Mon, 09 Apr 2018 15:30:40 GMT
server
AmazonS3
age
42832
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
29rNUV3PTqzu983wEfpU56NzKZyArISbi9rMYTe-kai40aOHzzq2Pg==
via
1.1 172e63b20fb363ed969de28ae3937e21.cloudfront.net (CloudFront)
moatvideo.js
z.moatads.com/spotxchangejsvideo759622536126/ Frame ED7E
306 KB
100 KB
Script
General
Full URL
https://z.moatads.com/spotxchangejsvideo759622536126/moatvideo.js
Requested by
Host: cdn.spotxcdn.com
URL: https://cdn.spotxcdn.com/integration/instreamadbroker/v1/instreamadbroker.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
1bef3fa80a1e44071f97f4263bc583c8138234b84c66eafb80f1af47ce3904d0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Encoding
gzip
Last-Modified
Sat, 19 Oct 2019 00:57:29 GMT
Server
AmazonS3
x-amz-request-id
57CCD7C6293E7014
ETag
"f3c1041cd0036779e8739eb0354df103"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=11695
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
102112
x-amz-id-2
f5p/XpI6eI34gbKQPks/YBZVSfqV+CLmvf/ONCjlSus/Ko686b6UEgq+jNYkYe2ul5kd1ql9u0E=
impression
ams01-event.spotxchange.com/vast/ Frame DB0F
0
348 B
Image
General
Full URL
https://ams01-event.spotxchange.com/vast/impression?_x=WzE1NzE3MzMyODIsImNiOWI5Mjg3ZjRhNjExZTliMmY2MTNhZTE3ZGMwMDA2IiwiMjE2NDQ4IiwiMWU2YTAuODQzNzEuNzZkMiIsIjY0MDkiLCIxZTZhMC44NDM3MS43NmQyIiwicE1MZlVJM1hZblhMRUlrMWNMbzgiLCJjYjFkYTdkZi1mNGE2LTExZTktYWUwMy0xMWEzY2JiYTA5MDYiLHRydWUsbnVsbCxbIjEyNDU3NiIsIjIxNjQ0OCIsIjY0MDkiLCI0NTkzODgiLCJ3d3cuZXhwcmVzcy5jby51ayIsNTcsWyJleHhvbm1vYmlsLmNvbSJdLDI4NzQwMCwyODc0MDAsMjQ0MjkwLDI0NDI5MCwwXSwyODc0MDAsIkwiLCJjYmJlYThjYmY0YTYxMWU5YjJmNjEzYWUxN2RjMDAwNiJdJnNldGVjPVlXWm1ZalJsWm1NelpURTRaVFkwTnpjd05qZzBZVEJsT0dNMk5UZG1OREk9
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.111 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
true
X-fe
44
Connection
keep-alive
Content-Length
0
beacon
ams01-search.spotxchange.com/ Frame DB0F
0
361 B
Image
General
Full URL
https://ams01-search.spotxchange.com/beacon?_a=216448&_p=1e6a0.84371.76d2&_z=1&_m=eNpFiV1PgzAYRl9%2FUEu%2FaKmJdxgzMyAm8wLvSiluATpCS8DF%2F66L0%2Fg8V%2BccgQkBAJoqqjhnGQPb6EazTHXCSEqdblgnKTeOqtYSQiQwKoXIIH8EKgRWElOiMSdwjHEK90myrit22zS7ELA946VPupM33rpkcnM4ezP8MaWaCa6T6LaIgjUjOo6zRdFsaHbd4lu0mtmf%2FDvqZrO0yLs1oMFEFyKUr%2Fs9UCZSJeHuRjcFX9eBFGTjklzxP%2F32n3%2BW%2BctWHXr%2Blj8PRT4MxVOd1qz%2BqA71WrIdLy69qPLdpRyLh2%2BxOlZJ&_l=eNp1jstOwzAQRedbvEaR7dixXYldo27aRIgUETaR7bgQNW6ikIg%2B6L%2FjKiwQiBnNLM698yBAgIcicGsu0TiSLBYkEklN%2F4JlChhqp9vgvqAYLS7INDVaIBxhKgVDd6jXp24avxFjVAX23rvDL9dk2sZW7mjf9OHVVTvnZj1EkO006NHVldfD3o19q63719sPzjeTv%2BHK9v4moesVsu16Pbfw62Pfjc%2FzOLjjsTv4zjRtZDsPREjKjYgVEztOlBQSK0FiUwtmdkZZSBhWQBTjkgLjKpZyXkso4yL5cQeHpJhJJYERIrjECSXwmS83dFM8fJQ%2B2%2BfF%2Fpyd0zhfZc2LL2np03NJt6e8eGrz1eb%2BC7M7asQ%3D&_t=eNpNUW1z2jAMzm%2FxZwZJeK25fUjXddcyCusoPRg7n%2BMoxF0S52wnwBj%2FfXLYbstdJPmRHll6HAMXqvREHAOfiDgd8FEQwE0cpqOgzyEYJ8L3%2FZEnMi5LT%2Bk9L6Xw4ivrTK4Bs6cKCCXGcm1Jh1Q5P1lZOKjv47mRCSjW8FwmLJXaWJZq3qYxyRNmTsZCQeiZaBs7hw1sqnTBMImcjJuM0LLO8w4xIoOWqioosZyFLMQuKUDCap1jIrO2orverqebMdSHd7boQgMajLUgsm4JdtczlbLHXa%2FJI7CL2SZRj9FQ3I7q5Wzt5q0kod%2FIehk93OGx9ezxK4bz5QDt%2FWdX9frxdo4uij60UOvmy76zgwjt4pOzz4vZC7rVGvnfcfy6qpS25roZoVbX0CEil1BahjOqvMFFDppXFWhDaMpz86%2FAoJCE%2BpcOSbjluOsSlV45pXForJeqRDDo%2BgRLDHAtMmYqEK2m3Glu265nkkAjBbgIjta5VhF2hRne%2FudNA2xUqARQ2LBDFHLDC36eh5f4HqdDejZ0REml8PFzMjU0pGQ4dsGAEiHtiUwlHY6nbZWGvRvxP2Sfq9jxJPURGCNF1aXVf1kXL%2FQHk5vJr%2B3rc%2F70tuk%2Fre7fNqvoiPFhW7wE22L7Y7H68nN%2B9xAgjv%2Fm%2FW%2BgP%2Bhy&_b=eNozYPAL9fFBI2r8qiINfbNCDSOr%2FHJ8s7IrI41CTXyNIk0jQ5LLI7MCjf3cA6v8w8OyfXMDbQF9gxRO&beacon_type=start&aid=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&syn%5Btiming%5D={%22event_log%22:[{%22id%22:12,%22ad_id%22:%22pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2%22,%22ts%22:1571733283.752},{%22id%22:11,%22ad_id%22:%22pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2%22,%22ts%22:1571733283.752},{%22id%22:14,%22ad_id%22:%22pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2%22,%22ts%22:1571733285.759},{%22id%22:16,%22ad_id%22:%22pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2%22,%22ts%22:1571733287.182}],%22listings%22:[]}
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.123 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Server
nginx
Transfer-Encoding
chunked
Access-Control-Allow-Methods
POST, GET, PATCH, DELETE, OPTIONS
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
https://www.express.co.uk
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
e.png
rtb-lb-event-tm-ams-tm.everesttech.net/rtb/ Frame DB0F
85 B
375 B
Image
General
Full URL
https://rtb-lb-event-tm-ams-tm.everesttech.net/rtb/e.png?e=win&aid=cb9b9287f4a611e9b2f613ae17dc0006.1&cp=2170284&slot=1&x_price=1&ets=1571733282981&tz=Europe%2FLondon&source=spotx&fc=8&fci=30&country=DE&region=UNKNOWN&mc=48&ap=0&ut=0&vis=UNKNOWN&site=9PliOidgZa3Mp9drI27Q&bp=28740000&curr=USD&exr=1.0&fid=We0nATVNAtvwvrOpbjtB&c=4117580621&ccurr=USD&cuxr=1.0&a=459388&ca=694808&st=INSTREAM%7CPREROLL_SURVEY%7CINSTREAM_VPAID2_DESKTOP%7CVPAID_JS&sh=480&sw=640&rid=-1&mp=161&psk=9PliOidgZa3Mp9drI27Q&cfc=8&cfci=30&dur=60&cityid=-1&metroid=-1&countryid=80&postalid=-1&duration=10&v=1&auth=dk1sXsf0WL24biQBSCbSwvSUUeA&x_r=Aci7zA
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.148.48.57 , Netherlands, ASN23539 (TUBEMOGUL - TubeMogul, Inc., US),
Reverse DNS
Software
Jetty(9.4.z-SNAPSHOT) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:47 GMT
X-PT
P=121 0=0
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
Connection
close
Server
Jetty(9.4.z-SNAPSHOT)
Expires
Thu, 01 Jan 1970 00:00:00 GMT
e.png
playtime-tm.everesttech.net/audit/ Frame DB0F
80 B
273 B
Image
General
Full URL
https://playtime-tm.everesttech.net/audit/e.png?event=blank
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ECAcc (frc/8E89) /
Resource Hash
bc614a222ee109e8bdb51477ae20a05f17c6fc97f61be458626cb1f600f521dd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
via
1.1 varnish
age
17736
x-cache
HIT, HIT
status
200
x-cache-hits
747
content-length
80
x-served-by
cache-fra19138-FRA
last-modified
Wed, 06 Feb 2013 23:00:20 GMT
server
ECAcc (frc/8E89)
x-timer
S1571733287.359917,VS0,VE0
etag
"1478688197"
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
expires
Fri, 04 Oct 2019 03:38:41 GMT
jstag
imonomy-d.openx.net/w/1.0/ Frame CA96
47 KB
17 KB
Script
General
Full URL
https://imonomy-d.openx.net/w/1.0/jstag
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash
8c1afa07812029e47a523799a1cd487ae198957df103429182ac12cc55ccfc6d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
content-encoding
gzip
server
OXGW/16.164.0
vary
Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
status
200
cache-control
max-age=3600
content-type
text/javascript
alt-svc
clear
content-length
17545
via
1.1 google
expires
Tue, 22 Oct 2019 09:34:47 GMT
mon
pixel.adsafeprotected.com/
0
0
Image
General
Full URL
https://pixel.adsafeprotected.com/mon?videoId=20edce92b9ddb5d9826e2ca1ae9c31da&pubId=406023&campId=694808&advId=undefined&bidurl=https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&chanId=We0nATVNAtvwvrOpbjtB&placementId=2170284&anId=F&uId=cb9b9287f4a611e9b2f613ae17dc0006.1&adsafe_par=&adsafe_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&adsafe_type=abdfq&adsafe_jsinfo=,id:b4a6952a-52c9-e720-8a9d-f56f2c87d69d,c:rLpdDO,sl:outOfView,em:false,fr:true,mn:app05ami,pt:2-5-15,wc:0.0.1600.1200,ac:323.908.590.332,am:v,cc:323.908.590.334,piv:88,obst:0,th:0,reas:v,br:u,abv:na,an:n,vc:jv3,fm:rFCgGEO+1*.-|11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f|1g11|1g12|1h|1i|1j|1k|1l|1m,idMap:1*,pl:,rend:1,renddet:env,rmeas:1,es:0,sc:1,ha:1,gm:0,tt:jsvid,thd:1,et:23,oid:ccbf53d7-f4a6-11e9-9e3c-00259086ca74,v:19.8.22,sp:0,wr:1600.1200,sr:1600.1200,ov:0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

acj
imonomy-d.openx.net/w/1.0/ Frame A147
Redirect Chain
  • https://imonomy-d.openx.net/w/1.0/acj?ai=426c21bd-3f18-457f-9470-7ffbcb551859&o=7857192742&callback=OX_7857192742&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-r...
  • https://imonomy-d.openx.net/w/1.0/acj?cc=1&ai=426c21bd-3f18-457f-9470-7ffbcb551859&o=7857192742&callback=OX_7857192742&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-...
1023 B
1 KB
Script
General
Full URL
https://imonomy-d.openx.net/w/1.0/acj?cc=1&ai=426c21bd-3f18-457f-9470-7ffbcb551859&o=7857192742&callback=OX_7857192742&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&jr=&auid=540666290&dims=1600x1200&adxy=-4500%2C1194&res=1600x1200x24&plg=pm&ch=UTF-8&tz=-120&ws=728x91&ifr=1&tws=1600x1200&mt=1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash
9c19ae6e2ba96531e72633df1fad205a2759670d0c17d822e5c0be2615b2a7ea

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:47 GMT
via
1.1 google
server
OXGW/16.164.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
status
200
cache-control
private, max-age=0, no-cache
content-type
application/json
alt-svc
clear
content-length
1023
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date
Tue, 22 Oct 2019 08:34:47 GMT
via
1.1 google
server
OXGW/16.164.0
status
302
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://imonomy-d.openx.net/w/1.0/acj?cc=1&ai=426c21bd-3f18-457f-9470-7ffbcb551859&o=7857192742&callback=OX_7857192742&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&jr=&auid=540666290&dims=1600x1200&adxy=-4500%2C1194&res=1600x1200x24&plg=pm&ch=UTF-8&tz=-120&ws=728x91&ifr=1&tws=1600x1200&mt=1
alt-svc
clear
content-length
0
acj
imonomy-d.openx.net/w/1.0/ Frame CA96
Redirect Chain
  • https://imonomy-d.openx.net/w/1.0/acj?ai=e9dd7785-126c-47d9-9b9b-ce44cc16dcdd&o=9740725079&callback=OX_9740725079&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-r...
  • https://imonomy-d.openx.net/w/1.0/acj?cc=1&ai=e9dd7785-126c-47d9-9b9b-ce44cc16dcdd&o=9740725079&callback=OX_9740725079&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-...
1021 B
1 KB
Script
General
Full URL
https://imonomy-d.openx.net/w/1.0/acj?cc=1&ai=e9dd7785-126c-47d9-9b9b-ce44cc16dcdd&o=9740725079&callback=OX_9740725079&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&jr=&auid=540666290&dims=1600x1200&adxy=-4500%2C1194&res=1600x1200x24&plg=pm&ch=UTF-8&tz=-120&ws=728x91&ifr=1&tws=1600x1200&mt=1
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash
d6ae9c160eecee16065db5ddb29b956f0bebf65ef3d0978de7eeaf24b1f6329c

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:47 GMT
via
1.1 google
server
OXGW/16.164.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
status
200
cache-control
private, max-age=0, no-cache
content-type
application/json
alt-svc
clear
content-length
1021
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date
Tue, 22 Oct 2019 08:34:47 GMT
via
1.1 google
server
OXGW/16.164.0
status
302
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://imonomy-d.openx.net/w/1.0/acj?cc=1&ai=e9dd7785-126c-47d9-9b9b-ce44cc16dcdd&o=9740725079&callback=OX_9740725079&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&jr=&auid=540666290&dims=1600x1200&adxy=-4500%2C1194&res=1600x1200x24&plg=pm&ch=UTF-8&tz=-120&ws=728x91&ifr=1&tws=1600x1200&mt=1
alt-svc
clear
content-length
0
main.js
tag.imonomy.com/script/ Frame 87A5
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15863
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a22564d92cbcc-VIE
content-length
5239
main.js
tag.imonomy.com/script/ Frame 7FE1
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15863
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a22564db2cbcc-VIE
content-length
5239
p2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=1&...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=1...
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_el=0&ns_st_pb=1&ns_st_mp=brightcove&ns_st_mv=6.19.2&ns_st_pn=1&ns_st_tp=1&ns_st_ad=pre-roll&ns_st_ci=16df29ab224&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1571733287461&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=5906&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_vo=100&ns_st_ws=norm&ns_st_ki=1200000&ns_st_pl=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&ns_st_pr=&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=&ns_st_ty=video&ns_st_ct=va11&ns_st_cs=0x0&ns_st_ge=News&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=*null&ns_st_ti=*null&ns_st_ami=pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2&ns_st_amt=3_30s_Desktop_Germany_German_Context_Politics%20%26%20Current%20Affairs_RUK8322_USD&ns_st_ams=ima&c3=northernandshell&c4=expressuk&c6=*null&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c8=*null&c9=*null
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:47 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_el=0&ns_st_pb=1&ns_st_mp=brightcove&ns_st_mv=6.19.2&ns_st_pn=1&ns_st_tp=1&ns_st_ad=pre-roll&ns_st_ci=16df29ab224&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1571733287461&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=5906&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_vo=100&ns_st_ws=norm&ns_st_ki=1200000&ns_st_pl=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&ns_st_pr=&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=&ns_st_ty=video&ns_st_ct=va11&ns_st_cs=0x0&ns_st_ge=News&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=*null&ns_st_ti=*null&ns_st_ami=pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2&ns_st_amt=3_30s_Desktop_Germany_German_Context_Politics%20%26%20Current%20Affairs_RUK8322_USD&ns_st_ams=ima&c3=northernandshell&c4=expressuk&c6=*null&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c8=*null&c9=*null
Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:47 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
n.js
geo.moatads.com/
110 B
284 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=!As)IBG%60%3AC&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=SPOTXCHANGEJSVIDEO1&hp=1&wf=1&cm=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=8&f=0&j=&t=1571733287468&de=202463855702&m=0&ar=6907c9d928-clean&iw=04fa941&q=2&cb=0&ym=0&cu=1571733287468&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=124576%3A216448%3A6409%3A1e6a0.84371.76d2&zMoatImpressionId=cbbea8cbf4a611e9b2f613ae17dc0006&zMoatAD=exxonmobil.com&zMoatFD=14ae4.6890e.f68d&zGSRC=1&gu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&id=1&bo=www.express.co.uk&bd=undefined&zMoatDomain=express.co.uk&zMoatSubdomain=express.co.uk&gw=spotxchangejsvideo759622536126&fd=1&ac=1&it=500&ti=0&ih=1&fs=173050&na=535125436&cs=0&callback=DOMlessLLDcallback_815617
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/spotxchangejsvideo759622536126/moatvideo.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.9.104.81 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-9-104-81.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
d5e8dd45e016659abf3f31bafbe99e0343c9757ecf450816d44ccaf49fdecaa3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:47 GMT
server
TornadoServer/4.5.3
etag
"8a7876ddf43ae3f7dc45cd88d2ce5a829f4972cd"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
110
in
c2.u5c93.com/v5/
2 B
364 B
Other
General
Full URL
https://c2.u5c93.com/v5/in
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.246.207.119 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-246-207-119.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryEt1usCVnRu15K9CE

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
status
200
x-powered-by
Express
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary
Origin
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
content-length
2
dv-measurements289.js
cdn.doubleverify.com/ Frame 3F50
270 KB
63 KB
Script
General
Full URL
https://cdn.doubleverify.com/dv-measurements289.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.216.102 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-216-102.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 /
Resource Hash
bbe4f1029e40458992a7f81787a6c2ffd5e861f80e463620ec9ce7131919cb2e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Oct 2019 13:39:28 GMT
Server
Microsoft-IIS/10.0
ETag
"0e8e7a3147dd51:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=946080000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
63718
main.js
srv.imonomy.com/script/ Frame A147
19 KB
5 KB
Script
General
Full URL
https://srv.imonomy.com/script/main.js
Requested by
Host: imonomy-d.openx.net
URL: https://imonomy-d.openx.net/w/1.0/jstag
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Encoding
gzip
Server
nginx
Etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=86400
Connection
keep-alive
Content-Length
5239
main.js
srv.imonomy.com/script/ Frame CA96
19 KB
5 KB
Script
General
Full URL
https://srv.imonomy.com/script/main.js
Requested by
Host: imonomy-d.openx.net
URL: https://imonomy-d.openx.net/w/1.0/jstag
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Encoding
gzip
Server
nginx
Etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=86400
Connection
keep-alive
Content-Length
5239
t2tv7.html
cdn3.doubleverify.com/ Frame 6599
0
0
Document
General
Full URL
https://cdn3.doubleverify.com/t2tv7.html
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements289.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.58.216.102 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-58-216-102.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Host
cdn3.doubleverify.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Cache-Control
max-age=946080000
Content-Type
text/html
Last-Modified
Thu, 11 Sep 2014 19:15:16 GMT
Accept-Ranges
bytes
ETag
"0ba3b8f4cdcf1:0"
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Encoding
gzip
Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Length
3877
Connection
keep-alive
visit.js
tps.doubleverify.com/ Frame 3F50
3 KB
2 KB
Script
General
Full URL
https://tps.doubleverify.com/visit.js?bridua=3&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D6IAC6DD%5D4%40%5DF%3CTau7%3A%3F2%3F46TauA6CD%40%3F2%3D7%3A%3F2%3F46Tau%60%60hacbhTauE6IE%5CD42%3E%5C9%3EC4%5CE2I%5CC67F%3F5%5CH2C%3F%3A%3F8%5C7C2F5%5C%3F6HD%5C%3D2E6DEU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D6IAC6DD%5D4%40%5DF%3CTar9EEADTbpTauTauHHH%5D6IAC6DD%5D4%40%5DF%3CU2%26C%3Dl&srcurlD=0&aUrlD=0&ssl=https:&aadid=912239f8862a821ea94eecb0091ffde3c2de2aa1&dfs=3687&ddur=69&uid=1571733287700910&jsCallback=dvCallback_1571733287700481&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&htmlmsging=1&chro=0&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&dvp_isOnHead=1&jsver=289&vavbkt=4,8,1,23&lvvn=26&m1=13&refD=1&referrer=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&fwc=0&fcl=331&flt=1&fec=2894&fcifrms=32&brh=2&dvp_epl=307&noc=16&ctx=484047&cmp=2228897&sid=593588&plc=22288971&adsrv=15&advid=484048&turl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&DVP_CHANNELID=216448&DVP_DEALID=1e6a0.84371.76d2&DVP_CMPID=1e6a0.84371.76d2&DVP_PUBLISHERID=124576&DVP_PUBNAME=Reach%20PLC%20%28previously%20Express%20Newspaper%29&DVP_DEVICETYPE=2&DVP_OS=2&DVPX_SX_UID=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&DVPX_SX_MID=cb9b9287f4a611e9b2f613ae17dc0006&DVPX_IP=144.76.109.30&DVPX_UA=Mozilla%252F5.0%2B%2528Macintosh%253B%2BIntel%2BMac%2BOS%2BX%2B10_14_5%2529%2BAppleWebKit%252F537.36%2B%2528KHTML%252C%2Blike%2BGecko%2529%2BChrome%252F74.0.3729.169%2BSafari%252F537.36
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements289.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.254.244.22 , Ireland, ASN36062 (DOUBLE-VERIFY - DoubleVerify, Inc., US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
594ebc800d95df8a4e1233264a1d5bdb856301f4cbd092933af01e786208e4d7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:46 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.0
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=0
Transfer-Encoding
chunked
Expires
10/21/2019 8:34:47 AM
serve
srv.imonomy.com/internal/ Frame 87A5
7 KB
2 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=4870&ttkan_x=942&sum_ttkan_x=942&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=187&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673388&tr=2&trs=1&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=6648&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
7930e613f31018ee14b039c260bce8a213fa0d2ae430f100022a6d0b80e70327

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Encoding
gzip
Server
nginx
Etag
"b0bf3d9d80c39bf9895dc05cacb72240a3921ad6"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2183
serve
srv.imonomy.com/internal/ Frame 7FE1
7 KB
2 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=4883&ttkan_x=920&sum_ttkan_x=920&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=23&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673388&tr=2&trs=1&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=7693&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
a10b3d6b29a48dabf9810b4e3d5512167ccfdb60ab206f47a1329b0875a63c6f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Encoding
gzip
Server
nginx
Etag
"2697efd18a00a4670c1ad1555197cc29b2e8e6a2"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2183
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&kq=1&lo=0&qs=1&ak=-&i=NANDSCONTENT1&ud=false&qm=-120&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%5B)1xfq_GUKB%7BJ9AKqD(ao%5DDXx2Tlw4%26ExM_1g%2Bk6%40QV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y5iC%3Dn%3CG.xpG%24czixape4tE0b15%7CQjw%60.%7BiO%23Ly*rdB%3Evq%2F9N%7CQEXp%2B3W%60R%23ItxO%2B%7BQZt%7Bx1b~tW%24n%7BF%5BZR64oD3PP%23wJD3%25B%3AUgiOJ%5D*P1R27%2Bmu7RDX%2B%2Cy_*hUUp%2FVNkUW!%40b%2FoT%23%3CFr4TmyU~%2B..%5Eh%5EH%40G%23(d9IUjDux1bWuqEd%5E95SpGl)17*BT2z.%5BOCDT%3FW4BKm55Y%25F3%2FNdLlDxAjT%3CUmfB.%26Y%3BRZ.%60)_Q%234kE5p(taEn%26%5BNLU%25%2F%22%3Bh%2C%25%3BbEW%3Ckk!LvRjy1%5Du!%3CFo%40NFdS97evb%5Dmc9!4O7P7D%3B%3FdKHapzrIw(%60*MVu%2Fs1S*qks!o%7B25jAbj19SUF%60(a~M%3Ai%60K%25_9.rV0%2F%60E%60%60%2CH%24%26x%5EAbgkN%3Df%3CU%3CekO2m%2F%26u~q%60RP%3CG.FTVGX%5E8Y.N%2CzKydjXB3UN%5EMk3okt%24b_o4i6yz40b_QnwoD%2CYood%23D3lBG&qp=00000&qq=000000000000&qr=0&gz=0&hh=0&hn=0&qt=0&bq=0&g=1&pl=1&fl=1&sr=0&sb=0&sq=0&sa=0&sn=0&sj=0&sm=0&si=0&md=0&mc=0&lb=9005&la=0&ld=0&lc=0&cw=-1&cx=-1&sh=undefined&xa=0&xb=0&xc=0&h=4&w=4&cm=1&f=0&j=&o=3&t=1571733282459&de=867175706853&cu=1571733282459&m=5308&ar=de60227-clean&cb=0&ll=2&ln=0&gh=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1600&qe=1200&qh=1600&qg=1200&lk=undefined&le=1&gm=1&io=1&ch=0&as=0&ag=0&an=0&gf=0&gg=0&aj=0&pg=0&pf=0&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&cq=0&em=0&en=0&bu=5059&cd=1&ah=5059&am=1&re=0&wb=1&cl=0&at=0&d=express.co.uk%3ATax%20refund%20scam%20warning%20-%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message%3A__page__%3A-&gw=nandscontent759292113&ab=1&ac=1&fd=1&kt=strict&it=500&fs=98334&na=2001188034&cs=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:47 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:47 GMT
pixel.gif
spotxchangejsvideo759622536126.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://spotxchangejsvideo759622536126.s.moatpixel.com/pixel.gif?m=1&vpt=29&iv=0&tuv=-1&ivt=15&cvt=15&fvt=0&cfvt=0&vol=0&at=0&cat=0&gmv=0&gmt=0&cgmt=0&apd=29&dh=30000&hov=0&th=-1&d=express.co.uk&w=590&h=332&sp=0&bfa=1&L1id=124576&L2id=216448&L3id=6409&L4id=1e6a0.84371.76d2&S1id=www.express.co.uk&S2id=-&ord=1571733287468&r=202463855702&t=meas&zMoatImpressionId=cbbea8cbf4a611e9b2f613ae17dc0006&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:47 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:47 GMT
pixel.gif
spotxchangejsvideo759622536126.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://spotxchangejsvideo759622536126.s.moatpixel.com/pixel.gif?m=1&vpt=29&iv=0&tuv=-1&ivt=15&cvt=15&fvt=0&cfvt=0&vol=0&at=0&cat=0&gmv=0&gmt=0&cgmt=0&apd=29&dh=30000&hov=0&th=-1&d=express.co.uk&w=590&h=332&sp=0&bfa=1&L1id=124576&L2id=216448&L3id=6409&L4id=1e6a0.84371.76d2&S1id=www.express.co.uk&S2id=-&ord=1571733287468&r=202463855702&t=hdn&zMoatImpressionId=cbbea8cbf4a611e9b2f613ae17dc0006&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:47 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:47 GMT
pixel.gif
spotxchangejsvideo759622536126.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://spotxchangejsvideo759622536126.s.moatpixel.com/pixel.gif?m=1&vpt=302&iv=0&tuv=-1&ivt=288&cvt=288&fvt=0&cfvt=0&vol=0&at=0&cat=0&gmv=0&gmt=0&cgmt=0&apd=302&dh=30000&hov=0&th=-1&d=express.co.uk&w=590&h=332&sp=0&bfa=1&L1id=124576&L2id=216448&L3id=6409&L4id=1e6a0.84371.76d2&S1id=www.express.co.uk&S2id=-&ord=1571733287468&r=202463855702&t=nht&zMoatImpressionId=cbbea8cbf4a611e9b2f613ae17dc0006&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:47 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:47 GMT
serve
srv.imonomy.com/internal/ Frame A147
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=5083&ttkan_x=953&sum_ttkan_x=2802&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=818&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673648&tr=3&trs=2&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=5966&rf=frame
Requested by
Host: srv.imonomy.com
URL: https://srv.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
f367a4f4ecdf49dc57467020cf68b8de6443b110d2bdfc24379d6e4e4ab92c19

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:47 GMT
Content-Encoding
gzip
Server
nginx
Etag
"7cd3ed0fa8643c7cdd415386ea10c900deac3218"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2263
css
fonts.googleapis.com/
12 KB
803 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800&subweset=latin,cyrillic-ext,cyrillic,greek-ext,greek,vietnamese,latin-ext
Requested by
Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
69027204f18bef3a3126cad6b61a5a480f8c3f1b7cf29b5739df72a18039b1b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Tue, 22 Oct 2019 08:34:47 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Tue, 22 Oct 2019 08:34:47 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:47 GMT
pixel
pix.spot.im/api/v1/
0
0
Image
General
Full URL
https://pix.spot.im/api/v1/pixel?m=eyJ2aXNpdF9pZCI6ImFhZTBhYjJiZWY1YWM3ZDEzYjZmY2I0NzM5ZGIwYzJmIiwiaWJfYnJvd3Nlcl9pZCI6ImFmMTM3YjJjYTk1ODdiMDhjNmE1NmU2MGEyMTg0ZDQ5IiwidiI6MCwidGltZV9kZWx0YSI6NzMxNCwidWlkIjoiZTNmNWI4ZjRmMTc3MzFkMTg4Mjc2OWJlMTgxYjY1MDEiLCJzcG90X2lkIjoic3BfOUxNSU5iSzkiLCJzb3VyY2UiOiJyZWNpcmN1bGF0aW9uIiwic291cmNlX3ZlcnNpb24iOiIxNzM0IiwicGFnZV92aWV3X2lkIjoiNGY2OWVmZDgtMzY4My00ODIzLWFiYTktY2UxYmNjYjg5NjBmIiwiY2xpZW50X3BsYXRmb3JtIjoiRGVza3RvcCIsImRvbWFpbiI6Ind3dy5leHByZXNzLmNvLnVrIiwidXJsIjoiaHR0cHM6Ly93d3cuZXhwcmVzcy5jby51ay9maW5hbmNlL3BlcnNvbmFsZmluYW5jZS8xMTkyNDM5L3RleHQtc2NhbS1obXJjLXRheC1yZWZ1bmQtd2FybmluZy1mcmF1ZC1uZXdzLWxhdGVzdCIsInJlZmVycmVyIjoiIiwibGFuZyI6ImVuLVVTIiwidHlwZSI6ImxvYWRlZCIsImVuZ2luZV9zdGF0dXMiOiJhdmFpbGFibGUifQ%3D%3D&rnd=0.6529942574863055
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin
access-control-allow-credentials
true
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2100588899&t=event&_s=11&dl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-n...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-545303-1&cid=7843761.1571733282&jid=1093669952&_gid=1331413262.1571733282&gjid=505629465&_v=j79&z=82882176
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=1093669952&_v=j79&z=82882176
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=1093669952&_v=j79&z=82882176&slf_rd=1&random=2522872485
42 B
109 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=1093669952&_v=j79&z=82882176&slf_rd=1&random=2522872485
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:48 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=1093669952&_v=j79&z=82882176&slf_rd=1&random=2522872485
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
graph.facebook.com/
429 B
669 B
Script
General
Full URL
https://graph.facebook.com/?ids=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&fields=og_object{engagement{count}}&callback=gig_pc_facebook_1571733282280_9365640516696239
Requested by
Host: cdns3.gigya.com
URL: https://cdns3.gigya.com/js/gigya.services.socialize.plugins.shareCounts.min.js?version=latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
93653ab4eedd19fad959cddad1eaa73c9e4692db2a3278a77795950c026e2baf
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
etag
"ec50174cb0be51e7739229675d1f2d774b3a1591"
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
x-fb-rev
1001324506
alt-svc
h3-23=":443"; ma=3600
content-length
197
pragma
no-cache
x-fb-debug
2V2nVh3Q1emnFtgZ92Qo1gwKgXsOQFTzln56RENXwBMt+GwG0ZArJ7NcZnxNYoA33ArDwWnMfrulC7xCYYNjFw==
x-fb-trace-id
A17uoTt4lhd
date
Tue, 22 Oct 2019 08:34:47 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AdkOt-3dGUZWJqkwkJWtSS2
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.10
expires
Sat, 01 Jan 2000 00:00:00 GMT
share
www.linkedin.com/countserv/count/
0
0
Script
General
Full URL
https://www.linkedin.com/countserv/count/share?format=jsonp&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&callback=gig_pc_linkedin_1571733282280_30573733083158916
Requested by
Host: cdns3.gigya.com
URL: https://cdns3.gigya.com/js/gigya.services.socialize.plugins.shareCounts.min.js?version=latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:10:101::b93f:9101 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements289.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800&subweset=latin,cyrillic-ext,cyrillic,greek-ext,greek,vietnamese,latin-ext
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 08 Oct 2019 17:59:15 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:49 GMT
server
sffe
age
1175732
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9132
x-xss-protection
0
expires
Wed, 07 Oct 2020 17:59:15 GMT
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements289.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800&subweset=latin,cyrillic-ext,cyrillic,greek-ext,greek,vietnamese,latin-ext
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 19:39:28 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:37 GMT
server
sffe
age
910519
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9016
x-xss-protection
0
expires
Sat, 10 Oct 2020 19:39:28 GMT
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements289.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800&subweset=latin,cyrillic-ext,cyrillic,greek-ext,greek,vietnamese,latin-ext
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 19 Oct 2019 01:14:30 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:31:11 GMT
server
sffe
age
285617
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9080
x-xss-protection
0
expires
Sun, 18 Oct 2020 01:14:30 GMT
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements289.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800&subweset=latin,cyrillic-ext,cyrillic,greek-ext,greek,vietnamese,latin-ext
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 14:51:43 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:44 GMT
server
sffe
age
927784
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9180
x-xss-protection
0
expires
Sat, 10 Oct 2020 14:51:43 GMT
serve
srv.imonomy.com/internal/ Frame CA96
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=5106&ttkan_x=854&sum_ttkan_x=2665&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=202&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673648&tr=3&trs=2&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=7262&rf=frame
Requested by
Host: srv.imonomy.com
URL: https://srv.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
4d0ffbae8d0f1647513fd2fe769e46bdd496da8ba6c337f7c4a692b43e21c900

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:48 GMT
Content-Encoding
gzip
Server
nginx
Etag
"1cee76e5dcfe8cd16e6af58b08d4df23db535a2a"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2262
pd
eu-u.openx.net/w/1.0/ Frame 019F
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
Requested by
Host: imonomy-d.openx.net
URL: https://imonomy-d.openx.net/w/1.0/jstag
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
i=7bce4a60-aded-004e-2af6-3f75621dc41a|1571733287
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
vary
Accept
set-cookie
i=7bce4a60-aded-004e-2af6-3f75621dc41a|1571733287; Version=1; Expires=Wed, 21-Oct-2020 08:34:48 GMT; Max-Age=31536000; Domain=.openx.net; Path=/ pd=v2|1571733288|mOsLgqgikin0fcmWiygu; Version=1; Expires=Wed, 06-Nov-2019 08:34:48 GMT; Max-Age=1296000; Domain=.openx.net; Path=/
server
OXGW/16.164.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 22 Oct 2019 08:34:48 GMT
content-type
text/html
content-length
862
via
1.1 google
alt-svc
clear
pd
eu-u.openx.net/w/1.0/ Frame A4C6
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
Requested by
Host: imonomy-d.openx.net
URL: https://imonomy-d.openx.net/w/1.0/jstag
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
i=7bce4a60-aded-004e-2af6-3f75621dc41a|1571733287; pd=v2|1571733288|mOsLgqgikin0fcmWiygu
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
vary
Accept
set-cookie
i=7bce4a60-aded-004e-2af6-3f75621dc41a|1571733287; Version=1; Expires=Wed, 21-Oct-2020 08:34:48 GMT; Max-Age=31536000; Domain=.openx.net; Path=/ pd=v2|1571733288|rskimWfcvmsHqGgqmuiynIsLomgemOgunsn0oagi; Version=1; Expires=Wed, 06-Nov-2019 08:34:48 GMT; Max-Age=1296000; Domain=.openx.net; Path=/
server
OXGW/16.164.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 22 Oct 2019 08:34:48 GMT
content-type
text/html
content-length
825
via
1.1 google
alt-svc
clear
index.v2.html
dynamic-cdn.spot.im/yad/ Frame FEFA
0
0
Document
General
Full URL
https://dynamic-cdn.spot.im/yad/index.v2.html
Requested by
Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.57 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-57.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash

Request headers

:method
GET
:authority
dynamic-cdn.spot.im
:scheme
https
:path
/yad/index.v2.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
content-type
text/html
last-modified
Mon, 25 Jun 2018 15:09:28 GMT
x-amz-version-id
YnGh6QYQ2LhhP2fm4NwaoqcMm4wJ3om_
server
AmazonS3
content-encoding
gzip
vary
Accept-Encoding
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
V2Iv2Vq4RqxF6NZR9yxF2FcJl1Cd8CXrVieeTgL4utF2oW_tp6p5SA==
cache-control
max-age=297
expires
Tue, 22 Oct 2019 08:39:45 GMT
date
Tue, 22 Oct 2019 08:34:48 GMT
content-length
1784
read
api-2-0.spot.im/v1.0.0/conversation/realtime/
2 KB
3 KB
Fetch
General
Full URL
https://api-2-0.spot.im/v1.0.0/conversation/realtime/read
Requested by
Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.112 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-112.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
12a03bd65b71d179e5566497dd08878d26218ae7ffd0155bffc8ff8cc4744096

Request headers

Sec-Fetch-Mode
cors
x-post-id
1192439
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json
Accept
application/json
x-spot-id
sp_9LMINbK9
x-spotim-page-view-id
4f69efd8-3683-4823-aba9-ce1bccb8960f
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
status
200
access-control-max-age
86400
x-envoy-upstream-service-time
56
x-access-token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6IiIsInVzZXJfaWQiOiJ1X0Y5NVdPazQ4WTRSbCIsImRpc3BsYXlfbmFtZSI6Ikd1ZXN0NDIwODc1IiwidXNlcl9uYW1lIjoiR3Vlc3Q0MjA4NzUiLCJyZWdpc3RlcmVkIjpmYWxzZSwiaW1hZ2VfaWQiOiIvdXNlcnMvYXZhdGFycy9EZWZhdWx0Iiwicm9sZXMiOltdLCJzcG90X2lkIjoic3BfOUxNSU5iSzkiLCJsYXN0X2NoZWNrIjoxNTcxNzMzMjg4LCJ2ZXJzaW9uIjoyLCJ4LXNwb3RpbS10b2tlbiI6IjAxMTkxMDIycklqRmVlIiwicGVybWlzc2lvbnMiOm51bGwsInNwb3RpbS1kZXZpY2UtdjIiOiJkX1RhS1pIelFtTFZvSG40dm1kZHZkIiwibmV0d29yayI6eyJuZXR3b3JrX2lkIjoibmV0X2V4cHJlc3MiLCJuZXR3b3JrX25hbWUiOiJFWFBSRVNTIiwibmV0d29ya19pbWFnZV9pZCI6IkV4cHJlc3NfR3JvdXAtMl90aXNyanYiLCJuZXR3b3JrX2NvbG9yIjoiI2JiMWEwMCJ9LCJzcG90X25hbWUiOiIiLCJkb21haW4iOiIiLCJyb2xlc19udW1iZXIiOjAsImV4cCI6MTYwMDE1NTI4OCwic3ViIjoidV9GOTVXT2s0OFk0UmwifQ._KCIeU_0CgzpYxHawiIj7w1YXYszCvioEUe3nqeOHtI
content-length
605
x-spotim-token
01191022rIjFee
x-request-id
d57feb6c-a1f1-43c3-954f-210e04b2c6ff
x-guid
1c659522-83a6-49f5-9aa2-3d2552c2d792
server
istio-envoy
x-spotim-networkid
net_express
x-spotim-device-v2
d_TaKZHzQmLVoHn4vmddvd
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-expose-headers
x-spotim-token, x-spotim-networkid, x-access-token, x-spotim-device-v2
access-control-allow-credentials
true
access-control-allow-headers
content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-spotim-page-view-id,x-spotim-device-v2
jstag
imonomy-d.openx.net/w/1.0/ Frame 31A1
47 KB
17 KB
Script
General
Full URL
https://imonomy-d.openx.net/w/1.0/jstag
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash
ab0cafad80b60e9fd9d90124d745768376a6995d149af9f37636094d5fae9709

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
server
OXGW/16.164.0
vary
Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
status
200
cache-control
max-age=3600
content-type
text/javascript
alt-svc
clear
content-length
17505
via
1.1 google
expires
Tue, 22 Oct 2019 09:34:48 GMT
jstag
imonomy-d.openx.net/w/1.0/ Frame 5229
47 KB
17 KB
Script
General
Full URL
https://imonomy-d.openx.net/w/1.0/jstag
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash
ab0cafad80b60e9fd9d90124d745768376a6995d149af9f37636094d5fae9709

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
server
OXGW/16.164.0
vary
Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
status
200
cache-control
max-age=3600
content-type
text/javascript
alt-svc
clear
content-length
17505
via
1.1 google
expires
Tue, 22 Oct 2019 09:34:48 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 057E
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: srv.imonomy.com
URL: https://srv.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:48 GMT
common.js
maps.googleapis.com/maps-api-v3/api/js/38/8/ Frame D1D1
75 KB
28 KB
Script
General
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/38/8/common.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDDSM5Fd4ukbvXhmJD11asM4CDnQOZnbHs&libraries=places&language=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c8bf0c92e9d760687900c78550d36be64b89a20978f6edda34dcae384dceb06e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest?sdk=3.6.0s&canonicalUrl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&type=editorial&iframeType=friendlyIframe&platform=desktop
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 18 Oct 2019 15:09:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 14 Oct 2019 20:45:26 GMT
server
sffe
age
321891
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28289
x-xss-protection
0
expires
Sat, 17 Oct 2020 15:09:57 GMT
util.js
maps.googleapis.com/maps-api-v3/api/js/38/8/ Frame D1D1
141 KB
52 KB
Script
General
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/38/8/util.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDDSM5Fd4ukbvXhmJD11asM4CDnQOZnbHs&libraries=places&language=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
2b20899b14f2ec5b8fde3819eab47d0003826f831014efc701299292c910a469
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest?sdk=3.6.0s&canonicalUrl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&type=editorial&iframeType=friendlyIframe&platform=desktop
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 17 Oct 2019 12:08:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 14 Oct 2019 20:45:26 GMT
server
sffe
age
419152
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
53568
x-xss-protection
0
expires
Fri, 16 Oct 2020 12:08:56 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 6595
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: srv.imonomy.com
URL: https://srv.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:48 GMT
acj
imonomy-d.openx.net/w/1.0/ Frame 31A1
1020 B
1 KB
Script
General
Full URL
https://imonomy-d.openx.net/w/1.0/acj?o=3001636827&callback=OX_3001636827&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&jr=&auid=540666290&dims=1600x1200&adxy=-4500%2C1194&res=1600x1200x24&plg=pm&ch=UTF-8&tz=-120&ws=728x91&ifr=1&tws=1600x1200&mt=1&nl=15%2C17&ul=238%2C265
Requested by
Host: imonomy-d.openx.net
URL: https://imonomy-d.openx.net/w/1.0/jstag
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash
15c1e6faad117d3c465962a22a732f65b3fd86c82a32ea4ed251b54b3480d267

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:48 GMT
via
1.1 google
server
OXGW/16.164.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
status
200
cache-control
private, max-age=0, no-cache
content-type
application/json
alt-svc
clear
content-length
1020
expires
Mon, 26 Jul 1997 05:00:00 GMT
query.gif
d2uepos3ef6db0.cloudfront.net/ Frame DB0F
807 B
1 KB
Image
General
Full URL
https://d2uepos3ef6db0.cloudfront.net/query.gif?dvp_win=0&dvp_script=0&dvp_ib=0&dvp_ac=0&dvp_twin=0&dvp_try=-1&dvp_len=1&ctx=11111111&cmp=11111111&sid=593588&plc=22288971&num=&adid=&advid=484048&adsrv=15&btreg=&btadsrv=&crt=&crtname=&chnl=&unit=&pid=&uid=&dvtagver=6.1.src&DVP_CHANNELID=216448&DVP_DEALID=1e6a0.84371.76d2&DVP_CMPID=1e6a0.84371.76d2&turl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&DVP_SX_UID=cb1da7df-f4a6-11e9-ae03-11a3cbba0906&DVP_SX_MID=cb9b9287f4a611e9b2f613ae17dc0006&DVP_IP=144.76.109.30&DVP_UA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&useragent=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&referrer=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6e00:9:2087:f700:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:47 GMT
via
1.1 f99b5b46e77cfe9c3413f99dc8a4088c.cloudfront.net (CloudFront)
server
Microsoft-IIS/8.0
x-amz-cf-pop
FRA2-C2
x-powered-by
ASP.NET
x-cache
Miss from cloudfront
content-type
image/gif
status
200
cache-control
max-age=0
content-length
807
x-amz-cf-id
Sm1Zsrq9r9rspkT1HelgQEkxd5rCiwoFIydsNWzN2MgxM5333XFGtQ==
expires
10/21/2019 8:34:48 AM
acj
imonomy-d.openx.net/w/1.0/ Frame 5229
1023 B
1 KB
Script
General
Full URL
https://imonomy-d.openx.net/w/1.0/acj?o=1612316963&callback=OX_1612316963&ju=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&jr=&auid=540666290&dims=1600x1200&adxy=-4500%2C1194&res=1600x1200x24&plg=pm&ch=UTF-8&tz=-120&ws=728x91&ifr=1&tws=1600x1200&mt=1&nl=15%2C17&ul=238%2C265
Requested by
Host: imonomy-d.openx.net
URL: https://imonomy-d.openx.net/w/1.0/jstag
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash
52d5b82d79a395a8b487a5299517fd8f2b342e263628305ee78fc63533878c78

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:48 GMT
via
1.1 google
server
OXGW/16.164.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
status
200
cache-control
private, max-age=0, no-cache
content-type
application/json
alt-svc
clear
content-length
1023
expires
Mon, 26 Jul 1997 05:00:00 GMT
integrator.js
adservice.google.de/adsid/ Frame 057E
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 057E
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 057E
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:48 GMT
AuthenticationService.Authenticate
maps.googleapis.com/maps/api/js/ Frame D1D1
62 B
210 B
Script
General
Full URL
https://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttps%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest%3Fsdk%3D3.6.0s%26canonicalUrl%3Dhttps%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest%26type%3Deditorial%26iframeType%3DfriendlyIframe%26platform%3Ddesktop&4sAIzaSyDDSM5Fd4ukbvXhmJD11asM4CDnQOZnbHs&callback=_xdc_._39dh2i&key=AIzaSyDDSM5Fd4ukbvXhmJD11asM4CDnQOZnbHs&token=83679
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps-api-v3/api/js/38/8/common.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
mafe /
Resource Hash
e8a0cdf16afdc033a01c83256cc29442726babba2d31e1d3ddd5c7475789dc14
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest?sdk=3.6.0s&canonicalUrl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&type=editorial&iframeType=friendlyIframe&platform=desktop
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
server
mafe
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment
server-timing
gfet4t7; dur=8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
63
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
integrator.js
adservice.google.de/adsid/ Frame 6595
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 6595
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 6595
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:48 GMT
main.js
srv.imonomy.com/script/ Frame 31A1
19 KB
5 KB
Script
General
Full URL
https://srv.imonomy.com/script/main.js
Requested by
Host: imonomy-d.openx.net
URL: https://imonomy-d.openx.net/w/1.0/jstag
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:48 GMT
Content-Encoding
gzip
Server
nginx
Etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=86400
Connection
keep-alive
Content-Length
5239
main.js
srv.imonomy.com/script/ Frame 5229
19 KB
5 KB
Script
General
Full URL
https://srv.imonomy.com/script/main.js
Requested by
Host: imonomy-d.openx.net
URL: https://imonomy-d.openx.net/w/1.0/jstag
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:48 GMT
Content-Encoding
gzip
Server
nginx
Etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=86400
Connection
keep-alive
Content-Length
5239
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame 0E2F
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_2&adk=3586048435&adf=1174745155&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=ht...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423385863&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423385863&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423385863&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:48 GMT
content-type
text/html
set-cookie
__cfduid=dbbed49ec016d45b6ada0f8c0ad95caec1571733288; expires=Wed, 21-Oct-20 08:34:48 GMT; path=/; domain=.imonomy.com; HttpOnly a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:29:10 GMT
cache-control
max-age=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a225e1d80cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423385863&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:48 GMT
server
cafe
content-length
46
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Tue, 22-Oct-2019 08:49:48 GMT; path=/; domain=.doubleclick.net
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 057E
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:48 GMT
Default
images.spot.im/image/upload/q_70,fl_lossy,dpr_3,h_24,w_24,c_thumb,g_face/v200//users/avatars/
2 KB
1 KB
Image
General
Full URL
https://images.spot.im/image/upload/q_70,fl_lossy,dpr_3,h_24,w_24,c_thumb,g_face/v200//users/avatars/Default
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jsvid?videoId=20edce92b9ddb5d9826e2ca1ae9c31da&pubId=406023&campId=694808&advId=undefined&bidurl=https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&chanId=We0nATVNAtvwvrOpbjtB&placementId=2170284&anId=F&uId=cb9b9287f4a611e9b2f613ae17dc0006.1&adsafe_par=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
5efa1b5e5972e10b92416a0ce3304688ad78216582c3eebe930a37771f729fc1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
status
200
content-disposition
attachment; filename="Default"
content-length
774
surrogate-key
268046594891881248488411371492607257864 153820388172593757763881939023157614421 5dae0ce85ee661e931f6926af99c713d
last-modified
Tue, 02 May 2017 12:09:20 GMT
server
cloudinary
etag
W/"cc57e66349097d7cfb1a1a369e01f9bc"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
expires
Wed, 21 Oct 2020 08:34:48 GMT
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame A332
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_2&adk=3586048435&adf=1174745164&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=ht...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423381282&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423381282&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423381282&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:48 GMT
content-type
text/html
set-cookie
__cfduid=dbbed49ec016d45b6ada0f8c0ad95caec1571733288; expires=Wed, 21-Oct-20 08:34:48 GMT; path=/; domain=.imonomy.com; HttpOnly a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:29:15 GMT
cache-control
max-age=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a225f0f05cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423381282&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:48 GMT
server
cafe
content-length
46
x-xss-protection
0
set-cookie
IDE=AHWqTUkWX1pk5ALrQtR3_XJ-QTenhblUS-YKCTc_IQsJeUEg5ENLXbzhIF4spTQK; expires=Sun, 15-Nov-2020 08:34:48 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 6595
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:48 GMT
serve
srv.imonomy.com/internal/ Frame 31A1
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=5983&ttkan_x=1100&sum_ttkan_x=2020&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=23&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673648&tr=3&trs=2&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=2888&rf=frame
Requested by
Host: srv.imonomy.com
URL: https://srv.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
092d222dffbf8e34d2b8de2c09801b1300519535774524fae07b047c97e59019

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:48 GMT
Content-Encoding
gzip
Server
nginx
Etag
"aac8d9c33cc481c0b04b7ff60bc2eabbdcc846b7"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2261
serve
srv.imonomy.com/internal/ Frame 5229
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=5999&ttkan_x=1129&sum_ttkan_x=2071&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=187&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673648&tr=3&trs=2&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=5001&rf=frame
Requested by
Host: srv.imonomy.com
URL: https://srv.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
49b3a6b2e71d782472f88c4c73d7e72254f9bfb196d9ea934dba30fbc5ef8f72

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:48 GMT
Content-Encoding
gzip
Server
nginx
Etag
"74abdd784d0287f8b471f81f5a940d721cd779c6"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2262
pd
eu-u.openx.net/w/1.0/ Frame B207
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
Requested by
Host: imonomy-d.openx.net
URL: https://imonomy-d.openx.net/w/1.0/jstag
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
i=58cd6f52-7ca6-4394-8fc4-130ee00d7c02|1571733288
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
vary
Accept
set-cookie
i=58cd6f52-7ca6-4394-8fc4-130ee00d7c02|1571733288; Version=1; Expires=Wed, 21-Oct-2020 08:34:48 GMT; Max-Age=31536000; Domain=.openx.net; Path=/ pd=v2|1571733288|mOsLgqgikin0fcmWiygu; Version=1; Expires=Wed, 06-Nov-2019 08:34:48 GMT; Max-Age=1296000; Domain=.openx.net; Path=/
server
OXGW/16.164.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 22 Oct 2019 08:34:48 GMT
content-type
text/html
content-length
862
via
1.1 google
alt-svc
clear
pd
eu-u.openx.net/w/1.0/ Frame 1BB3
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
Requested by
Host: imonomy-d.openx.net
URL: https://imonomy-d.openx.net/w/1.0/jstag
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=10&ph=71d92d66-0d37-4a3a-8339-a112f8b108af
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
i=58cd6f52-7ca6-4394-8fc4-130ee00d7c02|1571733288
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
vary
Accept
set-cookie
i=58cd6f52-7ca6-4394-8fc4-130ee00d7c02|1571733288; Version=1; Expires=Wed, 21-Oct-2020 08:34:48 GMT; Max-Age=31536000; Domain=.openx.net; Path=/ pd=v2|1571733288|mOsLgqgikin0fcmWiygu; Version=1; Expires=Wed, 06-Nov-2019 08:34:48 GMT; Max-Age=1296000; Domain=.openx.net; Path=/
server
OXGW/16.164.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 22 Oct 2019 08:34:48 GMT
content-type
text/html
content-length
862
via
1.1 google
alt-svc
clear
main.js
tag.imonomy.com/script/ Frame 057E
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15864
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a225f7fc6cbcc-VIE
content-length
5239
serve
srv.imonomy.com/internal/ Frame 057E
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=6154&ttkan_x=1071&sum_ttkan_x=3873&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=818&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673378&tr=4&trs=3&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=7865&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
20105511a1dc9faa8f1019d16f1b65996d7389ccff8277a88afe93cb7d7ea08a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:49 GMT
Content-Encoding
gzip
Server
nginx
Etag
"1d1ad3e7024a342e54c679149c23953876b9c479"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2263
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 104A
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: srv.imonomy.com
URL: https://srv.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:48 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 289B
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: srv.imonomy.com
URL: https://srv.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:49 GMT
integrator.js
adservice.google.de/adsid/ Frame 104A
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 104A
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 104A
238 KB
87 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:49 GMT
main.js
tag.imonomy.com/script/ Frame 6595
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15865
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a2260da55cbcc-VIE
content-length
5239
integrator.js
adservice.google.de/adsid/ Frame 289B
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 289B
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 289B
238 KB
87 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:49 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 9DE9
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:49 GMT
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame 55F5
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_2&adk=3586048435&adf=1174745165&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=ht...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423349261&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423349261&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423349261&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
__cfduid=dbbed49ec016d45b6ada0f8c0ad95caec1571733288
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:49 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:30:13 GMT
cache-control
max-age=86400
set-cookie
a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a22646981cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423349261&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:49 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 104A
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:49 GMT
integrator.js
adservice.google.de/adsid/ Frame 9DE9
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 9DE9
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 9DE9
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:49 GMT
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame C0EB
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_2&adk=3586048435&adf=1174745166&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=ht...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423379652&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423379652&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423379652&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
__cfduid=dbbed49ec016d45b6ada0f8c0ad95caec1571733288
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:50 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:08:16 GMT
cache-control
max-age=86400
set-cookie
a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a22651ae1cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423379652&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:49 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 289B
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:49 GMT
serve
srv.imonomy.com/internal/ Frame 6595
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=6551&ttkan_x=1445&sum_ttkan_x=4110&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=202&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673378&tr=4&trs=3&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=458&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
46670c797d8343b8f6bc437ff7d18512541a80c6e8c5bf8fcfa3a32bcbad148e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:49 GMT
Content-Encoding
gzip
Server
nginx
Etag
"82f06cda682baeb4b138d00aab0121f7a83a997b"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2263
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=331804&asId=e7cb5fcd-b763-069a-9d06-698b8f48e9ef&tv={c:rLpeOi,pingTime:2,time:3040,type:p,clog:[{piv:88,vs:o,r:v,w:590,h:332,t:32},{vs:i,r:,t:954}],ve:{vEventCount:7,vEvents:[{t:829,tp:adImpression,sl:o,ad_duration:30,volume:0,integral_timeToDecision:1500,integral_didBlock:false,x_vv:3.6.0,x_vanstag:fw,x_xpc:iask},{t:833,tp:adStarted,sl:o,ad_duration:30,volume:0},{t:834,tp:adVideoStart,sl:o,ad_duration:30,volume:0},{t:1433,tp:adRemainingTimeChange,sl:i,ad_duration:30,volume:0},{t:1862,tp:adRemainingTimeChange,sl:i,ad_duration:30,volume:0},{t:2354,tp:adRemainingTimeChange,sl:i,ad_duration:30,volume:0},{t:2923,tp:adRemainingTimeChange,sl:i,ad_duration:30,volume:0}]},vv:3.6.0,es:0,sc:1,ha:1,gm:0,slTimes:{i:2086,o:954,n:0,pp:0,pm:0},slEvents:[{sl:o,t:32,wc:0.0.1600.1200,ac:323.908.590.332,am:v,cc:323.908.590.332,piv:88,obst:0,th:0,reas:v,bkn:{piv:[947~75],as:[947~590.332]}},{sl:i,t:954,wc:0.0.1600.1200,ac:323.908.590.332,am:v,cc:323.908.590.332,piv:88,obst:0,th:0,reas:,bkn:{piv:[2086~75],as:[2086~590.332]}}],slEventCount:2,em:true,fr:true,e:,tt:fwjsvid,dtt:521,fm:rFCgGEO+1.-|11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f|1g1*.331804-39018748|1g11|1g12|1g13|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1q|1r|1s11,idMap:1g1*,rend:1,renddet:env,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:49 GMT
X-Server-Name
dt52dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
recirculation
spotops.spot.im/spot/sp_9LMINbK9/
9 KB
3 KB
XHR
General
Full URL
https://spotops.spot.im/spot/sp_9LMINbK9/recirculation?platform=Desktop&day=tuesday&hour=10
Requested by
Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.48 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-48.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5b516097f94e24a1f0478d32ceddbc943283de33fbf3d648ae1abae8a723cbcf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200
x-spotim-bid
x-spotim-rid
vary
Accept-Encoding
content-length
1980
x-spotim-vid
pragma
no-cache
access-control-max-age
86400
access-control-allow-methods
GET, POST, DELETE, PUT, PATCH, HEAD, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-expose-headers
x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
access-control-allow-headers
x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid, Content-Type, x-spotim-page-view-id, x-spotim-source, x-spotim-device-uuid
expires
Tue, 22 Oct 2019 08:34:49 GMT
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=-1&asId=b4a6952a-52c9-e720-8a9d-f56f2c87d69d&tv={c:rLpeOp,pingTime:2,time:4523,type:p,clog:[{piv:88,vs:o,r:v,w:590,h:332,t:22},{vs:i,r:,t:2497}],ve:{vEventCount:12,vEvents:[{t:-76,tp:perfCheckpoint,sl:o,type:vans,code:10,timestamp:1571733284798},{t:-76,tp:perfCheckpoint,sl:o,type:vans,code:20,timestamp:1571733284798},{t:322,tp:adLoaded,sl:o,ad_duration:-2,volume:0},{t:2309,tp:adStarted,sl:o,ad_duration:-2,volume:0},{t:2310,tp:adRemainingTimeChange,sl:o,ad_duration:-2,volume:0},{t:2310,tp:adDurationChange,sl:o,ad_duration:30,volume:0},{t:2428,tp:adImpression,sl:o,ad_duration:30,volume:0},{t:2713,tp:adVideoStart,sl:i,ad_duration:30,volume:0},{t:2909,tp:adRemainingTimeChange,sl:i,ad_duration:30,volume:0},{t:3338,tp:adRemainingTimeChange,sl:i,ad_duration:30,volume:0},{t:3830,tp:adRemainingTimeChange,sl:i,ad_duration:30,volume:0},{t:4399,tp:adRemainingTimeChange,sl:i,ad_duration:30,volume:0}]},vv:3.3.0,es:0,sc:1,ha:1,gm:0,slTimes:{i:2026,o:2497,n:0,pp:0,pm:0},slEvents:[{sl:o,t:22,wc:0.0.1600.1200,ac:323.908.590.332,am:v,cc:323.908.590.334,piv:88,obst:0,th:0,reas:v,bkn:{piv:[2490~75],as:[2490~590.332]}},{sl:i,t:2497,wc:0.0.1600.1200,ac:323.908.590.332,am:v,cc:323.908.590.334,piv:88,obst:0,th:0,reas:,bkn:{piv:[2026~75],as:[2026~590.332]}}],slEventCount:2,em:false,fr:true,e:,tt:jsvid,dtt:894,fm:rFCgGEO+1*.-|11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f|1g1.331804-39018748|1g11|1g12|1h|1i|1j|1k|1l|1m,idMap:1*,rend:1,renddet:env,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:49 GMT
X-Server-Name
dt77dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame 3409
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_3&adk=550597170&adf=1174745188&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=htt...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423558701&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423558701&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423558701&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:50 GMT
content-type
text/html
set-cookie
__cfduid=db28e7d63438780364444cc3d3f4998251571733289; expires=Wed, 21-Oct-20 08:34:49 GMT; path=/; domain=.imonomy.com; HttpOnly a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:05:14 GMT
cache-control
max-age=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a2265bc1ecbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423558701&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:49 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 9DE9
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:49 GMT
vimp
statsf-tm.everesttech.net/stats/1/ Frame A51C
85 B
179 B
Image
General
Full URL
https://statsf-tm.everesttech.net/stats/1/vimp?didtype=UNK&date=1571733282983&psId=9PliOidgZa3Mp9drI27Q&vinst=t&seller_id=124576&s=H4sIAAAAAAAAAAGwAE__RTQDlWVdllgdzqSv8hGJ21JikMzkCdzqYvGCvGDpDaMuJGZrJUWnfEA235N60LBFOJ8rZXLRjnkcv-RqyVWHNTZm9hrdR1OMpbWHACH2Ew9olN_HkZhLWO4AMz3QFGBi1qqM7b2j3UPEbpFxTNhRouWrPIvdLfnVTPvx2y52W8yJ1uM8pcHsWGaAkUzNLdpojhE791Tn_so3VFr-oAg0qaqsfnsrpFDWPGKdQFvccG9VxQcBsAAAAA&did=&auth=fcd8207c1c7cd28dbffd35b554ef2a19&conn=unknown&sessId=cb9b9287f4a611e9b2f613ae17dc0006.1&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&mpKey=We0nATVNAtvwvrOpbjtB&price=1&env=site&cpKey=mfpahjb2JnIu8hS7531w&adKey=pMLfUI3XYnXLEIk1cLo8&rt=HTML5&vw=590&vh=332&apv=J20190930&burl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&rurl=https%3A%2F%2Fwww.express.co.uk&pw=590&ph=332&w=590&h=332&wd=1&vwbl=t&vver=20190927&vpct=88&ifr=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Jetty(9.4.z-SNAPSHOT) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
via
1.1 varnish
x-pt
P=176
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status
200
x-cache-hits
0
x-region
EU-East
content-length
85
x-served-by
cache-hhn4033-HHN
pragma
no-cache
server
Jetty(9.4.z-SNAPSHOT)
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes, bytes
expires
Tue, 22 Oct 2019 03:34:49 -05:00
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 126C
0
0
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Requested by
Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_9LMINbK9
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Last-Modified
Fri, 26 Jul 2019 09:40:01 GMT
ETag
"1300708-26ca-58e92538a370a"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
3860
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=42678
Expires
Tue, 22 Oct 2019 20:26:07 GMT
Date
Tue, 22 Oct 2019 08:34:49 GMT
Connection
keep-alive
Vary
Accept-Encoding
sr.bladex.js
sdk.streamrail.com/blade/
422 KB
111 KB
Script
General
Full URL
https://sdk.streamrail.com/blade/sr.bladex.js
Requested by
Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_9LMINbK9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:3e00:c:492d:cd80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0ae29789f5f0e63c7edd44c7a2e4801ede5c1765b8b0eb68020497ecf3729771

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:42 GMT
content-encoding
gzip
age
8
x-cache
Hit from cloudfront
status
200
content-length
113480
access-control-allow-origin
*
last-modified
Thu, 17 Oct 2019 11:09:48 GMT
server
AmazonS3
etag
"aaae8d85cab6fba6422a8f61bc4b31ee"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET, PUT, HEAD, POST, DELETE
content-type
application/javascript
via
1.1 6b8ac2d6d64dc42007741d312e2d73ab.cloudfront.net (CloudFront)
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length , Content-Range
cache-control
max-age=1200, public
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
L5cwKIRLyKa3DBEgCiMCR9VPPvR6sB0je0pHaGpQTE-RupRHtTClBQ==
csync
sync.spotim.market/
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D271858%26extuid%3D%24UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fsync.spotim.market%252Fcsync%253Ft%253Da%2526ep%253D271858%2526extuid%253D%2524UID
  • https://sync.spotim.market/csync?t=a&ep=271858&extuid=1064964418146934768
86 B
481 B
Image
General
Full URL
https://sync.spotim.market/csync?t=a&ep=271858&extuid=1064964418146934768
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center _ColoCALL_, UA),
Reverse DNS
0-72.adtelligent3-tmp.cc.colocall.com
Software
Adtelligent 1.0 /
Resource Hash
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:49 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
Adtelligent 1.0
Content-Length
86
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.252:80
AN-X-Request-Uuid
6901a644-a682-4439-ac50-fd66de6c6d93
Server
nginx/1.13.4
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://sync.spotim.market/csync?t=a&ep=271858&extuid=1064964418146934768
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
partner
sync.search.spotxchange.com/
Redirect Chain
  • https://sync.search.spotxchange.com/partner?source=211945
  • https://sync.search.spotxchange.com/partner?source=211945&__user_check__=1&sync_id=cf919c8e-f4a6-11e9-be2a-169e7f671906
0
562 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?source=211945&__user_check__=1&sync_id=cf919c8e-f4a6-11e9-be2a-169e7f671906
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-spotx-halt-type
Audience Dsp sync Priority Sync endpoint Source ID is not on enabled source whitelist
Date
Tue, 22 Oct 2019 08:34:49 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
86
Connection
keep-alive
Content-Length
0

Redirect headers

Date
Tue, 22 Oct 2019 08:34:49 GMT
Server
nginx
Location
/partner?source=211945&__user_check__=1&sync_id=cf919c8e-f4a6-11e9-be2a-169e7f671906
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
38
Connection
keep-alive
Content-Length
0
sync
pixel.advertising.com/ups/58196/
0
92 B
Image
General
Full URL
https://pixel.advertising.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.24.221 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-156-24-221.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:49 GMT
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
/
sync.spotim.market/csync/
Redirect Chain
  • https://sync.search.spotxchange.com/partner?adv_id=8721&redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%2F%3Ft%3Da%26ep%3D301276%26extuid%3D%24SPOTX_USER_ID%20
  • https://sync.search.spotxchange.com/partner?adv_id=8721&redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%2F%3Ft%3Da%26ep%3D301276%26extuid%3D%24SPOTX_USER_ID%20&__user_check__=1&sync_id=cf8ffac9-f4a6...
  • https://sync.spotim.market/csync/?t=a&ep=301276&extuid=cf8ffa89-f4a6-11e9-b312-156e734c0806
86 B
498 B
Image
General
Full URL
https://sync.spotim.market/csync/?t=a&ep=301276&extuid=cf8ffa89-f4a6-11e9-b312-156e734c0806
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center _ColoCALL_, UA),
Reverse DNS
0-72.adtelligent3-tmp.cc.colocall.com
Software
Adtelligent 1.0 /
Resource Hash
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:50 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
Adtelligent 1.0
Content-Length
86
Content-Type
image/gif

Redirect headers

Date
Tue, 22 Oct 2019 08:34:49 GMT
Server
nginx
Location
https://sync.spotim.market/csync/?t=a&ep=301276&extuid=cf8ffa89-f4a6-11e9-b312-156e734c0806
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
112
Connection
keep-alive
Content-Length
0
usermatch
ssum.casalemedia.com/
Redirect Chain
  • https://ssum.casalemedia.com/usermatch?s=190532&cb=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D301804%26extuid%3D
  • https://ssum.casalemedia.com/usermatch?s=190532&cb=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D301804%26extuid%3D&C=1
0
0
Image
General
Full URL
https://ssum.casalemedia.com/usermatch?s=190532&cb=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D301804%26extuid%3D&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:49 GMT
Server
Apache
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://ssum.casalemedia.com/usermatch?s=190532&cb=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D301804%26extuid%3D&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
321
Expires
Tue, 22 Oct 2019 08:34:49 GMT
pixel
pix.spot.im/api/v1/
0
0
Image
General
Full URL
https://pix.spot.im/api/v1/pixel?m=eyJ2aXNpdF9pZCI6ImFhZTBhYjJiZWY1YWM3ZDEzYjZmY2I0NzM5ZGIwYzJmIiwiaWJfYnJvd3Nlcl9pZCI6ImFmMTM3YjJjYTk1ODdiMDhjNmE1NmU2MGEyMTg0ZDQ5IiwidiI6MCwidGltZV9kZWx0YSI6OTAxNiwidWlkIjoiZjE4OWQzZDQ2MmExNDhhNzQwODZhNjU0ZDYxY2I1MzEiLCJzcG90X2lkIjoic3BfOUxNSU5iSzkiLCJzb3VyY2UiOiJyZWNpcmN1bGF0aW9uIiwic291cmNlX3ZlcnNpb24iOiIxNzM0IiwicGFnZV92aWV3X2lkIjoiNGY2OWVmZDgtMzY4My00ODIzLWFiYTktY2UxYmNjYjg5NjBmIiwiY2xpZW50X3BsYXRmb3JtIjoiRGVza3RvcCIsImRvbWFpbiI6Ind3dy5leHByZXNzLmNvLnVrIiwidXJsIjoiaHR0cHM6Ly93d3cuZXhwcmVzcy5jby51ay9maW5hbmNlL3BlcnNvbmFsZmluYW5jZS8xMTkyNDM5L3RleHQtc2NhbS1obXJjLXRheC1yZWZ1bmQtd2FybmluZy1mcmF1ZC1uZXdzLWxhdGVzdCIsInJlZmVycmVyIjoiIiwibGFuZyI6ImVuLVVTIiwidHlwZSI6ImVuZ2luZV9zdGF0dXMiLCJlbmdpbmVfc3RhdHVzIjoiZW5naW5lLW1vbmV0aXphdGlvbi1sb2FkIiwiY291bnQiOjF9&rnd=0.7959631275908734
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin
access-control-allow-credentials
true
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
pixel
pix.spot.im/api/v1/
0
0
Image
General
Full URL
https://pix.spot.im/api/v1/pixel?m=eyJ2aXNpdF9pZCI6ImFhZTBhYjJiZWY1YWM3ZDEzYjZmY2I0NzM5ZGIwYzJmIiwiaWJfYnJvd3Nlcl9pZCI6ImFmMTM3YjJjYTk1ODdiMDhjNmE1NmU2MGEyMTg0ZDQ5IiwidiI6MCwidGltZV9kZWx0YSI6OTAxNywidWlkIjoiZDY2ZTU1MTA0YjJlODBkOTE2YmJkOThiOWU4NzY0NGIiLCJzcG90X2lkIjoic3BfOUxNSU5iSzkiLCJzb3VyY2UiOiJyZWNpcmN1bGF0aW9uIiwic291cmNlX3ZlcnNpb24iOiIxNzM0IiwicGFnZV92aWV3X2lkIjoiNGY2OWVmZDgtMzY4My00ODIzLWFiYTktY2UxYmNjYjg5NjBmIiwiZW5naW5lX3ZlbmRvcl9uYW1lIjoiU1IiLCJlbmdpbmVfdGFnX2lkIjoidGFnX2tManBVMEd6RDBIZyIsImNsaWVudF9wbGF0Zm9ybSI6IkRlc2t0b3AiLCJkb21haW4iOiJ3d3cuZXhwcmVzcy5jby51ayIsInVybCI6Imh0dHBzOi8vd3d3LmV4cHJlc3MuY28udWsvZmluYW5jZS9wZXJzb25hbGZpbmFuY2UvMTE5MjQzOS90ZXh0LXNjYW0taG1yYy10YXgtcmVmdW5kLXdhcm5pbmctZnJhdWQtbmV3cy1sYXRlc3QiLCJyZWZlcnJlciI6IiIsImxhbmciOiJlbi1VUyIsInR5cGUiOiJlbmdpbmVfc3RhdHVzIiwiZW5naW5lX3N0YXR1cyI6ImVuZ2luZS13aWxsLWluaXRpYWxpemUiLCJjb3VudCI6MX0%3D&rnd=0.45523256728131756
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin
access-control-allow-credentials
true
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame DD1E
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:49 GMT
gen_204
pagead2.googlesyndication.com//pagead/ Frame 9DE9
0
58 B
Image
General
Full URL
https://pagead2.googlesyndication.com//pagead/gen_204?v=20191021&id=av-js&type=verif&vtype=capability&i=0&adk=550597170&b_name=nio&v_name=geo&v=20191021
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:49 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
spotxchangejsvideo759622536126.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://spotxchangejsvideo759622536126.s.moatpixel.com/pixel.gif?m=1&vpt=2177&iv=1&tuv=1920&ivt=2163&cvt=2163&fvt=0&cfvt=0&vol=0&at=0&cat=0&gmv=0&gmt=0&cgmt=0&apd=2177&dh=30000&hov=0&th=-1&d=express.co.uk&w=590&h=332&sp=0&bfa=1&L1id=124576&L2id=216448&L3id=6409&L4id=1e6a0.84371.76d2&S1id=www.express.co.uk&S2id=-&ord=1571733287468&r=202463855702&t=iv&zMoatImpressionId=cbbea8cbf4a611e9b2f613ae17dc0006&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:49 GMT
ads
securepubads.g.doubleclick.net/gampad/
70 KB
17 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=293019804438819&correlator=3323699773170479&output=ldjh&impl=fifs&adsid=NT&eid=21062415%2C21063203%2C21064791&vrg=2019101401&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A536903688%2C2%3A553680904%2C8%3A32776&sc=1&sfv=1-0-35&ecs=20191022&iu_parts=34722903%2CExpress%2CFinance%2CPersonalFinance%2Cexpress&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F4&prev_iu_szs=320x50%7C1x1%7C728x90%7C970x250%7C970x90%2C320x50%7C300x250%7C300x600%2C320x50%7C300x250%2C320x50%7C300x250%2C320x50%7C1x1%2C320x50%7C300x250%2C1x1%2C8x8&fluid=height%2Cheight%2Cheight%2Cheight%2Cheight%2Cheight%2C0%2C0&ists=2&prev_scp=pos%3Dtop%7Cpos%3Dright%7Cpos%3Dright2%7Cpos%3Dright3%7Cpos%3Dmiddle%7Cpos%3Dright1%26strnativekey%3DC196fpMvhkDKp8g7hK9tEmzE%7Cpos%3Doutofpage%7C&cust_params=gdpr%3D1%26pagetype%3Darticle%26articleid%3D1192439%26keywords%3Dlifestyle%252Cautomotive%252Cculture%252Cfood%2520and%2520beverage%252Chome%2520and%2520garden%252Ctheater%252Ctravel%252Cctp_video%252Cautoplay_video%252Ctext%2520scam%252Chmrc%2520tax%2520refund%252Chmrc%2520tax%2520refund%2520scam%252Ctext%2520scam%2520warning%252Ctax%2520scam%252C%26device%3DDesktop%26inskin_yes%3Dtrue%26home%3Dfalse%26gs_cat%3Dpos_danone_brandsafety_family%252Cpos_danone_brandsafety_fitness%252Cpos_danone_brandsafety_health%252Cpos_danone_brandsafety_society%252Cpos_test_death%252Cbespoke_mortgages%252Cbespoke_solicitors%252Cshadow9hu7_pos_sky_blacklist%252Cgs_finance_tax%252Cnegative_tesco%252Cgs_politics_british%252Cgv_crime%252Cgs_finance_pensions%252Cgs_tech_phones%252Cshadow9hu7_pos_tuibrandsafe%252Cpr_astonvillafc%252Cgs_economy_misc%252Cgs_tech_computing&cookie_enabled=1&bc=31&abxe=1&lmt=1571733289&dt=1571733289772&dlt=1571733280544&idt=1319&frm=20&biw=1585&bih=1200&oid=3&adxs=792%2C948%2C948%2C948%2C323%2C948%2C0%2C0&adys=9%2C560%2C4429%2C8406%2C8074%2C2308%2C8%2C0&adks=2672499039%2C2427907695%2C2153926628%2C2153926629%2C1207656411%2C2153926627%2C2751423868%2C2965745391&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dssz=159&icsg=0&mso=128&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x10%7C330x286%7C330x286%7C330x286%7C590x3133%7C330x286%7C1585x10014%7C1585x10014&msz=1585x1%7C330x271%7C330x271%7C330x271%7C590x1%7C330x271%7C1585x1%7C1585x8&ga_vid=1175119503.1571733290&ga_sid=1571733290&ga_hid=2100588899&fws=4%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1585%2C330%2C330%2C330%2C980%2C330%2C1585%2C1585
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
03b9d066e7b937c3de9be540864035db66ad99b0477137d0ef8c693046fee3bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17368
x-xss-protection
0
google-lineitem-id
5187559359,4824781385,4870730049,4871301086,221175503,193785863,-2,5114640715
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138289531442,138290509209,138251763494,138251964595,103020847223,138238693789,-2,138275390696
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019101401.js
securepubads.g.doubleclick.net/gpt/
64 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101401.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
f123fae1ceff20dea7ee2ff8895276a22cddecc8e0ef503b5e95419e76909a54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 14 Oct 2019 13:08:16 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24836
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/
0
0

integrator.js
adservice.google.de/adsid/ Frame DD1E
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame DD1E
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame DD1E
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:50 GMT
event.png
tps20227.doubleverify.com/ Frame 3F50
67 B
492 B
Other
General
Full URL
https://tps20227.doubleverify.com/event.png?impid=af08dabf552c4ba087e29e402639c34c&vdur=31&eoid=6&msrjs=289&pltfrm=Linux%20x86_64&isvelg=1&vit=2&engms=1&engisel=1&dvp_esdtms=2466&cbust=1571733290135240
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements289.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.254.244.22 , Ireland, ASN36062 (DOUBLE-VERIFY - DoubleVerify, Inc., US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:49 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.0
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
image/png
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
max-age=0
Transfer-Encoding
chunked
Access-Control-Allow-Credentials
true
Expires
10/21/2019 8:34:49 AM
sr.bladex.js
sdk.streamrail.com/blade/ Frame 40CC
422 KB
111 KB
Script
General
Full URL
https://sdk.streamrail.com/blade/sr.bladex.js
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:3e00:c:492d:cd80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0ae29789f5f0e63c7edd44c7a2e4801ede5c1765b8b0eb68020497ecf3729771

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:30:10 GMT
content-encoding
gzip
last-modified
Thu, 17 Oct 2019 11:09:48 GMT
server
AmazonS3
age
289
etag
"aaae8d85cab6fba6422a8f61bc4b31ee"
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=1200, public
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
113480
via
1.1 1b73451818d2dd47a574604c0b84f692.cloudfront.net (CloudFront)
x-amz-cf-id
5oUZ2vVeRrBfVWz7quPjSV0Sm9uNIPGypeCMCMAqu7aaozNx8rcDFw==
config.js
confiant-integrations.global.ssl.fastly.net/w1xQEgMUxjOvHcT3z4FHiGLhJLE/gpt_and_prebid/ Frame F118
192 KB
42 KB
Script
General
Full URL
https://confiant-integrations.global.ssl.fastly.net/w1xQEgMUxjOvHcT3z4FHiGLhJLE/gpt_and_prebid/config.js
Requested by
Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_9LMINbK9
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
992b58602147f002b41995da6179a06fcac92acd850f98429b6cdafe738ec14c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:50 GMT
Content-Encoding
gzip
Age
2446
X-Cache
HIT
Connection
keep-alive
Content-Length
42439
x-amz-id-2
U+N3dd8hzloKnLNAERzsloIH79GP2uCSrGBL5Wm9LNvgdfWqM3N5FlXwtoEcI8xWppp5XsRI/1E=
X-Served-By
cache-fra19160-FRA
Last-Modified
Tue, 22 Oct 2019 07:47:52 GMT
Server
AmazonS3
X-Timer
S1571733290.486520,VS0,VE0
ETag
"572f842c828c81c30b4b70f5001f705c"
x-amz-request-id
8222B513027440EF
Via
1.1 varnish
Cache-Control
public, max-age=900, stale-while-revalidate=3600
Accept-Ranges
bytes
Content-Type
text/javascript
X-Cache-Hits
19
wrapper_hb_270443_3428.js
player.spotim.market/prebid/ Frame F118
74 KB
18 KB
Script
General
Full URL
https://player.spotim.market/prebid/wrapper_hb_270443_3428.js?cb=18191
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
41367ea3722634b7e99e3a92f77a81cf5b6ab5712461e211473af21eff571301

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
last-modified
Fri, 18 Oct 2019 16:53:43 GMT
server
nginx
etag
W/"5da9ee17-12925"
status
200
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Tue, 22 Oct 2019 08:39:50 GMT
cache-control
max-age=300
x-proxy-cache
HIT
pixel
pix.spot.im/api/v1/
0
0
Image
General
Full URL
https://pix.spot.im/api/v1/pixel?m=eyJ2aXNpdF9pZCI6ImFhZTBhYjJiZWY1YWM3ZDEzYjZmY2I0NzM5ZGIwYzJmIiwiaWJfYnJvd3Nlcl9pZCI6ImFmMTM3YjJjYTk1ODdiMDhjNmE1NmU2MGEyMTg0ZDQ5IiwidiI6MCwidGltZV9kZWx0YSI6OTkwOSwidWlkIjoiMTY1ZjE4OTRlNDcyZDU1ZDBkZjZiMzk0MDY2YzI4YmYiLCJzcG90X2lkIjoic3BfOUxNSU5iSzkiLCJzb3VyY2UiOiJyZWNpcmN1bGF0aW9uIiwic291cmNlX3ZlcnNpb24iOiIxNzM0IiwicGFnZV92aWV3X2lkIjoiNGY2OWVmZDgtMzY4My00ODIzLWFiYTktY2UxYmNjYjg5NjBmIiwiZW5naW5lX3ZlbmRvcl9uYW1lIjoiREZQIiwiZW5naW5lX3RhZ19pZCI6IjYwMTYyIiwiY2xpZW50X3BsYXRmb3JtIjoiRGVza3RvcCIsImRvbWFpbiI6Ind3dy5leHByZXNzLmNvLnVrIiwidXJsIjoiaHR0cHM6Ly93d3cuZXhwcmVzcy5jby51ay9maW5hbmNlL3BlcnNvbmFsZmluYW5jZS8xMTkyNDM5L3RleHQtc2NhbS1obXJjLXRheC1yZWZ1bmQtd2FybmluZy1mcmF1ZC1uZXdzLWxhdGVzdCIsInJlZmVycmVyIjoiIiwibGFuZyI6ImVuLVVTIiwidHlwZSI6ImVuZ2luZV9zdGF0dXMiLCJlbmdpbmVfc3RhdHVzIjoiZW5naW5lLXdpbGwtaW5pdGlhbGl6ZSIsImNvdW50IjoxfQ%3D%3D&rnd=0.8292241071389757
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin
access-control-allow-credentials
true
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
pixel
pix.spot.im/api/v1/
0
0
Image
General
Full URL
https://pix.spot.im/api/v1/pixel?m=eyJ2aXNpdF9pZCI6ImFhZTBhYjJiZWY1YWM3ZDEzYjZmY2I0NzM5ZGIwYzJmIiwiaWJfYnJvd3Nlcl9pZCI6ImFmMTM3YjJjYTk1ODdiMDhjNmE1NmU2MGEyMTg0ZDQ5IiwidiI6MCwidGltZV9kZWx0YSI6OTkxMCwidWlkIjoiYjk1ODBhYjMyMDU1MTA1YmNhZDJlNzM1YTM1ZGZhM2YiLCJzcG90X2lkIjoic3BfOUxNSU5iSzkiLCJzb3VyY2UiOiJyZWNpcmN1bGF0aW9uIiwic291cmNlX3ZlcnNpb24iOiIxNzM0IiwicGFnZV92aWV3X2lkIjoiNGY2OWVmZDgtMzY4My00ODIzLWFiYTktY2UxYmNjYjg5NjBmIiwiZW5naW5lX3ZlbmRvcl9uYW1lIjoiU1IiLCJlbmdpbmVfdGFnX2lkIjoidGFnX2tManBVMEd6RDBIZyIsImNsaWVudF9wbGF0Zm9ybSI6IkRlc2t0b3AiLCJkb21haW4iOiJ3d3cuZXhwcmVzcy5jby51ayIsInVybCI6Imh0dHBzOi8vd3d3LmV4cHJlc3MuY28udWsvZmluYW5jZS9wZXJzb25hbGZpbmFuY2UvMTE5MjQzOS90ZXh0LXNjYW0taG1yYy10YXgtcmVmdW5kLXdhcm5pbmctZnJhdWQtbmV3cy1sYXRlc3QiLCJyZWZlcnJlciI6IiIsImxhbmciOiJlbi1VUyIsInR5cGUiOiJlbmdpbmVfc3RhdHVzIiwiZW5naW5lX3N0YXR1cyI6ImVuZ2luZS1pbml0aWFsaXplZCIsImNvdW50IjoxfQ%3D%3D&rnd=0.06981185485689756
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin
access-control-allow-credentials
true
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
pixel
pix.spot.im/api/v1/
0
0
Image
General
Full URL
https://pix.spot.im/api/v1/pixel?m=eyJ2aXNpdF9pZCI6ImFhZTBhYjJiZWY1YWM3ZDEzYjZmY2I0NzM5ZGIwYzJmIiwiaWJfYnJvd3Nlcl9pZCI6ImFmMTM3YjJjYTk1ODdiMDhjNmE1NmU2MGEyMTg0ZDQ5IiwidiI6MCwidGltZV9kZWx0YSI6OTkxMCwidWlkIjoiZWY2ZTkwZTViZTAyMDdiODAwZGIxYTFlNGJkZmE3YjMiLCJzcG90X2lkIjoic3BfOUxNSU5iSzkiLCJzb3VyY2UiOiJyZWNpcmN1bGF0aW9uIiwic291cmNlX3ZlcnNpb24iOiIxNzM0IiwicGFnZV92aWV3X2lkIjoiNGY2OWVmZDgtMzY4My00ODIzLWFiYTktY2UxYmNjYjg5NjBmIiwiZW5naW5lX3ZlbmRvcl9uYW1lIjoiREZQIiwiZW5naW5lX3RhZ19pZCI6IjYwMTYyIiwiY2xpZW50X3BsYXRmb3JtIjoiRGVza3RvcCIsImRvbWFpbiI6Ind3dy5leHByZXNzLmNvLnVrIiwidXJsIjoiaHR0cHM6Ly93d3cuZXhwcmVzcy5jby51ay9maW5hbmNlL3BlcnNvbmFsZmluYW5jZS8xMTkyNDM5L3RleHQtc2NhbS1obXJjLXRheC1yZWZ1bmQtd2FybmluZy1mcmF1ZC1uZXdzLWxhdGVzdCIsInJlZmVycmVyIjoiIiwibGFuZyI6ImVuLVVTIiwidHlwZSI6ImVuZ2luZV9zdGF0dXMiLCJlbmdpbmVfc3RhdHVzIjoiZW5naW5lLWluaXRpYWxpemVkIiwiY291bnQiOjF9&rnd=0.3545152799592175
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.106.97 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-106-97.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin
access-control-allow-credentials
true
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame 2294
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_3&adk=550597170&adf=1174745190&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=htt...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423575769&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423575769&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423575769&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
__cfduid=db28e7d63438780364444cc3d3f4998251571733289
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:50 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:20:33 GMT
cache-control
max-age=86400
set-cookie
a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a226a2c83cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423575769&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:50 GMT
server
cafe
content-length
46
x-xss-protection
0
set-cookie
test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame DD1E
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 0FC8
0
129 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvJ6zxSpRoZIv_25T8_VGtpF2PWTFbgasOciUfKPBPUz8TUAq9zEhtJR6vjCJ6SfoFwmSkyY4sWm4hy7LynGetipg86DOSmLk_zNIPE0n26amSqVItoL5gWNK6gMrwVf14z62ZAXlovWt8ngtPxqrCt7QtMfONZNckSKochjO14HKssfiWbNG4ILDt4_yT6SO25R45jQxR-AeKDM5jLROj4Ve5S6lIfe8shtnNSsOvJp5weyCa_Sd_wj_W8HYL3o9CSH92fjHRFi3VSymNQUT5s-Yx7s223EpPtbg4UHw&sai=AMfl-YSvHZafUtnWO87Fk-nURXysNXHvnLBRlhQIZgfy5nZ6Ia8ErMRfgeoK5WTPoRNCKziV299r4WoB4uGX7PbYbwR3SXASQ1sZgJi6_LFq4Q&sig=Cg0ArKJSzPfHLcMg6aw9EAE&urlfix=1&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
dcmads.js
www.googletagservices.com/dcm/ Frame 0FC8
4 KB
2 KB
Script
General
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
dbe699db5579e6b8f485d6d3fd23f6c5b77e4928bec888900fc95282e363fdb7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:36:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 21 Oct 2019 14:05:53 GMT
server
sffe
age
3487
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2032
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:36:43 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 0FC8
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c1c53a4d300ac7532bec2ed085532b2fe66d27f2b592b3a9383aa649e42ed6fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29691
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
ctax=Campaigns%5E4742659370%5E2607736224%5E5187559359%5E%5EImpression-5187559359138289531442
bcp.crwdcntrl.net/5/ct=y/c=7101/ Frame 0FC8
Redirect Chain
  • https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E4742659370%5E2607736224%5E5187559359%5E%5EImpression-5187559359138289531442
  • https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4742659370%5E2607736224%5E5187559359%5E%5EImpression-5187559359138289531442
49 B
960 B
Image
General
Full URL
https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4742659370%5E2607736224%5E5187559359%5E%5EImpression-5187559359138289531442
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.211.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-211-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Access-Control-Allow-Origin
*
Cache-Control
no-cache
X-Server
10.45.13.78
Connection
keep-alive
Content-Type
image/gif
Content-Length
49
Expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:50 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4742659370%5E2607736224%5E5187559359%5E%5EImpression-5187559359138289531442
Cache-Control
no-cache
X-Server
10.45.13.221
Connection
keep-alive
Content-Length
0
Expires
0
osd.js
www.googletagservices.com/activeview/js/current/
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 317C
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuwfFisMu9Dd6x0Ue2b89urGCfVcaiUF3xl3HkZ92OaqUiyGsZwBd1Gb8i9jOl4nJJ91enRaJL_3nn_H2rvoXq-4ccJ2CYvo-ag3TY3aaCsrC0F0k2-vQQNMPaa59lrYGaYmYe-G0OIP3dFW47rIvPAdNUu7XB_C9KHn89lG4vlmMq4mR9Gs07zDugRxMbk3tr7bzZOwQidXF-ehsd8i4Vg_qlL28xhqQWGOdJL_lBZN3F84bYmUiPnjTTMNCWF1nlbiSQiTzlNKbe_UdFqtxoxVRisQ-TAvkKFbSBRVw&sai=AMfl-YSFGGJH9ciXbzyPRffRzZERAwQsLL9op0RRcAwEZF-_2Lcdg2RNOjjSVHDBf6QxaWSQkLsAps0Phuy2DDPd3SuBvOXh7be5xoa04WOfAQ&sig=Cg0ArKJSzNZVuz6lM1a1EAE&urlfix=1&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
36867436-ef7d-4f51-8344-9f3ffdedda95.js
d3lcz8vpax4lo2.cloudfront.net/ads-code/ Frame 317C
74 KB
19 KB
Script
General
Full URL
https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:6400:1c:386f:ec80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f97c0872652460761415e9fdf3db6cc6f8bef4bbe4350bd072e572f489455aa8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 13:48:06 GMT
content-encoding
gzip
last-modified
Fri, 11 Oct 2019 13:46:40 GMT
server
AmazonS3
age
931605
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
FSOQNAAKD5kev29fX_qKHcKXxWORr4v5
status
200
cache-control
max-age=31536000,public
x-amz-cf-pop
FRA50-C1
content-type
application/javascript
x-amz-cf-id
F-qubcqxKsnTq66Zu7tRf3qM7WLwxPOLlohMsc7YV003ByLquxHLog==
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 317C
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c1c53a4d300ac7532bec2ed085532b2fe66d27f2b592b3a9383aa649e42ed6fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29691
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
ctax=Campaigns%5E127600103%5E2406490302%5E4824781385%5E%5EImpression-4824781385138290509209
bcp.crwdcntrl.net/5/ct=y/c=7101/ Frame 317C
Redirect Chain
  • https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E127600103%5E2406490302%5E4824781385%5E%5EImpression-4824781385138290509209
  • https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E127600103%5E2406490302%5E4824781385%5E%5EImpression-4824781385138290509209
49 B
960 B
Image
General
Full URL
https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E127600103%5E2406490302%5E4824781385%5E%5EImpression-4824781385138290509209
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.211.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-211-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Access-Control-Allow-Origin
*
Cache-Control
no-cache
X-Server
10.45.21.20
Connection
keep-alive
Content-Type
image/gif
Content-Length
49
Expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:50 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E127600103%5E2406490302%5E4824781385%5E%5EImpression-4824781385138290509209
Cache-Control
no-cache
X-Server
10.45.14.163
Connection
keep-alive
Content-Length
0
Expires
0
view
securepubads.g.doubleclick.net/pcs/ Frame FC7B
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvzHkWw8JOg6BfTfqM6iWiTxuUaDs6wAck0c5BLYQi2c7YunfxY0hBjc8z_Vdph85NJLfZGf7J5_ErfNAsiKImdg_p2vnmLRh2OoWZB-weuMoUThx1Ltb6WCCxBQz4ekCGH8oL_uPCAGgyHG8UntLhl3ZfbVFpJ_ObxpAEknuN6h0CSQ8bdq6G9noYzkhq2fhuQjT3Yz_gRthVrJO0GTmaKaHfwvJpCG-FW-mbt8FKNk14vyhAuzdBjG8e7_LKIJ5j2_eEBtDkZuafTHEnB9HUBjlLAKsw165y5XT1zyA&sai=AMfl-YSDZ1AovRgUVxs58hjW8kcB08WtkJXmokfxw60xtOUzFCq474duXuH7ZjgD4RSWjpxCTm41v8Fx159WJUXBB-ix3ahdGMSorZ1yeouCJA&sig=Cg0ArKJSzEuPW0edb3XpEAE&urlfix=1&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
fpi.js
ap.lijit.com/www/delivery/ Frame FC7B
5 KB
3 KB
Script
General
Full URL
https://ap.lijit.com/www/delivery/fpi.js?z=592013&width=300&height=250
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
4c2b8d176a8b50e769ee8b8b01b8af3cbe66264c8de47bbf9aab4c285a1b7957

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:50 GMT
Content-Encoding
gzip
Server
nginx
ETag
W/"5d83babe-1534"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Transfer-Encoding
chunked
X-Sovrn-Pod
ap3ams1
Expires
Thu, 01 Jan 1970 00:00:01 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame FC7B
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c1c53a4d300ac7532bec2ed085532b2fe66d27f2b592b3a9383aa649e42ed6fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29691
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
ctax=Campaigns%5E4635466512%5E2435030858%5E4870730049%5E%5EImpression-4870730049138251763494
bcp.crwdcntrl.net/5/ct=y/c=7101/ Frame FC7B
Redirect Chain
  • https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4870730049%5E%5EImpression-4870730049138251763494
  • https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4870730049%5E%5EImpression-4870730049138251763494
49 B
960 B
Image
General
Full URL
https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4870730049%5E%5EImpression-4870730049138251763494
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.211.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-211-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Access-Control-Allow-Origin
*
Cache-Control
no-cache
X-Server
10.45.8.204
Connection
keep-alive
Content-Type
image/gif
Content-Length
49
Expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:50 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4870730049%5E%5EImpression-4870730049138251763494
Cache-Control
no-cache
X-Server
10.45.22.7
Connection
keep-alive
Content-Length
0
Expires
0
view
securepubads.g.doubleclick.net/pcs/ Frame 0C55
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstlAnKSThj82sRupGPHNlJwl-K4sKWR8caggacSMUPzGDxML9wMRgpLbupkorDbJE7X1o1zfCxlTTKon8gM7RmJLzQ2UFUMuLJ4STyCaSf1FuITSr5jbLhqFKlr5_aCSrDXNT-ovzmjtwRDmJG-2EaHoRVB9P0g3iObWXHth9cC5R3S9SShUCm1AARUVtbF-aFHRy8AGMOJWLPkmPmS3mAZ6YlC93XjKwM_eCvKQdoQ1_IBseQbxytSBU4K_v90_WddwDpbBg3KZoqnZjD6eCFww8yoaXQkVzJglsvEnA&sai=AMfl-YRePrkd_f3sVvV0n9JN58VlCLv9cMkdzlPGcdBO1pbRT5cpKUrihZuKLy2a71PgXEh3DZhwEEuO-Kb0trEDBTw0ETF9Z3PphBea6Wi6HQ&sig=Cg0ArKJSzHdBT0xgjHqaEAE&urlfix=1&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
fpi.js
ap.lijit.com/www/delivery/ Frame 0C55
5 KB
3 KB
Script
General
Full URL
https://ap.lijit.com/www/delivery/fpi.js?z=592022&width=300&height=250
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
4c2b8d176a8b50e769ee8b8b01b8af3cbe66264c8de47bbf9aab4c285a1b7957

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:50 GMT
Content-Encoding
gzip
Server
nginx
ETag
W/"5d83bab8-1534"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Transfer-Encoding
chunked
X-Sovrn-Pod
ap3ams1
Expires
Thu, 01 Jan 1970 00:00:01 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 0C55
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c1c53a4d300ac7532bec2ed085532b2fe66d27f2b592b3a9383aa649e42ed6fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29691
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
ctax=Campaigns%5E4635466512%5E2435030858%5E4871301086%5E%5EImpression-4871301086138251964595
bcp.crwdcntrl.net/5/ct=y/c=7101/ Frame 0C55
Redirect Chain
  • https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4871301086%5E%5EImpression-4871301086138251964595
  • https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4871301086%5E%5EImpression-4871301086138251964595
49 B
960 B
Image
General
Full URL
https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4871301086%5E%5EImpression-4871301086138251964595
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.211.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-211-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Access-Control-Allow-Origin
*
Cache-Control
no-cache
X-Server
10.45.27.29
Connection
keep-alive
Content-Type
image/gif
Content-Length
49
Expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:50 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E4635466512%5E2435030858%5E4871301086%5E%5EImpression-4871301086138251964595
Cache-Control
no-cache
X-Server
10.45.6.96
Connection
keep-alive
Content-Length
0
Expires
0
view
securepubads.g.doubleclick.net/pcs/ Frame 53A4
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssU4XAIJOLGpVciRgmL1d_1r8QIdQxahg5KAyHNnCJ4vrtflAOf5y2MLf9HyntQjmt0b8PXfoceuZuX_eLkv4L9wr0DnpycGZq8SuFPSdcQhMUnI2wDlbiMiLbVQdkpuSuH2oULvp2j4Fto0lzCor4x5AQJVJJwUuk_MdzJmaNFfyDeXxvicz2uhFdOeFvd3ZkwXUMFKKhE4F8sY4cQZvMAGvPkCZiQ4mcjywbF09bJPIok46dFvTrcVoroZviACaX4zzvmxNMrunofhZaBuzBsi6hOcXepT5ZswpNy&sai=AMfl-YTvIzLih582bNESH2apHgmE5gziBGnXCB6jwx74X5OAzbSkafqUJj4YJ1gXgQMIQMk8RJ-q-tg1Hhh3sE8-C0gxcNkbAr9GSpDk_bFpYw&sig=Cg0ArKJSzBdNpKyzj9bpEAE&urlfix=1&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
fi_client.js
ecdn.firstimpression.io/
436 KB
190 KB
Script
General
Full URL
https://ecdn.firstimpression.io/fi_client.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.3.92.12 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
nb-185-3-92-12.london.nodebalancer.linode.com
Software
nginx/1.12.2 / PHP/7.0.33
Resource Hash
2e0a9a25fbd566695e1e25004a62fad985cd884718e411ed7fb7fc17dc24cbfa
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:41:00 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Last-Modified
Thu, 01 Jan 2015 00:00:00 GMT
Server
nginx/1.12.2
X-Powered-By
PHP/7.0.33
ETag
8fd453624f68dae69d9314382c0359cb
Transfer-Encoding
chunked
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
text/javascript;charset=UTF-8
Cache-Control
max-age=3600
Access-Control-Allow-Credentials
true
Connection
close
X-XSS-Protection
0
Expires
Tue, 22 Oct 2019 09:41:00 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 53A4
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c1c53a4d300ac7532bec2ed085532b2fe66d27f2b592b3a9383aa649e42ed6fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29691
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
ctax=Campaigns%5E107891423%5E473210903%5E221175503%5E%5EImpression-221175503103020847223
bcp.crwdcntrl.net/5/ct=y/c=7101/ Frame 53A4
Redirect Chain
  • https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E107891423%5E473210903%5E221175503%5E%5EImpression-221175503103020847223
  • https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E107891423%5E473210903%5E221175503%5E%5EImpression-221175503103020847223
49 B
967 B
Image
General
Full URL
https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E107891423%5E473210903%5E221175503%5E%5EImpression-221175503103020847223
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.211.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-211-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Access-Control-Allow-Origin
*
Cache-Control
no-cache
X-Server
10.45.27.138
Connection
keep-alive
Content-Type
image/gif
Content-Length
49
Expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:50 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://bcp.crwdcntrl.net/5/ct=y/c=7101/ctax=Campaigns%5E107891423%5E473210903%5E221175503%5E%5EImpression-221175503103020847223
Cache-Control
no-cache
X-Server
10.45.4.176
Connection
keep-alive
Content-Length
0
Expires
0
5187559359
dfp-gateway.s-onetag.com/1/34722903/
112 B
580 B
XHR
General
Full URL
https://dfp-gateway.s-onetag.com/1/34722903/5187559359
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:7200:a:52eb:a100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
847104f3ab8443474f93e5bab9771e8690fe4ac8c6c0552a8f7c48807cf0a13a

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:50:11 GMT
via
1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront), 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
age
2679
x-amzn-requestid
81668fde-356c-4dd2-867f-c783a6ff6897
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=3600, public
x-amzn-trace-id
Root=1-5daeb4b3-0f194ad99f385d4b9ddfc9e0;Sampled=0
x-amz-cf-pop
FRA2-C1, FRA2-C2
x-amz-apigw-id
B9EsBG9dSK4FfpA=
content-length
112
x-amz-cf-id
DdMs1dv-RArjO15QeOiz7p5YX-8CFPPd7uVFUNRofjPbNL2Gg8viNg==
4824781385
dfp-gateway.s-onetag.com/1/34722903/
116 B
581 B
XHR
General
Full URL
https://dfp-gateway.s-onetag.com/1/34722903/4824781385
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:7200:a:52eb:a100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
e0c6725ad0c01557a29fef49091f321e333b792d2e5a4727f6f8bf716d8adeb1

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:46:57 GMT
via
1.1 9568a708c8ab21597698ebe7dce6c42e.cloudfront.net (CloudFront), 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
age
1827
x-amzn-requestid
589100ff-be13-4e7b-a23b-6a9d45ab7e5a
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=3600, public
x-amzn-trace-id
Root=1-5daeb3f1-208770ca6d2f1c33cc1a1c4a;Sampled=0
x-amz-cf-pop
FRA2-C1, FRA2-C2
x-amz-apigw-id
B9ENuEFiyK4Ftmw=
content-length
116
x-amz-cf-id
Xss8YUnKvpohKhWxb5Q24zwcgpn87STDqwL8yoWzDCo2ePIqETeMTw==
4870730049
dfp-gateway.s-onetag.com/1/34722903/
119 B
583 B
XHR
General
Full URL
https://dfp-gateway.s-onetag.com/1/34722903/4870730049
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:7200:a:52eb:a100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
11c2a935a5453887aaf8d73e4b82bce853345bca3e240d670ca018693a6319d6

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:57:09 GMT
via
1.1 8391f131e4acb30724947dab1f8592a5.cloudfront.net (CloudFront), 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
age
2261
x-amzn-requestid
e4c9fe1c-01ed-44aa-a04c-cbad5e348156
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=3600, public
x-amzn-trace-id
Root=1-5daeb655-6953391f3dfc8c6ec695a2cf;Sampled=0
x-amz-cf-pop
FRA2, FRA2-C2
x-amz-apigw-id
B9FtYG0VyK4Fixw=
content-length
119
x-amz-cf-id
oZiE_YWGxKlB_kETEo4YVUryI6b3RjJQ5FpWovwZaUfWr-VG4yAdGg==
4871301086
dfp-gateway.s-onetag.com/1/34722903/
119 B
587 B
XHR
General
Full URL
https://dfp-gateway.s-onetag.com/1/34722903/4871301086
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:7200:a:52eb:a100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
11c2a935a5453887aaf8d73e4b82bce853345bca3e240d670ca018693a6319d6

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:57:09 GMT
via
1.1 fa5a3d5abd34c6fac657b045a4dcbdc5.cloudfront.net (CloudFront), 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
age
2261
x-amzn-requestid
14de14c3-fb12-49ea-b1bc-35f30576bc40
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=3600, public
x-amzn-trace-id
Root=1-5daeb655-4c7d68aca8897060a7a2c560;Sampled=0
x-amz-cf-pop
FRA50-C1, FRA2-C2
x-amz-apigw-id
B9FtVHMlyK4Fg3g=
content-length
119
x-amz-cf-id
IiTDOhO5vfW22lMLyC_B91xIk_yrvHKuSTMptVxKE_qiH8aUs1GhXw==
221175503
dfp-gateway.s-onetag.com/1/34722903/
118 B
586 B
XHR
General
Full URL
https://dfp-gateway.s-onetag.com/1/34722903/221175503
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:7200:a:52eb:a100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
631c3953d18876f7caa5fabc9aed8719631ef353b6160bcab29516daf88b320b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:57:15 GMT
via
1.1 9bb7bac3df4ba5eb70e607f6fa98eab8.cloudfront.net (CloudFront), 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
age
2223
x-amzn-requestid
e23eec99-5b32-4e9f-bbc0-a02a50b27fe2
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=3600, public
x-amzn-trace-id
Root=1-5daeb65b-2ac9bb60ffa833785654e358;Sampled=0
x-amz-cf-pop
FRA2, FRA2-C2
x-amz-apigw-id
B9FuWEbLyK4FiAg=
content-length
118
x-amz-cf-id
Njh8EvCFZEOSgIDMTqC_tSXky8I5QCZjxc4kjqXHZdSYwckOXPd6hw==
main.js
tag.imonomy.com/script/ Frame 104A
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15866
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a226a8d2bcbcc-VIE
content-length
5239
main.js
tag.imonomy.com/script/ Frame 289B
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15866
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a226aad59cbcc-VIE
content-length
5239
view
securepubads.g.doubleclick.net/pcs/ Frame 5DB5
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu0qbrvklRDOV9zDIZftyZF22vK5jQZEmFBJ4cg6ubDeWTkf6z6NuAZHAn5rSs9PWIixgv5Cii3y14dPWpL81JEfw4ndcVIcWW-UphsLsPY9CQF1eb0hW8_7vI0oAxquBx837ii8qgLKic6lGa1lCofu4cqg6uJy54bOhmhIwqUv2wQpUymEUVmfNsH6CPqQYrdSXzogdCXM6mRVnHVrSjyfWyNvW3sSNyfLNHjkfAwm2mVSWw3AwVpdJMB1rYIzEjpbJQN-NLJHCGDQltHM8RBFzEPVoEM4erh&sai=AMfl-YSK5VRKpA1nYG0BHcewOUC6UvitA8_u5eWolk1IoBVWI-W_Cs8jsVMU6kL0RzJdOMdAvMH3WL0KCJZ1_r9oDn1ZiTu98LK1daJFxL4gGQ&sig=Cg0ArKJSzIcrOXuK4claEAE&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
abg_lite.js
tpc.googlesyndication.com/pagead/js/r20191015/r20110914/ Frame 5DB5
30 KB
11 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20191015/r20110914/abg_lite.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ff2e8d7d164d98cb0dd71282747c6d718236e79036bc2d3f3fecf10d9abb2872
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 04:52:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
13362
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
11471
x-xss-protection
0
server
cafe
etag
8177752728920464164
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 05 Nov 2019 04:52:08 GMT
window_focus.js
tpc.googlesyndication.com/pagead/js/r20191015/r20110914/client/ Frame 5DB5
2 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20191015/r20110914/client/window_focus.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d31b12baad65082a7d404da9971cc9fed871e35f29a5893f815f468f1050491f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 02:12:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
22922
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1044
x-xss-protection
0
server
cafe
etag
16885093947315342629
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 05 Nov 2019 02:12:48 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 5DB5
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c1c53a4d300ac7532bec2ed085532b2fe66d27f2b592b3a9383aa649e42ed6fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29691
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
ctax=Campaigns%5E36174863%5E468246743%5E193785863%5E%5EImpression-193785863138238693789
bcp.crwdcntrl.net/5/c=7101/ Frame 5DB5
49 B
1 KB
Image
General
Full URL
https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E36174863%5E468246743%5E193785863%5E%5EImpression-193785863138238693789
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.211.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-211-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:50 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Access-Control-Allow-Origin
*
Cache-Control
no-cache
X-Server
10.45.7.21
Connection
keep-alive
Content-Type
image/gif
Content-Length
49
Expires
0
2734427575278463742
tpc.googlesyndication.com/simgad/ Frame 5DB5
93 KB
93 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/2734427575278463742
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7cc08243a55cd399ee78806a2499e42d872ebe79505134600822abd8d505a152
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 00:39:13 GMT
x-content-type-options
nosniff
age
28537
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
95472
x-xss-protection
0
last-modified
Thu, 12 Jul 2018 15:16:25 GMT
server
sffe
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 21 Oct 2020 00:39:13 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame DA91
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssbZDE0Qk09Gt7hgeYwp5HUiI7Rcp0ygg54uGpAWcLkxgVNMSevDCfL2UJv6CnnuhxMwOe7b9BK2wHxAuvuEMQbAD8IQTpauSik2ygxjhMXrVfcHI-9TOq1AGlw21GrB7teBAueFZHT6xq4wYaVC48l9sApgOD_6cJBfUqKapwu-wdkDxTtEfg-f3jKyh0k1QeL5Aaxiu5i3beGUjxiw7a3wNwGSseqObMoRYAw2k0DhszuLF_4KOrI52XuLiNFni6Jg9I4&sai=AMfl-YTPgC9Buv8F4efrj_zHq95wvNhpoUAKeSjqwK83Jrb7Hc0mkORwxRAbRmfmAv47JEyRXWFX415iLvguftv5TzcEDjOXwWNhvxxwNcWvDg&sig=Cg0ArKJSzNv5dDI0lzZpEAE&urlfix=1&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
tag
a.teads.tv/page/105267/ Frame DA91
869 B
799 B
Script
General
Full URL
https://a.teads.tv/page/105267/tag
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-7.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fcea863949651d32c48c40e5ea26ac29818235b292e50f9cec01a7243cd638b6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, must-revalidate, max-age=3600
access-control-allow-credentials
true
content-length
523
expires
Tue, 22 Oct 2019 09:34:50 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame DA91
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c1c53a4d300ac7532bec2ed085532b2fe66d27f2b592b3a9383aa649e42ed6fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29691
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:50 GMT
ctax=Campaigns%5E96678263%5E2569795437%5E5114640715%5E%5EImpression-5114640715138275390696
bcp.crwdcntrl.net/5/c=7101/ Frame DA91
49 B
467 B
Image
General
Full URL
https://bcp.crwdcntrl.net/5/c=7101/ctax=Campaigns%5E96678263%5E2569795437%5E5114640715%5E%5EImpression-5114640715138275390696
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.211.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-211-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:50 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Access-Control-Allow-Origin
*
Cache-Control
no-cache
X-Server
10.45.21.20
Connection
keep-alive
Content-Type
image/gif
Content-Length
49
Expires
0
193785863
dfp-gateway.s-onetag.com/1/34722903/
109 B
568 B
XHR
General
Full URL
https://dfp-gateway.s-onetag.com/1/34722903/193785863
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:7200:a:52eb:a100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
826a5f7c74ebfb3fbc9c11452d4bfd0228f87513e3859c538781957072186429

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
via
1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront), 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50, FRA2-C2
x-amzn-requestid
8573b593-dd42-468c-84d6-c2793d2e624c
status
200
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=3600, public
x-amzn-trace-id
Root=1-5daebf2a-e931670cbec403f97550dc3f;Sampled=0
x-amz-apigw-id
B9LOuEP4yK4FSAg=
content-length
109
x-amz-cf-id
TnIT7EbvdsbygIczb626YsLdhYeQbZwZ9vhMxbPRgNkq8fv-mXw8MA==
5114640715
dfp-gateway.s-onetag.com/1/34722903/
119 B
588 B
XHR
General
Full URL
https://dfp-gateway.s-onetag.com/1/34722903/5114640715
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/0db6fc14-cc7e-43d6-aa47-200c36378f86/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:7200:a:52eb:a100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
beb58bb9c6a40d9b57f41cf77bc6649bdd8deb733b8862310a3841cf22c44a88

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:57:09 GMT
via
1.1 cb33a7a4640adbb55df3e0d143601559.cloudfront.net (CloudFront), 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
age
2261
x-amzn-requestid
ed2ba497-8e4f-4923-ac5d-aab4a30d2f89
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=3600, public
x-amzn-trace-id
Root=1-5daeb655-3bffaa7c32b129c466c14910;Sampled=0
x-amz-cf-pop
FRA2-C1, FRA2-C2
x-amz-apigw-id
B9FtWGXRyK4Fdmg=
content-length
119
x-amz-cf-id
0sV3g3BYLRmyNeTWnk25LTmzzLPeJjMbZZfxgfVX2FcUC_q3kdD4sA==
main.js
tag.imonomy.com/script/ Frame 9DE9
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:50 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15866
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a226ca8e1cbcc-VIE
content-length
5239
5cb74dcb4b194a0001f77ed6
api.vidiom.net/player/587dfc37febaab0002000001/ Frame 40CC
6 KB
2 KB
XHR
General
Full URL
https://api.vidiom.net/player/587dfc37febaab0002000001/5cb74dcb4b194a0001f77ed6?aw=400&ah=300&sr_format=js&page_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&sub_id=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&param1=player_1_load_1571733290353&subid=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&ddomain=express.co.uk&domain=express.co.uk&sid=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&player_ver=bx_1228
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.78.160 , Ascension Island, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
160.78.201.35.bc.googleusercontent.com
Software
/
Resource Hash
674915d28d6b3b7b947e0784b76a18693eeb19edfe909481e5c5b6baeed5a66e

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:51 GMT
content-encoding
gzip
last-modified
Tue, 22 Oct 2019 08:34:51 GMT
status
200
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
cache-control
max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials
true
alt-svc
clear
content-length
2195
via
1.1 google
expires
Tue, 03 Jul 2001 06:00:00 GMT
hb_270443_3428.js
player.spotim.market/prebid/ Frame F118
241 KB
76 KB
Script
General
Full URL
https://player.spotim.market/prebid/hb_270443_3428.js?cb=18191
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebid/wrapper_hb_270443_3428.js?cb=18191
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e1c2041fc27e7fd38dd8821941394b66e75307de16228a0709bd2f4e62cf49fc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:51 GMT
content-encoding
gzip
last-modified
Thu, 17 Oct 2019 16:21:40 GMT
server
nginx
etag
W/"5da89514-3c481"
status
200
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Tue, 22 Oct 2019 08:39:51 GMT
cache-control
max-age=300
x-proxy-cache
HIT
adthbjs
hb.spotim.market/ Frame F118
0
195 B
XHR
General
Full URL
https://hb.spotim.market/adthbjs?cb=https%3A%2F%2Fwww.express.co.uk
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebid/wrapper_hb_270443_3428.js?cb=18191
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
213.174.156.165 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.express.co.uk
Date
Tue, 22 Oct 2019 08:34:50 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
Content-Length
0
tracking
hb.spotim.market/adunit/ Frame F118
43 B
264 B
XHR
General
Full URL
https://hb.spotim.market/adunit/tracking?event=11&client_id=270443&site_id=3428&full_page_url=https%3A%2F%2Fwww.express.co.uk&adid=1lf50l.1i
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebid/wrapper_hb_270443_3428.js?cb=18191
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
213.174.156.165 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.express.co.uk
Date
Tue, 22 Oct 2019 08:34:50 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
Content-Length
43
Content-Type
image/gif
gpt.js
www.googletagservices.com/tag/js/ Frame F118
46 KB
15 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
13426ba13e9862a0e6f6e2c9af87cce602482e4fd64aa5419bea6d0f449e7c70
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"314 / 808 of 1000 / last-modified: 1571691975"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14762
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:51 GMT
wrap.js
confiant-integrations.global.ssl.fastly.net/gpt/201910171256/ Frame F118
86 KB
30 KB
Script
General
Full URL
https://confiant-integrations.global.ssl.fastly.net/gpt/201910171256/wrap.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/w1xQEgMUxjOvHcT3z4FHiGLhJLE/gpt_and_prebid/config.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2c04e548e2c644df3e071eca3e5e55732e4425da3d4b753418247c8ba8ac3da2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
Age
498
X-Cache
HIT
Connection
keep-alive
Content-Length
29921
x-amz-id-2
bUOG/phyRrFYOxE/oCT7ZTATuvmoiFr4XX9cwayKQwrGEulbtPGPFbXZuCmFAhFY6v4tOC2T04o=
X-Served-By
cache-fra19135-FRA
Last-Modified
Thu, 17 Oct 2019 18:13:25 GMT
Server
AmazonS3
X-Timer
S1571733291.070770,VS0,VE0
ETag
"d2f82a175a9502997d9bdc8e17e63b0a"
x-amz-request-id
CF6B41D61703BF6C
Via
1.1 varnish
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
X-Cache-Hits
101
wrap.js
confiant-integrations.global.ssl.fastly.net/prebid/201910171256/ Frame F118
28 KB
11 KB
Script
General
Full URL
https://confiant-integrations.global.ssl.fastly.net/prebid/201910171256/wrap.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/w1xQEgMUxjOvHcT3z4FHiGLhJLE/gpt_and_prebid/config.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
51fbe136f28f60bc09b2a92ec09f109e560fb76b14d564e46fbd39cc6020f425

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
Age
759
X-Cache
HIT
Connection
keep-alive
Content-Length
10727
x-amz-id-2
AmADXxslGV9+mE9ujebgWUccxUdcDd8tLtSxRkTB2OIvcXtXMv51IwxcNKh1TGcgaiSLE1BwU34=
X-Served-By
cache-fra19120-FRA
Last-Modified
Thu, 17 Oct 2019 18:13:36 GMT
Server
AmazonS3
X-Timer
S1571733291.074284,VS0,VE0
ETag
"084deea6f314d94436d69a233e4af5e3"
x-amz-request-id
317AFB2B8E1D42CE
Via
1.1 varnish
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
X-Cache-Hits
1153
impl_v54.js
www.googletagservices.com/dcm/ Frame 0FC8
21 KB
9 KB
Script
General
Full URL
https://www.googletagservices.com/dcm/impl_v54.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
701e46658735a0ca01cfe72d1f8f8d626900805db2bb67a986b45c7da6080c7b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 02:17:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 14 Oct 2019 13:49:46 GMT
server
sffe
age
22647
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9449
x-xss-protection
0
expires
Wed, 21 Oct 2020 02:17:24 GMT
sync
ap.lijit.com/ Frame FC7B
49 KB
16 KB
Script
General
Full URL
https://ap.lijit.com/sync
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
4a270ec2745e615605f9b87bcf390e13a496560e6d846fd618d298c0782d1f88

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
Last-Modified
Thu, 19 Sep 2019 17:28:31 GMT
Server
nginx
ETag
W/"5d83babf-c373"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=86400, must-revalidate
Transfer-Encoding
chunked
X-Sovrn-Pod
ap3ams1
Expires
Wed, 23 Oct 2019 08:34:51 GMT
sync
ap.lijit.com/ Frame 0C55
49 KB
16 KB
Script
General
Full URL
https://ap.lijit.com/sync
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
4a270ec2745e615605f9b87bcf390e13a496560e6d846fd618d298c0782d1f88

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
Last-Modified
Thu, 19 Sep 2019 17:28:27 GMT
Server
nginx
ETag
W/"5d83babb-c373"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=86400, must-revalidate
Transfer-Encoding
chunked
X-Sovrn-Pod
ap3ams1
Expires
Wed, 23 Oct 2019 08:34:51 GMT
truncated
/ Frame 317C
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
06f5ce5d97072ad2d7e26a1bfcb9fe06ca604f57a4c2787061b3a3591418a2da

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
jload
pixel.adsafeprotected.com/ Frame BA93
45 KB
13 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x600&pubId=127600103&chanId=33750743&placementId=4824781385&pubCreative=138290509209&pubOrder=2406490302&cb=799544936&custom=right&adsafe_par&impId=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
45e5cf0eeab5f0fe8dd84658810bedcaa754aec8806166fa8c1438921399c74a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
X-Server-Name
app51ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
event.png
tps20227.doubleverify.com/ Frame 3F50
67 B
492 B
Other
General
Full URL
https://tps20227.doubleverify.com/event.png?impid=af08dabf552c4ba087e29e402639c34c&msrcanlm=264&msrcannum=2&eoid=10&ismms=64&isumms=64&isvelg=1&nvr=2&isgmmims=64&isgmv4mims=64&isbxdms=2437&b0=2661&engisel=1&dvp_vsosnmr=3&dvp_mvpw=1600&lftb=2661&sftb=2661&naral=256&vct=1&vphgt=1200&vpwdth=1600&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&engalms=62&dvp_hdnAd=22013&dvp_dpr=1&dvp_itg=HEAD:1,IFRAME:2,SCRIPT:5,BODY:1,&dvp_ltspl=7152&dvp_esdtms=3482&cbust=1571733291151482
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements289.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.254.244.22 , Ireland, ASN36062 (DOUBLE-VERIFY - DoubleVerify, Inc., US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:50 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.0
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
image/png
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
max-age=0
Transfer-Encoding
chunked
Access-Control-Allow-Credentials
true
Expires
10/21/2019 8:34:50 AM
truncated
/ Frame 53A4
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
476551c531aed18233298b9c501253aba66b1cf03b74e7375e4344f99d31bb67

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
jload
pixel.adsafeprotected.com/ Frame 9CC1
45 KB
13 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/jload?anId=10079&campId=1x1&pubId=107891423&chanId=33750743&placementId=221175503&pubCreative=103020847223&pubOrder=473210903&cb=1519130979&custom=middle&adsafe_par&impId=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
196774b588fb427bcbcf473d3ac027291e62e6817c180471211479ce7770b92e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
X-Server-Name
app51ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
spc_fi.php
cdn.firstimpression.io/delivery/
5 KB
2 KB
Script
General
Full URL
https://cdn.firstimpression.io/delivery/spc_fi.php?id=5559&url=%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&charset=UTF-8&wrapto=firstSpcFetch&ch=10&referer=&_firid=17667194&fiodpe=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.64.113 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-64-113.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 / PHP/7.0.33
Resource Hash
c4680d0c58e0e1e593ff09ad98bf0b38b9f0515a237355309c7272c6931b0114
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:51 GMT
content-encoding
gzip
server
nginx/1.14.1
x-powered-by
PHP/7.0.33
status
200
access-control-allow-methods
POST, GET, OPTIONS
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
content-type
application/javascript; charset=UTF-8
access-control-allow-headers
Content-Type
x-xss-protection
0
expires
0
main.js
tag.imonomy.com/script/ Frame DD1E
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:51 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15867
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a226f4e32cbcc-VIE
content-length
5239
truncated
/ Frame DA91
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fe350550651039fc4dda6ec99bf2be5ee6ad01d87d9732efa3db30f6ede91c76

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
jload
pixel.adsafeprotected.com/ Frame 9F94
45 KB
13 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/jload?anId=10079&campId=8x8&pubId=96678263&chanId=33739823&placementId=5114640715&pubCreative=138275390696&pubOrder=2569795437&cb=828926111&custom=&adsafe_par&impId=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
fcb3ba32d938b01406682fcf2392f8aa999f31fe71645b5230967ca191795021

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
X-Server-Name
app51ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
truncated
/ Frame 40CC
175 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
cs.html
sdk.streamrail.com/mrail/200/ Frame CAA9
0
0
Document
General
Full URL
https://sdk.streamrail.com/mrail/200/cs.html?tc=5cb74c624b194a0001f77d99&org=587dfc37febaab0002000001&sid=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&ip=144.76.109.30&domain=express.co.uk&pv=1228&sv=
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:3e00:c:492d:cd80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

:method
GET
:authority
sdk.streamrail.com
:scheme
https
:path
/mrail/200/cs.html?tc=5cb74c624b194a0001f77d99&org=587dfc37febaab0002000001&sid=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&ip=144.76.109.30&domain=express.co.uk&pv=1228&sv=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
content-type
text/html
content-length
247
last-modified
Sun, 03 Mar 2019 10:24:33 GMT
accept-ranges
bytes
server
AmazonS3
date
Tue, 22 Oct 2019 08:34:52 GMT
etag
"e9af93f10ca3d78d6ca9e54a5e4174c2"
cache-control
no-cache
x-cache
RefreshHit from cloudfront
via
1.1 1b73451818d2dd47a574604c0b84f692.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
eJv31gLdQbguastvbU9EvGfKCofPtBv0uezHh9rkSxSRTdYz1u_jfw==
vast.xml
optimized-by.rubiconproject.com/a/api/ Frame 40CC
195 B
2 KB
XHR
General
Full URL
https://optimized-by.rubiconproject.com/a/api/vast.xml?account_id=17184&site_id=274302&zone_id=1368522&size_id=201&tg_c.language=en&width=400&height=300&x_source.pchain=1.0,1!streamrail,266658,1,,,
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
3f87130f2c1a5a9df7d83f1db680e9628fd700956c7e9b6fd36f82cb817ea53b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/xml
Keep-Alive
timeout=5, max=491
Content-Length
195
Expires
Wed, 17 Sep 1975 21:32:10 GMT
vast.xml
optimized-by.rubiconproject.com/a/api/ Frame 40CC
195 B
2 KB
XHR
General
Full URL
https://optimized-by.rubiconproject.com/a/api/vast.xml?account_id=17184&site_id=274304&zone_id=1368524&size_id=201&tg_c.language=en&width=400&height=300&x_source.pchain=1.0,1!streamrail,266658,1,,,
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
38cc5e638623027e14d83d21653e26a5d1f005289c2c87645fadf419fa520dc3

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/xml
Keep-Alive
timeout=5, max=490
Content-Length
195
Expires
Wed, 17 Sep 1975 21:32:10 GMT
av
spot-im-d.openx.net/v/1.0/ Frame 40CC
Redirect Chain
  • https://spot-im-d.openx.net/v/1.0/av?auid=540863609&cb=1571733291883&vwd=400&vht=300&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fr...
  • https://spot-im-d.openx.net/v/1.0/av?cc=1&auid=540863609&cb=1571733291883&vwd=400&vht=300&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warni...
48 B
241 B
XHR
General
Full URL
https://spot-im-d.openx.net/v/1.0/av?cc=1&auid=540863609&cb=1571733291883&vwd=400&vht=300&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ip=144.76.109.30
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.164.0 /
Resource Hash
a355f2718a8d0b7444670aca6fd1dfdc126f9b8e9931a34a52cac9c343a68e3f

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
server
OXGW/16.164.0
status
200
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.express.co.uk
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
text/xml
alt-svc
clear
content-length
48
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date
Tue, 22 Oct 2019 08:34:51 GMT
via
1.1 google
server
OXGW/16.164.0
status
302
location
https://spot-im-d.openx.net/v/1.0/av?cc=1&auid=540863609&cb=1571733291883&vwd=400&vht=300&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ip=144.76.109.30
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
alt-svc
clear
content-length
0
/
vast.spotim.market/ Frame 40CC
133 B
410 B
XHR
General
Full URL
https://vast.spotim.market/?content_page_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&width=400&height=300&video_duration=&cb=1571733292191&aid=468793
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a0c:5c80:5026::2 , United Kingdom, ASN55081 (24SHELLS - 24 SHELLS, US),
Reverse DNS
Software
nginx /
Resource Hash
973960bfd5d01a34238de691886ac5848aaf98e5d2828db7540b3dbe79502a52

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/xml; charset=UTF-8
Access-Control-Allow-Origin
https://www.express.co.uk
Access-Control-Allow-Credentials
true
Connection
keep-alive
/
vast.spotim.market/ Frame 40CC
133 B
410 B
XHR
General
Full URL
https://vast.spotim.market/?content_page_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&width=400&height=300&video_duration=&cb=1571733291814&aid=468792
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a0c:5c80:5026::2 , United Kingdom, ASN55081 (24SHELLS - 24 SHELLS, US),
Reverse DNS
Software
nginx /
Resource Hash
973960bfd5d01a34238de691886ac5848aaf98e5d2828db7540b3dbe79502a52

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/xml; charset=UTF-8
Access-Control-Allow-Origin
https://www.express.co.uk
Access-Control-Allow-Credentials
true
Connection
keep-alive
266251
search.spotxchange.com/vast/2.00/ Frame 40CC
67 B
1 KB
XHR
General
Full URL
https://search.spotxchange.com/vast/2.00/266251?VPAID=JS&content_page_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&cb=1571733292106&player_width=400&player_height=300&ip_addr=144.76.109.30&device[ua]=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.123 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
78e958d620d6e40a19e424eee3a9b23932cd9bfa4d7f736442048777d203052d

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
X-SpotX-Timing-Transform
0.000541
X-SpotX-Timing-SpotMarket
0.155523
X-SpotX-Timing-Page-Mux
0.000159
X-SpotX-Timing-Page-Require
0.000303
X-fe
082
Connection
keep-alive
X-SpotX-Timing-Page-Cookie
0.000038
Content-Length
76
X-SpotX-Timing-Page
0.160167
Pragma
no-cache
X-SpotX-Timing-Page-Context
0.000213
Last-Modified
Tue, 22 Oct 2019 08:34:51 GMT
Server
nginx
Cache-Control
no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Methods
POST, GET, PATCH, DELETE, OPTIONS
Vary
Accept-Encoding
X-SpotX-Timing-SpotMarket-Primary
0.123567
Content-Type
text/xml;charset=UTF-8
Access-Control-Allow-Origin
https://www.express.co.uk
X-SpotX-Timing-Page-Misc
0.003382
X-SpotX-Timing-Page-Exception
0.000000
X-SpotX-Timing-SpotMarket-Secondary
0.031956
X-SpotX-Timing-Page-URI
0.000008
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Expires
Thu, 01 Jan 1970 00:00:00 GMT
266458
search.spotxchange.com/vast/2.00/ Frame 40CC
67 B
1 KB
XHR
General
Full URL
https://search.spotxchange.com/vast/2.00/266458?VPAID=JS&content_page_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&cb=1571733291814&player_width=400&player_height=300&ip_addr=144.76.109.30&device[ua]=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.123 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
78e958d620d6e40a19e424eee3a9b23932cd9bfa4d7f736442048777d203052d

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
X-SpotX-Timing-Transform
0.000280
X-SpotX-Timing-SpotMarket
0.097907
X-SpotX-Timing-Page-Mux
0.000215
X-SpotX-Timing-Page-Require
0.000322
X-fe
045
Connection
keep-alive
X-SpotX-Timing-Page-Cookie
0.000027
Content-Length
76
X-SpotX-Timing-Page
0.101136
Pragma
no-cache
X-SpotX-Timing-Page-Context
0.000273
Last-Modified
Tue, 22 Oct 2019 08:34:51 GMT
Server
nginx
Cache-Control
no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Methods
POST, GET, PATCH, DELETE, OPTIONS
Vary
Accept-Encoding
X-SpotX-Timing-SpotMarket-Primary
0.038832
Content-Type
text/xml;charset=UTF-8
Access-Control-Allow-Origin
https://www.express.co.uk
X-SpotX-Timing-Page-Misc
0.002076
X-SpotX-Timing-Page-Exception
0.000000
X-SpotX-Timing-SpotMarket-Secondary
0.059075
X-SpotX-Timing-Page-URI
0.000036
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Expires
Thu, 01 Jan 1970 00:00:00 GMT
265786
search.spotxchange.com/vast/2.00/ Frame 40CC
67 B
1 KB
XHR
General
Full URL
https://search.spotxchange.com/vast/2.00/265786?VPAID=JS&content_page_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&cb=1571733291524&player_width=400&player_height=300&ip_addr=144.76.109.30&device[ua]=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.123 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
78e958d620d6e40a19e424eee3a9b23932cd9bfa4d7f736442048777d203052d

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
X-SpotX-Timing-Transform
0.000330
X-SpotX-Timing-SpotMarket
0.069729
X-SpotX-Timing-Page-Mux
0.000217
X-SpotX-Timing-Page-Require
0.000318
X-fe
106
Connection
keep-alive
X-SpotX-Timing-Page-Cookie
0.000030
Content-Length
76
X-SpotX-Timing-Page
0.073475
Pragma
no-cache
X-SpotX-Timing-Page-Context
0.000250
Last-Modified
Tue, 22 Oct 2019 08:34:51 GMT
Server
nginx
Cache-Control
no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Methods
POST, GET, PATCH, DELETE, OPTIONS
Vary
Accept-Encoding
X-SpotX-Timing-SpotMarket-Primary
0.038280
Content-Type
text/xml;charset=UTF-8
Access-Control-Allow-Origin
https://www.express.co.uk
X-SpotX-Timing-Page-Misc
0.002590
X-SpotX-Timing-Page-Exception
0.000001
X-SpotX-Timing-SpotMarket-Secondary
0.031449
X-SpotX-Timing-Page-URI
0.000010
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Expires
Thu, 01 Jan 1970 00:00:00 GMT
265327
search.spotxchange.com/vast/2.00/ Frame 40CC
67 B
1 KB
XHR
General
Full URL
https://search.spotxchange.com/vast/2.00/265327?VPAID=JS&content_page_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&cb=1571733292196&player_width=400&player_height=300&ip_addr=144.76.109.30&device[ua]=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.123 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
78e958d620d6e40a19e424eee3a9b23932cd9bfa4d7f736442048777d203052d

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
X-SpotX-Timing-Transform
0.011368
X-SpotX-Timing-SpotMarket
0.913947
X-SpotX-Timing-Page-Mux
0.000163
X-SpotX-Timing-Page-Require
0.000277
X-fe
094
Connection
keep-alive
X-SpotX-Timing-Page-Cookie
0.000044
Content-Length
76
X-SpotX-Timing-Page
0.929530
Pragma
no-cache
X-SpotX-Timing-Page-Context
0.000211
Last-Modified
Tue, 22 Oct 2019 08:34:52 GMT
Server
nginx
Cache-Control
no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Methods
POST, GET, PATCH, DELETE, OPTIONS
Vary
Accept-Encoding
X-SpotX-Timing-SpotMarket-Primary
0.869400
Content-Type
text/xml;charset=UTF-8
Access-Control-Allow-Origin
https://www.express.co.uk
X-SpotX-Timing-Page-Misc
0.003511
X-SpotX-Timing-Page-Exception
0.000001
X-SpotX-Timing-SpotMarket-Secondary
0.044547
X-SpotX-Timing-Page-URI
0.000008
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Expires
Thu, 01 Jan 1970 00:00:00 GMT
WGGvk3CF30m9wNZ+BAZTJyFR1XHLby71wYHFMqmw7busg9ZNuNt1y8dObTULPw7OGis+zxkolgSg63SWosWzAw==
ads.adaptv.advertising.com/a/h/ Frame 40CC
3 KB
1 KB
XHR
General
Full URL
https://ads.adaptv.advertising.com/a/h/WGGvk3CF30m9wNZ+BAZTJyFR1XHLby71wYHFMqmw7busg9ZNuNt1y8dObTULPw7OGis+zxkolgSg63SWosWzAw==?cb=1571733291718&gdpr=&gdpr_consent=[GDPR_CONSENT]&pet=preroll&pageUrl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&eov=eov
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.121.26.224 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-121-26-224.eu-central-1.compute.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
066ce21f2761d5b7377230fb0f498e18be7e1592b7b66a2f5214fbdb19def137

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Content-Encoding
gzip
Server
adaptv/1.0
Content-Type
text/xml
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
1049
Expires
0
vast.xml
video-ads.rubiconproject.com/video/17184/168186/810158/201/ Frame 40CC
2 KB
1 KB
XHR
General
Full URL
https://video-ads.rubiconproject.com/video/17184/168186/810158/201/vast.xml?tg_c.language=en&x_source.pchain=1.0,1!streamrail,266658,1,,,
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.105.3 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-105-3.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
fc7ba06a76dcf3fde4d52c8667360d310504a7d961b330989c500e5c5ce4f382

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, GET, PUT, OPTIONS, PATCH, DELETE
Content-Type
text/xml
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
public, must-revalidate, max-age=0, s-maxage=600
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
X-Accept-Charset,X-Accept,Content-Type
Content-Length
880
Expires
Tue, 22 Oct 2019 08:34:51 GMT
vast.xml
video-ads.rubiconproject.com/video/17184/260258/1289094/204/ Frame 40CC
2 KB
1 KB
XHR
General
Full URL
https://video-ads.rubiconproject.com/video/17184/260258/1289094/204/vast.xml?tg_c.language=en&x_source.pchain=1.0,1!streamrail,266658,1,,,
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.105.3 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-105-3.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
b6eecdd9c3ee5be28efde691c4c427248bc3ce4121e67fd3cdb48d9b108591d7

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, GET, PUT, OPTIONS, PATCH, DELETE
Content-Type
text/xml
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
public, must-revalidate, max-age=0, s-maxage=600
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
X-Accept-Charset,X-Accept,Content-Type
Content-Length
881
Expires
Tue, 22 Oct 2019 08:34:51 GMT
x
k.streamrail.com/ Frame 40CC
0
62 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&a=am&ca=adserver&lt=4&co=adsmanager&p=1340047297&rand=3376415634&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:51 GMT
via
1.1 google
alt-svc
clear
/
geoip.insticator.com/json/ Frame 317C
204 B
621 B
XHR
General
Full URL
https://geoip.insticator.com/json/
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb8cbd2a68b8068930e22baa762a4463ffd66b91ac3905ef9123ea07203bc133

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 vegur
vary
Origin
cf-cache-status
DYNAMIC
status
200
x-database-date
Tue, 22 Oct 2019 00:21:36 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining
9999
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
x-ratelimit-reset
3600
x-ratelimit-limit
10000
cf-ray
529a22711f03cbc4-VIE
/
geoip.insticator.com/json/ Frame 317C
204 B
244 B
XHR
General
Full URL
https://geoip.insticator.com/json/
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb8cbd2a68b8068930e22baa762a4463ffd66b91ac3905ef9123ea07203bc133

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 vegur
vary
Origin
cf-cache-status
DYNAMIC
status
200
x-database-date
Tue, 22 Oct 2019 02:04:32 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining
9999
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
x-ratelimit-reset
3600
x-ratelimit-limit
10000
cf-ray
529a22711f04cbc4-VIE
usertracking
b2c.insticator.com/v3/pages/ Frame FA0D
0
0
Document
General
Full URL
https://b2c.insticator.com/v3/pages/usertracking
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:190b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
b2c.insticator.com
:scheme
https
:path
/v3/pages/usertracking
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:52 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d021052da17aa20c8f6f822fa578241eb1571733291; expires=Wed, 21-Oct-20 08:34:51 GMT; path=/; domain=.insticator.com; HttpOnly
vary
Accept-Encoding,Origin
pragma
max-age=3600
cache-control
max-age=3600
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a22714da4cba4-VIE
content-encoding
gzip
instbid_1_34_release_20190807.js
df80k0z3fi8zg.cloudfront.net/files/ Frame 317C
218 KB
66 KB
Script
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/instbid_1_34_release_20190807.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8075fe09e142b517a80252d1befdd7c1d6f4938ada76218ad6a2ac25d7aea997

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
ZyO56HU_sYG3L.Nf3MAtxCLO1RTIEG4J
content-encoding
gzip
last-modified
Mon, 05 Aug 2019 21:52:22 GMT
server
AmazonS3
age
67065
date
Mon, 21 Oct 2019 14:01:51 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
aw04KXcnzYH0wMHalwvhkod2C3VlWZ2A8suUw1b8m_XvwOqn3JqF_w==
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
apstag.js
c.amazon-adsystem.com/aax2/ Frame 317C
77 KB
22 KB
Script
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-224-199-29.fra2.r.cloudfront.net
Software
Server /
Resource Hash
c02e2b06d9126930b67bf7d73a9537dd60aa430a345a9e2773b645807ef0b4ec

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 17:52:56 GMT
content-encoding
gzip
server
Server
age
52914
etag
9adec3ed0e2dfb55ea99831806416a28
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=86400
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
x-amz-cf-id
lVNoLOaWCjs8SvpxsQLshYZjbtPSfmxH8tGVr7gEtK5_khkRSGOCHA==
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfd.cloudfront.net (CloudFront)
B23047164.253457958;dc_ver=54.151;dc_eid=40004000;sz=970x250;u_sd=1;dc_adk=1349504071;ord=bg3uts;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsslnSAMZbSGF44dHvTSDiTg6WQ-...
ad.doubleclick.net/ddm/adj/N244601.136246EXPRESS.CO.UK/ Frame 0FC8
25 KB
11 KB
Script
General
Full URL
https://ad.doubleclick.net/ddm/adj/N244601.136246EXPRESS.CO.UK/B23047164.253457958;dc_ver=54.151;dc_eid=40004000;sz=970x250;u_sd=1;dc_adk=1349504071;ord=bg3uts;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsslnSAMZbSGF44dHvTSDiTg6WQ-YMT_u3g4VlmYLtOBB2CJ6iTQ76LflykMNr7GA7VwOo5h9I7awlqU-jgI8ySxCjH4AEpl5DeNMD2BxzIXR2jhDbVuNm9IPQbFhWGv_PtJJA4At4f7W-bU0qiTZmylr100P4pIYJsjaz0dFTVBwmoIJzAZdtrBN0_21ZoVb3Uo9DnutDHjd6cttGkuAa_OIueQxZxtkSYQsivYOt8aPOzIALnlEL1QV2r0J0HUpNzu_YjBUWnZ0u2yIMoSV7hi2hModeqq3L7cLw%26sai%3DAMfl-YSjHLBfEgGi1YTgPt8rRKYinKNZ7Q4ZjWHlWkFnwquqq5O_Rns-bQmg6Zl2oD0GM2090DwSU5nqNVbd7R_le29izjw2AhhyhF5Zkltung%26sig%3DCg0ArKJSzHyenxpNEOjXEAE%26urlfix%3D1%26adurl%3D;dc_rfl=1,https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest$0;xdt=0;crlt=Fm-yi5v-s1;cmpl=4;osda=2;sttr=781;prcl=s?
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.21.198 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f198.1e100.net
Software
cafe /
Resource Hash
66aa7a521c13e429eeb95f5b58da6efd7714b11d19345ef8843a0cdf86f8ed77
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:51 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10986
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
integrator.js
adservice.google.de/adsid/ Frame F118
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame F118
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019101401.js
securepubads.g.doubleclick.net/gpt/ Frame F118
156 KB
57 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
f8800772f0dd827877029d9d634a170a156ff82b6b6bdf251b62c750b73cfe93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 14 Oct 2019 13:08:16 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58589
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:51 GMT
truncated
/ Frame 5DB5
217 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4fc2dfa4181827bca24ccee472596a6c549123afa8c70a5979c50bd1a74599c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
jload
pixel.adsafeprotected.com/ Frame 333E
45 KB
13 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x250&pubId=36174863&chanId=33750743&placementId=193785863&pubCreative=138238693789&pubOrder=468246743&cb=601301676&custom=right1&adsafe_par&impId=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
733adb819b2c1d12c4f3ce71475f633d3f3559c85651b4478d305ad2b5db3eb2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
X-Server-Name
app11ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
teads-format.min.js
a.teads.tv/media/format/v3/
708 KB
184 KB
Script
General
Full URL
https://a.teads.tv/media/format/v3/teads-format.min.js
Requested by
Host: a.teads.tv
URL: https://a.teads.tv/page/105267/tag
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-7.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
db2619c2d7a2c41b123c8bbca1cdade0ae40b5a90023a492926c827e63b18f97

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:51 GMT
content-encoding
gzip
last-modified
Tue, 22 Oct 2019 08:28:03 GMT
x-amz-request-id
EB7C5BA139736512
etag
"6d0b7f09ede83a24467e5090016e8062"
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
status
200
cache-control
private, must-revalidate, max-age=600
x-bucket
c
accept-ranges
bytes
content-length
187956
x-amz-id-2
5KuLYvDtGdrTSJj0hnMk72SsyKO3ET9BpKWNqIDeFL3tQxW/CvkSaIEHrdGDWi3yO+N+DjRs0CE=
expires
Tue, 22 Oct 2019 08:44:51 GMT
adcfg
ap.lijit.com/ Frame FC7B
159 B
565 B
Script
General
Full URL
https://ap.lijit.com/adcfg?zoneid=592013&tid=bd67127c01824227bc60f4eba8ad36c10c2d2fd1&mode=1&dmn=www.express.co.uk
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
376e161a2ac95b590fcea27b4ef2f4ed40a4ebc024a6a811311e2021858adaeb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:51 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ap3ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
/
tt.onthe.io/
0
287 B
XHR
General
Full URL
https://tt.onthe.io/?k[]=41764:time[url:%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest,cdn_version:97]&s=632ae8d6a623792c016809f53c694b47&1571733291970
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/1eWNpP6x0acZ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.150 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:52 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
adcfg
ap.lijit.com/ Frame 0C55
159 B
564 B
Script
General
Full URL
https://ap.lijit.com/adcfg?zoneid=592022&tid=c06320fcd1404e5c8b85a1a191057eb659dd3b4f&mode=1&dmn=www.express.co.uk
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
8c27e973421237631c29cb0434e2a424ba47954cd3850def6f6e0cced37d5cd3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ap3ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
main.19.8.22.js
static.adsafeprotected.com/ Frame BA93
158 KB
50 KB
Script
General
Full URL
https://static.adsafeprotected.com/main.19.8.22.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x600&pubId=127600103&chanId=33750743&placementId=4824781385&pubCreative=138290509209&pubOrder=2406490302&cb=799544936&custom=right&adsafe_par&impId=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
5df41461e8c29072a827d5fd000d2506238b77e767a34642d6613b79ce49134c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Oct 2019 16:27:21 GMT
X-Server-Name
app35ami.ami.303net.pvt
ETag
"5d9e0a69-c7d3"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
51155
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&a=bid&t=1&tl=12&ai=5cdd193b804dce00018382db&fb=true&bs=NXLxU8C1F0k&bqi=1017&r=12&as=vpaid%20both&ca=adserver&lt=566&co=adsmanager&p=1708664989&rand=4673663188&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&a=bid&t=1&tl=12&ai=5a42195720e31100021a1fa9&fb=true&bs=NXLxU8qxH0o&bqi=1017&r=11&as=vpaid%20both&ca=adserver&lt=571&co=adsmanager&p=1747152875&rand=3328643299&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&a=bid&t=1&tl=12&ai=5d7f474bd177f3000108ea7a&fb=true&bs=NXLxUsK4FUg&bqi=1017&r=10&as=vpaid%20js&ca=adserver&lt=575&co=adsmanager&p=2154384927&rand=754478210&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
serve
srv.imonomy.com/internal/ Frame 104A
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=8866&ttkan_x=2867&sum_ttkan_x=4938&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=187&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673378&tr=4&trs=3&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=1796&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
0a45f2d6f819adacf882f3d21daebd5b036306abf88b41005f363a4ee8d8638d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Server
nginx
Etag
"19a6bff13c1737c838196ab1ecc8bec2a7089b77"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2263
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&t=1&tl=12&ai=5d377263749d65000151059e&fb=true&bs=PXL0Ucu0Ek8&bqi=1017&r=1&ec=201&a=lose&ca=prebid-error&lt=587&co=adsmanager&p=3593406560&rand=2137160827&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&t=1&tl=12&ai=5d5d448fae8a9e00012ac364&fb=true&bs=NnL1VsayFkE&bqi=1003&r=8&ec=201&a=lose&ca=prebid-error&lt=589&co=adsmanager&p=2117864032&rand=6201611437&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&t=1&tl=12&ai=5d377300524a960001167053&fb=true&bs=MnL5UcqzFUs&bqi=1017&r=2&ec=201&a=lose&ca=prebid-error&lt=594&co=adsmanager&p=2547251030&rand=197732065&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&t=1&tl=12&ai=5d6d2716a96b48000132390b&fb=true&bs=NnL0V8KxEUE&bqi=1003&r=7&ec=201&a=lose&ca=prebid-error&lt=600&co=adsmanager&p=4188831165&rand=3055944247&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&t=1&tl=12&ai=5d663b38b41e29000100699a&fb=true&bs=MHL4UsayFkw&bqi=1003&r=6&ec=201&a=lose&ca=prebid-error&lt=641&co=adsmanager&p=195883149&rand=3060653235&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
serve
srv.imonomy.com/internal/ Frame 289B
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=8972&ttkan_x=2989&sum_ttkan_x=5009&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=23&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673378&tr=4&trs=3&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=291&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
b6cea4a8688630abdba053c6d781cb7e6a96d0e5994b3ed8d9cb49d351573132

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Server
nginx
Etag
"0c0a32edfa13c2e7e602011013cb4aeab5652126"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2261
main.19.8.22.js
static.adsafeprotected.com/ Frame 9CC1
158 KB
50 KB
Script
General
Full URL
https://static.adsafeprotected.com/main.19.8.22.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10079&campId=1x1&pubId=107891423&chanId=33750743&placementId=221175503&pubCreative=103020847223&pubOrder=473210903&cb=1519130979&custom=middle&adsafe_par&impId=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
5df41461e8c29072a827d5fd000d2506238b77e767a34642d6613b79ce49134c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Oct 2019 16:27:21 GMT
X-Server-Name
app35ami.ami.303net.pvt
ETag
"5d9e0a69-c7d3"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
51155
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&t=1&tl=12&ai=5d7f8882d177f300011a03e9&fb=true&bs=M3L5UcC0FUE&bqi=1003&r=4&ec=201&a=lose&ca=prebid-error&lt=694&co=adsmanager&p=3219269452&rand=8060464628&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
main.19.8.22.js
static.adsafeprotected.com/ Frame 9F94
158 KB
50 KB
Script
General
Full URL
https://static.adsafeprotected.com/main.19.8.22.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10079&campId=8x8&pubId=96678263&chanId=33739823&placementId=5114640715&pubCreative=138275390696&pubOrder=2569795437&cb=828926111&custom=&adsafe_par&impId=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
5df41461e8c29072a827d5fd000d2506238b77e767a34642d6613b79ce49134c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Oct 2019 16:27:21 GMT
X-Server-Name
app35ami.ami.303net.pvt
ETag
"5d9e0a69-c7d3"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
51155
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&t=1&tl=12&ai=5d8b578fd177f300017c3d82&fb=true&bs=MnLxV8GwH0k&bqi=1003&r=3&ec=201&a=lose&ca=prebid-error&lt=781&co=adsmanager&p=3018434509&rand=5427967362&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
serve
srv.imonomy.com/internal/ Frame 9DE9
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=9346&ttkan_x=3191&sum_ttkan_x=7064&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=818&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673376&tr=5&trs=4&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=4047&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
e3b5202cd40276b18faadcc849c66a031af88bf5c249e08476b637e81486c68d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Server
nginx
Etag
"2d6bcc28d8b154868eca7e6b15a9a8a6ce8356a0"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2256
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 317C
6 KB
3 KB
XHR
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-224-199-29.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 18:04:11 GMT
content-encoding
gzip
vary
Origin
age
52242
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Sat, 19 Oct 2019 18:03:24 GMT
server
AmazonS3
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
XiSZpiyGPDdRtQAR4uO7U53SzJppWBs9PdTPSSw_uR3_vQqf1ILRCw==
express_html_inpage_rendering_lib_200_258.js
s0.2mdn.net/879366/ Frame 0FC8
120 KB
41 KB
Script
General
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_258.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f98fe2d1b58cfc0f428e3f48c20ad2028fac3dcf14e98484634a578e12666077
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 02:17:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
22613
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42032
x-xss-protection
0
last-modified
Thu, 18 Jul 2019 21:33:45 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 02:17:59 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 0FC8
41 KB
15 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 07:22:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 May 2018 20:45:00 GMT
server
sffe
age
4369
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15207
x-xss-protection
0
expires
Wed, 21 Oct 2020 07:22:03 GMT
config.json
player.adtelligent.com/exchange_rates/279896/ Frame F118
2 KB
1 KB
XHR
General
Full URL
https://player.adtelligent.com/exchange_rates/279896/config.json?cb=https%3A%2F%2Fwww.express.co.uk
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebid/hb_270443_3428.js?cb=18191
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
213.174.135.2 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
abc62642cae0286d2c99498596a49ae314284236dfa4adfbe637309ba4e69568

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 22 Oct 2019 08:34:52 GMT
content-encoding
gzip
last-modified
Tue, 22 Oct 2019 00:01:27 GMT
server
nginx
etag
W/"5dae46d7-832"
status
200
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
expires
Tue, 22 Oct 2019 08:39:52 GMT
cache-control
max-age=300
x-proxy-cache
HIT
ads
securepubads.g.doubleclick.net/gampad/ Frame F118
4 KB
2 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4342883606741426&correlator=3399333057823428&output=ldjh&impl=fifs&eid=21063635&vrg=2019101401&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A536903688%2C2%3A553680904%2C8%3A32776&sc=1&sfv=1-0-35&ecs=20191022&iu_parts=39694909%2CDBV%2CDBV-ExpressFP&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&prev_scp=recirculationSpotId%3Dsp_9LMINbK9&eri=4&cookie_enabled=1&cdm=www.express.co.uk&bc=31&abxe=1&lmt=1571733292&dt=1571733292330&dlt=1571733290391&idt=1924&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=251&oid=3&adxs=330&adys=7569&adks=1353685825&ucis=v4bnulv05nw1&sps=url,,www.express.co.uk&ifi=1&ifk=354444864&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&top=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dssz=13&icsg=2720&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x251&msz=300x-1&ga_vid=555413072.1571733292&ga_sid=1571733292&ga_hid=152890771&fws=260&ohw=300
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
b9f426c6aeda05ebf83ed83a460b850ed0b06a49c1f5cacacc40f3ca5b8660bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:52 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2043
x-xss-protection
0
google-lineitem-id
5158766074
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138285648594
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019101401.js
securepubads.g.doubleclick.net/gpt/ Frame F118
64 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101401.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
f123fae1ceff20dea7ee2ff8895276a22cddecc8e0ef503b5e95419e76909a54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 14 Oct 2019 13:08:16 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24836
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:52 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame F118
0
0

51bb6f47-986a-4028-a272-6611b0837f1f.js
d3lcz8vpax4lo2.cloudfront.net/embed-code/ Frame E0DC
479 KB
103 KB
Script
General
Full URL
https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:6400:1c:386f:ec80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
86f505494adcc0e85d59f35383a6bb5107163838124974f7ce797f338cc334a7

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 12:55:24 GMT
content-encoding
gzip
last-modified
Fri, 11 Oct 2019 12:54:12 GMT
server
AmazonS3
age
934769
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
.3Hg2Xp6xIHiBgjESNikSjvCTHqcOY8O
status
200
cache-control
max-age=31536000,public
x-amz-cf-pop
FRA50-C1
content-type
application/javascript
x-amz-cf-id
Y5qznM7dX-WPCxCGgaH3Qo_CyhdL654MZzslDO7sVZ0CRYkyhYvABw==
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
main.19.8.22.js
static.adsafeprotected.com/ Frame 333E
158 KB
50 KB
Script
General
Full URL
https://static.adsafeprotected.com/main.19.8.22.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x250&pubId=36174863&chanId=33750743&placementId=193785863&pubCreative=138238693789&pubOrder=468246743&cb=601301676&custom=right1&adsafe_par&impId=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
5df41461e8c29072a827d5fd000d2506238b77e767a34642d6613b79ce49134c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Oct 2019 16:27:21 GMT
X-Server-Name
app45ami.ami.303net.pvt
ETag
"5d9e0a69-c7d3"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
51155
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
sca.17.4.95.js
static.adsafeprotected.com/ Frame 2121
81 KB
20 KB
Script
General
Full URL
https://static.adsafeprotected.com/sca.17.4.95.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
149c8d10677f2f6979fa28c078cf832f575ee53c397d791b739e7c4c687fe7bc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Jun 2018 17:20:43 GMT
X-Server-Name
app45ami.ami.303net.pvt
ETag
"5b293b6b-4fda"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
20442
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
mon
pixel.adsafeprotected.com/
43 B
309 B
Image
General
Full URL
https://pixel.adsafeprotected.com/mon?anId=10079&campId=300x600&pubId=127600103&chanId=33750743&placementId=4824781385&pubCreative=138290509209&pubOrder=2406490302&cb=799544936&custom=right&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&adsafe_type=abdfq&adsafe_jsinfo=,id:9fe44dc9-10c4-9fe3-1c98-a636a43bbfd2,c:rLpfC3,sl:partialViewPlus,em:true,fr:true,mn:app51ami,pt:1-5-15,wc:0.0.1600.1200,ac:948.788.300.600,am:i,cc:948.788.300.600,piv:69,obst:0,th:0,reas:,br:u,abv:na,an:n,scm:publ1.grpm1,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a|11b*.10079|11b1|11b2|11c|11d|11e1|11f1|11g1|11h|11i,idMap:11b*,pl:,rend:1,renddet:DIV.qs.sn,rmeas:1,es:0,sc:1,ha:1,gm:1,tt:jload,thd:1,et:487,oid:d085d173-f4a6-11e9-b7de-f0795938d977,v:19.8.22,sp:1,wr:1600.1200,sr:1600.1200,ov:0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:52 GMT
X-Server-Name
app33ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&t=1&tl=12&ai=5d7f864fd177f3000119fc00&fb=true&bs=M3L2UMO3E08&bqi=1003&r=5&ec=201&a=lose&ca=prebid-error&lt=1044&co=adsmanager&p=1374903064&rand=4441095838&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
truncated
/ Frame 0FC8
208 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5388f8b6fc95b7858dc2906e0d479a47e1f20b670d3161c287f2a303b2251c70

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
jload
pixel.adsafeprotected.com/ Frame 6DF7
45 KB
13 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/jload?anId=10079&campId=970x250&pubId=4742659370&chanId=33750743&placementId=5187559359&pubCreative=138289531442&pubOrder=2607736224&cb=693241170&custom=top&adsafe_par&impId=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
843c7cd8bdeb2ea501f0df2b25abda0c1c20f86255d11c779838ede20a3dc804

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
X-Server-Name
app33ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
serve
srv.imonomy.com/internal/ Frame DD1E
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=9624&ttkan_x=3073&sum_ttkan_x=7183&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=202&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673376&tr=5&trs=4&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=3940&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
e9dd5429c2cbf9c59c11784b04a58ffb8ef2dddefaa23743af3df52272f8642c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Server
nginx
Etag
"d0de16f42e5f69edc27c320558555f500063191c"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2255
index.html
cmp.teads.mgr.consensu.org/ Frame C8BC
0
0
Document
General
Full URL
https://cmp.teads.mgr.consensu.org/index.html
Requested by
Host: a.teads.tv
URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:292::2c92 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Host
cmp.teads.mgr.consensu.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

x-amz-id-2
eP74N5mDf2mwuUwz6E0m831egGDvXvr6HEIydDhB20yVDuv4ZE6ina8YQaGiXGlfbz2w11Bw+zo=
x-amz-request-id
93A9209AF986CF84
Last-Modified
Fri, 14 Sep 2018 07:42:32 GMT
ETag
"e7d6c2974a38b7ff77a560e83789f66a"
Accept-Ranges
bytes
Content-Type
text/html
Content-Length
583
Server
AmazonS3
Cache-Control
max-age=300
Expires
Tue, 22 Oct 2019 08:39:52 GMT
Date
Tue, 22 Oct 2019 08:34:52 GMT
Connection
keep-alive
p2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733292636&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_s...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733292636&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_...
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733292636&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=*null&c4=*null&c6=*null&ns_ts=38794257&cs_ucfr=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:52 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1571733292636&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=*null&c4=*null&c6=*null&ns_ts=38794257&cs_ucfr=1
Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:52 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
track
t.teads.tv/
23 B
157 B
Image
General
Full URL
https://t.teads.tv/track?action=placementCall&ts=1571733292632&pageId=105267&pid=113944&env=js-web&pfid=[pfid]&f=1&fv=141
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-7.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Tue, 22 Oct 2019 08:34:52 GMT
cache-control
max-age=0, no-cache, no-store
expires
Tue, 22 Oct 2019 08:34:52 GMT
content-length
23
content-type
image/gif
track
t.teads.tv/
23 B
157 B
Image
General
Full URL
https://t.teads.tv/track?action=slotAvailable&ts=1571733292633&pageId=105267&pid=113944&env=js-web&pfid=[pfid]&f=1&slot=native&fv=141
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-7.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Tue, 22 Oct 2019 08:34:52 GMT
cache-control
max-age=0, no-cache, no-store
expires
Tue, 22 Oct 2019 08:34:52 GMT
content-length
23
content-type
image/gif
truncated
/ Frame FC7B
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bced8533a3ecb808d3f165e99262c0bedb81531a301f4b20568439fa0bd7f9e6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
jload
pixel.adsafeprotected.com/ Frame B785
45 KB
13 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x250&pubId=4635466512&chanId=33750743&placementId=4870730049&pubCreative=138251763494&pubOrder=2435030858&cb=584924900&custom=right2&adsafe_par&impId=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
626ba97ec31dcb7a6661152bf5445c3e9365ed7e90c2ee24ed740d64a3c6498a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
X-Server-Name
app55ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
truncated
/ Frame 0C55
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ec9fd827749f1a790a6ff94fbf964c0ccdc3ba9fb9c69c82ac7b746a27fd83ff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
jload
pixel.adsafeprotected.com/ Frame 2E7C
45 KB
13 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x250&pubId=4635466512&chanId=33750743&placementId=4871301086&pubCreative=138251964595&pubOrder=2435030858&cb=1800158787&custom=right3&adsafe_par&impId=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
f0b498080cf7e6717b596b9b7590f3f0a94f1ee14ee981dce61e40866a7f9de3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
X-Server-Name
app25ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
/
onetag-geo.s-onetag.com/
23 B
435 B
XHR
General
Full URL
https://onetag-geo.s-onetag.com/
Requested by
Host: beacon.s-onetag.com
URL: https://beacon.s-onetag.com/beacon.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:d000:5:ae3a:ba00:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
ad16e1b37490fca28df99d039d6373d2fee4d894fcd279d95b90ae872f4d860f

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:08:43 GMT
via
1.1 1bf129b8787cf2e96d3bce725554e4d5.cloudfront.net (CloudFront), 1.1 cc0ab20766d57035422a2c4c69fe0620.cloudfront.net (CloudFront)
age
1542
x-amzn-requestid
c4d801e3-8b40-4e14-92a2-8da33cd6bb8a
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=3600
x-amz-cf-pop
FRA2-C2, FRA2-C2
x-amz-apigw-id
B9HZ1G-PyK4FSDQ=
content-length
23
x-amz-cf-id
GDKku7obpLnPLUQ_ikG4y9UHNtw5HOYRvy8lvd9ESPDTkPg_GXXjaw==
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/
103 KB
36 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
304ae66279a84ab5174685bd0d52365d0daf5077d4f4d6a3de7d2d3602903252
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
36818
x-xss-protection
0
server
cafe
etag
6601406587884151186
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:52 GMT
sca.17.4.95.js
static.adsafeprotected.com/ Frame 773E
81 KB
20 KB
Script
General
Full URL
https://static.adsafeprotected.com/sca.17.4.95.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
149c8d10677f2f6979fa28c078cf832f575ee53c397d791b739e7c4c687fe7bc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Jun 2018 17:20:43 GMT
X-Server-Name
app45ami.ami.303net.pvt
ETag
"5b293b6b-4fda"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
20442
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
mon
pixel.adsafeprotected.com/
43 B
309 B
Image
General
Full URL
https://pixel.adsafeprotected.com/mon?anId=10079&campId=8x8&pubId=96678263&chanId=33739823&placementId=5114640715&pubCreative=138275390696&pubOrder=2569795437&cb=828926111&custom=&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&adsafe_type=abdfq&adsafe_jsinfo=,id:6b9fb135-7986-57bd-f683-c2254dd2a46e,c:rLpfGI,sl:inView,em:true,fr:true,mn:app51ami,pt:1-5-15,wc:0.0.1600.1200,ac:0.5.8.8,am:i,cc:0.5.8.8,piv:100,obst:0,th:0,reas:,br:u,abv:na,an:n,scm:publ1.grpm1,fm:rFCgIyN+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a1|11b1|11b2|11b3|11c1|11d1|11e1|11f1|11g*.10079|11g1|11h|11i|11j,idMap:11g*,pl:,rend:0,renddet:DIV.us.sn,rmeas:1,es:0,sc:1,ha:1,gm:1,tt:jload,thd:1,et:576,oid:d0afa0f1-f4a6-11e9-b7de-f0795938d977,v:19.8.22,sp:1,wr:1600.1200,sr:1600.1200,ov:0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:52 GMT
X-Server-Name
app25ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&t=1&tl=12&ai=5d515aad77619d0001195854&fb=true&bs=N3L3U8e1Ek0&bqi=1003&r=9&ec=201&a=lose&ca=prebid-error&lt=1355&co=adsmanager&p=1104832706&rand=5296438322&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
alt-svc
clear
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 143E
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/Enqz_20U.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
8395
date
Tue, 22 Oct 2019 07:22:02 GMT
expires
Wed, 21 Oct 2020 07:22:02 GMT
last-modified
Wed, 09 May 2018 20:45:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
4370
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
sca.17.4.95.js
static.adsafeprotected.com/ Frame 2C1C
81 KB
20 KB
Script
General
Full URL
https://static.adsafeprotected.com/sca.17.4.95.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
149c8d10677f2f6979fa28c078cf832f575ee53c397d791b739e7c4c687fe7bc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Jun 2018 17:20:43 GMT
X-Server-Name
app45ami.ami.303net.pvt
ETag
"5b293b6b-4fda"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
20442
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
mon
pixel.adsafeprotected.com/
43 B
309 B
Image
General
Full URL
https://pixel.adsafeprotected.com/mon?anId=10079&campId=1x1&pubId=107891423&chanId=33750743&placementId=221175503&pubCreative=103020847223&pubOrder=473210903&cb=1519130979&custom=middle&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&adsafe_type=abdfq&adsafe_jsinfo=,id:6cae62de-bc69-1915-5977-ddece33e7895,c:rLpfIr,sl:outOfView,em:true,fr:true,mn:app51ami,pt:1-5-15,wc:0.0.1600.1200,ac:323.8321.1.1,am:i,cc:323.8321.1.1,piv:0,obst:0,th:0,reas:l,br:u,abv:na,an:n,scm:publ1.grpm1,fm:rFCgIxA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a1|11a2|11b1|11b2|11b3|11c1|11d1|11e*.10079|11e1|11f1|11g1|11g2|11h|11i|11j,idMap:11e*,pl:,rend:0,renddet:WINDOW,rmeas:0,es:0,sc:1,ha:1,gm:1,tt:jload,thd:1,et:758,oid:d0903218-f4a6-11e9-ac4b-f0795938d977,v:19.8.22,sp:1,wr:1600.1200,sr:1600.1200,ov:0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:52 GMT
X-Server-Name
app25ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
PL_CE_NRC-No-Deposit-Free-Spins-Campaign_Reach-Media-970x250-German-animated-637013692065385540-5d53ca70baeb50425c3e0bfd.gif
s0.2mdn.net/5474477/ Frame 0FC8
124 KB
124 KB
Image
General
Full URL
https://s0.2mdn.net/5474477/PL_CE_NRC-No-Deposit-Free-Spins-Campaign_Reach-Media-970x250-German-animated-637013692065385540-5d53ca70baeb50425c3e0bfd.gif
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
78e590d339d146235531f9f600281f37d38dfefee3a19c99129e992723d8512a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 02:25:16 GMT
x-content-type-options
nosniff
last-modified
Wed, 14 Aug 2019 08:46:52 GMT
server
sffe
age
22176
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
127255
x-xss-protection
0
expires
Wed, 23 Oct 2019 02:25:16 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 0FC8
0
57 B
Image
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss_c0H4ZY9aeMM0-_vlxLw-aFIvVZhDrNsV4HgWtw8w-b1pc3ZJ3Jwi0Y7DNX89XJ5--izgUfJPpOiXEEc9DjngwkEGJkwlnZxBIgk0s3si69gczqhYhuItduqsG9hB&sig=Cg0ArKJSzN5dNrR_3hwrEAE&urlfix=1&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:52 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
sync
t.myvisualiq.net/ Frame 0FC8
Redirect Chain
  • https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https://t.myvisualiq.net/sync?prid=1001%26ao=0%26pruuid=TAPAD_${IDS:key}
  • https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_d190b163-f4a6-11e9-bdea-3e74db81f9bb
43 B
300 B
Image
General
Full URL
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_d190b163-f4a6-11e9-bdea-3e74db81f9bb
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.89.106 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-184-89-106.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:53 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length
43
Content-Type
image/gif

Redirect headers

date
Tue, 22 Oct 2019 08:34:52 GMT
via
1.1 google
server
Jetty(8.1.13.v20130916)
status
302
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_d190b163-f4a6-11e9-bdea-3e74db81f9bb
alt-svc
clear
content-length
0
impression_pixel
t.myvisualiq.net/ul_cb/ Frame 0FC8
Redirect Chain
  • https://t.myvisualiq.net/impression_pixel?pt=i&r=[CACHEBUSTER]&et=i&ago=212&ao=788&advt=5474477&pi=253457958&ad=449373252&si=5378468&aca=23047164&ci=120131290&chnl=-7&sz=1833&vndr=115
  • https://t.myvisualiq.net/ul_cb/impression_pixel?pt=i&r=[CACHEBUSTER]&et=i&ago=212&ao=788&advt=5474477&pi=253457958&ad=449373252&si=5378468&aca=23047164&ci=120131290&chnl=-7&sz=1833&vndr=115
43 B
300 B
Image
General
Full URL
https://t.myvisualiq.net/ul_cb/impression_pixel?pt=i&r=[CACHEBUSTER]&et=i&ago=212&ao=788&advt=5474477&pi=253457958&ad=449373252&si=5378468&aca=23047164&ci=120131290&chnl=-7&sz=1833&vndr=115
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.89.106 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-184-89-106.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:53 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://t.myvisualiq.net/ul_cb/impression_pixel?pt=i&r=[CACHEBUSTER]&et=i&ago=212&ao=788&advt=5474477&pi=253457958&ad=449373252&si=5378468&aca=23047164&ci=120131290&chnl=-7&sz=1833&vndr=115
Date
Tue, 22 Oct 2019 08:34:52 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 105D
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/201910171256/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-35/html/container.html?n=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
3491
date
Mon, 21 Oct 2019 21:46:49 GMT
expires
Tue, 20 Oct 2020 21:46:49 GMT
last-modified
Fri, 21 Jun 2019 14:35:26 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
38883
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame F118
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:52 GMT
event
event.insticator.com/v1/ Frame 317C
0
136 B
XHR
General
Full URL
https://event.insticator.com/v1/event?event_name=event_pageview
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Allow-Origin
*
Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/json

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
cf-cache-status
DYNAMIC
server
cloudflare
status
201
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
cf-ray
529a2279c843cbc4-VIE
content-length
0
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&kq=1&lo=0&qs=1&ak=-&i=NANDSCONTENT1&ud=false&qm=-120&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%5B)1xfq_GUKB%7BJ9AKqD(ao%5DDXx2Tlw4%26ExM_1g%2Bk6%40QV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y5iC%3Dn%3CG.xpG%24czixape4tE0b15%7CQjw%60.%7BiO%23Ly*rdB%3Evq%2F9N%7CQEXp%2B3W%60R%23ItxO%2B%7BQZt%7Bx1b~tW%24n%7BF%5BZR64oD3PP%23wJD3%25B%3AUgiOJ%5D*P1R27%2Bmu7RDX%2B%2Cy_*hUUp%2FVNkUW!%40b%2FoT%23%3CFr4TmyU~%2B..%5Eh%5EH%40G%23(d9IUjDux1bWuqEd%5E95SpGl)17*BT2z.%5BOCDT%3FW4BKm55Y%25F3%2FNdLlDxAjT%3CUmfB.%26Y%3BRZ.%60)_Q%234kE5p(taEn%26%5BNLU%25%2F%22%3Bh%2C%25%3BbEW%3Ckk!LvRjy1%5Du!%3CFo%40NFdS97evb%5Dmc9!4O7P7D%3B%3FdKHapzrIw(%60*MVu%2Fs1S*qks!o%7B25jAbj19SUF%60(a~M%3Ai%60K%25_9.rV0%2F%60E%60%60%2CH%24%26x%5EAbgkN%3Df%3CU%3CekO2m%2F%26u~q%60RP%3CG.FTVGX%5E8Y.N%2CzKydjXB3UN%5EMk3okt%24b_o4i6yz40b_QnwoD%2CYood%23D3lBG&qp=00000&qq=000000000000&qr=0&gz=0&hh=0&hn=0&qt=0&bq=0&g=2&pl=1&fl=1&sr=0&sb=0&sq=0&sa=0&sn=0&sj=0&sm=0&si=0&md=0&mc=0&lb=10596&la=0&ld=0&lc=0&cw=-1&cx=-1&sh=undefined&xa=0&xb=0&xc=0&h=4&w=4&cm=1&f=0&j=&o=3&t=1571733282459&de=867175706853&cu=1571733282459&m=10476&ar=de60227-clean&cb=0&ll=2&ln=0&gh=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1600&qe=1200&qh=1600&qg=1200&lk=undefined&le=1&gm=1&io=1&ch=0&as=0&ag=0&an=0&gf=0&gg=0&aj=0&pg=0&pf=0&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&cq=0&em=0&en=0&bu=10227&cd=5059&ah=10227&am=5059&re=0&wb=1&cl=0&at=0&d=express.co.uk%3ATax%20refund%20scam%20warning%20-%20HMRC%20reveals%20simple%20way%20to%20spot%20a%20bogus%20text%20message%3A__page__%3A-&gw=nandscontent759292113&ab=1&ac=1&fd=1&kt=strict&it=500&fs=98334&na=853084001&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:52 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:52 GMT
css
fonts.googleapis.com/ Frame E0DC
3 KB
560 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Work+Sans:400,500,600,700&display=swap
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
218cd0b67ca26b5a6d1891256a4402a9c2ec65a68a039d96d36b17e595ff5285
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Tue, 22 Oct 2019 08:34:53 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Tue, 22 Oct 2019 08:34:53 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:53 GMT
all.css
use.fontawesome.com/releases/v5.5.0/css/ Frame E0DC
50 KB
13 KB
Stylesheet
General
Full URL
https://use.fontawesome.com/releases/v5.5.0/css/all.css
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
9e4cac65c7a5ee0bd0743afefcabdd3e73854e1284ac9ac433813d6231f550f2

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
last-modified
Fri, 02 Nov 2018 15:16:46 GMT
server
NetDNA-cache/2.2
status
200
etag
W/"1cc6c92172d124fbd305ba3d8e263333"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
analytics.js
www.google-analytics.com/ Frame E0DC
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
2444
date
Tue, 22 Oct 2019 07:54:09 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Tue, 22 Oct 2019 09:54:09 GMT
/
geoip.insticator.com/json/ Frame E0DC
204 B
341 B
XHR
General
Full URL
https://geoip.insticator.com/json/
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb8cbd2a68b8068930e22baa762a4463ffd66b91ac3905ef9123ea07203bc133

Request headers

Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
via
1.1 vegur
vary
Origin
cf-cache-status
DYNAMIC
status
200
x-database-date
Mon, 21 Oct 2019 23:36:24 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining
9999
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
x-ratelimit-reset
3600
x-ratelimit-limit
10000
cf-ray
529a227a08abcbc4-VIE
event
event.insticator.com/v1/ Frame E0DC
0
37 B
XHR
General
Full URL
https://event.insticator.com/v1/event?event_name=event_embed-loaded
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/json

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
cf-cache-status
DYNAMIC
server
cloudflare
status
201
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
cf-ray
529a227aea67cbc4-VIE
content-length
0
event
event.insticator.com/v1/ Frame E0DC
0
37 B
XHR
General
Full URL
https://event.insticator.com/v1/event?event_name=event_embed-in-view
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/json

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
cf-cache-status
DYNAMIC
server
cloudflare
status
201
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
cf-ray
529a227c2d25cbc4-VIE
content-length
0
logo-insticator-light.png
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
21 KB
21 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/logo-insticator-light.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6413b7dec6a597c00831914e8e4391b59538c6104cea547e13350840cc7c616b

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
CTBFOiOZF9Pc8nkBYDMEiY0Rbq5FsRhl
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Fri, 04 May 2018 18:57:58 GMT
server
AmazonS3
age
67072
etag
"31605596be6a56e2ccc39b5ddc16be95"
x-cache
Hit from cloudfront
content-type
image/png
status
200
date
Mon, 21 Oct 2019 13:57:02 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
21163
x-amz-cf-id
qYTPZZEEHVkjZOnDMfPmhKkvqrDRv8Noko2A68L_DENaeGzYutpDlA==
logo-giphy.gif
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
5 KB
5 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/logo-giphy.gif
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2ad4ec405159beb9e962e752ab2696369ee2436ac7b4e7e34c99f9ba22aa1fe4

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
6s1xHKpyJMfBO7E3xKrrzQcN3hUsgxCx
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Tue, 21 Aug 2018 23:56:52 GMT
server
AmazonS3
age
67088
etag
"9be4d53630dea437d62f2a2441634674"
x-cache
Hit from cloudfront
content-type
image/gif
status
200
date
Mon, 21 Oct 2019 13:56:46 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
4769
x-amz-cf-id
7AWLzJKSzZDwtEBUrUPTE4arnkGKdBURFlj_KTEfAX9dRryoj_qL3Q==
logo-facebook.png
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
20 KB
21 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/logo-facebook.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1defd5791b61d4a0aa9417ca6fcae832f6ce0172e61ce0290ad567e7cd511973

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
ULtGRAG0cozVmrk8QTxkU4CRg4lLUOvG
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Fri, 04 May 2018 18:57:58 GMT
server
AmazonS3
age
67090
etag
"60b5cab66c2ac82262a0da5346037875"
x-cache
Hit from cloudfront
content-type
image/png
status
200
date
Mon, 21 Oct 2019 13:56:44 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
20991
x-amz-cf-id
DXod-iy_LxnhLEfy1uNDXgvJaBhmyIsikZ1bCq_AAN5jhIi4fK6kPw==
logo-facebook-light.png
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
21 KB
21 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/logo-facebook-light.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
41f31dd2e2557de961bcc07f0e0f320a637632c9ae48416c0d9ee25294ed0ffe

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
iVGTFYl9UoOIsb_VjgmcCUFWcozgxrNA
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Fri, 04 May 2018 18:57:58 GMT
server
AmazonS3
age
67072
etag
"1aa9c1ee9848a890aac9ed2e662345b8"
x-cache
Hit from cloudfront
content-type
image/png
status
200
date
Mon, 21 Oct 2019 13:57:02 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
21054
x-amz-cf-id
m6uDZsapGJY4Y7Ja9_Zt_ptlPaoitIRnOB3OKJyTE5OCm25sqP52gA==
logo-twitter.png
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
21 KB
22 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/logo-twitter.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
aeb5540c19002caf52af3502b43ff4d503ec33ace0119153b8ea525cf1e1d580

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
PabYyULYcagrrnl5_VBagXR6.2QcHh82
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Fri, 04 May 2018 18:57:58 GMT
server
AmazonS3
age
67088
etag
"8e6f619e7da6deedeb066c522967841e"
x-cache
Hit from cloudfront
content-type
image/png
status
200
date
Mon, 21 Oct 2019 13:56:46 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
21925
x-amz-cf-id
eE2i3xqmHDT_rUj3411wwEZ3k9ywNqV07uPMJ_dvgpBTGhQQxhTw6w==
logo-twitter-light.png
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
21 KB
22 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/logo-twitter-light.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
74a587c5c9706f95046b2dcf80f6bb90cd488ae4edb45e9bcd4507d3787a88d7

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
qL1Phj4H.8a2GAJwlw0J623oQlDV0Krh
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Fri, 04 May 2018 18:57:58 GMT
server
AmazonS3
age
67072
etag
"27f2f41e838101e82a68c5d8a255f0f8"
x-cache
Hit from cloudfront
content-type
image/png
status
200
date
Mon, 21 Oct 2019 13:57:02 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
21920
x-amz-cf-id
OuNmwliN8vp-EKC8qmJ-TsUe2lYziW86FnS0_dMOuKOw1fer5MXViQ==
icon-check.png
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
649 B
1016 B
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/icon-check.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
151c4c52c25dd28c33321aaaeabe879c4814087d4eaf7545d93f5d81d4d1c4f3

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
hmsI6iaZVJVbWmWfdDEj8IUq8AjvoEjw
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Fri, 04 May 2018 18:57:56 GMT
server
AmazonS3
age
67075
etag
"b673377b664a0b33454c267d911fcfc1"
x-cache
Hit from cloudfront
content-type
image/png
status
200
date
Mon, 21 Oct 2019 13:56:59 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
649
x-amz-cf-id
yBkRu_QopDmfUF5jb6-lnyxuZS3pCytets-kihyEdpVZ8p9PD488pw==
graphic-ooc.png
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
11 KB
12 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/graphic-ooc.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
45df18bdacb438598423616ef9b6f85a5d26e1aab8d426209937423d477d80e6

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
h4Ib2m7Gg.0JamqBIDYCvhEivLLP.vl4
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Tue, 10 Sep 2019 22:29:18 GMT
server
AmazonS3
age
67072
etag
"9e51f7cb70aed79b30392a1909d568ab"
x-cache
Hit from cloudfront
content-type
image/png
status
200
date
Mon, 21 Oct 2019 13:57:02 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
11480
x-amz-cf-id
8iaMYDOLQsiGokby8ID7HoP6FNMu3dobdbXUUxoKVEBdFcBg7klDVQ==
EU
onetag-geo-grouping.s-onetag.com/regionalbloc/
1 KB
1 KB
XHR
General
Full URL
https://onetag-geo-grouping.s-onetag.com/regionalbloc/EU
Requested by
Host: beacon.s-onetag.com
URL: https://beacon.s-onetag.com/beacon.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:2200:7:8699:e840:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
6088012dda2274a27fa40ed153d9e3a6c96a22af1b177f8a2916368eb3e88bb0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 20 Oct 2019 18:09:53 GMT
via
1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront), 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-amzn-remapped-content-length
1128
age
138299
x-amzn-requestid
0e346d3f-e458-49f2-ba74-6b1f479b2f2a
x-cache
Hit from cloudfront
status
200
x-amzn-remapped-content-md5
V3bqcw6aFQKp3T52xvqaow==
request-id
8cf0326c-8752-4344-b31d-8d1519f2cbae
content-encoding
gzip
x-amz-apigw-id
B35ltE9QSK4Fs0Q=
x-amz-cf-id
klaHolCsMDplzRtFgHvlv0JW1wbsmpyNaNrJSA4tKw7IVAuPa-wG-A==
access-control-allow-headers
Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, Api-Version, Response-Time
x-amzn-remapped-server
restify
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-expose-headers
api-version, content-length, content-md5, content-type, date, request-id, response-time
cache-control
max-age=3600
x-amz-cf-pop
FRA50-C1, FRA2-C1
response-time
19
x-amzn-remapped-date
Sun, 20 Oct 2019 18:15:50 GMT
x-amzn-remapped-connection
Keep-Alive
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=6b9fb135-7986-57bd-f683-c2254dd2a46e&tv={c:rLpfMS,pingTime:0,time:957,type:pf,clog:[{piv:100,vs:i,r:,w:8,h:8,t:575}],es:0,sc:1,ha:1,gm:1,slTimes:{i:957,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:575,wc:0.0.1600.1200,ac:0.5.8.8,am:i,cc:0.5.8.8,piv:100,obst:0,th:0,reas:,bkn:{piv:[423~100],as:[423~8.8]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a1|11b.10079|11b1|11b2|11b3|11c1|11d1|11e1|11f1|11g*.10079|11g1|11h|11i|11j,idMap:11g*,rend:0,renddet:DIV.us.sn,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:53 GMT
X-Server-Name
dt42dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
prebid
ib.adnxs.com/ut/v3/ Frame 317C
259 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_1_34_release_20190807.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
84e26c55c92f92e4fb8b04ce59c3a2e0e409947c2751bc98a1f970d8a775b1c0
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:55 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.240:80
AN-X-Request-Uuid
739113f0-f56c-4e4c-a1a1-585fbf68090c
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
259
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
hb.emxdgt.com/ Frame 317C
0
309 B
XHR
General
Full URL
https://hb.emxdgt.com/?t=3000&ts=1571733293189
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_1_34_release_20190807.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.104.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-196-104-43.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 22 Oct 2019 08:34:52 GMT
Content-Type
text/html
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Access-Control-Allow-Headers
security, Content-Type
Content-Length
0
v1
dmx.districtm.io/b/ Frame 317C
0
420 B
XHR
General
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_1_34_release_20190807.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
cf-cache-status
DYNAMIC
server
cloudflare
status
204
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
origin
access-control-allow-methods
OPTIONS, POST
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
529a227b7c3dc290-FRA
access-control-allow-headers
origin, content-type
bid
ap.lijit.com/rtb/ Frame 317C
24 B
478 B
XHR
General
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_1.34.0
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_1_34_release_20190807.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
e4bc3946ec97b93a1b6afba423aeaef7ba8ea7836045d9095333372950bc3ce3

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 22 Oct 2019 08:34:53 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://www.express.co.uk
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ap3ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=9fe44dc9-10c4-9fe3-1c98-a636a43bbfd2&tv={c:rLpfNG,pingTime:-2,time:1206,type:a,im:{sf:0,pom:1,prf:{beA:852,beZ:854,mfA:1283,cmA:1284,inA:1284,inZ:1290,prA:1290,prZ:1326,si:1339,poA:1340,poZ:1350,cmZ:1350,mfZ:1350,loA:1658,loZ:1660,ltA:2058,ltZ:2058,mdA:854,mdZ:928}},sca:{dfp:{df:4,sz:300.600,dom:body}},env:{gca:1},clog:[{piv:69,vs:pp,r:,w:300,h:600,t:485}],es:0,sc:1,ha:1,gm:1,slTimes:{i:0,o:0,n:0,pp:1206,pm:0},slEvents:[{sl:pp,t:485,wc:0.0.1600.1200,ac:948.788.300.600,am:i,cc:948.788.300.600,piv:69,obst:0,th:0,reas:,bkn:{piv:[771~50],as:[771~300.600]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a|11b*.10079|11b1|11b2|11c|11d|11e1|11f1|11g.10079|11g1|11h|11i,idMap:11b*,rend:1,renddet:DIV.qs.sn,rmeas:1,slid:[google_ads_iframe_/34722903/Express/Finance/PersonalFinance_1,google_ads_iframe_/34722903/Express/Finance/PersonalFinance_1__container__,div-gpt-ad-681040515914899306-2,maincontainer],sinceFw:718,readyFired:true}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:53 GMT
X-Server-Name
dt70dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
activeview
pagead2.googlesyndication.com/pcs/ Frame 317C
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstzILqNb_Lh7I0RXV6WM994hSUlDywMC5Pri3kH_wIdiRQhl53Vv0FLfVWWEWk4XnFpZndT9Rb1KAb9uVIMxkXfLPnmPo1WOiIn6BGXLbY&sig=Cg0ArKJSzPAFpOEjisRCEAE&adk=2427907695&tt=1701&bs=1585%2C1200&mtos=0,0,1251,1251,1251&tos=0,0,1251,0,0&p=788,948,1388,1248&mcvt=1251&rs=3&ht=0&tfs=465&tls=1716&mc=0.68&lte=0.68&bas=0&bac=0&met=no&avms=nio&niot_obs=12&niot_cbk=267&md=2&lm=2&rst=1571733290562&rpt=819&isd=0&msd=0&ext=mvo%3D-1%26brt%3D9513&oseid=3&xdi=0&ps=1585%2C10596&ss=1600%2C1200&pt=16&bin=1&deb=1-7-7-8-5-17-67-4-0-0-0&tvt=1709&r=v&id=osdim&vs=4&uc=6&upc=0&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20191021
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:53 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&a=win&t=1&tl=12&ai=5d7f474bd177f3000108ea7a&fb=true&bs=NXLxUsK4FUg&bqi=1017&r=10&as=vpaid%20js&ca=adserver&lt=1746&co=adsmanager&p=758591783&rand=5603408187&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:53 GMT
via
1.1 google
alt-svc
clear
main.19.8.22.js
static.adsafeprotected.com/ Frame 6DF7
158 KB
50 KB
Script
General
Full URL
https://static.adsafeprotected.com/main.19.8.22.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10079&campId=970x250&pubId=4742659370&chanId=33750743&placementId=5187559359&pubCreative=138289531442&pubOrder=2607736224&cb=693241170&custom=top&adsafe_par&impId=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
5df41461e8c29072a827d5fd000d2506238b77e767a34642d6613b79ce49134c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:53 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Oct 2019 16:27:21 GMT
X-Server-Name
app50ami.ami.303net.pvt
ETag
"5d9e0a69-c7d3"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
51155
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
ad
a.teads.tv/page/105267/
118 B
337 B
XHR
General
Full URL
https://a.teads.tv/page/105267/ad?windowWidth=1600&windowHeight=1200&windowDepth=1&windowReferrerUrl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&page=%7B%22id%22%3A105267%2C%22placements%22%3A%5B%7B%22id%22%3A113944%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A590%2C%22height%22%3A332%7D%2C%22slotType%22%3A%22native%22%7D%5D%2C%22gdpr_iab%22%3A%7B%22status%22%3A23%2C%22consent%22%3A%22%22%2C%22reason%22%3A230%7D%7D&userId=7de66d8d-4ed2-4305-b58d-9e52b565508d&formatVersion=2.22.61&env=js-web&netBw=10&ttfb=113
Requested by
Host: a.teads.tv
URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-7.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f50167bee40cd7fdd6c623efb794e0edddec7de87ef71f48c8b1b1413e1dfc4a

Request headers

Accept
application/json; charset=UTF-8
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
status
200
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
129
expires
Tue, 22 Oct 2019 08:34:53 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 31E9
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:53 GMT
main.19.8.22.js
static.adsafeprotected.com/ Frame B785
158 KB
50 KB
Script
General
Full URL
https://static.adsafeprotected.com/main.19.8.22.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x250&pubId=4635466512&chanId=33750743&placementId=4870730049&pubCreative=138251763494&pubOrder=2435030858&cb=584924900&custom=right2&adsafe_par&impId=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
5df41461e8c29072a827d5fd000d2506238b77e767a34642d6613b79ce49134c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:53 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Oct 2019 16:27:21 GMT
X-Server-Name
app53ami.ami.303net.pvt
ETag
"5d9e0a69-c7d3"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
51155
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:53 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame D42A
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:53 GMT
main.19.8.22.js
static.adsafeprotected.com/ Frame 2E7C
158 KB
50 KB
Script
General
Full URL
https://static.adsafeprotected.com/main.19.8.22.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10079&campId=300x250&pubId=4635466512&chanId=33750743&placementId=4871301086&pubCreative=138251964595&pubOrder=2435030858&cb=1800158787&custom=right3&adsafe_par&impId=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
5df41461e8c29072a827d5fd000d2506238b77e767a34642d6613b79ce49134c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:53 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Oct 2019 16:27:21 GMT
X-Server-Name
app53ami.ami.303net.pvt
ETag
"5d9e0a69-c7d3"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
51155
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=6b9fb135-7986-57bd-f683-c2254dd2a46e&tv={c:rLpfRu,pingTime:-2,time:1243,type:a,im:{sf:0,pom:1,prf:{beA:759,beZ:761,mfA:1294,cmA:1294,inA:1294,inZ:1295,prA:1295,prZ:1331,si:1335,poA:1336,poZ:1344,cmZ:1344,mfZ:1344,loA:1719,loZ:1722,ltA:2002,ltZ:2002,mdA:761,mdZ:789}},sca:{dfp:{df:0}},env:{gca:1},clog:[{piv:100,vs:i,r:,w:8,h:8,t:575}],es:0,sc:1,ha:1,gm:1,slTimes:{i:1243,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:575,wc:0.0.1600.1200,ac:0.5.8.8,am:i,cc:0.5.8.8,piv:100,obst:0,th:0,reas:,bkn:{piv:[708~100],as:[708~8.8]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a1|11b.10079|11b1|11b2|11b3|11c1|11d1|11e.10079|11e1|11f1|11g*.10079|11g1|11h|11i|11j,idMap:11g*,rend:0,renddet:DIV.us.sn,rmeas:1,slid:[google_ads_iframe_/34722903/express_0,google_ads_iframe_/34722903/express_0__container__,div-gpt-ad-vip],sinceFw:666,readyFired:true}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:53 GMT
X-Server-Name
dt42dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 956A
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:53 GMT
sca.17.4.95.js
static.adsafeprotected.com/ Frame 61C9
81 KB
20 KB
Script
General
Full URL
https://static.adsafeprotected.com/sca.17.4.95.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
149c8d10677f2f6979fa28c078cf832f575ee53c397d791b739e7c4c687fe7bc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:53 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Jun 2018 17:20:43 GMT
X-Server-Name
app53ami.ami.303net.pvt
ETag
"5b293b6b-4fda"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
20442
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
mon
pixel.adsafeprotected.com/
43 B
309 B
Image
General
Full URL
https://pixel.adsafeprotected.com/mon?anId=10079&campId=300x250&pubId=36174863&chanId=33750743&placementId=193785863&pubCreative=138238693789&pubOrder=468246743&cb=601301676&custom=right1&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&adsafe_type=abdfq&adsafe_jsinfo=,id:ae0fc106-1d88-1dfb-c943-301fc7b77ae2,c:rLpfSN,sl:outOfView,em:true,fr:true,mn:app11ami,pt:1-5-15,wc:0.0.1600.1200,ac:948.2886.300.250,am:i,cc:948.2886.300.250,piv:0,obst:0,th:0,reas:l,br:u,abv:na,an:n,scm:publ1.grpm1,fm:rFCgIBH+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|1191|11a1|11a2|11b1|11b2|11b3|11c1|11d1|11e1|11e2|11f*.10079|11f1|11g1|11g2|11h|11i|11j|11k|11l|11m|11n|11o,idMap:11f*,pl:,rend:1,renddet:IMG.qs,rmeas:1,es:0,sc:1,ha:1,gm:1,tt:jload,thd:1,et:1145,oid:d0fde82e-f4a6-11e9-a52b-002590882940,v:19.8.22,sp:1,wr:1600.1200,sr:1600.1200,ov:0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:53 GMT
X-Server-Name
app55ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=6cae62de-bc69-1915-5977-ddece33e7895&tv={c:rLpfTN,pingTime:-2,time:1461,type:a,im:{sf:0,pom:1,prf:{beA:889,beZ:891,mfA:1615,cmA:1615,inA:1615,inZ:1617,prA:1617,prZ:1643,si:1646,poA:1646,poZ:1652,cmZ:1652,mfZ:1652,loA:2012,loZ:2013,ltA:2348,ltZ:2348,mdA:892,mdZ:944}},sca:{dfp:{df:0}},env:{gca:1},clog:[{piv:0,vs:o,r:l,w:1,h:1,t:757}],es:0,sc:1,ha:1,gm:1,slTimes:{i:0,o:1461,n:0,pp:0,pm:0},slEvents:[{sl:o,t:757,wc:0.0.1600.1200,ac:323.8321.1.1,am:i,cc:323.8321.1.1,piv:0,obst:0,th:0,reas:l,bkn:{piv:[733~0],as:[733~1.1]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIxA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a1|11a2|11b1|11b2|11b3|11c1|11d1|11e*.10079|11e1|11f1|11g.10079|11g1|11g2|11h|11i|11j,idMap:11e*,rend:0,renddet:WINDOW,rmeas:0,slid:[google_ads_iframe_/34722903/Express/Finance/PersonalFinance_4,google_ads_iframe_/34722903/Express/Finance/PersonalFinance_4__container__,div-gpt-ad-681040515914899306-6,singleArticle,maincontainer],sinceFw:702,readyFired:true}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:53 GMT
X-Server-Name
dt70dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
usertracking
b2c.insticator.com/v3/pages/ Frame 2730
0
0
Document
General
Full URL
https://b2c.insticator.com/v3/pages/usertracking
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:190b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
b2c.insticator.com
:scheme
https
:path
/v3/pages/usertracking
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:53 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=dcc757ae8b49eddb3a87e83c98e347a451571733293; expires=Wed, 21-Oct-20 08:34:53 GMT; path=/; domain=.insticator.com; HttpOnly
vary
Accept-Encoding,Origin
pragma
max-age=3600
cache-control
max-age=3600
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a227cfddccba4-VIE
content-encoding
gzip
activeview
pagead2.googlesyndication.com/pcs/ Frame DA91
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu8pX9hLJnYSTDsqrYHH8hzNb6w82m_KYZuKxdG5zW1Wk4gWksW4xYr6lsRDLZy9zECIFqqdcLcDYmIzT87h6kapj4cRmTyOx97ZT5wMlI&sig=Cg0ArKJSzIidYFXwTIOdEAE&adk=2965745391&tt=2144&bs=1585%2C1200&mtos=1179,1179,1179,1179,1179&tos=1179,0,0,0,0&p=5,0,13,8&mcvt=1179&rs=3&ht=0&tfs=981&tls=2160&mc=1&lte=1&bas=0&bac=0&met=no&avms=nio&niot_obs=12&niot_cbk=267&md=2&lm=2&rst=1571733290816&rpt=1111&isd=0&msd=0&ext=mvo%3D-1%26brt%3D0&oseid=3&xdi=0&ps=1585%2C10596&ss=1600%2C1200&pt=16&bin=1&deb=1-7-7-11-6-17-99-5-0-0-0&tvt=2152&r=v&id=osdim&vs=4&uc=5&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20191021
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:53 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 8E66
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:53 GMT
redirect
sync.teads.tv/iframe/ Frame BBD2
Redirect Chain
  • https://sync.teads.tv/iframe?pid=113944&userId=7de66d8d-4ed2-4305-b58d-9e52b565508d&gdprIab={%22status%22:23,%22consent%22:%22%22,%22reason%22:230}&env=js-web&1571733293648
  • https://sync.teads.tv/iframe/redirect?pid=113944&userId=7de66d8d-4ed2-4305-b58d-9e52b565508d&gdprIab=%7B%22status%22:23,%22consent%22:%22%22,%22reason%22:230%7D&env=js-web&1571733293648
0
0
Document
General
Full URL
https://sync.teads.tv/iframe/redirect?pid=113944&userId=7de66d8d-4ed2-4305-b58d-9e52b565508d&gdprIab=%7B%22status%22:23,%22consent%22:%22%22,%22reason%22:230%7D&env=js-web&1571733293648
Requested by
Host: a.teads.tv
URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-7.deploy.static.akamaitechnologies.com
Software
akka-http/10.1.5 /
Resource Hash

Request headers

:method
GET
:authority
sync.teads.tv
:scheme
https
:path
/iframe/redirect?pid=113944&userId=7de66d8d-4ed2-4305-b58d-9e52b565508d&gdprIab=%7B%22status%22:23,%22consent%22:%22%22,%22reason%22:230%7D&env=js-web&1571733293648
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
tt_viewer=ec780baa-3f92-4cc1-8f75-cfd6ff5e799b
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
content-type
text/html; charset=UTF-8
server
akka-http/10.1.5
content-length
1844
expires
Tue, 22 Oct 2019 08:34:53 GMT
cache-control
max-age=0, no-cache, no-store
pragma
no-cache
date
Tue, 22 Oct 2019 08:34:53 GMT
set-cookie
tt_exelate=; Expires=Wed, 23 Oct 2019 08:34:53 GMT; Domain=.teads.tv; SameSite=None tt_bluekai=; Expires=Wed, 23 Oct 2019 08:34:53 GMT; Domain=.teads.tv; SameSite=None tt_emetriq=; Expires=Wed, 23 Oct 2019 08:34:53 GMT; Domain=.teads.tv; SameSite=None tt_liveramp=; Expires=Wed, 23 Oct 2019 08:34:53 GMT; Domain=.teads.tv; SameSite=None tt_neustar=; Expires=Wed, 23 Oct 2019 08:34:53 GMT; Domain=.teads.tv; SameSite=None tt_salesforce=; Expires=Wed, 23 Oct 2019 08:34:53 GMT; Domain=.teads.tv; SameSite=None tt_dar=; Expires=Wed, 23 Oct 2019 08:34:53 GMT; Domain=.teads.tv; SameSite=None tt_skp=; Expires=Wed, 23 Oct 2019 08:34:53 GMT; Domain=.teads.tv; SameSite=None

Redirect headers

status
302
content-type
text/html; charset=UTF-8
location
/iframe/redirect?pid=113944&userId=7de66d8d-4ed2-4305-b58d-9e52b565508d&gdprIab=%7B%22status%22:23,%22consent%22:%22%22,%22reason%22:230%7D&env=js-web&1571733293648
server
akka-http/10.1.5
content-length
237
expires
Tue, 22 Oct 2019 08:34:53 GMT
cache-control
max-age=0, no-cache, no-store
pragma
no-cache
date
Tue, 22 Oct 2019 08:34:53 GMT
set-cookie
tt_viewer=ec780baa-3f92-4cc1-8f75-cfd6ff5e799b; Expires=Tue, 20 Oct 2020 08:34:53 GMT; Max-Age=31449600; Domain=.teads.tv; Path=/; SameSite=None
collect
www.google-analytics.com/r/ Frame E0DC
35 B
101 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&a=294119732&t=pageview&_s=1&dl=about%3A%2F%2F%2Fblank&dp=%2F36867436-ef7d-4f51-8344-9f3ffdedda95&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=300x350&je=0&_u=YEBAAGAB~&jid=250822264&gjid=627105396&cid=595209818.1571733294&tid=UA-123718506-6&_gid=686278061.1571733294&_r=1&z=271900607
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame D1C4
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:53 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 317C
46 KB
15 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
dae0df258a8943f1e474c721170373a8282dd2443a714a1bb8ef9f2573bb91d5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"314 / 742 of 1000 / last-modified: 1571692025"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14762
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:53 GMT
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=9fe44dc9-10c4-9fe3-1c98-a636a43bbfd2&tv={c:rLpfWS,pingTime:-10,time:1776,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.95v220002022020220000022002222000022220202020222220222220002222022002222200002220222022222222222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002002202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022222220020222222000220000222202222202222000002002002222222222220022202200022002220222202,sd:MTcuNC45NXYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNC45NXZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8MTZ8fG58fDB8fG58fExpbnV4IHg4Nl82NHx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzQuMC4zNzI5LjE2OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1571733293765||7f8af2c82620e58551c7587d29bc3fd3||675c74d5f114ba25a49fb0f4cb02f70f||a19bc0be6d733238f99dccf4286f0792||d5fc6b81978d9568482851983b425fdc||acd59d4a707db71dd8a18d69aa92e4ab||8b9b606ee0816f98996e6167c96979d3||5f7d6f8b1ce13c9958455b40627972d0||1529428597}
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:53 GMT
X-Server-Name
dt70dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
o2shim
acds.prod.vidible.tv/ Frame FF1D
15 KB
7 KB
Script
General
Full URL
https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1250361&orgId=21364&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&vrid=f9912b31-abb9-4398-bb55-2d9ba1040500&pblob=
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.250.55.69 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-250-55-69.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
051e45db2a7c2ea8dbb9bb72bdde35e96a68645a00d22b9c5bc47b73e0cf12c5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:53 GMT
Content-Encoding
gzip
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
POST, GET, HEAD, PUT, PATCH, DELETE
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Content-Length
6563
lg.php
cdn.firstimpression.io/delivery/
1 B
261 B
XHR
General
Full URL
https://cdn.firstimpression.io/delivery/lg.php?bannerid=39982&campaignid=305&zoneid=108077&loc=%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&spcPVID=2238207657771008&ficb=878353
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.64.113 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-64-113.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 / PHP/7.0.33
Resource Hash
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

Request headers

Accept
*/*
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
server
nginx/1.14.1
x-powered-by
PHP/7.0.33
status
200
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
expires
0
PL_CE_NRC-No-Deposit-Free-Spins-Campaign_Reach-Media-970x250-German-animated-637013692065385540-5d53ca70baeb50425c3e0bfd.html
s0.2mdn.net/5474477/1565772407911/ Frame BA62
0
0
Document
General
Full URL
https://s0.2mdn.net/5474477/1565772407911/PL_CE_NRC-No-Deposit-Free-Spins-Campaign_Reach-Media-970x250-German-animated-637013692065385540-5d53ca70baeb50425c3e0bfd.html
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_258.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
s0.2mdn.net
:scheme
https
:path
/5474477/1565772407911/PL_CE_NRC-No-Deposit-Free-Spins-Campaign_Reach-Media-970x250-German-animated-637013692065385540-5d53ca70baeb50425c3e0bfd.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
access-control-allow-origin
*
content-length
1423
date
Mon, 21 Oct 2019 23:35:01 GMT
expires
Tue, 22 Oct 2019 23:35:01 GMT
last-modified
Wed, 14 Aug 2019 08:46:47 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=86400
age
32392
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
lidar.js
www.googletagservices.com/activeview/js/current/ Frame 0FC8
79 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/lidar.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
2def15be7c0d6cb1a0882a2ca59d0215b306f45396c439170d9249aa24a91023
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29282
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:53 GMT
integrator.js
adservice.google.de/adsid/ Frame 31E9
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 31E9
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 31E9
238 KB
87 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:53 GMT
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=9fe44dc9-10c4-9fe3-1c98-a636a43bbfd2&tv={c:rLpfYT,pingTime:1,time:1901,type:p,clog:[{piv:69,vs:pp,r:,w:300,h:600,t:485}],es:0,sc:1,ha:1,gm:1,slTimes:{i:0,o:0,n:0,pp:1901,pm:0},slEvents:[{sl:pp,t:485,wc:0.0.1600.1200,ac:948.788.300.600,am:i,cc:948.788.300.600,piv:69,obst:0,th:0,reas:,bkn:{piv:[1466~50],as:[1466~300.600]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a|11b*.10079|11b1|11b2|11c|11d|11e.10079|11e1|11f.10079|11f1|11g.10079|11g1|11h|11i,idMap:11b*,rend:1,renddet:DIV.qs.sn,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:53 GMT
X-Server-Name
dt70dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
integrator.js
adservice.google.de/adsid/ Frame 956A
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 956A
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 956A
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:53 GMT
postmessage.html
ecdn.firstimpression.io/ Frame 5C7D
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3622156405313063&output=html&h=280&slotname=6c2b49d.9ca08fd&adk=2807784095&adf=1519143749&w=336&lmt=1571733293&npa=1&guci=1.2.0.0.2.1.0....
  • https://ecdn.firstimpression.io/postmessage.html?command=passbackFn&group=5
0
0
Document
General
Full URL
https://ecdn.firstimpression.io/postmessage.html?command=passbackFn&group=5
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.3.92.12 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
nb-185-3-92-12.london.nodebalancer.linode.com
Software
nginx/1.12.2 / PHP/7.0.33
Resource Hash

Request headers

Host
ecdn.firstimpression.io
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Server
nginx/1.12.2
Date
Tue, 22 Oct 2019 08:38:58 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
168
Connection
close
X-Powered-By
PHP/7.0.33
Expires
Tue, 22 Oct 2019 09:38:58 GMT
Cache-Control
max-age=3600

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://ecdn.firstimpression.io/postmessage.html?command=passbackFn&group=5
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:54 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
sca.17.4.95.js
static.adsafeprotected.com/ Frame 8F8F
81 KB
20 KB
Script
General
Full URL
https://static.adsafeprotected.com/sca.17.4.95.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
149c8d10677f2f6979fa28c078cf832f575ee53c397d791b739e7c4c687fe7bc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Jun 2018 17:20:43 GMT
X-Server-Name
app55ami.ami.303net.pvt
ETag
"5b293b6b-4fda"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
20442
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
mon
pixel.adsafeprotected.com/
43 B
309 B
Image
General
Full URL
https://pixel.adsafeprotected.com/mon?anId=10079&campId=300x250&pubId=4635466512&chanId=33750743&placementId=4870730049&pubCreative=138251763494&pubOrder=2435030858&cb=584924900&custom=right2&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&adsafe_type=abdfq&adsafe_jsinfo=,id:a16014b3-55af-deb2-ff2b-91875cc50bd9,c:rLpg1o,sl:outOfView,em:true,fr:true,mn:app55ami,pt:1-5-15,wc:0.0.1600.1200,ac:948.5007.300.250,am:i,cc:948.5007.300.250,piv:0,obst:0,th:0,reas:l,br:u,abv:na,an:n,scm:publ1.grpm1,fm:rFCgIRw+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a1|11a2|11a3|11b1|11b21|11b3|11c*.10079|11c1|11d1|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p|11q|11r,idMap:11c*,pl:,rend:0,renddet:DIV,rmeas:0,es:0,sc:1,ha:1,gm:1,tt:jload,thd:1,et:697,oid:d17317b6-f4a6-11e9-b671-382c4ac63121,v:19.8.22,sp:1,wr:1600.1200,sr:1600.1200,ov:0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
app10ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
sca.17.4.95.js
static.adsafeprotected.com/ Frame 0051
81 KB
20 KB
Script
General
Full URL
https://static.adsafeprotected.com/sca.17.4.95.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
149c8d10677f2f6979fa28c078cf832f575ee53c397d791b739e7c4c687fe7bc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Jun 2018 17:20:43 GMT
X-Server-Name
app55ami.ami.303net.pvt
ETag
"5b293b6b-4fda"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
20442
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
mon
pixel.adsafeprotected.com/
43 B
309 B
Image
General
Full URL
https://pixel.adsafeprotected.com/mon?anId=10079&campId=300x250&pubId=4635466512&chanId=33750743&placementId=4871301086&pubCreative=138251964595&pubOrder=2435030858&cb=1800158787&custom=right3&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&adsafe_type=abdfq&adsafe_jsinfo=,id:874b85e6-e610-96e7-e656-02a662aa1d8c,c:rLpg29,sl:outOfView,em:true,fr:true,mn:app25ami,pt:1-5-15,wc:0.0.1600.1200,ac:948.8984.300.250,am:i,cc:948.8984.300.250,piv:0,obst:0,th:0,reas:l,br:u,abv:na,an:n,scm:publ1.grpm1,fm:rFCgISE+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a1|11a2|11a3|11b1|11b21|11b3|11c1|11c2|11d*.10079|11d1|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p|11q|11r,idMap:11d*,pl:,rend:0,renddet:DIV,rmeas:0,es:0,sc:1,ha:1,gm:1,tt:jload,thd:1,et:674,oid:d175889d-f4a6-11e9-b21b-00259086ca0c,v:19.8.22,sp:1,wr:1600.1200,sr:1600.1200,ov:0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
app10ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=ae0fc106-1d88-1dfb-c943-301fc7b77ae2&tv={c:rLpg2j,pingTime:-2,time:1734,type:a,im:{sf:0,pom:1,prf:{beA:453,beZ:455,mfA:1552,cmA:1552,inA:1552,inZ:1561,prA:1561,prZ:1594,si:1598,poA:1598,poZ:1604,cmZ:1604,mfZ:1604,loA:1854,loZ:1855,ltA:2187,ltZ:2187,mdA:455,mdZ:516}},sca:{dfp:{df:4,sz:300.250,dom:div}},env:{gca:1},clog:[{piv:0,vs:o,r:l,w:300,h:250,t:1144}],es:0,sc:1,ha:1,gm:1,slTimes:{i:0,o:1734,n:0,pp:0,pm:0},slEvents:[{sl:o,t:1144,wc:0.0.1600.1200,ac:948.2886.300.250,am:i,cc:948.2886.300.250,piv:0,obst:0,th:0,reas:l,bkn:{piv:[634~0],as:[634~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIBH+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|1191|11a1|11a2|11b1|11b2|11b3|11c1|11d1|11e1|11e2|11f*.10079|11f1|11g1|11g2|11h|11i|11j|11k|11l|11m|11n|11o,idMap:11f*,rend:1,renddet:IMG.qs,rmeas:1,slid:[google_ads_iframe_/34722903/Express/Finance/PersonalFinance_5,google_ads_iframe_/34722903/Express/Finance/PersonalFinance_5__container__,div-gpt-ad-681040515914899306-3,maincontainer],sinceFw:589,readyFired:true}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt83dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=6b9fb135-7986-57bd-f683-c2254dd2a46e&tv={c:rLpg2u,pingTime:-10,time:1925,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.95v220002022020220000022002222000022220202020222220222220002222022002222200002220222022222222222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002002202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022222220020222222000220000222202222202222000002002002222222222220022202200022002220222202,sd:MTcuNC45NXYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNC45NXZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8MTZ8fG58fDB8fG58fExpbnV4IHg4Nl82NHx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzQuMC4zNzI5LjE2OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1571733294113||103997b3a401665c5f25e5b39346e693||675c74d5f114ba25a49fb0f4cb02f70f||4d7b0def836371e296ed53db3f97376b||4d83bc3cfd19ea60745ad4ddbee89b59||941733433e53f26dd7e1bc5c6442569b||4cc7fe5f91346f41ffb6db4e5754d459||1f9faf151b00383a6929c277cd163ec2||1529428597}
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt83dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
integrator.js
adservice.google.de/adsid/ Frame 8E66
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 8E66
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 8E66
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:54 GMT
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=6b9fb135-7986-57bd-f683-c2254dd2a46e&tv={c:rLpg38,pingTime:1,time:1965,type:p,clog:[{piv:100,vs:i,r:,w:8,h:8,t:575}],es:0,sc:1,ha:1,gm:1,slTimes:{i:1965,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:575,wc:0.0.1600.1200,ac:0.5.8.8,am:i,cc:0.5.8.8,piv:100,obst:0,th:0,reas:,bkn:{piv:[1431~100],as:[1431~8.8]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:970,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a1|11b.10079|11b1|11b2|11b3|11c1|11d1|11e.10079|11e1|11f.10079|11f1|11g*.10079|11g1|11h|11i|11j,idMap:11g*,rend:0,renddet:DIV.us.sn,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt59dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=6b9fb135-7986-57bd-f683-c2254dd2a46e&tv={c:rLpg3a,pingTime:1,time:1967,type:pf,clog:[{piv:100,vs:i,r:,w:8,h:8,t:575}],es:0,sc:1,ha:1,gm:1,slTimes:{i:1967,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:575,wc:0.0.1600.1200,ac:0.5.8.8,am:i,cc:0.5.8.8,piv:100,obst:0,th:0,reas:,bkn:{piv:[1432~100],as:[1432~8.8]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:970,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a1|11b.10079|11b1|11b2|11b3|11c1|11d1|11e.10079|11e1|11f.10079|11f1|11g*.10079|11g1|11h|11i|11j,idMap:11g*,rend:0,renddet:DIV.us.sn,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt81dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=6b9fb135-7986-57bd-f683-c2254dd2a46e&tv={c:rLpg3c,pingTime:1,time:1969,type:c,clog:[{piv:100,vs:i,r:,w:8,h:8,t:575}],es:0,sc:1,ha:1,gm:1,slTimes:{i:1969,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:575,wc:0.0.1600.1200,ac:0.5.8.8,am:i,cc:0.5.8.8,piv:100,obst:0,th:0,reas:,bkn:{piv:[1434~100],as:[1434~8.8]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:970,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a1|11b.10079|11b1|11b2|11b3|11c1|11d1|11e.10079|11e1|11f.10079|11f1|11g*.10079|11g1|11h|11i|11j,idMap:11g*,rend:0,renddet:DIV.us.sn,rmeas:1,metricId:publ1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt39dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=6b9fb135-7986-57bd-f683-c2254dd2a46e&tv={c:rLpg3d,pingTime:1,time:1970,type:c,clog:[{piv:100,vs:i,r:,w:8,h:8,t:575}],es:0,sc:1,ha:1,gm:1,slTimes:{i:1970,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:575,wc:0.0.1600.1200,ac:0.5.8.8,am:i,cc:0.5.8.8,piv:100,obst:0,th:0,reas:,bkn:{piv:[1435~100],as:[1435~8.8]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:970,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a1|11b.10079|11b1|11b2|11b3|11c1|11d1|11e.10079|11e1|11f.10079|11f1|11g*.10079|11g1|11h|11i|11j,idMap:11g*,rend:0,renddet:DIV.us.sn,rmeas:1,metricId:grpm1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt74dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
sca.17.4.95.js
static.adsafeprotected.com/ Frame 2327
81 KB
20 KB
Script
General
Full URL
https://static.adsafeprotected.com/sca.17.4.95.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.32 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.static.adsafeprotected.com
Software
nginx /
Resource Hash
149c8d10677f2f6979fa28c078cf832f575ee53c397d791b739e7c4c687fe7bc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Jun 2018 17:20:43 GMT
X-Server-Name
app10ami.ami.303net.pvt
ETag
"5b293b6b-4fda"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
20442
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
mon
pixel.adsafeprotected.com/
43 B
309 B
Image
General
Full URL
https://pixel.adsafeprotected.com/mon?anId=10079&campId=970x250&pubId=4742659370&chanId=33750743&placementId=5187559359&pubCreative=138289531442&pubOrder=2607736224&cb=693241170&custom=top&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&adsafe_type=abdfq&adsafe_jsinfo=,id:415db03d-364d-40b2-2a9e-04b0b9f23ee6,c:rLpg4m,sl:inView,em:true,fr:true,mn:app33ami,pt:1-5-15,wc:0.0.1600.1200,ac:308.13.970.250,am:i,cc:308.13.970.250,piv:100,obst:0,th:0,reas:,br:u,abv:na,an:n,dvs:visible,scm:publ1.grpm1,fm:rFCgIPJ+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a*.10079|11a1|11a2|11a3|11b1|11b21|11b3|11c1|11c2|11d1|11d2|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p1|11q|11r,idMap:11a*,pl:,rend:1,renddet:XIFRAME.qs.dr,rmeas:1,es:0,sc:1,ha:1,gm:1,tt:jload,thd:1,et:991,oid:d15751ee-f4a6-11e9-88b1-382c4ac630ed,v:19.8.22,sp:1,wr:1600.1200,sr:1600.1200,ov:0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.166.0.26 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
anycast.pixel.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
app53ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=415db03d-364d-40b2-2a9e-04b0b9f23ee6&tv={c:rLpg4n,pingTime:-8,time:992,type:l,es:0,sc:1,ha:1,gm:1,slTimes:{i:992,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:990,wc:0.0.1600.1200,ac:308.13.970.250,am:i,cc:308.13.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[56~100],as:[56~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIPJ+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a*.10079|11a1|11a2|11a3|11b1|11b21|11b3|11c1|11c2|11d1|11d2|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p1|11q|11r,idMap:11a*,rend:1,renddet:XIFRAME.qs.dr,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt64dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
integrator.js
adservice.google.de/adsid/ Frame D1C4
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame D1C4
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame D1C4
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:54 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 1A60
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3622156405313063&output=html&adk=1812271804&adf=3025194257&lmt=1571733294&plat=1%3A32776%2C2%3A16809992%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&npa=1&guci=1.2.0.0.2.1.0.0&format=0x0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1571733293404&bpp=7&bdt=12860&fdt=892&idt=892&shv=r20191015&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=336x280&nras=1&correlator=8649018514736&frm=20&pv=1&ga_vid=1175119503.1571733290&ga_sid=1571733290&ga_hid=2100588899&ga_fc=0&ga_cid=595209818.1571733294&iag=0&icsg=0&dssz=157&mdo=0&mso=128&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199337%2C21062415%2C21063203%2C21064791%2C151527025%2C151527225%2C368226411%2C368226421%2C368226431%2C26835106%2C410075105&oid=3&pvsid=293019804438819&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=10&uci=a.1h1l038rwux7&fsb=1&dtd=907
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-3622156405313063&output=html&adk=1812271804&adf=3025194257&lmt=1571733294&plat=1%3A32776%2C2%3A16809992%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&npa=1&guci=1.2.0.0.2.1.0.0&format=0x0&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1571733293404&bpp=7&bdt=12860&fdt=892&idt=892&shv=r20191015&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=336x280&nras=1&correlator=8649018514736&frm=20&pv=1&ga_vid=1175119503.1571733290&ga_sid=1571733290&ga_hid=2100588899&ga_fc=0&ga_cid=595209818.1571733294&iag=0&icsg=0&dssz=157&mdo=0&mso=128&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199337%2C21062415%2C21063203%2C21064791%2C151527025%2C151527225%2C368226411%2C368226421%2C368226431%2C26835106%2C410075105&oid=3&pvsid=293019804438819&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=10&uci=a.1h1l038rwux7&fsb=1&dtd=907
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUlF2fIxGJ9gyOvIHkxLhYEdvvg6aOcVCLxtrO30BmyZL-39BQH4LfdAvulf
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Tue, 22 Oct 2019 08:34:54 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
integrator.js
adservice.google.de/adsid/ Frame 317C
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 317C
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019101401.js
securepubads.g.doubleclick.net/gpt/ Frame 317C
156 KB
57 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js?21064803
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
f8800772f0dd827877029d9d634a170a156ff82b6b6bdf251b62c750b73cfe93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 14 Oct 2019 13:08:16 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58589
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:54 GMT
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=415db03d-364d-40b2-2a9e-04b0b9f23ee6&tv={c:rLpg8t,pingTime:0,time:1246,type:pf,clog:[{piv:100,vs:i,r:,w:970,h:250,t:990}],es:0,sc:1,ha:1,gm:1,slTimes:{i:1246,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:990,wc:0.0.1600.1200,ac:308.13.970.250,am:i,cc:308.13.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[310~100],as:[310~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIPJ+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a*.10079|11a1|11a2|11a3|11b1|11b21|11b3|11c.10079|11c1|11c2|11d.10079|11d1|11d2|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p1|11q|11r,idMap:11a*,rend:1,renddet:XIFRAME.qs.dr,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt83dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
tracking
hb.spotim.market/dfp/ Frame F118
0
184 B
XHR
General
Full URL
https://hb.spotim.market/dfp/tracking
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebid/wrapper_hb_270443_3428.js?cb=18191
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
213.174.156.165 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type
application/json

Response headers

Access-Control-Allow-Origin
https://www.express.co.uk
Date
Tue, 22 Oct 2019 08:34:54 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame 0D75
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_3&adk=550597170&adf=1174745479&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=htt...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423515254&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423515254&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423515254&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:54 GMT
content-type
text/html
set-cookie
__cfduid=d643873d2efa4383bb1d66513c35f1c251571733294; expires=Wed, 21-Oct-20 08:34:54 GMT; path=/; domain=.imonomy.com; HttpOnly a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:07:30 GMT
cache-control
max-age=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a22838860cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423515254&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:54 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 31E9
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:54 GMT
0.js
cdn-ssl.vidible.tv/prod/ad-client/js/10.1.20/ Frame FF1D
334 KB
107 KB
Script
General
Full URL
https://cdn-ssl.vidible.tv/prod/ad-client/js/10.1.20/0.js
Requested by
Host: acds.prod.vidible.tv
URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1250361&orgId=21364&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&vrid=f9912b31-abb9-4398-bb55-2d9ba1040500&pblob=
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),
Reverse DNS
Software
ATS /
Resource Hash
aa6e0af2db44c3941b0fea58d414430d083f5a0481b12c0414a7a6f91f2f94d5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 20 Oct 2019 19:35:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
133180
x-amz-server-side-encryption
AES256
status
200
vary
Accept-Encoding
x-amz-request-id
913EE4C02AF6CFF4
x-amz-id-2
c/AF2utzaIULXwKUKPFBwvQY17TjTHmDoqDt1KBWUahgyPWJXBOLSkPA4Gj2/dqQXFDgtc9vVeo=
accept-ranges
bytes
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 17 Oct 2019 10:03:23 GMT
server
ATS
etag
"8615e0c428e7ed78dee55750f5d11295-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-version-id
null
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=1209600
content-length
109496
content-type
application/javascript
impression.gif
trk.vidible.tv/trk/ Frame FF1D
43 B
363 B
Image
General
Full URL
https://trk.vidible.tv/trk/impression.gif?pid=59947c0544a64b1a49e52a48&bcid=5909e7c27cdce053ec937ebe&s=true&pv=10.1.20&ifr=true&cb=0.8683327909678251&pt=o2unit&sid=c7133b21-cc9f-452b-ae05-b41141ce5694&r=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.194.34.120 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-194-34-120.eu-central-1.compute.amazonaws.com
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:54 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx/1.10.3 (Ubuntu)
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:54 GMT
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame BAAE
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=DirectAdx728x90_floor_3&adk=550597170&adf=1174745483&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=htt...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423569456&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423569456&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=423569456&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
__cfduid=d643873d2efa4383bb1d66513c35f1c251571733294
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:55 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:14:14 GMT
cache-control
max-age=86400
set-cookie
a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a22858bf7cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=423569456&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:54 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 956A
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:54 GMT
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=a16014b3-55af-deb2-ff2b-91875cc50bd9&tv={c:rLpgaY,pingTime:-2,time:1290,type:a,im:{sf:0,pom:1,prf:{beA:658,beZ:659,mfA:1320,cmA:1320,inA:1320,inZ:1321,prA:1321,prZ:1351,si:1354,poA:1354,poZ:1360,cmZ:1360,mfZ:1360,loA:1664,loZ:1665,ltA:1947,ltZ:1947,mdA:660,mdZ:722}},sca:{dfp:{df:4,sz:300.250,dom:body}},env:{gca:1},clog:[{piv:0,vs:o,r:l,w:300,h:250,t:696}],es:0,sc:1,ha:1,gm:1,slTimes:{i:0,o:1290,n:0,pp:0,pm:0},slEvents:[{sl:o,t:695,wc:0.0.1600.1200,ac:948.5007.300.250,am:i,cc:948.5007.300.250,piv:0,obst:0,th:0,reas:l,bkn:{piv:[627~0],as:[627~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIPJ+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a.10079|11a1|11a2|11a3|11b1|11b21|11b3|11c*.10079|11c1|11d.10079|11d1|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p|11q|11r,idMap:11c*,rend:0,renddet:DIV,rmeas:0,slid:[google_ads_iframe_/34722903/Express/Finance/PersonalFinance_2,google_ads_iframe_/34722903/Express/Finance/PersonalFinance_2__container__,div-gpt-ad-681040515914899306-4,maincontainer],sinceFw:592,readyFired:true}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt83dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=874b85e6-e610-96e7-e656-02a662aa1d8c&tv={c:rLpgbh,pingTime:-2,time:1239,type:a,im:{sf:0,pom:1,prf:{beA:715,beZ:717,mfA:1353,cmA:1353,inA:1353,inZ:1355,prA:1355,prZ:1386,si:1389,poA:1389,poZ:1394,cmZ:1394,mfZ:1394,loA:1671,loZ:1672,ltA:1953,ltZ:1953,mdA:717,mdZ:732}},sca:{dfp:{df:4,sz:300.250,dom:body}},env:{gca:1},clog:[{piv:0,vs:o,r:l,w:300,h:250,t:673}],es:0,sc:1,ha:1,gm:1,slTimes:{i:0,o:1239,n:0,pp:0,pm:0},slEvents:[{sl:o,t:673,wc:0.0.1600.1200,ac:948.8984.300.250,am:i,cc:948.8984.300.250,piv:0,obst:0,th:0,reas:l,bkn:{piv:[600~0],as:[600~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIPJ+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a.10079|11a1|11a2|11a3|11b1|11b21|11b3|11c.10079|11c1|11c2|11d*.10079|11d1|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p|11q|11r,idMap:11d*,rend:0,renddet:DIV,rmeas:0,slid:[google_ads_iframe_/34722903/Express/Finance/PersonalFinance_3,google_ads_iframe_/34722903/Express/Finance/PersonalFinance_3__container__,div-gpt-ad-681040515914899306-5,maincontainer],sinceFw:564,readyFired:true}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt64dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=ae0fc106-1d88-1dfb-c943-301fc7b77ae2&tv={c:rLpgbS,pingTime:-10,time:2327,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.95v220002022020220000022002222000022220202020222220222220002222022002222200002220222022222222222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002002202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022222220020222222000220000222202222202222000002002002222222222220022202200022002220222202,sd:MTcuNC45NXYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNC45NXZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8MTZ8fG58fDB8fG58fExpbnV4IHg4Nl82NHx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzQuMC4zNzI5LjE2OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1571733294694||7b27a08bde82d1eb0641eb13769a876a||675c74d5f114ba25a49fb0f4cb02f70f||4cf555c0629515b88d031150d04af92b||b0bf903208d04578a8abbbc1ee0e1296||3502febf080e7abc5f8934c9a4558601||73e2a7b23e4c65dfa4f2e69ddd09920d||b953fb6742a0343fd844ad4dc193ea4f||1529428597}
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:54 GMT
X-Server-Name
dt74dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame C567
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90&adk=1913573300&adf=1174745507&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424189297&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424189297&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=424189297&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:55 GMT
content-type
text/html
set-cookie
__cfduid=d120c962c45cde58982720ea0f0458f191571733295; expires=Wed, 21-Oct-20 08:34:55 GMT; path=/; domain=.imonomy.com; HttpOnly a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:25:23 GMT
cache-control
max-age=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a2287d893cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424189297&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:55 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 8E66
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:54 GMT
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=415db03d-364d-40b2-2a9e-04b0b9f23ee6&tv={c:rLpggr,pingTime:-2,time:1740,type:a,im:{sf:0,pom:1,prf:{beA:725,beZ:726,mfA:1659,cmA:1660,inA:1660,inZ:1661,prA:1661,prZ:1711,si:1716,poA:1717,poZ:1723,cmZ:1723,mfZ:1723,loA:1972,loZ:1973,ltA:2464,ltZ:2464,mdA:726,mdZ:791}},sca:{dfp:{df:3,sz:970.250,dom:div}},env:{gca:1},clog:[{piv:100,vs:i,r:,w:970,h:250,t:990}],es:0,sc:1,ha:1,gm:1,slTimes:{i:1740,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:990,wc:0.0.1600.1200,ac:308.13.970.250,am:i,cc:308.13.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[804~100],as:[804~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:rFCgIPJ+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a*.10079|11a1|11a2|11a3|11b1|11b21|11b3|11c.10079|11c1|11c2|11d.10079|11d1|11d2|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p1|11q|11r,idMap:11a*,rend:1,renddet:XIFRAME.qs.dr,rmeas:1,slid:[google_ads_iframe_/34722903/Express/Finance/PersonalFinance_0,google_ads_iframe_/34722903/Express/Finance/PersonalFinance_0__container__,div-gpt-ad-681040515914899306-1,superbanner],sinceFw:747,readyFired:true}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:55 GMT
X-Server-Name
dt74dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
activeview
pagead2.googlesyndication.com/pcs/ Frame 0FC8
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvdv9CT_3rSSGf1FLomZLj5VC2xKcPaErfwC9vgfm8Sdg6VIwpeHRawFnvimR4MEa1kDTVAHtrVx2zz7hmkJids-6fH09DT6r7IHSTTK_o&sig=Cg0ArKJSzJhD08gXdyw7EAE&adk=2672499039&tt=3416&bs=1585%2C1200&mtos=1272,1272,1272,1272,1272&tos=1272,0,0,0,0&p=13,308,263,1278&mcvt=1272&rs=3&ht=0&tfs=2160&tls=3432&mc=1&lte=1&bas=0&bac=0&met=no&la=1&avms=nio&niot_obs=12&niot_cbk=267&md=2&lm=2&rst=1571733290541&rpt=2275&isd=0&msd=0&ext=mvo%3D-1%26brt%3D0&oseid=3&xdi=0&ps=1585%2C10596&ss=1600%2C1200&pt=16&bin=1&deb=1-7-9-14-9-17-134-8-0-0-0&tvt=3424&r=v&id=osdim&vs=4&uc=6&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20191021
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:54 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame B754
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90&adk=1913573300&adf=1174745505&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424142754&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424142754&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=424142754&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:55 GMT
content-type
text/html
set-cookie
__cfduid=d120c962c45cde58982720ea0f0458f191571733295; expires=Wed, 21-Oct-20 08:34:55 GMT; path=/; domain=.imonomy.com; HttpOnly a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:07:32 GMT
cache-control
max-age=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a2287e8b9cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424142754&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:55 GMT
server
cafe
content-length
46
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Tue, 22-Oct-2019 08:49:55 GMT; path=/; domain=.doubleclick.net
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame D1C4
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:55 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 317C
5 KB
3 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=482351651286624&correlator=3406341927251255&output=ldjh&impl=fif&eid=21064803&vrg=2019101401&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A536903688%2C2%3A553680904%2C8%3A32776&sc=1&sfv=1-0-35&ecs=20191022&iu=%2F27794161%2Fexpress.co.uk_Web_300x250_1&sz=300x250&scp=refurl%3Dexpress.co.uk%26floor_group%3Dctrl_group%26hour%3D8%26adx_floor%3D1%26Exclude_Adx%3DN%26instBid_bidder%3Dnofill%26instBid_pb%3D0%26instBid_adid%3Dnofill%26instBid_size%3D300x250%26impression_type%3Dinitial_load&cust_params=amznbid%3D0%26amznp%3D0&cookie_enabled=1&cdm=www.express.co.uk&bc=31&abxe=1&lmt=1571733295&dt=1571733295336&dlt=1571733290558&idt=4753&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=600&oid=3&adx=948&ady=788&adk=2369279298&uci=3rjg6mfko2du&ifi=1&ifk=3464926852&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&top=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dssz=17&icsg=32938&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x600&msz=300x-1&ga_vid=844150094.1571733295&ga_sid=1571733295&ga_hid=1790225015&fws=256&ohw=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js?21064803
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
00c0a6cf39259cf251132571101c0133beb08e1fc7bf88a55f1f9ecad9d1104c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2401
x-xss-protection
0
google-lineitem-id
5160929221
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138286292479
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019101401.js
securepubads.g.doubleclick.net/gpt/ Frame 317C
64 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101401.js?21064803
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
f123fae1ceff20dea7ee2ff8895276a22cddecc8e0ef503b5e95419e76909a54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 14 Oct 2019 13:08:16 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24836
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:55 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 317C
0
0

ads
securepubads.g.doubleclick.net/gampad/ Frame 317C
5 KB
3 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=482351651286624&correlator=3406341927251255&output=ldjh&impl=fif&eid=21064803&vrg=2019101401&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A536903688%2C2%3A553680904%2C8%3A32776&sc=1&sfv=1-0-35&ecs=20191022&iu=%2F27794161%2Fexpress.co.uk_Web_300x250_2&sz=300x250&scp=refurl%3Dexpress.co.uk%26floor_group%3Dctrl_group%26hour%3D8%26adx_floor%3D1%26Exclude_Adx%3DN%26instBid_bidder%3Dnofill%26instBid_pb%3D0%26instBid_adid%3Dnofill%26instBid_size%3D300x250%26impression_type%3Dinitial_load&cust_params=amznbid%3D0%26amznp%3D0&cookie_enabled=1&cdm=www.express.co.uk&bc=31&abxe=1&lmt=1571733295&dt=1571733295351&dlt=1571733290558&idt=4753&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=600&oid=3&adx=948&ady=1088&adk=368248288&uci=qr1pb7bubfby&ifi=2&ifk=3464926852&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&top=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dssz=18&icsg=164010&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x600&msz=300x-1&ga_vid=844150094.1571733295&ga_sid=1571733295&ga_hid=1790225015&fws=256&ohw=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js?21064803
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
cca11cadd735ca563c70cc0e8865c4c8dafcdfe0d5294bae8c11a7362d988167
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2413
x-xss-protection
0
google-lineitem-id
5160929221
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138286292212
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.express.co.uk
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
main.js
tag.imonomy.com/script/ Frame 31E9
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15871
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a22883943cbcc-VIE
content-length
5239
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=a16014b3-55af-deb2-ff2b-91875cc50bd9&tv={c:rLpgnq,pingTime:-10,time:2062,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.95v220002022020220000022002222000022220202020222220222220002222022002222200002220222022222222222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002002202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022222220020222222000220000222202222202222000002002002222222222220022202200022002220222202,sd:MTcuNC45NXYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNC45NXZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8MTZ8fG58fDB8fG58fExpbnV4IHg4Nl82NHx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzQuMC4zNzI5LjE2OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1571733295411||5e4e22407dd5a5e5558ae42bcb34baeb||675c74d5f114ba25a49fb0f4cb02f70f||b699563bc525de4047d43877dbe54b04||1e98a8417464d3e7f95f818b9e83369a||e56c46c7d30351564c63e4da96dc4e93||caae47390f41466619dde1bf886101e0||4f7ac71f77927b519e53eadd738ce735||1529428597}
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:55 GMT
X-Server-Name
dt86dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=874b85e6-e610-96e7-e656-02a662aa1d8c&tv={c:rLpgnL,pingTime:-10,time:2013,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.95v220002022020220000022002222000022220202020222220222220002222022002222200002220222022222222222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002002202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022222220020222222000220000222202222202222000002002002222222222220022202200022002220222202,sd:MTcuNC45NXYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNC45NXZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8MTZ8fG58fDB8fG58fExpbnV4IHg4Nl82NHx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzQuMC4zNzI5LjE2OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1571733295432||5a0a88d023ec27ce642e87a2d2b6503a||675c74d5f114ba25a49fb0f4cb02f70f||953adfd72d2e19efe28f6a0c11c29505||3c305a2d1fccd05ef82a64387e379df7||2426f959417fba8d51df99b691a6d2e2||e9101ba6c5272dc03bad420d98f4b245||80a69acc25b6fbf54315718c73eac8a6||1529428597}
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:55 GMT
X-Server-Name
dt80dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
main.js
tag.imonomy.com/script/ Frame 956A
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15871
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a228899eccbcc-VIE
content-length
5239
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=415db03d-364d-40b2-2a9e-04b0b9f23ee6&tv={c:rLpgoF,pingTime:-10,time:2250,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.95v220002022020220000022002222000022220202020222220222220002222022002222200002220222022222222222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002002202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022222220020222222000220000222202222202222000002002002222222222220022202200022002220222202,sd:MTcuNC45NXYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNC45NXZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8MTZ8fG58fDB8fG58fExpbnV4IHg4Nl82NHx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzQuMC4zNzI5LjE2OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1571733295488||4f90f365861a4a561f8e797071a8e3d8||675c74d5f114ba25a49fb0f4cb02f70f||9b2f9e64291a4b9cd5a7ae8388324a70||99f2c6baf896beeffaed7243d9d78b5a||76c63622b6f3413b89329bbb2cb8325e||8f77fc9306039a5e6ec27ee0e5140650||62d4a4540394d0b23619e7dc7593c8cd||1529428597}
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:55 GMT
X-Server-Name
dt01dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
lg.php
cdn.firstimpression.io/delivery/
1 B
261 B
XHR
General
Full URL
https://cdn.firstimpression.io/delivery/lg.php?bannerid=28679&campaignid=32&zoneid=103010&loc=%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&spcPVID=2238207657771008&ficb=823664
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.64.113 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-64-113.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 / PHP/7.0.33
Resource Hash
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

Request headers

Accept
*/*
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
server
nginx/1.14.1
x-powered-by
PHP/7.0.33
status
200
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
expires
0
contents
cms.insticator.com/v3/ Frame E0DC
8 KB
3 KB
XHR
General
Full URL
https://cms.insticator.com/v3/contents?embed_uuid=51bb6f47-986a-4028-a272-6611b0837f1f&cookie_id=null&content_order=RANDOM&for_embed=true&content_count=10
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
103e8636684cffc517010e343af1e04dd0fb46ea10a360fc58e5d86d7a156536

Request headers

Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
cf-ray
529a2288f8f9cbc4-VIE
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=415db03d-364d-40b2-2a9e-04b0b9f23ee6&tv={c:rLpgoP,pingTime:1,time:2260,type:p,clog:[{piv:100,vs:i,r:,w:970,h:250,t:990}],es:0,sc:1,ha:1,gm:1,slTimes:{i:2260,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:990,wc:0.0.1600.1200,ac:308.13.970.250,am:i,cc:308.13.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1324~100],as:[1324~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:1213,fm:rFCgIPJ+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a*.10079|11a1|11a2|11a3|11b1|11b21|11b3|11c.10079|11c1|11c2|11d.10079|11d1|11d2|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p1|11q|11r,idMap:11a*,rend:1,renddet:XIFRAME.qs.dr,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:55 GMT
X-Server-Name
dt88dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=415db03d-364d-40b2-2a9e-04b0b9f23ee6&tv={c:rLpgoR,pingTime:1,time:2262,type:pf,clog:[{piv:100,vs:i,r:,w:970,h:250,t:990}],es:0,sc:1,ha:1,gm:1,slTimes:{i:2262,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:990,wc:0.0.1600.1200,ac:308.13.970.250,am:i,cc:308.13.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1326~100],as:[1326~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:1213,fm:rFCgIPJ+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a*.10079|11a1|11a2|11a3|11b1|11b21|11b3|11c.10079|11c1|11c2|11d.10079|11d1|11d2|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p1|11q|11r,idMap:11a*,rend:1,renddet:XIFRAME.qs.dr,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:55 GMT
X-Server-Name
dt59dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=415db03d-364d-40b2-2a9e-04b0b9f23ee6&tv={c:rLpgoT,pingTime:1,time:2264,type:c,clog:[{piv:100,vs:i,r:,w:970,h:250,t:990}],es:0,sc:1,ha:1,gm:1,slTimes:{i:2264,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:990,wc:0.0.1600.1200,ac:308.13.970.250,am:i,cc:308.13.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1329~100],as:[1329~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:1213,fm:rFCgIPJ+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a*.10079|11a1|11a2|11a3|11b1|11b21|11b3|11c.10079|11c1|11c2|11d.10079|11d1|11d2|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p1|11q|11r,idMap:11a*,rend:1,renddet:XIFRAME.qs.dr,rmeas:1,metricId:publ1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:55 GMT
X-Server-Name
dt80dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=415db03d-364d-40b2-2a9e-04b0b9f23ee6&tv={c:rLpgoV,pingTime:1,time:2266,type:c,clog:[{piv:100,vs:i,r:,w:970,h:250,t:990}],es:0,sc:1,ha:1,gm:1,slTimes:{i:2266,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:990,wc:0.0.1600.1200,ac:308.13.970.250,am:i,cc:308.13.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1330~100],as:[1330~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:1213,fm:rFCgIPJ+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|11812|11911|1192|11a*.10079|11a1|11a2|11a3|11b1|11b21|11b3|11c.10079|11c1|11c2|11d.10079|11d1|11d2|11e1|11e2|11f1|11f2|11g1|11g2|11h|11i|11j|11k1|11l|11m1|11n|11o1|11p1|11q|11r,idMap:11a*,rend:1,renddet:XIFRAME.qs.dr,rmeas:1,metricId:grpm1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:55 GMT
X-Server-Name
dt86dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
logo-insticator-light.png
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
21 KB
21 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/logo-insticator-light.png
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6413b7dec6a597c00831914e8e4391b59538c6104cea547e13350840cc7c616b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
CTBFOiOZF9Pc8nkBYDMEiY0Rbq5FsRhl
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Fri, 04 May 2018 18:57:58 GMT
server
AmazonS3
age
67074
etag
"31605596be6a56e2ccc39b5ddc16be95"
x-cache
Hit from cloudfront
content-type
image/png
status
200
date
Mon, 21 Oct 2019 14:15:00 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
21163
x-amz-cf-id
AlQKd3D2PSWHzQ8LMoe_KKahYOuK5zlWSYLRfMFM8MFofY4LHV49aA==
QGYpz_wNahGAdqQ43Rh3o4T8mNhNy_r-Kw.woff2
fonts.gstatic.com/s/worksans/v5/ Frame E0DC
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/worksans/v5/QGYpz_wNahGAdqQ43Rh3o4T8mNhNy_r-Kw.woff2
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5a3fdd33eef5a838c25b2afe031bc8478dd97dcd175ce9b9d99c2a77163b6748
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Work+Sans:400,500,600,700&display=swap
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 10:03:49 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:25:40 GMT
server
sffe
age
945066
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
16608
x-xss-protection
0
expires
Sat, 10 Oct 2020 10:03:49 GMT
QGYsz_wNahGAdqQ43Rh_fKDptfpA4Q.woff2
fonts.gstatic.com/s/worksans/v5/ Frame E0DC
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/worksans/v5/QGYsz_wNahGAdqQ43Rh_fKDptfpA4Q.woff2
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6a645c93a587df5075444babe7d852b13ed4e4d24e339e307551acf743e214ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Work+Sans:400,500,600,700&display=swap
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 10 Oct 2019 17:36:18 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:19:14 GMT
server
sffe
age
1004317
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15112
x-xss-protection
0
expires
Fri, 09 Oct 2020 17:36:18 GMT
fa-solid-900.woff2
use.fontawesome.com/releases/v5.5.0/webfonts/ Frame E0DC
72 KB
73 KB
Font
General
Full URL
https://use.fontawesome.com/releases/v5.5.0/webfonts/fa-solid-900.woff2
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
7798165ee5a3c6809310d8261dcbe7c8d0c12d795b7b09a71af3eb86ec8f33f2

Request headers

Sec-Fetch-Mode
cors
Referer
https://use.fontawesome.com/releases/v5.5.0/css/all.css
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
last-modified
Fri, 02 Nov 2018 15:17:39 GMT
server
NetDNA-cache/2.2
status
200
etag
"fb493903265cad425ccdf8e04fc2de61"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
accept-ranges
bytes
content-length
73852
postmessage.html
ecdn.firstimpression.io/ Frame 1DE8
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3622156405313063&output=html&h=250&slotname=a68b939.2cc54ed&adk=2829789302&adf=2723100192&w=300&lmt=1571733295&npa=1&guci=1.2.0.0.2.1.0....
  • https://ecdn.firstimpression.io/postmessage.html?command=passbackFn&group=12
0
0
Document
General
Full URL
https://ecdn.firstimpression.io/postmessage.html?command=passbackFn&group=12
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.3.92.12 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
nb-185-3-92-12.london.nodebalancer.linode.com
Software
nginx/1.12.2 / PHP/7.0.33
Resource Hash

Request headers

Host
ecdn.firstimpression.io
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

Server
nginx/1.12.2
Date
Tue, 22 Oct 2019 08:41:06 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
169
Connection
close
X-Powered-By
PHP/7.0.33
Expires
Tue, 22 Oct 2019 09:41:06 GMT
Cache-Control
max-age=3600

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://ecdn.firstimpression.io/postmessage.html?command=passbackFn&group=12
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:55 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
metrics
metrics-collector.s-onetag.com/
0
0
Other
General
Full URL
https://metrics-collector.s-onetag.com/metrics
Requested by
Host: beacon.s-onetag.com
URL: https://beacon.s-onetag.com/beacon.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.10.122 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ab1c511d4246f7da1.awsglobalaccelerator.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://www.express.co.uk
access-control-expose-headers
api-version, content-length, content-md5, content-type, date, request-id, response-time
access-control-allow-headers
Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, Api-Version, Response-Time
access-control-allow-methods
POST
main.js
tag.imonomy.com/script/ Frame 8E66
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15871
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a228a7d7ccbcc-VIE
content-length
5239
main.js
tag.imonomy.com/script/ Frame D1C4
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15871
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a228a7d7dcbcc-VIE
content-length
5239
view
securepubads.g.doubleclick.net/pcs/ Frame 07F7
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstfDuRsQ0C0-GgtUI_xsv6GyqQH0MgCo4s6BquTFPHU1R1_6UdKMzMdV2--XYBGrTgeoKuzf4Du_bNvHPiWyjuJKBXvyA4si_8DsMemvimISEvXf2MAbMDpVvKxsAj1D3I_wcnBnJ8VElZ1w_PCU_8v5BcSWjLdE28f7Kr42Ron0elXpryCU0zwz4f3NKwrRY3SiIbGxREjSRg7YXxGwg7vJr6Kv9wgmkLABm2be9gfXhDLOmkGzBRUiuU5pd5gmeqbS7pJWFBaX8K_h64QANVh1BqgeIge2PrT&sig=Cg0ArKJSzFj5pJZYHd6lEAE&urlfix=1&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:55 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 07F7
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101401.js?21064803
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c1c53a4d300ac7532bec2ed085532b2fe66d27f2b592b3a9383aa649e42ed6fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29691
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:55 GMT
imgad
tpc.googlesyndication.com/pagead/ Frame 07F7
443 KB
443 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKCHp77iexABGAEyCOjikC3GP-Sx
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101401.js?21064803
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
a5f27fa2ec95057ba31d09de0d1a10e0696b7c29541ff4ceec2a42e2e5880e54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 03:55:09 GMT
x-content-type-options
nosniff
server
cafe
age
16786
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
status
200
cache-control
public, max-age=604800
content-disposition
attachment; filename="image.png"
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
453590
x-xss-protection
0
expires
Tue, 29 Oct 2019 03:55:09 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 9490
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstBQzBSERHHiHwRHzzGlXeQHQUZq8M4XTiyzIkYhRHMcEl1C1w34ypetTx4W0GkkQOi3GAMZ8ddBZ2QvrAmOBzQsLlTTKyYBtwDaUtTriJi_FrSr4Xz2OL7DIx7pB7TwFdymIFwpYmvWVo687zj5Jwkii_sb39yexCG4geeu67jQqYF6XpZq8mYVZqemOud5D0gOba3-fBWtTPj-2mUc2-SYZIgbfysv84kEIJG9fWvkm79O8ghX0eYZmnIX8tBn23GRBIm7BNvhgMldZGjOiyaBdYhNTE2FE2L&sig=Cg0ArKJSzPrcrSgASYQlEAE&urlfix=1&adurl=
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:55 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 9490
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101401.js?21064803
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c1c53a4d300ac7532bec2ed085532b2fe66d27f2b592b3a9383aa649e42ed6fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29691
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:55 GMT
imgad
tpc.googlesyndication.com/pagead/ Frame 9490
33 KB
33 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDb7aahtAEQARgBMgjXDi0KeZe8gg
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101401.js?21064803
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
479deaea78a22be3bb4ba1f4f3676454ffc3cfd88a3253285e0696fad7f304c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 02:54:28 GMT
x-content-type-options
nosniff
server
cafe
age
20427
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
status
200
cache-control
public, max-age=604800
content-disposition
attachment; filename="image.png"
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
33958
x-xss-protection
0
expires
Tue, 29 Oct 2019 02:54:28 GMT
osd.js
www.googletagservices.com/activeview/js/current/ Frame 317C
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/70ada3f1dd19fad6fb00e261111f7902014589bb6b517a5e324719b35dc36e92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:55 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 317C
0
58 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&r=300x250&w=300&h=250
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:55 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
event
event.insticator.com/v1/ Frame E0DC
0
157 B
XHR
General
Full URL
https://event.insticator.com/v1/event?event_name=event_question-loaded
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/json

Response headers

date
Tue, 22 Oct 2019 08:34:56 GMT
cf-cache-status
DYNAMIC
server
cloudflare
status
201
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
cf-ray
529a228c0ed2cbc4-VIE
content-length
0
logo-facebook.png
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
20 KB
21 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/logo-facebook.png
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1defd5791b61d4a0aa9417ca6fcae832f6ce0172e61ce0290ad567e7cd511973

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
ULtGRAG0cozVmrk8QTxkU4CRg4lLUOvG
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Fri, 04 May 2018 18:57:58 GMT
server
AmazonS3
age
67092
etag
"60b5cab66c2ac82262a0da5346037875"
x-cache
Hit from cloudfront
content-type
image/png
status
200
date
Mon, 21 Oct 2019 14:15:01 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
20991
x-amz-cf-id
MWc0SWe2sCL48bJitZvR0iU-NS-BN2Zlck-x6LTzXwdFrywTJg4Q7Q==
logo-twitter.png
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
21 KB
22 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/logo-twitter.png
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
aeb5540c19002caf52af3502b43ff4d503ec33ace0119153b8ea525cf1e1d580

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
PabYyULYcagrrnl5_VBagXR6.2QcHh82
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Fri, 04 May 2018 18:57:58 GMT
server
AmazonS3
age
67090
etag
"8e6f619e7da6deedeb066c522967841e"
x-cache
Hit from cloudfront
content-type
image/png
status
200
date
Mon, 21 Oct 2019 14:24:39 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
21925
x-amz-cf-id
GEUhlK0KqNTOsLQf5elyK4sJDirMXnUp6gD1579pE0CRbzRPuw8dhw==
logo-giphy.gif
df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/ Frame E0DC
5 KB
5 KB
Image
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/images/embed4.0/app/logo-giphy.gif
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ea00:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2ad4ec405159beb9e962e752ab2696369ee2436ac7b4e7e34c99f9ba22aa1fe4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
6s1xHKpyJMfBO7E3xKrrzQcN3hUsgxCx
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified
Tue, 21 Aug 2018 23:56:52 GMT
server
AmazonS3
age
67090
etag
"9be4d53630dea437d62f2a2441634674"
x-cache
Hit from cloudfront
content-type
image/gif
status
200
date
Mon, 21 Oct 2019 14:15:01 GMT
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
4769
x-amz-cf-id
D-M9HfQwcncdbEoMVRJQf0ijh3Fus6Xkx9y_XmyHB37yKA3MDskT3A==
b23419f3-ce46-4996-855d-8ca955057713
d3lcz8vpax4lo2.cloudfront.net/client_images/8bb3e1ef-8c2b-44f4-a210-136e23974912/ Frame E0DC
15 KB
15 KB
Image
General
Full URL
https://d3lcz8vpax4lo2.cloudfront.net/client_images/8bb3e1ef-8c2b-44f4-a210-136e23974912/b23419f3-ce46-4996-855d-8ca955057713
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:6400:1c:386f:ec80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9384744ef06bc563766e7913a308cff5a84795b9d6b50aa9d1620d412378f2af

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 06:16:07 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Fri, 11 Oct 2019 11:29:34 GMT
server
AmazonS3
age
8329
etag
"fad5e4049233a4d660e4972e57aef884"
x-cache
Hit from cloudfront
x-amz-version-id
ofEK.7RRRFC3cXj1dY39ZARSGudRV6QP
status
200
cache-control
max-age=31536000,public
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/octet-stream
content-length
14900
x-amz-cf-id
J2wddHyIrwezHe_cRFSt0Xcb954PNfBHgtplIQBmNdcQ0X9BwVaNFQ==
QGYpz_wNahGAdqQ43Rh3x4X8mNhNy_r-Kw.woff2
fonts.gstatic.com/s/worksans/v5/ Frame E0DC
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/worksans/v5/QGYpz_wNahGAdqQ43Rh3x4X8mNhNy_r-Kw.woff2
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a25e14865126cb8fb6fba6ec8e05a94bf93b5f999bcc8785a80b54001d120eb5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Work+Sans:400,500,600,700&display=swap
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 21:48:33 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:25:19 GMT
server
sffe
age
1075582
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
16576
x-xss-protection
0
expires
Thu, 08 Oct 2020 21:48:33 GMT
dc_oe=ChMIsM_f4Lqv5QIVMcTmCh1_zQkrEAAYACCc1fs5;met=1;ecn1=1;etm1=0;eid1=960584;
ade.googlesyndication.com/ddm/activity/ Frame A51C
42 B
109 B
Image
General
Full URL
https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIsM_f4Lqv5QIVMcTmCh1_zQkrEAAYACCc1fs5;met=1;ecn1=1;etm1=0;eid1=960584;
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:55 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
beacon
tag.researchnow.com/t/ Frame A51C
42 B
361 B
Image
General
Full URL
https://tag.researchnow.com/t/beacon?adn=3&ca=23075601&cr=121563804_Q1&ord=568494396&pl=253815120&pr=284008&si=4958750
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.91.215 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-91-215.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:55 GMT
Last-Modified
Thu, 11 Dec 2014 18:19:06 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
42
Expires
Tue, 22 Oct 2019 08:34:55 GMT
event
vastpixel2.adsafeprotected.com/ Frame A51C
15 B
15 B
Image
General
Full URL
https://vastpixel2.adsafeprotected.com/event?vh=fa509523a03883ffa8d1622624d02e03bb42a956&cid=5c4c420560131b5189fcf2e7&vs=0&vt=vpaid-omit&apos=0&mode=ott%3A0%2Csingle_tag%3A0%2Cdoublewrapped%3A0%2Ccsw%3A0%2Ccm%3A0%2Cfw%3A1&mas=0&t=firstQuartile&z=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.189.119.248 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-189-119-248.us-east-2.compute.amazonaws.com
Software
nginx / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:55 GMT
Server
nginx
X-Powered-By
Express
ETag
W/"f-sfeWUgIhIQAHyyjp/cGfmg"
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
15
pct25
statsf-tm.everesttech.net/stats/1/ Frame A51C
85 B
173 B
Image
General
Full URL
https://statsf-tm.everesttech.net/stats/1/pct25?didtype=UNK&date=1571733282983&psId=9PliOidgZa3Mp9drI27Q&vinst=t&seller_id=124576&s=H4sIAAAAAAAAAAGwAE__RTQDlWVdllgdzqSv8hGJ21JikMzkCdzqYvGCvGDpDaMuJGZrJUWnfEA235N60LBFOJ8rZXLRjnkcv-RqyVWHNTZm9hrdR1OMpbWHACH2Ew9olN_HkZhLWO4AMz3QFGBi1qqM7b2j3UPEbpFxTNhRouWrPIvdLfnVTPvx2y52W8yJ1uM8pcHsWGaAkUzNLdpojhE791Tn_so3VFr-oAg0qaqsfnsrpFDWPGKdQFvccG9VxQcBsAAAAA&did=&pvId=1&auth=fcd8207c1c7cd28dbffd35b554ef2a19&conn=unknown&sessId=cb9b9287f4a611e9b2f613ae17dc0006.1&bi=B087LWbQeUcwPQAR6KVevE1VuWPdz_kPGG8M-JeH2KO5zs_h5WYEgpcNByI0apg3GUO9gCerqYdqARFPcdwSfHRy8Qtz4f_8jR_egjfBF57kBNJKGWBk_RwTuw0h6JljrR39ESi7kLMSkXtNtrMLEmI9p9pZZx57gp_7sYvnXsDBXqTNrqX4Qr1y9SVZPQHi6q-sIE6V5D2VA8-XtqVVyWUY1sCode9cmB23HbImeRtXJk&mpKey=We0nATVNAtvwvrOpbjtB&price=1&env=site&cpKey=mfpahjb2JnIu8hS7531w&adKey=pMLfUI3XYnXLEIk1cLo8&rt=HTML5&vwbl=f&st=0&end=0&vol=0&dur=30&apv=J20190930&burl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&rurl=https%3A%2F%2Fwww.express.co.uk&pw=590&ph=332&w=590&h=332&wd=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Jetty(9.4.z-SNAPSHOT) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:55 GMT
via
1.1 varnish
x-pt
P=108
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status
200
x-cache-hits
0
x-region
EU-East
content-length
85
x-served-by
cache-hhn4033-HHN
pragma
no-cache
server
Jetty(9.4.z-SNAPSHOT)
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes, bytes
expires
Tue, 22 Oct 2019 03:34:55 -05:00
truncated
/ Frame 07F7
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
878a50823552b7ad1f85719c36d968db09f1b6ab5d0fc15f39f3b84f3691c665

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 9490
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
029da3ef40fa7479bb85d34076212d7e31b5814fee0eabd04c5c1ee2584e4b4d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
serve
srv.imonomy.com/internal/ Frame 31E9
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=13197&ttkan_x=4331&sum_ttkan_x=9269&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=187&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673376&tr=5&trs=4&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=7065&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
63cccaa69de7567f784a28e21c1374a1ddee0d02321b5bd4675398246cffe74c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Content-Encoding
gzip
Server
nginx
Etag
"2eebe66a79547427be6a82f48f5ef23a28d56108"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2256
serve
srv.imonomy.com/internal/ Frame 956A
7 KB
3 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=13264&ttkan_x=4291&sum_ttkan_x=9300&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=23&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673376&tr=5&trs=4&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=7629&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
9d7bdd879dad672e0e26dd18a174edd3115215d14e3b10149f8bbfdfe1928ced

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Content-Encoding
gzip
Server
nginx
Etag
"e003fc2da038877fa474b3014a405c2d0dff2fdf"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
2253
270443_3428.json
player.spotim.market/prebid/ Frame F118
39 KB
3 KB
XHR
General
Full URL
https://player.spotim.market/prebid/270443_3428.json?cb=1571733296167.9468
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebid/wrapper_hb_270443_3428.js?cb=18191
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
c013112bfa535faee1451ee2845658b4594379c235d6d4946f352e2fd61a5ca2

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:56 GMT
content-encoding
gzip
last-modified
Fri, 18 Oct 2019 16:53:43 GMT
server
nginx
etag
W/"5da9ee17-9b39"
status
200
content-type
application/json
access-control-allow-origin
https://www.express.co.uk
expires
Tue, 22 Oct 2019 08:39:56 GMT
cache-control
max-age=300
x-proxy-cache
HIT
25
event.spotxchange.com/vast/ Frame DB0F
0
349 B
Image
General
Full URL
https://event.spotxchange.com/vast/25?_x=WzE1NzE3MzMyODIsImNiOWI5Mjg3ZjRhNjExZTliMmY2MTNhZTE3ZGMwMDA2IiwiMjE2NDQ4IiwiMWU2YTAuODQzNzEuNzZkMiIsIjY0MDkiLCIxZTZhMC44NDM3MS43NmQyIiwicE1MZlVJM1hZblhMRUlrMWNMbzgiLCJjYmJlYThjYmY0YTYxMWU5YjJmNjEzYWUxN2RjMDAwNiJdJnNldGVjPU5ERmpObVJoTURobE9XRXdaVEU0TWpRNVlUTmxNMlV6T0RBM1l6ZzRaVGc9
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.111 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Origin
https://www.express.co.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
true
X-fe
141
Connection
keep-alive
Content-Length
0
beacon
search.spotxchange.com/ Frame DB0F
0
361 B
Image
General
Full URL
https://search.spotxchange.com/beacon?_a=216448&_p=1e6a0.84371.76d2&_z=1&_m=eNpFi00LwjAQRPcXye4m3aQHbykiNBXBIvbWT8TUuwZ%2Fuxqr4AwMPB6jV4gAQJkhoxRbhr7Lu5ytmXQrRGPe8SSk2pHM0COiAJNobcEV8DmyzozAcwlUdVl%2Bh%2BCVAqLxpgQT%2FtXPL32c4h6bQ4h%2BU9x9rGnn%2BsTD2ceCvZtDc5mvlQtUHbfrN0DKMKU%3D&_l=eNp1j8tKxDAUhvMsWUtJ0qRJB9zIiAjTykiLpJuSSY%2Fa2xhqC3bGeXdT6mIQPLfF9%2F2bQxFFwi9FfgiiEBkSKB5KGsioYmh772kFpvP6jEO8OeNDXeENJgFhSnJ8g52ZP6bxF3HOYs8%2BHRz%2FpKZDV9sSvuy7Ob5B%2BQqwel9e22kwI1Rlb4YWRtcZC%2F9m3QB9PfULLq3rF4UvF5Tmu916lm%2FQ8k3MhWKIizhUalWUcSGjqyzxzQhXsUKcUikUiRhF3zp7nNNtzpLsuXnK2jB5yE%2BaJSTNNNEv%2B1mf7uqiKdqi2d%2F%2BAGQmVCU%3D&_t=eNpFUduS2jAMzbf4mUIIl2Uz04dQaIeFQGbL0klLx%2BM4CvE2iTO2ExZo%2F71y2E79oCNLR7J0nADjsnJ4kgCb8SQbs%2BlwCI%2BJl02HIwbDh5S7rjt1eM5E5Uh1YpXgTnKvupG7Q82lBuITBbxRSlQn0iN1wS5GlDY8cvHeihQkbVkhUpoJpQ3NFOvSmGQp1RdtoCT%2BjSiTWMAGJpOqpJjEmpzpnPhVUxQ9onkOXamsoUI69aiHXTKAlDaqwERuTO0fB8eBah%2BgOX8wZR9aUKCNAZ73KzDHga6leTsO2iIAs1vHqXwKJnw%2BbaL1wc5bC%2BL%2FIIcoWC3w2iF9%2BopuGI3Rft5Y1rflPEQIgk9dqIMwGlk7DtDuvlj7vFu%2FIOwPWP8Tx2%2FqWiqj75sR36gGeoQXAipDcUZZtLjIWbG6BqWJn7FC%2FydoFJL47p8eSZlhuGuESu%2Bt0jg08oWsMDjsuwQpGpjiOdU18E5TZjU3XdcbSaEVHKwHb8ZCpwi9hym%2B%2Fv6vVnTsVcoUin9fIPV7HI%2Fj4Guus33ZbBzPHc8eZ7%2B319M49uJruDjk4etyst3Pf8XX2AvLpbfb8%2FP314PYLlaTuFx9%2FAuPldJu&_b=eNozYvAL9fFBI2p8qxwNIrOyK6JCUnL8XUIr%2FEIyMiOz0iv83X0rfLOyTX2rko38XVwrIqsibQGT7hUz&beacon_type=recurring&view_percent=25
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
185.94.180.123 , Netherlands, ASN35220 (SPOTX-AMS, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Server
nginx
Transfer-Encoding
chunked
Access-Control-Allow-Methods
POST, GET, PATCH, DELETE, OPTIONS
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
https://www.express.co.uk
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
serve
srv.imonomy.com/internal/ Frame 8E66
4 KB
2 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=13396&ttkan_x=4050&sum_ttkan_x=11114&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=818&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673402&tr=6&trs=5&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=8100&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
2395b9aa2b7755ea04da6b4ad6d277b77d7ae021bec647f465a147ea3e62aa6a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Content-Encoding
gzip
Server
nginx
Etag
"f1f616ed444eaae74ce858c7982d5de6da7035da"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
1293
serve
srv.imonomy.com/internal/ Frame D1C4
4 KB
2 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=13425&ttkan_x=3800&sum_ttkan_x=10983&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=202&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673402&tr=6&trs=5&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=5307&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
2eb7ad2b01824cf937a0dded22fff7ebe5e8616ea105fb56692d0bc5bb4dcd86

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Content-Encoding
gzip
Server
nginx
Etag
"7194e39c8cebd632517a2e59890b8da6cb264424"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
1292
411f1e96-3bde-4d85-b17e-63749e5f0695.js
dtm.advertising.com/ Frame FF1D
2 KB
1 KB
Script
General
Full URL
https://dtm.advertising.com/411f1e96-3bde-4d85-b17e-63749e5f0695.js
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.1.20/0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.177 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F60) /
Resource Hash
1586e2588cce8f05ba9f9819634bc63725efbd798a1fcd995b9ae5fdff09e568

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:58 GMT
content-encoding
gzip
last-modified
Wed, 16 Oct 2019 17:58:05 GMT
server
ECAcc (frc/8F60)
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript; charset=utf-8
status
200
cache-control
public, max-age=1800, s-maxage=1800, must-revalidate, proxy-revalidate=1800
content-length
1122
expires
Tue, 22 Oct 2019 09:04:58 GMT
moatapi.js
z.moatads.com/aolvidibleapi29384728347/ Frame FF1D
133 KB
44 KB
Script
General
Full URL
https://z.moatads.com/aolvidibleapi29384728347/moatapi.js
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.1.20/0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ae8dd8617d923f0098d9278754faf1693030212d957544608a5ccf7f51c88079

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Content-Encoding
gzip
Last-Modified
Tue, 28 Nov 2017 15:04:46 GMT
Server
AmazonS3
x-amz-request-id
DF86E0FFD3B16E9A
ETag
"b464a76f8a9370e63ef6d538d84c7ef7"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=11718
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
44278
x-amz-id-2
k5mASk8h/quFWq4U77P3FQ4ZRBTBiIr0K81icAFiUflTQbS2rL+1oMOyg7xoM89QPIPqxG6iff8=
local-storage.html
cdn.vidible.tv/prod/player/ad-time/ Frame 6236
0
0
Document
General
Full URL
https://cdn.vidible.tv/prod/player/ad-time/local-storage.html
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.1.20/0.js
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),
Reverse DNS
Software
ATS /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
cdn.vidible.tv
:scheme
https
:path
/prod/player/ad-time/local-storage.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
x-amz-id-2
t56N8MvNU9Lr10R9loKDU0FPdkPcZkiMTFD8JSBDYvPTPyEVc5iMOvryLpxX5Wo3VRY33PiDcoc=
x-amz-request-id
353FA5FA28049B1D
date
Sat, 12 Oct 2019 07:59:51 GMT
last-modified
Tue, 08 Oct 2019 11:30:24 GMT
etag
"3ba0167f9f40b17c70af8074ec7b3c55-df"
x-amz-server-side-encryption
AES256
x-amz-version-id
null
accept-ranges
bytes
content-type
text/html
server
ATS
referrer-policy
no-referrer-when-downgrade
cache-control
max-age=1209600
age
866107
ats-carp-promotion
1
access-control-allow-methods
GET
access-control-allow-origin
*
content-encoding
gzip
vary
Accept-Encoding
content-length
557
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block
x-content-type-options
nosniff
WGGvk3CF30m9wNZ+BAZTJyFR1XHLby71wYHFMqmw7busg9ZNuNt1y8dObTULPw7OGis+zxkolgSg63SWosWzAw==
ads.adaptv.advertising.com/a/h/ Frame FF1D
249 B
828 B
XHR
General
Full URL
https://ads.adaptv.advertising.com/a/h/WGGvk3CF30m9wNZ+BAZTJyFR1XHLby71wYHFMqmw7busg9ZNuNt1y8dObTULPw7OGis+zxkolgSg63SWosWzAw==?cb=1571733291718&gdpr=&gdpr_consent=&pet=preroll&pageUrl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&eov=eov&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=300&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=2&p.vw.viewable=0&p.vw.viewableOpportunity=0&referrerUrl=&width=400
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.1.20/0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.121.26.224 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-121-26-224.eu-central-1.compute.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
6c138576e7381d3ab0aa7b511adc3a7cbb7fe3a3d33768bad05577f5dfc60cad

Request headers

Accept
text/javascript, application/json, text/html, application/xml, text/xml, */*
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Content-Encoding
gzip
Server
adaptv/1.0
Content-Type
text/xml
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
192
Expires
0
display.gif
trk.vidible.tv/trk/ Frame FF1D
43 B
363 B
Image
General
Full URL
https://trk.vidible.tv/trk/display.gif?bcid=5909e7c27cdce053ec937ebe&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.1.20&r=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&s=true&sid=c7133b21-cc9f-452b-ae05-b41141ce5694&vvuid=986c2cfe-6113-4a83-a2f5-1dd54483a6b3&orgId=21364&plcid=1250361&vrid=f9912b31-abb9-4398-bb55-2d9ba1040500&ab=0&dt=1717&h=300&spaceid=793604934&w=400&cb=0.12842552938478313
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.194.34.120 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-194-34-120.eu-central-1.compute.amazonaws.com
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx/1.10.3 (Ubuntu)
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:56 GMT
ad-request.gif
trk.vidible.tv/trk/ Frame FF1D
43 B
363 B
Image
General
Full URL
https://trk.vidible.tv/trk/ad-request.gif?bcid=5909e7c27cdce053ec937ebe&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.1.20&r=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&s=true&sid=c7133b21-cc9f-452b-ae05-b41141ce5694&vvuid=986c2cfe-6113-4a83-a2f5-1dd54483a6b3&orgId=21364&plcid=1250361&vrid=f9912b31-abb9-4398-bb55-2d9ba1040500&at=preroll&ps=html5-vpaid&spaceid=793604934&p.vw.active=1&p.vw.sound=0&vwa=0&vwm=-1&cb=0.3754898096622541
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.194.34.120 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-194-34-120.eu-central-1.compute.amazonaws.com
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx/1.10.3 (Ubuntu)
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:56 GMT
ad-engine-request.gif
trk.vidible.tv/trk/ Frame FF1D
43 B
363 B
Image
General
Full URL
https://trk.vidible.tv/trk/ad-engine-request.gif?bcid=5909e7c27cdce053ec937ebe&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.1.20&r=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&s=true&sid=c7133b21-cc9f-452b-ae05-b41141ce5694&vvuid=986c2cfe-6113-4a83-a2f5-1dd54483a6b3&orgId=21364&plcid=1250361&vrid=f9912b31-abb9-4398-bb55-2d9ba1040500&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=400&p.vw.active=1&p.vw.sound=0&vwa=0&vwm=-1&h=300&cb=0.7980678736028757
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.194.34.120 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-194-34-120.eu-central-1.compute.amazonaws.com
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx/1.10.3 (Ubuntu)
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:56 GMT
ad-engine-response.gif
trk.vidible.tv/trk/ Frame FF1D
43 B
363 B
Image
General
Full URL
https://trk.vidible.tv/trk/ad-engine-response.gif?bcid=5909e7c27cdce053ec937ebe&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.1.20&r=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&s=true&sid=c7133b21-cc9f-452b-ae05-b41141ce5694&vvuid=986c2cfe-6113-4a83-a2f5-1dd54483a6b3&orgId=21364&plcid=1250361&vrid=f9912b31-abb9-4398-bb55-2d9ba1040500&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=400&aert=151&ar=no&fo=0&ft=0&h=300&cb=0.9261840886684085
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.194.34.120 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-194-34-120.eu-central-1.compute.amazonaws.com
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx/1.10.3 (Ubuntu)
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:56 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 0FC8
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuvxllRRbUeoV_OgNUevsYTa975cbR1JfuBExwNqZdiYr0tH1k_q1itF2DVmjsR0YU18Zx4LaTjxw&sig=Cg0ArKJSzFYnzkLR0CLFEAE&id=lidar2&adk=1&p=0,0,250,970&tos=1213,0,0,0,0&mtos=1213,1213,1213,1213,1213&mcvt=1213&rs=5&tfs=756&tls=1969&mc=1&lte=-1&bas=0&bac=0&met=no&la=1&avms=nio&niot_obs=5&niot_cbk=756&lm=4&bs=1585,1200&ps=1585,10596&ss=1600,1200&tt=1968&pt=2&bin=2&deb=1-1-1-3-6-0-0-6-0-0-0&tvt=1965&iframe_loc=https%253A%252F%252Fwww.express.co.uk%252Ffinance%252Fpersonalfinance%252F1192439%252Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&is=970,250&url=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&itpl=0&r=v&v=20191021
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:56 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&ac=1&bq=7&i=AOL_VIDIBLE_API1&t=1571733296480&de=346006382323&d=227%3A-%3A-%3A-&bo=express.co.uk&bd=express.co.uk&f=0&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:56 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:56 GMT
in
c2.u5c93.com/v5/
2 B
363 B
Other
General
Full URL
https://c2.u5c93.com/v5/in
Requested by
Host: players.brightcove.net
URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.246.207.119 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-246-207-119.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryiKXNGeuo4amdGHF0

Response headers

date
Tue, 22 Oct 2019 08:34:56 GMT
status
200
x-powered-by
Express
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary
Origin
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.express.co.uk
access-control-allow-credentials
true
content-length
2
pixel.gif
spotxchangejsvideo759622536126.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://spotxchangejsvideo759622536126.s.moatpixel.com/pixel.gif?m=1&vpt=9012&iv=1&tuv=1920&ivt=2902&cvt=2902&fvt=0&cfvt=0&vol=0&at=0&cat=0&gmv=0&gmt=0&cgmt=0&apd=9012&dh=30000&hov=0&th=-1&d=express.co.uk&w=590&h=332&sp=0&bfa=1&L1id=124576&L2id=216448&L3id=6409&L4id=1e6a0.84371.76d2&S1id=www.express.co.uk&S2id=-&ord=1571733287468&r=202463855702&t=q1&zMoatImpressionId=cbbea8cbf4a611e9b2f613ae17dc0006&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:56 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 22 Oct 2019 08:34:56 GMT
411f1e96-3bde-4d85-b17e-63749e5f0695
dtm.advertising.com/ids/ Frame 6F61
0
0
Document
General
Full URL
https://dtm.advertising.com/ids/411f1e96-3bde-4d85-b17e-63749e5f0695?secure=true
Requested by
Host: dtm.advertising.com
URL: https://dtm.advertising.com/411f1e96-3bde-4d85-b17e-63749e5f0695.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.177 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FEA) /
Resource Hash

Request headers

:method
GET
:authority
dtm.advertising.com
:scheme
https
:path
/ids/411f1e96-3bde-4d85-b17e-63749e5f0695?secure=true
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
APID=VAd3679da4-f4a6-11e9-995c-02ae75fbef16
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
content-encoding
gzip
cache-control
public, max-age=1800, s-maxage=1800, must-revalidate, proxy-revalidate=1800
content-type
text/html; charset=utf-8
date
Tue, 22 Oct 2019 08:34:56 GMT
expires
Tue, 22 Oct 2019 09:04:56 GMT
last-modified
Sun, 15 Sep 2019 02:48:02 GMT
server
ECAcc (frc/8FEA)
vary
Accept-Encoding
x-cache
HIT
content-length
3393
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame BFE2
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:56 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 764E
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28353
x-xss-protection
0
server
cafe
etag
1500920369728438592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:56 GMT
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&a=win&t=1&tl=12&ai=5a42195720e31100021a1fa9&fb=true&bs=NXLxU8qxH0o&bqi=1017&r=11&as=vpaid%20both&ca=adserver&lt=5316&co=adsmanager&p=2747521162&rand=6610010424&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:56 GMT
via
1.1 google
alt-svc
clear
gen_204
pagead2.googlesyndication.com//pagead/ Frame 9DE9
0
58 B
Image
General
Full URL
https://pagead2.googlesyndication.com//pagead/gen_204?v=20191021&id=av-js&type=verif&vtype=capt&i=1&adk=550597170&b_name=nio&v_name=geo&b_exp=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&v_exp=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&diff=0&diff_buckets=0&v=20191021
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:56 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
1x1.gif
s3.amazonaws.com/brt-appnexus-cookie-sync/ Frame 317C
Redirect Chain
  • https://edba.brealtime.com/
  • https://s3.amazonaws.com/brt-appnexus-cookie-sync/1x1.gif
42 B
397 B
Image
General
Full URL
https://s3.amazonaws.com/brt-appnexus-cookie-sync/1x1.gif
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.160.69 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:58 GMT
Last-Modified
Fri, 10 Nov 2017 21:53:47 GMT
Server
AmazonS3
x-amz-request-id
E725E9EC8456BDF0
ETag
"d89746888da2d9510b64a9f031eaecd5"
Content-Type
image/gif
Accept-Ranges
bytes
Content-Length
42
x-amz-id-2
T0ktgFDJL4f/nzydeZLatQ1im24tOkC5V3jaMGXwq8MWQ7dFqHbrEfwsKCB6PHJMiqr1FWq3LZI=

Redirect headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Server
cloudflare
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
Location
https://s3.amazonaws.com/brt-appnexus-cookie-sync/1x1.gif
Cache-Control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
529a22913813d6f5-FRA
Expires
Thu, 01 Jan 1970 00:00:01 GMT
integrator.js
adservice.google.de/adsid/ Frame BFE2
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame BFE2
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame BFE2
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:56 GMT
integrator.js
adservice.google.de/adsid/ Frame 764E
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 764E
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.express.co.uk
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Oct 2019 08:34:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/ Frame 764E
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
530792698881188819
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 22 Oct 2019 08:34:56 GMT
bridge-30709.js
video-ads.rubiconproject.com/video/ Frame 8E19
62 KB
19 KB
Script
General
Full URL
https://video-ads.rubiconproject.com/video/bridge-30709.js
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.105.3 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-105-3.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
120afadff73d06a7f0815a38e863f5fe090899f35b623b03a05c5329d7343d6c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:56 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 Jul 2019 08:10:40 GMT
Server
Apache/2.2.15 (CentOS)
ETag
"6010b-f8cd-58ef5a92d4000"
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, GET, PUT, OPTIONS, PATCH, DELETE
Content-Type
text/javascript
Access-Control-Allow-Origin
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Accept-Charset,X-Accept,Content-Type
Content-Length
19411
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame 5013
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90&adk=1913573300&adf=1174745505&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424140312&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424140312&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=424140312&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
__cfduid=d120c962c45cde58982720ea0f0458f191571733295
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:57 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:08:26 GMT
cache-control
max-age=86400
set-cookie
a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a2295acb3cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424140312&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:57 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame BFE2
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:57 GMT
postmessage.html
tag.imonomy.com/script/internal/passback/ Frame DE6E
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7169237679086737&output=html&h=90&slotname=Direct_NS_728x90&adk=1913573300&adf=1174745504&w=728&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%...
  • https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424151813&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud...
0
0
Document
General
Full URL
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424151813&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
tag.imonomy.com
:scheme
https
:path
/script/internal/passback/postmessage.html?id=424151813&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
accept-encoding
gzip, deflate, br
cookie
__cfduid=d120c962c45cde58982720ea0f0458f191571733295
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest

Response headers

status
200
date
Tue, 22 Oct 2019 08:34:58 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2019 07:32:41 GMT
cache-control
max-age=86400
set-cookie
a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
529a2297a888cbcc-VIE
content-encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://tag.imonomy.com/script/internal/passback/postmessage.html?id=424151813&target=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 22 Oct 2019 08:34:57 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 764E
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191015/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571656559023965"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29155
x-xss-protection
0
expires
Tue, 22 Oct 2019 08:34:57 GMT
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=express.co.uk&p=%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&u=kczELBZB4Amk2H9r&d=express.co.uk&g=33715&g0=Finance%2C%20Personal%20Finance&g1=Jess%20Sheldon&n=1&f=00001&c=0.25&x=0&m=0&y=10596&o=1585&w=1200&j=30&R=1&W=0&I=0&E=5&e=4&r=&b=1865&t=C-eksfDSSKH4BcQY-8CnIxsFDscYtG&V=116&tz=-120&_vi=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&_vp=5798750504001&_vdd=video%40express.co.uk&_vs=s1&_vt=ct&_vap=&_vtn=https%3A%2F%2Fhttpsak-a.akamaihd.net%2F2540076170001%2F2540076170001_5798751587001_5798750504001-th.jpg%3FpubId%3D2540076170001%26videoId%3D5798750504001&_vd=-1&sn=3&sv=B7NeDNBfky4iB0YOZ0tHo-iw4yCY&sd=1&im=067b9fff&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.231.246 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-231-246.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Tue, 22 Oct 2019 08:34:57 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
p2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=2&...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=2...
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10076&ns_st_cl=30000&ns_st_el=0&ns_st_hc=1&ns_st_mp=brightcove&ns_st_mv=6.19.2&ns_st_pn=1&ns_st_tp=1&ns_st_ad=pre-roll&ns_st_ci=16df29ab224&ns_st_pt=10076&ns_st_dpt=10076&ns_st_ipt=10076&ns_st_et=10076&ns_st_det=10076&ns_st_upc=10076&ns_st_dupc=10076&ns_st_iupc=10076&ns_st_upa=10076&ns_st_dupa=10076&ns_st_iupa=10076&ns_st_lpc=10076&ns_st_dlpc=10076&ns_st_lpa=10076&ns_st_dlpa=10076&ns_st_pa=10076&ns_ts=1571733297537&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_vo=100&ns_st_ws=norm&ns_st_ki=1200000&ns_st_pl=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&ns_st_pr=&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=&ns_st_ty=video&ns_st_ct=va11&ns_st_cs=0x0&ns_st_ge=News&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=*null&ns_st_ti=*null&ns_st_ami=pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2&ns_st_amt=3_30s_Desktop_Germany_German_Context_Politics%20%26%20Current%20Affairs_RUK8322_USD&ns_st_ams=ima&c3=northernandshell&c4=expressuk&c6=*null&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c8=*null&c9=*null
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:57 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=12961652&ns_ap_pn=js&ns_ap_pfm=html&ns_type=hidden&ns_st_sv=6.1.0.170130&ns_st_pv=1.5.1.190515&ns_st_smv=5.8&ns_st_it=c&ns_st_id=1571733281554&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10076&ns_st_cl=30000&ns_st_el=0&ns_st_hc=1&ns_st_mp=brightcove&ns_st_mv=6.19.2&ns_st_pn=1&ns_st_tp=1&ns_st_ad=pre-roll&ns_st_ci=16df29ab224&ns_st_pt=10076&ns_st_dpt=10076&ns_st_ipt=10076&ns_st_et=10076&ns_st_det=10076&ns_st_upc=10076&ns_st_dupc=10076&ns_st_iupc=10076&ns_st_upa=10076&ns_st_dupa=10076&ns_st_iupa=10076&ns_st_lpc=10076&ns_st_dlpc=10076&ns_st_lpa=10076&ns_st_dlpa=10076&ns_st_pa=10076&ns_ts=1571733297537&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_vo=100&ns_st_ws=norm&ns_st_ki=1200000&ns_st_pl=Martin%20Lewis%20gives%20his%20tips%20on%20how%20to%20spot%20a%20scammer&ns_st_pr=&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=&ns_st_ty=video&ns_st_ct=va11&ns_st_cs=0x0&ns_st_ge=News&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=*null&ns_st_ti=*null&ns_st_ami=pMLfUI3XYnXLEIk1cLo8-1e6a0.84371.76d2&ns_st_amt=3_30s_Desktop_Germany_German_Context_Politics%20%26%20Current%20Affairs_RUK8322_USD&ns_st_ams=ima&c3=northernandshell&c4=expressuk&c6=*null&c7=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&c8=*null&c9=*null
Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:57 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 07F7
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstvqWnIrXvUW9Acd57BvFHuXbA-RjV9N4SQGCuDBDmexyFfKRVlzCP36tfrcc34GbDyHjcNXnpSXSBk_nXZGVd_onkHlTDJUNXYpSfd7ZY&sig=Cg0ArKJSzHISN6NNpXliEAE&adk=2369279298&tt=1146&bs=1585%2C1200&mtos=1148,1148,1148,1148,1148&tos=1148,0,0,0,0&p=0,0,250,300&mcvt=1148&rs=3&ht=0&tfs=301&tls=1449&mc=1&lte=1&bas=0&bac=0&met=no&avms=nio&niot_obs=10&niot_cbk=108&md=2&lm=2&rst=1571733295808&rpt=415&isd=0&oseid=3&xdi=0&ps=1585%2C10596&ss=1600%2C1200&pt=303&bin=1&deb=1-2-2-2-8-13-18-6-0-0-0&tvt=1440&is=300%2C600&iframe_loc=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&r=v&id=osdim&vs=4&uc=8&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20191021
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
201
stats.aws.rubiconproject.com/stats/video/bridge-loaded/js/17184/168186/810158/ Frame 8E19
49 B
422 B
Image
General
Full URL
https://stats.aws.rubiconproject.com/stats/video/bridge-loaded/js/17184/168186/810158/201
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.21.61.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-23-21-61-195.compute-1.amazonaws.com
Software
Apache/2.4.6 (CentOS) /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:57 GMT
Server
Apache/2.4.6 (CentOS)
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
no-cache, no-cache, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
49
Expires
Mon, 01 Jun 2009 01:06:09 GMT, Thu, 1 Jan 2015 00:00:00 GMT
vast.xml
optimized-by.rubiconproject.com/a/api/ Frame 8E19
195 B
2 KB
XHR
General
Full URL
https://optimized-by.rubiconproject.com/a/api/vast.xml?account_id=17184&site_id=168186&zone_id=810158&size_id=201&tg_c.language=en&x_source.pchain=1.0,1!streamrail,266658,1,,,&p_window.depth=0&rf=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&p_window.url=&p_window.w=400&p_window.h=300&p_aso.video.ext.ad.w=400&p_aso.video.ext.ad.h=300&width=400&height=300&p_aso.video.api=2&p_aso.video.mimes=application/javascript,video/mp4&tk_vpaid=1&cb=7904598945621890&rp_secure=1
Requested by
Host: video-ads.rubiconproject.com
URL: https://video-ads.rubiconproject.com/video/bridge-30709.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
38cc5e638623027e14d83d21653e26a5d1f005289c2c87645fadf419fa520dc3

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:57 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.express.co.uk
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/xml
Keep-Alive
timeout=5, max=276
Content-Length
195
Expires
Wed, 17 Sep 1975 21:32:10 GMT
main.js
tag.imonomy.com/script/ Frame BFE2
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:57 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15873
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a2296ff4ccbcc-VIE
content-length
5239
serve
srv.imonomy.com/internal/ Frame BFE2
4 KB
2 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=15044&ttkan_x=1847&sum_ttkan_x=11116&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=187&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673402&tr=6&trs=5&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=1130&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
2b3407afb58fba21cc477803b7b0f23dbe3762a66c6cfa7ff8cd08c2115398c6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:58 GMT
Content-Encoding
gzip
Server
nginx
Etag
"f592b93d4cca5fab9f74b3bd97ed5833f45b7cab"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
1293
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=9fe44dc9-10c4-9fe3-1c98-a636a43bbfd2&tv={c:rLpgZS,pingTime:5,time:5806,type:p,clog:[{piv:69,vs:pp,r:,w:300,h:600,t:485}],es:0,sc:1,ha:1,gm:1,slTimes:{i:0,o:0,n:0,pp:5807,pm:0},slEvents:[{sl:pp,t:485,wc:0.0.1600.1200,ac:948.788.300.600,am:i,cc:948.788.300.600,piv:69,obst:0,th:0,reas:,bkn:{piv:[5372~50],as:[5372~300.600]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:744,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a.10079|11b*.10079|11b1|11b2|11c.10079|11d.10079|11e.10079|11e1|11f.10079|11f1|11g.10079|11g1|11h|11i,idMap:11b*,rend:1,renddet:DIV.qs.sn,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:58 GMT
X-Server-Name
dt43dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2100588899&t=event&ni=1&_s=12&dl=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fr...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-545303-1&cid=7843761.1571733282&jid=603512821&_gid=1331413262.1571733282&gjid=713982082&_v=j79&z=241390402
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=603512821&_v=j79&z=241390402
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=603512821&_v=j79&z=241390402&slf_rd=1&random=3039436926
42 B
109 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=603512821&_v=j79&z=241390402&slf_rd=1&random=3039436926
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:57 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-545303-1&cid=7843761.1571733282&jid=603512821&_v=j79&z=241390402&slf_rd=1&random=3039436926
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
lg.php
cdn.firstimpression.io/delivery/
1 B
261 B
XHR
General
Full URL
https://cdn.firstimpression.io/delivery/lg.php?bannerid=35599&campaignid=32&zoneid=106363&loc=%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&spcPVID=2238207657771008&ficb=84136
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.64.113 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-64-113.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 / PHP/7.0.33
Resource Hash
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

Request headers

Accept
*/*
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

pragma
no-cache
date
Tue, 22 Oct 2019 08:34:57 GMT
content-encoding
gzip
server
nginx/1.14.1
x-powered-by
PHP/7.0.33
status
200
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
expires
0
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=6b9fb135-7986-57bd-f683-c2254dd2a46e&tv={c:rLph5R,pingTime:5,time:5978,type:p,clog:[{piv:100,vs:i,r:,w:8,h:8,t:575}],es:0,sc:1,ha:1,gm:1,slTimes:{i:5978,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:575,wc:0.0.1600.1200,ac:0.5.8.8,am:i,cc:0.5.8.8,piv:100,obst:0,th:0,reas:,bkn:{piv:[5443~100],as:[5443~8.8]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:1284,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a.10079|11a1|11b.10079|11b1|11b2|11b3|11c.10079|11c1|11d.10079|11d1|11e.10079|11e1|11f.10079|11f1|11g*.10079|11g1|11h|11i|11j,idMap:11g*,rend:0,renddet:DIV.us.sn,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:58 GMT
X-Server-Name
dt43dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
308 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=10079&asId=6b9fb135-7986-57bd-f683-c2254dd2a46e&tv={c:rLph5T,pingTime:5,time:5980,type:pf,clog:[{piv:100,vs:i,r:,w:8,h:8,t:575}],es:0,sc:1,ha:1,gm:1,slTimes:{i:5980,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:575,wc:0.0.1600.1200,ac:0.5.8.8,am:i,cc:0.5.8.8,piv:100,obst:0,th:0,reas:,bkn:{piv:[5445~100],as:[5445~8.8]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:1284,fm:rFCgIvA+11|12|13|14|15|16|17|18|19|1a1|1b|1c|1d|1e|1f1|1f2|1g11|1g12|1g131|1g14|1h1|1i1|1j1|1k1|1l1|1m1|1n|1o11|1o12|1o13|1o14|1o15|1o16|1o17|1o18|1o19|1o1a|1o1b|1o1c|1o1d|1o1e|1o1f|1o1g|1o1h|1o1i|1o1j|1o1k|1p11|1p2|1p3|1p4|1q|1r1|1s11|1s2|1s3|1t11|1t2|1t3|1u11|1u2|1u3|1v1|1v2|1w1|1w2|1x|1y|1z1|1z2|1101|1102|11111|1112|1113|11211|1122|1123|11311|1132|1133|11411|1142|1143|11511|1152|1153|11611|11612|11613|11614|11615|11616|11617|11618|11619|1161a|1161b|1161c|1161d|1161e|1161f|1161g|1161h|1161i|1161j|11711|1172|1173|11811|119|11a.10079|11a1|11b.10079|11b1|11b2|11b3|11c.10079|11c1|11d.10079|11d1|11e.10079|11e1|11f.10079|11f1|11g*.10079|11g1|11h|11i|11j,idMap:11g*,rend:0,renddet:DIV.us.sn,rmeas:1}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.37.20 , United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
daldt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Oct 2019 08:34:58 GMT
X-Server-Name
dt43dal.dal.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
main.js
tag.imonomy.com/script/ Frame 764E
19 KB
5 KB
Script
General
Full URL
https://tag.imonomy.com/script/main.js
Requested by
Host: www.express.co.uk
URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2f46 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 08:34:58 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
15874
etag
"cb0c31892a05b4133a1f0930a8ceae1eb531712f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
529a229a6ececbcc-VIE
content-length
5239
serve
srv.imonomy.com/internal/ Frame 764E
4 KB
2 KB
Script
General
Full URL
https://srv.imonomy.com/internal/serve?cb=imonomy_render(va_resp$$fid$$,false,null)&frai=1&ude=false&ufp=false&ufe=false&fwc=undefined&fcl=imonomy_strip_frame&timepreload=1571733282726&ptaken=15651&ttkan_x=2387&sum_ttkan_x=11687&format=6&sid=14567721676&cqt=11%2C12%2C15%2C22%2C26%2C30&cid=imonomy_stripmyEdge_auto&subid=none_personalized_ads&httpsite=true&fid=23&ctxu=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=express.co.uk&uid=14567673402&tr=6&trs=5&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&img=true&cbs=1714&rf=frame
Requested by
Host: tag.imonomy.com
URL: https://tag.imonomy.com/script/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.114.216.54 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:58 GMT
Content-Encoding
gzip
Server
nginx
Etag
"e1c1430208ecabb423f593936f89dd25685244f9"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=5
Connection
keep-alive
Content-Length
1291
x
k.streamrail.com/ Frame 40CC
0
40 B
Image
General
Full URL
https://k.streamrail.com/x?at=vpaid-js&s=d06ddc40-f4a6-11e9-a5e9-6ddd204d4f4d&mv=0f8_7f9&hh=vpaid-c8zm&or=587dfc37febaab0002000001&d=express.co.uk&pi=5cb74dcb4b194a0001f77ed6&w=400&h=300&ps=medium&sam_js_ver=1894&si=domain%3Dwww.express.co.uk%26os%3DDesktop%26spotId%3Dsp_9LMINbK9%26source%3Drecirculation%26utm%3D&l=1&en=d&bl=2041&tc=5cb74c624b194a0001f77d99&v=1228&pl=bx_1228&cc=QRk&ns=0&os=mac%20os%20x&ov=10.14.5&b=chrome&bv=74&ip=144.76.109.30&uc=0&wi=MD%2BjVMbjHk5HOj9UllW9wC8MTbWjILKy&dw=400&dh=300&ds=medium&ac=12&blf=3047&r1=89edd985d3359329274111bfece56ee5&ts=6rz%2FOg&p1=player_1_load_1571733290353&a=win&t=1&tl=12&ai=5cdd193b804dce00018382db&fb=true&bs=NXLxU8C1F0k&bqi=1017&r=12&as=vpaid%20both&ca=adserver&lt=6987&co=adsmanager&p=1469780071&rand=6903341520&dd=express.co.uk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.247.57 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
57.247.178.107.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Tue, 22 Oct 2019 08:34:58 GMT
via
1.1 google
alt-svc
clear
bridge-30709.js
video-ads.rubiconproject.com/video/ Frame 3184
62 KB
19 KB
Script
General
Full URL
https://video-ads.rubiconproject.com/video/bridge-30709.js
Requested by
Host: sdk.streamrail.com
URL: https://sdk.streamrail.com/blade/sr.bladex.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.105.3 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-105-3.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
120afadff73d06a7f0815a38e863f5fe090899f35b623b03a05c5329d7343d6c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:58 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 Jul 2019 08:10:40 GMT
Server
Apache/2.2.15 (CentOS)
ETag
"6010b-f8cd-58ef5a92d4000"
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, GET, PUT, OPTIONS, PATCH, DELETE
Content-Type
text/javascript
Access-Control-Allow-Origin
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Accept-Charset,X-Accept,Content-Type
Content-Length
19411
204
stats.aws.rubiconproject.com/stats/video/bridge-loaded/js/17184/260258/1289094/ Frame 3184
49 B
422 B
Image
General
Full URL
https://stats.aws.rubiconproject.com/stats/video/bridge-loaded/js/17184/260258/1289094/204
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.21.61.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-23-21-61-195.compute-1.amazonaws.com
Software
Apache/2.4.6 (CentOS) /
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 08:34:58 GMT
Server
Apache/2.4.6 (CentOS)
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
no-cache, no-cache, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
49
Expires
Mon, 01 Jun 2009 01:06:09 GMT, Thu, 1 Jan 2015 00:00:00 GMT
serve
srv.imonomy.com/internal/
0
0

serve
srv.imonomy.com/internal/
0
0

vast.xml
optimized-by.rubiconproject.com/a/api/ Frame 3184
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
tpc.googlesyndication.com
URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?v=1-0-36
Domain
tpc.googlesyndication.com
URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Domain
tpc.googlesyndication.com
URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Domain
srv.imonomy.com
URL
https://srv.imonomy.com/internal/serve?v=2&format=6&img=true&cid=imonomy_strip_auto_rf_ns&ab=&isps=false&rdn=imonomy_image_$$fid$$&fid=4&cb=imonomy.strips.hook_strip_action($$fid$$,%20imonomy_image_$$fid$$,%20false%20,true%20,%204%20,%200)&sid=14567721676&terms=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&httpsite=true&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&dm=express.co.uk&charset=UTF-8&timepreload=1571733282726&ptaken=15785&ttaken=15785&ttkan_x=0&sum_ttkan_x=0&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&cqt=11,12,15,22,26,30&ln=en&ct=0&w=1600&h=1200&pxr=1&ppi=96&loc=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=www.express.co.uk&subid=none_personalized_ads&rtb_highest_price=
Domain
srv.imonomy.com
URL
https://srv.imonomy.com/internal/serve?v=2&format=6&img=true&cid=imonomy_strip_auto_rf_ns&ab=&isps=false&rdn=imonomy_image_$$fid$$&fid=5&cb=imonomy.strips.hook_strip_action($$fid$$,%20imonomy_image_$$fid$$,%20false%20,true%20,%205%20,%201)&sid=14567721676&terms=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&httpsite=true&keywords=tax%20refund%2C%20hmrc%2C%20way%2C%20tax%2C%20refund&dm=express.co.uk&charset=UTF-8&timepreload=1571733282726&ptaken=15786&ttaken=15786&ttkan_x=0&sum_ttkan_x=0&ttl=HMRC%20reveals%20way%20to%20spot%20bogus%20tax%20refund%20text%20message%20scam%20%7C%20Personal%20Finance%20%7C%20Finance%20%7C%20Express.co.uk&cqt=11,12,15,22,26,30&ln=en&ct=0&w=1600&h=1200&pxr=1&ppi=96&loc=https%3A//www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest&dm=www.express.co.uk&subid=none_personalized_ads&rtb_highest_price=
Domain
optimized-by.rubiconproject.com
URL
https://optimized-by.rubiconproject.com/a/api/vast.xml?account_id=17184&site_id=260258&zone_id=1289094&size_id=204&tg_c.language=en&x_source.pchain=1.0,1!streamrail,266658,1,,,&p_window.depth=0&rf=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&p_window.url=&p_window.w=400&p_window.h=300&p_aso.video.ext.ad.w=400&p_aso.video.ext.ad.h=300&width=400&height=300&p_aso.video.api=2&p_aso.video.mimes=application/javascript,video/mp4&tk_vpaid=1&cb=9680717356548246&rp_secure=1

Verdicts & Comments Add Verdict or Comment

468 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| event object| onformdata object| onpointerrawupdate function| dynViewport object| googletag string| CMPUI_URL object| dataLayer function| $ function| jQuery string| __cmpEnv function| __cmp object| ExpressApp function| tmpl object| lz object| utag_data string| gs_channels function| grapeshotInit object| _sf_async_config function| getIsIrisSupported object| lotamePid function| extractPid function| noop object| d object| e object| indexExchangeV2 string| IndexHTversion function| getWidth function| isMobile function| isNotDesktop object| slotsArray object| wtHBSettings boolean| toggle_for_google_surveys function| setUpAgknTag string| ChannelName boolean| showPageSkinFallback object| _comscore object| gigya object| expressoOptions string| expressoScriptSrc number| gvl string| GoogleAnalyticsObject function| ga function| webpackJsonp_spotim_702388420 function| setImmediate function| clearImmediate object| SPOTIMInternals object| __core-js_shared__ object| $$SPOTIM_DEBUG$$ function| _spotim_fn number| SECTION_ID string| WEBROOT string| GA_PREPEND string| SECURE_LOGIN_URL boolean| showAdverts function| check_for_pii function| redirect_if_pii string| asyncGpt object| gptadslots function| ISMScreenRes string| currentUrl object| gptadtags object| amznApsPromise function| UUIDv1 function| clamp object| STR undefined| UUID object| Audit object| _io_config function| getCookie string| REFERRER string| cookielaw boolean| returning_visitor boolean| vimo_none_personalized_ads object| __io undefined| xmlHttp object| APESTER boolean| VIDEOJS_NO_DYNAMIC_STYLE function| videojs object| videojsLoscore function| videojsFlash object| videojsFlashlsSourceHandler object| videojsHttpStreaming function| videojsProxyTracks function| videojsPerSourceBehaviors function| videojsSeekEvents function| videojsContextmenu function| videojsContextmenuUi function| videojsPlayerInfo function| videojsBcAnalytics function| videojsErrors function| videojsBcCatalog object| videojsDock function| videojsPlaylist function| videojsSocial object| videojsIma3 function| nsIma3Plugin object| ApHandler object| CustomPlayer function| wtAdTracer object| ns_ object| pSUPERFLY_mab object| _cbq object| pSUPERFLY object| pSUPERFLY_video object| _cbv_strategies object| _cbv function| WebVTT boolean| irisLibraryLoaded boolean| irisLibraryPending object| pendingRequests function| loadPendingRequests function| bc string| brightcoveBrandsafety object| google_tag_data object| gaplugins object| gaGlobal object| gaData boolean| utag_condload object| utag object| google_tag_manager object| headertag object| Criteo function| headertag_render object| pbjs object| rubicontag function| pbjsChunk object| core function| cygnus_index_parse_res function| index_render object| cygnus_index_args object| wtHBAnalyticsEvents function| wtHBRegisterPlayer object| _IndexRequestData function| cygnus_index_ready_state object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| wtStream function| udm_ object| ns_p object| COMSCORE object| _cb_shared function| webpackJsonp_spotim_283688472 boolean| SpotImMessagesCountScriptRun object| OBR string| OB_releaseVer function| OBR$ object| outbrain object| outbrain_rater object| __SPOTIM__ string| __SPOTIM_PAGE_VIEW_ID__ number| SPOTIM_INTERVAL_NOTIFICATION object| regeneratorRuntime string| $$SPOTIM_VID$$ string| $$SPOTIM_BID$$ boolean| $$SPOTIM_ACTIVATE_RC_CALLED$$ function| __SPOTIM_DISABLE_ADS__ string| __SPOTIM_SPOT_ID__ object| __exposedModules boolean| $$SPOTIM_TRACK_SPOTLOAD$$ boolean| relatedRailGlobal boolean| sideRailGlobal function| initializeIrisPlugin string| _io_uniques_holing_params object| vttjs object| criteo_pubtag number| google_srt boolean| google_measure_js_timing boolean| google_noFetch number| __google_ad_urls_id object| irisInstances object| iris object| _google_rum_ns_ object| google_persistent_state_async number| google_global_correlator function| mb function| Goog_AdSense_Lidar_sendVastEvent function| Goog_AdSense_Lidar_getViewability function| Goog_AdSense_Lidar_getUrlSignalsArray function| Goog_AdSense_Lidar_getUrlSignalsList object| ima object| google object| closure_lm_55588 object| act object| globalsharebuttons object| showShareBarUI_params object| google_conversion_id object| google_conversion_label object| google_custom_params object| google_remarketing_only object| _cbm boolean| CLOSURE_NO_DEPS object| SpotX function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_conversion_format object| google_enable_display_cookie_match object| google_conversion_type object| google_conversion_order_id object| google_conversion_language object| google_conversion_value object| google_conversion_evaluemrc object| google_conversion_currency object| google_conversion_domain object| google_conversion_color object| google_disable_viewthrough object| google_gtag_event_data object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| onload_callback object| opt_image_generator object| google_conversion_page_url object| google_conversion_referrer_url object| google_gtm object| google_gcl_cookie_prefix object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_disable_merchant_reported_conversions object| google_additional_conversion_params function| _extends function| _typeof function| LazyLoad object| ll object| jQuery111305262133224323708 function| withinviewport function| addToHomescreen object| resolver string| btnImg object| commentIco object| closure_lm_521088 boolean| DEBUGMODE function| relatedVideosModal function| amazonProducts string| headerbgcolor object| InskinControls function| storeGigyaComment number| triesCount function| adjustLayout number| adjustInterval object| SPOTIM object| twttr object| DigiTrust object| socketCluster object| ObservedSections object| breakingNews function| utag_add_event string| state object| __onetag object| __connect object| gig_pc_facebook_1571733282280_9365640516696239 object| gig_pc_linkedin_1571733282280_30573733083158916 object| scCGSHMRCache object| $img object| base function| bindCustomEvent object| expressoLoadingTimeout function| initExpresso function| isReady function| loadAssets function| loadExpresso function| makeUrl function| onPreferencesPage object| to3 object| Expresso boolean| isSafari undefined| ct undefined| et undefined| hourElapsed undefined| msg undefined| pixelDomain undefined| pxSrc undefined| px object| Moat#G23 object| MoatSuperV23 boolean| _lastFocusState object| a object| Moat#PML#23#1.2 object| params string| queryString boolean| Moat#EVA object| MoatContent function| agknTagBuilder object| _agknTag string| _agknTagName object| _agknEchoTag number| _isAgknTagSet function| resetCarousel function| mobileCarousel function| setUpShowMore function| setUpAccordians object| Hogan object| base1 object| base10 object| base11 object| base2 object| base3 object| base4 object| base5 object| base6 object| base7 object| base8 object| base9 function| extend function| hasProp function| bind function| indexOf object| templates function| dispatchFakeEvent function| _ object| Backbone object| Mustache object| jquery_easyXDM function| Spinner object| toastr object| expressoUser object| widgetView object| webpackJsonp_spotim_580132258 function| multiframesDebug object| __SPOTIM_TRACKER__ function| showReg object| __SVG_SPRITE__ function| initialize object| imonomy function| getZIndex function| getElementPosition function| getComputedStylePropertyValue object| brand_name_for_internal string| protocol object| shopping_words object| curr_host_split object| g_metadata number| wordscount object| match_dict boolean| msgData string| sovrn_beacon_tid object| __SPOTIM_DEV_STORE__ object| React object| NVPInjector function| _createClass function| _classCallCheck object| closure_lm_962011 function| st_show_func string| not_first boolean| use_foce_image object| filter_splited number| curtop number| cur_width string| float_parent string| imageTitle string| donot_show_id number| extraDataInstance function| obpExtraDataCallback0 function| obpExtraDataCallback1 function| obpExtraDataCallback2 function| obpExtraDataCallback3 function| obpExtraDataCallback4 function| obpExtraDataCallback5 function| obpExtraDataCallback6 function| __IntegralASDiagnosticCall object| __IntegralASConfig object| __IASScope boolean| isDomless object| __IASOmidVerificationClient function| __IntegralAS_b4a6952a52c9e7208a9df56f2c87d69d_1681 object| um_pix_pubmatic_kom object| imonomy_image_0 boolean| is_um_pix_pubmatic_kom string| frame_id object| data_obj boolean| GoogleSetNPA object| closure_lm_202244 object| google_reactive_ads_global_state object| imonomy_image_1 object| google_jobrunner object| google_ad_modifications object| google_prev_clients object| obj_style object| imonomy_image_2 object| imonomy_image_3 object| Moat#G26 object| MoatSuperV26 object| DOMlessLLDcallback_815617 boolean| $$SPOTIM_SRSDK_CALLED$$ function| srAsyncInit number| google_unique_id object| SR_NS object| streamlytics object| PLAYER_SIZE function| SR boolean| $$SPOTIM_SRSDK_RESOLVED$$ function| sr_player_cb_d0099c30-f4a6-11e9-9c80-7be5c3aca970 function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| __google_ad_urls object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired object| apd_options number| bannerContainerWidth boolean| ad_refuse_refresh boolean| wait_to_prevent_empty_ads function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb undefined| commonInit function| visibilityEventsManager function| visibilityEventsManagerDOM function| scrollEventsManager function| DeviceDetector object| FI function| apdqueryCompatibility object| JSON_PIWIK object| _fipaq object| FIPiwik object| AnalyticsTracker function| fipbChunk object| fipb function| C function| W function| JSEncrypt function| fiPrebidAnalyticsHandler function| $apd function| fiQuery object| async object| ads_list object| embeds_list boolean| isPageviewSent boolean| insticatorIframeLoaded object| $iframe object| teadsscript undefined| firstSpcFetch object| jQuery111305733427899965573 function| importJS function| apdQuery function| A object| teads object| adsbygoogle object| confiant object| google_logging_queue boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots boolean| google_apltlad boolean| _gfp_p_ function| google_spfd number| google_lpabyc object| google_sv_map object| google_t12n_vars function| google_sa_impl object| google_iframe_oncopy undefined| moatApiInit1571733296262

13 Cookies

Domain/Path Name / Value
.imonomy.com/ Name: __cfduid
Value: d542aba9da4f5c84420859e3e9174cd5e1571733287
www.express.co.uk/ Name: GED_PLAYLIST_ACTIVITY
Value: W3sidSI6Ikc0NS8iLCJ0c2wiOjE1NzE3MzMyODgsIm52IjowLCJ1cHQiOjE1NzE3MzMyODEsImx0IjoxNTcxNzMzMjgxfSx7InUiOiJQRS9UIiwidHNsIjoxNTcxNzMzMjg4LCJudiI6MSwidXB0IjoxNTcxNzMzMjg1LCJsdCI6MTU3MTczMzI4NX1d
srv.imonomy.com/ Name: tid
Value: i-7449822102770213751571733287.22584
.express.co.uk/ Name: _gat
Value: 1
www.express.co.uk/ Name: OX_user_latency
Value: 238%2C265
.doubleclick.net/ Name: IDE
Value: AHWqTUmNeK2ToH2tO0ewPlOlEL_-l530K7NVO5J0uDet5Br2-K3aqE98ufgBiBBi
www.express.co.uk/ Name: OX_digitrust_id
Value:
www.express.co.uk/ Name: OX_BI
Value:
srv.imonomy.com/ Name: uid
Value: 1d0e791e3808853ab7a7342363657690
www.express.co.uk/ Name: OX_digitrust_id_exp
Value:
www.express.co.uk/ Name: OX_net_latency
Value: 15%2C17
www.express.co.uk/ Name: OX_BI_TS
Value:
www.express.co.uk/ Name: OX_plg
Value: pm

136 Console Messages

Source Level URL
Text
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 1024 ) consented: false
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 95 ) consented: false
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 95 ) consented: false
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 1008 ) consented: false
console-api log URL: https://www.spot.im/embed/modules/launcher/bundle.js?module=messages-count(Line 6)
Message:
Spot.IM Launcher version 4.0.125-fed.conversation-ScbAAJca.0 deployed at Fri Jun 15 2018 16:24:49 GMT+0000 (UTC)
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 95 ) consented: false
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 1023 ) consented: false
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 1023 ) consented: false
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 1023 ) consented: false
console-api info URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 14)
Message:
[GDPR] Init
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 1009 ) consented: false
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: Play middleware has been registered with videojs
console-api warning URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: WARN: videojs.plugin() is deprecated; use videojs.registerPlugin() instead
console-api warning URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: WARN: videojs.plugin() is deprecated; use videojs.registerPlugin() instead
console-api warning URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: WARN: videojs.plugin() is deprecated; use videojs.registerPlugin() instead
console-api warning URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: WARN: videojs.plugin() is deprecated; use videojs.registerPlugin() instead
console-api warning URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: WARN: videojs.plugin() is deprecated; use videojs.registerPlugin() instead
console-api warning URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: WARN: videojs.plugin() is deprecated; use videojs.registerPlugin() instead
console-api warning URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: WARN: TypeError: Cannot read property 'getItem' of null
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
Plugin Version: [Adaptive: v1.13.4]
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; registering to player's loadstart event @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; listening for the adplaying event @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; registered to fix hidden ads @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 1017 ) consented: false
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; hiding vjs-dock-shelf @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:785383)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; detach click event for delegateClick @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:785493)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; re-define delegateClick @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:785580)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; re-attach delegateClick @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:786149)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; Player started, consent given? No @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; setting ima3 plugin options [object Object] @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: Setting up IMA middleware
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; showing options [object Object] [object Object] @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; play event emitted @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; trigger autoplay handler @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; running can autoplay tests @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; can't autoplay with sound: [object DOMException] @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; trying autoplay muted @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api log URL: https://app-cdn.spot.im/modules/messages-count/3.3.435/bundle.js(Line 1)
Message:
Spot.IM Messges Count Module version 3.3.435 deployed at Mon Mar 12 2018 16:26:56 GMT+0000 (UTC)
console-api log URL: https://launcher.spot.im/spot/sp_9LMINbK9(Line 1)
Message:
[ConfigProvider] production
console-api log URL: https://launcher.spot.im/spot/sp_9LMINbK9(Line 1)
Message:
[ConfigProvider] production
console-api log URL: https://launcher.spot.im/spot/sp_9LMINbK9(Line 1)
Message:
[ConfigProvider] production
console-api debug URL: https://launcher.spot.im/spot/sp_9LMINbK9(Line 1)
Message:
Track [object Object]
console-api log URL: https://recirculation.spot.im/spot/sp_9LMINbK9(Line 6)
Message:
Spot.IM Recirculation Module version 15e749f8 deployed at Wed Sep 11 2019 08:46:16 GMT+0000 (Coordinated Universal Time)
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 1023 ) consented: false
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 1001 ) consented: false
console-api info URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 12)
Message:
[GDPR] set non personalized ads
console-api log URL: https://ovp.iris.tv/libs/adaptive/v2/iris.adaptive.js(Line 1)
Message:
[IRIS.TV][Info]: *** Iris Adaptive Plugin version 2.0.10 ***
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 47)
Message:
add spot comment counter
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; player loadstart triggered @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; player's container: [object HTMLDivElement] @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; Wrapping video container @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; Checking for default embed and fixing containers @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; Adding classes to existing containers @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; [object HTMLDivElement] @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; Adding headline @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; Adding headline to [object HTMLDivElement] @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; Putting mediainfo data into headline @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; loadstart finished, player customized @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; playerTags adverts,advice,email,fraud,hmrc,itv,martin lewis,money,money saving expert,phone,scam,scammers,tax rebate,this morning,tips @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; playerBrandsafety 4 @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; gs_channels pos_danone_brandsafety_family,pos_danone_brandsafety_fitness,pos_danone_brandsafety_health,pos_danone_brandsafety_society,pos_test_death,bespoke_mortgages,bespoke_solicitors,shadow9hu7_pos_sky_blacklist,gs_finance_tax,negative_tesco,gs_politics_british,gv_crime,gs_finance_pensions,gs_tech_phones,shadow9hu7_pos_tuibrandsafe,pr_astonvillafc,gs_economy_misc,gs_tech_computing @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; skipAds false @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; custParams [object Object] @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; irisId: RvnJ @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; iris params [object Object] @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; dfp https://pubads.g.doubleclick.net/gampad/ads?sz=640x360&url=[referrer_url]&description_url=[wt_page_url]&correlator=[timestamp]&duration={mediainfo.duration}&cust_params=tags%3Dctp_video%2Cautoplay_video%2Ctext%20scam%2Chmrc%20tax%20refund%2Chmrc%20tax%20refund%20scam%2Ctext%20scam%20warning%2Ctax%20scam%2Cadverts%2Cadvice%2Cemail%2Cfraud%2Chmrc%2Citv%2Cmartin%20lewis%2Cmoney%2Cmoney%20saving%20expert%2Cphone%2Cscam%2Cscammers%2Ctax%20rebate%2Cthis%20morning%2Ctips%26articleid%3D1192439%26vidIndex%3D1%26gs_cat%3Dpos_danone_brandsafety_family%2Cpos_danone_brandsafety_fitness%2Cpos_danone_brandsafety_health%2Cpos_danone_brandsafety_society%2Cpos_test_death%2Cbespoke_mortgages%2Cbespoke_solicitors%2Cshadow9hu7_pos_sky_blacklist%2Cgs_finance_tax%2Cnegative_tesco%2Cgs_politics_british%2Cgv_crime%2Cgs_finance_pensions%2Cgs_tech_phones%2Cshadow9hu7_pos_tuibrandsafe%2Cpr_astonvillafc%2Cgs_economy_misc%2Cgs_tech_computing%26plId%3DBrightcove%7CWeb%7CAutoplay%26gdpr%3D1%26safetymeta%3D4%26section%3DFinance%26subSection%3DPersonal%20Finance&impl=s&gdfp_req=1&env=vp&output=vast&unviewed_position_start=1&hl=en&npa=1&iu=/34722903/Express/Express_AutoPlay @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; resolve dfpUrl deferred in loadstart @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; calls wtatPlayer.sendData @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; can autoplay muted? true null @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; can autoplay muted, playing now after 464 @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; muting player @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; done. @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; muting ima3 player @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; done. @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: ADS: Using playMiddleware to block content playback
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: ADS: Play call to Tech was terminated.
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: ADS: Received play event (BeforePreroll)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: ADS: BeforePreroll -> Preroll
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; play event triggered @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:767048)
console-api info URL: https://cdn.images.express.co.uk/theme/Responsive/js/dist/app-init20191017.min.js(Line 14)
Message:
[GDPR] Checking vendor ( 1023 ) consented: false
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; start serverUrl callback resolution [object Promise] @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; dfpUrlReady: https://pubads.g.doubleclick.net/gampad/ads?sz=640x360&url=[referrer_url]&description_url=[wt_page_url]&correlator=[timestamp]&duration={mediainfo.duration}&cust_params=tags%3Dctp_video%2Cautoplay_video%2Ctext%20scam%2Chmrc%20tax%20refund%2Chmrc%20tax%20refund%20scam%2Ctext%20scam%20warning%2Ctax%20scam%2Cadverts%2Cadvice%2Cemail%2Cfraud%2Chmrc%2Citv%2Cmartin%20lewis%2Cmoney%2Cmoney%20saving%20expert%2Cphone%2Cscam%2Cscammers%2Ctax%20rebate%2Cthis%20morning%2Ctips%26articleid%3D1192439%26vidIndex%3D1%26gs_cat%3Dpos_danone_brandsafety_family%2Cpos_danone_brandsafety_fitness%2Cpos_danone_brandsafety_health%2Cpos_danone_brandsafety_society%2Cpos_test_death%2Cbespoke_mortgages%2Cbespoke_solicitors%2Cshadow9hu7_pos_sky_blacklist%2Cgs_finance_tax%2Cnegative_tesco%2Cgs_politics_british%2Cgv_crime%2Cgs_finance_pensions%2Cgs_tech_phones%2Cshadow9hu7_pos_tuibrandsafe%2Cpr_astonvillafc%2Cgs_economy_misc%2Cgs_tech_computing%26plId%3DBrightcove%7CWeb%7CAutoplay%26gdpr%3D1%26safetymeta%3D4%26section%3DFinance%26subSection%3DPersonal%20Finance&impl=s&gdfp_req=1&env=vp&output=vast&unviewed_position_start=1&hl=en&npa=1&iu=/34722903/Express/Express_AutoPlay @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://launcher.spot.im/spot/sp_9LMINbK9(Line 1)
Message:
options: [object Object]
console-api log URL: https://launcher.spot.im/spot/sp_9LMINbK9(Line 1)
Message:
events collector data we log: [object Object]
console-api error URL: https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.js(Line 1)
Message:
CMP Error: pubvendors.json references vendor id 293 which does not exist in the Global Vendor List
console-api error URL: https://cdn.images.express.co.uk/cmp-19.4.4/dx/cmpui.js(Line 1)
Message:
CMP Error: pubvendors.json references vendor id 309 which does not exist in the Global Vendor List
console-api log URL: https://static-cdn.spot.im/production/messages-count/messages-count-bundle-79a867e5b6b1d29bb91e.js(Line 1)
Message:
[ConfigProvider] production
console-api log URL: https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js(Line 75)
Message:
[CurrentUser]
console-api log URL: https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js(Line 75)
Message:
[ConfigProvider] production
console-api log URL: https://static-cdn.spot.im/production/conversation/conversation-bundle-8c6b9ff.js(Line 96)
Message:
[ConfigProvider] production
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; rewrite promise @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:756568)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: ADS: Received adsready event (Preroll)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: ADS: Triggered readyforpreroll event (Preroll)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; ad player shown on ads-load @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: ADS: Received nopostroll event
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: ADS: Starting ad break
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 88)
Message:
StartTheClock
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 88)
Message:
timeSinceWindowLoad is 0
console-api debug URL: https://static.adsafeprotected.com/sca.17.4.95.js(Line 32)
Message:
a: 0.0009765625ms
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
VIDEOJS: ima3-started
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; check video player is paused? @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; check vjs-ad-playing is set for the wrapper @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js(Line 1)
Message:
%c[NS Brightcove Player] background: #a314e5; color: #fff; ad player shown on ads-ad-started block @ https://players.brightcove.net/2540076170001/B1Hli6KCG_default/index.min.js:1:783842)
console-api log URL: https://tags.tiqcdn.com/utag/northern-and-shell/dx/prod/utag.96.js?utv=ut4.39.201910031508(Line 12)
Message:
ads-ad-started - hide close btn
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 88)
Message:
StartTheClock
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 88)
Message:
timeSinceWindowLoad is 0
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 84)
Message:
delayscroll
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 85)
Message:
superbanner
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 88)
Message:
resize
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 85)
Message:
superbanner
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 86)
Message:
dothesticky
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 86)
Message:
doing sticky at 0
console-api log URL: https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest(Line 86)
Message:
1
console-api error URL: https://player.spotim.market/prebid/wrapper_hb_270443_3428.js?cb=18191(Line 1)
Message:
localStorage unavailable
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js(Line 1)
Message:
dom ready!
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js(Line 1)
Message:
topFrame: [object Object]
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js(Line 1)
Message:
params: [object URLSearchParams]
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js(Line 1)
Message:
Cookie enabled, set cookie
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js(Line 1)
Message:
session: [object Object]
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js(Line 1)
Message:
Send pageview now
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js(Line 1)
Message:
Prepare to load embed: 51bb6f47-986a-4028-a272-6611b0837f1f
console-api warning URL: https://player.spotim.market/prebid/hb_270443_3428.js?cb=18191(Line 1)
Message:
fun-hooks: referenced 'registerAdserver' but it was never created
console-api error URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101401.js(Line 1)
Message:
Exception in queued GPT command TypeError: Cannot read property 'getItem' of null
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js(Line 1)
Message:
formatedPageview: {"timestamp":"2019-10-22T08:34:51.618Z","user_data":{"session_details":{"id":"e35166c0-436b-4e9a-a9e2-7736ea2b6a69","referrer":"","campaign":{"source":null,"medium":null,"campaign":null,"term":null,"content":null}}},"embed_context":{"site":{"id":"36867436-ef7d-4f51-8344-9f3ffdedda95","page_url":"https://www.express.co.uk/finance/personalfinance/1192439/text-scam-hmrc-tax-refund-warning-fraud-news-latest","hostname":"www.express.co.uk"},"environment":{"device":"DESKTOP"}},"event_data":{"type":"load","data":{"pageview_type":"EMBED_AND_AD","ads":["div-insticator-ad-1","div-insticator-ad-2"],"embed":["51bb6f47-986a-4028-a272-6611b0837f1f"]}}}
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js(Line 1)
Message:
TypeError: Cannot read property 'setItem' of null
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js(Line 1)
Message:
Cookie enabled, set cookie
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/ads-code/36867436-ef7d-4f51-8344-9f3ffdedda95.js(Line 1)
Message:
session: [object Object]
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/embed-code/51bb6f47-986a-4028-a272-6611b0837f1f.js(Line 1)
Message:
INTEGRATION HARD_CODED_WITH_FRIENDLYFRAME
console-api debug URL: https://static.adsafeprotected.com/sca.17.4.95.js(Line 32)
Message:
a: 0.00390625ms
console-api debug URL: https://static.adsafeprotected.com/sca.17.4.95.js(Line 32)
Message:
a: 0.0009765625ms
console-api debug URL: https://static.adsafeprotected.com/sca.17.4.95.js(Line 32)
Message:
a: 0.000732421875ms
console-api debug URL: https://static.adsafeprotected.com/sca.17.4.95.js(Line 32)
Message:
a: 0.0009765625ms
console-api debug URL: https://static.adsafeprotected.com/sca.17.4.95.js(Line 32)
Message:
a: 0.003173828125ms
console-api debug URL: https://static.adsafeprotected.com/sca.17.4.95.js(Line 32)
Message:
a: 0.002197265625ms
console-api log URL: https://video-ads.rubiconproject.com/video/bridge-30709.js(Line 1)
Message:
com.rubiconproject.vpaid: XHR - https://optimized-by.rubiconproject.com/a/api/vast.xml?account_id=17184&site_id=168186&zone_id=810158&size_id=201&tg_c.language=en&x_source.pchain=1.0,1!streamrail,266658,1,,,&p_window.depth=0&rf=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&p_window.url=&p_window.w=400&p_window.h=300&p_aso.video.ext.ad.w=400&p_aso.video.ext.ad.h=300&width=400&height=300&p_aso.video.api=2&p_aso.video.mimes=application/javascript,video/mp4&tk_vpaid=1&cb=7904598945621890&rp_secure=1
console-api log URL: https://video-ads.rubiconproject.com/video/bridge-30709.js(Line 1)
Message:
com.rubiconproject.vpaid: XHR - https://optimized-by.rubiconproject.com/a/api/vast.xml?account_id=17184&site_id=260258&zone_id=1289094&size_id=204&tg_c.language=en&x_source.pchain=1.0,1!streamrail,266658,1,,,&p_window.depth=0&rf=https%3A%2F%2Fwww.express.co.uk%2Ffinance%2Fpersonalfinance%2F1192439%2Ftext-scam-hmrc-tax-refund-warning-fraud-news-latest&p_window.url=&p_window.w=400&p_window.h=300&p_aso.video.ext.ad.w=400&p_aso.video.ext.ad.h=300&width=400&height=300&p_aso.video.api=2&p_aso.video.mimes=application/javascript,video/mp4&tk_vpaid=1&cb=9680717356548246&rp_secure=1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests; default-src 'self' blob: *.brightcove.com ; script-src https: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; img-src https: data: blob: http: *.images.express.co.uk *.images.dailyexpress.co.uk; media-src https: data: blob:; font-src https: data:; frame-src https: data: blob:; connect-src https: wss: blob:; object-src https:;
Strict-Transport-Security max-age=180

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.teads.tv
aa.agkn.com
acds.prod.vidible.tv
ad.doubleclick.net
ad.turn.com
ade.googlesyndication.com
ads.adaptv.advertising.com
ads.pubmatic.com
adservice.google.com
adservice.google.de
aka.spotxcdn.com
ams01-event.spotxchange.com
ams01-search.spotxchange.com
analytics.twitter.com
ap.lijit.com
api-2-0.spot.im
api.iris.tv
api.vidiom.net
app-cdn.spot.im
as-sec.casalemedia.com
aws-fr-sync.bidswitch.net
b2c.insticator.com
bcp.crwdcntrl.net
beacon.krxd.net
beacon.s-onetag.com
brightcove.northernandshell.co.uk
bsw.digitru.st
c.amazon-adsystem.com
c1.adform.net
c2.u5c93.com
cdn-ssl.vidible.tv
cdn.digitru.st
cdn.doubleverify.com
cdn.firstimpression.io
cdn.images.express.co.uk
cdn.my.northernandshell.co.uk
cdn.onthe.io
cdn.spotxcdn.com
cdn.vidible.tv
cdn.watchingthat.net
cdn3.doubleverify.com
cdns.eu1.gigya.com
cdns.gigya.com
cdns2.gigya.com
cdns3.gigya.com
cf-images.eu-west-1.prod.boltdns.net
cm.g.doubleclick.net
cmp.teads.mgr.consensu.org
cms.insticator.com
confiant-integrations.global.ssl.fastly.net
consent.cmp.oath.com
csi.gstatic.com
d.agkn.com
d1azc1qln24ryf.cloudfront.net
d23xwq4myz19mk.cloudfront.net
d2q1qtsl33ql2r.cloudfront.net
d2uepos3ef6db0.cloudfront.net
d3lcz8vpax4lo2.cloudfront.net
df80k0z3fi8zg.cloudfront.net
dfp-gateway.s-onetag.com
display.apester.com
dmx.districtm.io
dpm.demdex.net
dt.adsafeprotected.com
dtm.advertising.com
dynamic-cdn.spot.im
ecdn.firstimpression.io
edba.brealtime.com
edge.api.brightcove.com
eu-u.openx.net
event.insticator.com
event.spotxchange.com
events-collector.spot.im
events.apester.com
f1.media.brightcove.com
fonts.googleapis.com
fonts.gstatic.com
gcdn.2mdn.net
geo.moatads.com
geoip.insticator.com
get.s-onetag.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
graph.facebook.com
hb.emxdgt.com
hb.spotim.market
httpsak-a.akamaihd.net
ib.adnxs.com
idsync.rlcdn.com
images.outbrainimg.com
images.spot.im
imasdk.googleapis.com
imonomy-d.openx.net
js-sec.indexww.com
js.agkn.com
js.spotx.tv
k.streamrail.com
launcher.spot.im
libs.sphere.com
load77.exelator.com
loadm.exelator.com
log.outbrainimg.com
mab.chartbeat.com
maps.googleapis.com
match.adsrvr.org
mcdp-nydc1.outbrain.com
metrics-collector.s-onetag.com
metrics.brightcove.com
mid.rkdms.com
mv.outbrain.com
native.sharethrough.com
odb.outbrain.com
onetag-geo-grouping.s-onetag.com
onetag-geo.s-onetag.com
optimized-by.rubiconproject.com
ovp.iris.tv
p.cpx.to
p.rfihub.com
pagead2.googlesyndication.com
ping.chartbeat.net
pix.spot.im
pixel.adsafeprotected.com
pixel.advertising.com
platform.twitter.com
player.adtelligent.com
player.spotim.market
players.brightcove.net
playtime-tm.everesttech.net
playtime.tubemogul.com
pm.w55c.net
pool.admedo.com
pr-bh.ybp.yahoo.com
prebid.adnxs.com
publisher-assets.spot.im
px.moatads.com
r1---sn-4g5ednse.c.2mdn.net
recirculation.spot.im
renderer.apester.com
rtb-lb-event-tm-ams-tm.everesttech.net
s0.2mdn.net
s3.amazonaws.com
sb.scorecardresearch.com
scripts.webcontentassessor.com
sdk.streamrail.com
search.spotxchange.com
secure.brightcove.com
securepubads.g.doubleclick.net
service.cmp.oath.com
spot-im-d.openx.net
spotops.spot.im
spotxchangejsvideo759622536126.s.moatpixel.com
srv.imonomy.com
ssum.casalemedia.com
static-cdn.spot.im
static.ads-twitter.com
static.adsafeprotected.com
static.apester.com
static.chartbeat.com
static.criteo.net
stats.aws.rubiconproject.com
stats.g.doubleclick.net
statsf-tm.everesttech.net
sync-tm.everesttech.net
sync.crwdcntrl.net
sync.mathtag.com
sync.search.spotxchange.com
sync.spotim.market
sync.teads.tv
t.co
t.myvisualiq.net
t.teads.tv
tag.imonomy.com
tag.researchnow.com
tags.bluekai.com
tags.tiqcdn.com
tapestry.tapad.com
tcheck.outbrainimg.com
tpc.googlesyndication.com
tps.doubleverify.com
tps20227.doubleverify.com
trinitymirror.grapeshot.co.uk
trk.vidible.tv
tt.onthe.io
ud.tubemogul.com
use.fontawesome.com
vast.adsafeprotected.com
vast.spotim.market
vastcdn.outbrain.com
vastpixel2.adsafeprotected.com
video-ads.rubiconproject.com
videoadextradata.outbrain.com
vjs.zencdn.net
vpaid3.adsafeprotected.com
widgets.outbrain.com
www.express.co.uk
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
www.spot.im
x.bidswitch.net
z.moatads.com
optimized-by.rubiconproject.com
srv.imonomy.com
tpc.googlesyndication.com
104.109.91.215
104.16.68.69
104.17.119.107
104.244.37.20
104.244.42.195
104.244.42.5
107.178.247.57
13.224.196.129
13.224.196.39
13.224.197.43
13.224.199.29
13.225.78.146
13.225.78.78
13.225.78.80
13.225.84.133
142.93.164.210
143.204.101.62
147.75.102.200
148.64.56.194
151.101.114.27
151.101.114.49
151.101.12.157
151.101.13.194
151.101.14.2
151.101.14.217
151.101.14.49
151.139.128.10
152.199.23.177
152.199.23.241
159.180.84.2
167.114.216.54
172.217.16.130
172.217.16.194
172.217.21.198
172.217.23.98
178.250.2.130
18.184.89.106
18.189.119.248
18.194.34.120
18.196.104.43
184.31.90.250
185.148.48.57
185.29.135.226
185.3.92.12
185.33.223.206
185.94.180.111
185.94.180.123
185.94.180.126
185.94.180.128
193.0.160.128
195.181.174.6
199.166.0.26
199.166.0.32
2.16.106.112
2.16.106.115
2.16.106.48
2.16.106.56
2.16.106.57
2.16.106.59
2.16.106.82
2.16.106.97
2.16.186.16
2.18.232.234
2.18.232.28
2.18.232.7
2.18.233.180
2.18.234.122
2.18.234.190
2.18.234.21
2.18.234.36
2.18.235.40
2.19.43.224
209.197.3.63
213.174.135.1
213.174.135.2
213.174.156.165
213.254.244.22
216.58.207.66
23.111.9.35
23.21.61.195
23.45.105.3
23.58.216.102
23.67.136.71
2404:6800:4006:809::2003
2600:9000:200c:9e00:5:9a4c:9b00:93a1
2600:9000:200c:c00:15:efbc:e300:93a1
2600:9000:20eb:1c00:1f:287:d20a:ce1
2600:9000:20eb:2200:7:8699:e840:93a1
2600:9000:20eb:bc00:14:3684:7f00:21
2600:9000:20eb:ea00:10:3422:3f00:21
2600:9000:2156:3e00:c:492d:cd80:93a1
2600:9000:2156:6400:1c:386f:ec80:21
2600:9000:21f3:1800:1d:b722:f80:93a1
2600:9000:21f3:5e00:15:d134:4e40:93a1
2600:9000:21f3:6800:18:1fcd:349:ca21
2600:9000:21f3:6e00:9:2087:f700:21
2600:9000:21f3:7200:a:52eb:a100:93a1
2600:9000:21f3:a000:e:515c:9940:93a1
2600:9000:21f3:d000:5:ae3a:ba00:93a1
2606:2800:135:155a:23ba:b2a:25ff:122d
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:4700:10::6814:180b
2606:4700:10::6814:190b
2606:4700:10::6814:2f46
2a00:1288:110:c205::2000
2a00:1288:f03d:1fa::2000
2a00:1450:4001:69::6
2a00:1450:4001:800::2006
2a00:1450:4001:809::2001
2a00:1450:4001:80b::2003
2a00:1450:4001:815::200e
2a00:1450:4001:816::2002
2a00:1450:4001:818::2004
2a00:1450:4001:81a::2002
2a00:1450:4001:81a::2008
2a00:1450:4001:81b::200a
2a00:1450:4001:81c::200a
2a00:1450:4001:820::2002
2a00:1450:4001:821::2003
2a00:1450:4001:821::200a
2a00:1450:4001:821::200e
2a00:1450:400c:c00::9a
2a02:26f0:6c00:28a::2a83
2a02:26f0:6c00:292::2c92
2a03:2880:f01c:800e:face:b00c:0:2
2a04:4e42:1b::714
2a04:4e42:1b::729
2a05:f500:10:101::b93f:9101
2a0c:5c80:5026::2
3.121.153.221
3.121.26.224
3.121.36.175
3.9.104.81
34.250.55.69
34.95.120.147
34.96.112.165
35.156.24.221
35.177.239.109
35.186.220.219
35.186.231.222
35.190.63.234
35.190.72.21
35.190.72.53
35.201.78.160
35.227.248.159
35.244.232.184
37.157.6.252
37.252.161.184
37.252.173.27
46.228.164.11
52.0.234.50
52.212.115.156
52.215.211.56
52.216.160.69
52.57.21.24
52.58.208.187
54.154.151.160
54.154.79.134
54.194.238.142
54.230.203.45
54.230.95.51
54.246.207.119
54.77.188.50
54.86.231.246
54.93.38.207
62.149.0.72
63.32.64.113
64.202.112.31
64.74.101.79
69.173.144.141
70.42.32.127
72.251.249.9
76.223.10.122
93.184.221.64
95.216.24.150
00c0a6cf39259cf251132571101c0133beb08e1fc7bf88a55f1f9ecad9d1104c
01c417e4ea52cd6bcf4926f6a407ab12c995b851798a0301845fd5b1dc15cdbb
029da3ef40fa7479bb85d34076212d7e31b5814fee0eabd04c5c1ee2584e4b4d
02c851ded2dc8888229b1dd5ecb987d3596f6749985280095bbb598c2bc722ae
03b9d066e7b937c3de9be540864035db66ad99b0477137d0ef8c693046fee3bd
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
04a74928965ed27c791351d7e70bc0bb40194158a56fd949b19c66f28d4835c1
051e45db2a7c2ea8dbb9bb72bdde35e96a68645a00d22b9c5bc47b73e0cf12c5
05a2710ff0d2757e4ee766eb719963246b525a3569b26b55e73724f1a729a43c
06641cfbd2d9cf7c077cc7fbed92509e4bca0b41e5c6a3b9e0ce1c10dea77cfa
066ce21f2761d5b7377230fb0f498e18be7e1592b7b66a2f5214fbdb19def137
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06f5ce5d97072ad2d7e26a1bfcb9fe06ca604f57a4c2787061b3a3591418a2da
072013f8289424eaea2a286a164cceeeb1c15038901cfd2c43eaeedbd4439f38
073899583d7d08709cacbbe3308293db7ebbfc59fc5d9d2a79620cad9ca24d59
0765787f1966c35a86910225b871ca49249be9e882aade8899d624b431e7446b
092d222dffbf8e34d2b8de2c09801b1300519535774524fae07b047c97e59019
0a45f2d6f819adacf882f3d21daebd5b036306abf88b41005f363a4ee8d8638d
0a4abba6d7b7d8f7396f2aa74afd583f6670a16b9be6b62fcfee52d69afaafa9
0a776ab14b51e0c0fa5833e283d9e8fa26343b2ae720fa90b65e69867dbe6c7e
0ae29789f5f0e63c7edd44c7a2e4801ede5c1765b8b0eb68020497ecf3729771
0ae2c3b752d0c3923ea80b03456ab1564f1ae7040336472ea6f2dca25adb59a1
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0d661c4b4ac372767351289da7baab9ec0f5e282435d3ba521f2a4503201beec
0eb43c7748056d757b5b5c51b1479f9483ea8443b68a27ab03933c9cb58df8d2
0fc2159485ac7d7159330dd52c143f4569ac349507e8ada36e298d09c47a8f16
103e8636684cffc517010e343af1e04dd0fb46ea10a360fc58e5d86d7a156536
108e5e46ad99ff788eec19ead675ea6d1842dd2c274db6ef7ed995e818459efe
1185ac7ee0922936a46115cf79bf1d9d704792bef6dc6dccf96215d874e9f706
11c2a935a5453887aaf8d73e4b82bce853345bca3e240d670ca018693a6319d6
120afadff73d06a7f0815a38e863f5fe090899f35b623b03a05c5329d7343d6c
12a03bd65b71d179e5566497dd08878d26218ae7ffd0155bffc8ff8cc4744096
13426ba13e9862a0e6f6e2c9af87cce602482e4fd64aa5419bea6d0f449e7c70
13bb93a8b98944d49afe0a369ed52484db89f9f50aa50fb508575ab250cc4e80
149c8d10677f2f6979fa28c078cf832f575ee53c397d791b739e7c4c687fe7bc
151c4c52c25dd28c33321aaaeabe879c4814087d4eaf7545d93f5d81d4d1c4f3
1586e2588cce8f05ba9f9819634bc63725efbd798a1fcd995b9ae5fdff09e568
15b54d408557488fd7cc7fc3c6240046813d492b9d2b936a0bee8b8fe1597853
15c1e6faad117d3c465962a22a732f65b3fd86c82a32ea4ed251b54b3480d267
166f9390df29e23f9c9c45c50026de3b8ea04605424c6edc8557a3d3e71af7b8
1736daaeadfccedf08c180425fc810c77ff528696691940d49a27545cc0ea6e9
18d224bb28692ee8b1f6415513ff417143e9a5ddc5d7a52e0c233304bf246308
196774b588fb427bcbcf473d3ac027291e62e6817c180471211479ce7770b92e
19f6cd03771ec6205cf92aca5fdab1ca31d6aed2815a89ed9356f5d5d3e8b8cb
1a58095266eb45b55188805f4507e88c0fa62d1fc111b67585e98a9f8b1c4e4e
1afd1b92401f9c665d8957de5bef4f5ac8d510ce664d559514c77c6ea4ee13ab
1b03be18e07e94ff40f413fd0a41d6f374b0d3df44e951baa53295099e2c3642
1bef3fa80a1e44071f97f4263bc583c8138234b84c66eafb80f1af47ce3904d0
1c925d301ad8ab1c335bd096b9c622a8b76df99212f6fdee2b1f0591fc84458a
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997
1d8da6f57df5358c5f6dc10170fb0e043a83ccad4bfa26b2763c0f27bd611b3f
1dac4741dcb38d6db66482eb97f40a7a62a12e9d4b4b726941673b144ccf43d7
1defd5791b61d4a0aa9417ca6fcae832f6ce0172e61ce0290ad567e7cd511973
20105511a1dc9faa8f1019d16f1b65996d7389ccff8277a88afe93cb7d7ea08a
204d5a095fd30ea65540054f069a02685a3fa7ecec64306f588731529d486e6a
20e8607f169a2994deb82d0b9621f119ad85041835664bdd5842443a6f357227
20f11c11a29ad9ff1d8838fedeedd99354383ed6c4c25f3fb383dac2003a5075
218cd0b67ca26b5a6d1891256a4402a9c2ec65a68a039d96d36b17e595ff5285
23689a90002be26bd4891f568bb0e62a4507e85dee64ede6d60830d949fae475
2395b9aa2b7755ea04da6b4ad6d277b77d7ae021bec647f465a147ea3e62aa6a
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
26ca840c9d02b5b4c1013bf1e2371ff3e04dea1fb2dc7b60cc7d21345359938d
2758c030ad0e7492643f4ca4a7f7f6b4c633e1010707b3afe4742ebf72a7020d
284b4de0e96bd0ca2dc776d8380a81598b650e85d035c0c3b066db657279e1e4
289e2982f225b4be905970d0c8351f4242b137605bcf998e9b56b768cd85b550
28d8bbab44302e9e4657656ba52ec721e55a8fa20e257a7a200a4b2d3caa064a
2ad4ec405159beb9e962e752ab2696369ee2436ac7b4e7e34c99f9ba22aa1fe4
2b20899b14f2ec5b8fde3819eab47d0003826f831014efc701299292c910a469
2b3407afb58fba21cc477803b7b0f23dbe3762a66c6cfa7ff8cd08c2115398c6
2c04e548e2c644df3e071eca3e5e55732e4425da3d4b753418247c8ba8ac3da2
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04
2db1636a03ded06c126389ec4c994bc6f2c675ddab40d4b5c6fd9467dd65b5bc
2def15be7c0d6cb1a0882a2ca59d0215b306f45396c439170d9249aa24a91023
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e0a9a25fbd566695e1e25004a62fad985cd884718e411ed7fb7fc17dc24cbfa
2e5db12b7bc11cb638f81918df0b68bc7026a2c1e29ac02f2e056dba2cf7303b
2eb7ad2b01824cf937a0dded22fff7ebe5e8616ea105fb56692d0bc5bb4dcd86
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2f9d84e5edaf4d8cfae1461e32d46ef50dc0335384cdd0d51094b80d387addc8
304ae66279a84ab5174685bd0d52365d0daf5077d4f4d6a3de7d2d3602903252
311b291bd38ac9aed28f38b4219d87a492ffceb0453d03203fce5d1759edc7dc
3130db42a0dfbabc4f30e4b9f550e44ddb5f6c98bee3e75db2f6492199d4d921
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
31d08ec38a8dfab082676503b6085ca78829c45d05b4002534b5281cd7185310
327f01ac5f92e7ccabcb54fa03ee98eab899e454ec1fd2fc1cb806878eed437e
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
34c0194deac635fd02a300e11745a72d36b67bddefe58e02de53f5ffd2f70381
363e141b8355e99fd7a23028f29ebe543d98277b697c48d37267112c3214a6e2
375fe8f768b66df95f452ab64081fcde3f327f764f7ff800a06afc9e80299f72
376e161a2ac95b590fcea27b4ef2f4ed40a4ebc024a6a811311e2021858adaeb
37e5f6d2b6da6f8594ebe59589a01683ca180e5f12d5a38b0c68d128e6c792b9
38b8696323d24ce56253d95467444b809f0309f94ea77212800a0fd3d306f97d
38cc5e638623027e14d83d21653e26a5d1f005289c2c87645fadf419fa520dc3
38d3a29ae81bb72d33b76783c4ab591fda8e280fb7b1d0156c4b0f7749e09562
39a2c2c07937d3b55bb855ed20afe3d6c577a7e69ad3b7c4f61058b8fed7eed6
3a819ebf9c72c6bc403110067ad8b8cac0deb61d84c0bd4b48aeba78b7410791
3b0279812eb54bc321b3b11fcfdd21360f264236c7259bbdee7d124d8bd78674
3ba16530b9e71bf07fc28a2cc7eda8b4d52722da6a7436bb0a959ef02ede8c9f
3cbe89a32e276e2db1fe0b32f614658d36af7dee6305dd8383d6c464801c715d
3daa5bb872615c3ba820d165f18734b915db9bc86e826019a9bc0bdf809376db
3deda9c4104de2f32ed217f4ed0f2a7543c5f2b963fda7f9d20090eedb2432b1
3ee0806e69f2ae70a2267a58ac5fc5d52b5aa7aca6f3c0c08adad605fd8fbc16
3f87130f2c1a5a9df7d83f1db680e9628fd700956c7e9b6fd36f82cb817ea53b
401c91003752594ba259739d54f6431c01fee188d115306d95bf42846e053163
40e4df9f4457dfadf41313a8d8eb7632bc774bbb3bfeb826c92fa398c2fc22b2
41367ea3722634b7e99e3a92f77a81cf5b6ab5712461e211473af21eff571301
417e156e282af4b7d146d16b8fc9505255de2d8d085d40e37afe5089b8fe9b77
41f31dd2e2557de961bcc07f0e0f320a637632c9ae48416c0d9ee25294ed0ffe
44159966f048107d18a4c62de519864adfcd09219f3cfb838e8fe166b44b923b
45df18bdacb438598423616ef9b6f85a5d26e1aab8d426209937423d477d80e6
45e5cf0eeab5f0fe8dd84658810bedcaa754aec8806166fa8c1438921399c74a
45f08f27c7337d189e8c31e635b5d0a0781b273131135cd77ee8b6f12366e7a2
46670c797d8343b8f6bc437ff7d18512541a80c6e8c5bf8fcfa3a32bcbad148e
476551c531aed18233298b9c501253aba66b1cf03b74e7375e4344f99d31bb67
479deaea78a22be3bb4ba1f4f3676454ffc3cfd88a3253285e0696fad7f304c5
487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
49a9a85fdc042175646d84e22fc5e7b203b81bb42a9637c35d535ee31bcc3d4f
49b3a6b2e71d782472f88c4c73d7e72254f9bfb196d9ea934dba30fbc5ef8f72
4a270ec2745e615605f9b87bcf390e13a496560e6d846fd618d298c0782d1f88
4b6b1a2cf838b25dbf614c720106071ead2d7d2157cd371505438151a90fdcdc
4c2b8d176a8b50e769ee8b8b01b8af3cbe66264c8de47bbf9aab4c285a1b7957
4cc7badf143f41162685c763ee7d306ab1717f9316099170887754c945692e21
4d0ffbae8d0f1647513fd2fe769e46bdd496da8ba6c337f7c4a692b43e21c900
4d15cd27dd3458e7e819b9215ae5b7c1be3a1324df4626ce8262ef4fb40853bf
4e568073a900787fc46710900fe2556d4a6c7c7469ca1da96def7e8585e032b2
4f2aa9698cf19b56a1f31e7285c7628cad14a072790e373985e6195d52ca2e2b
4fc2dfa4181827bca24ccee472596a6c549123afa8c70a5979c50bd1a74599c3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50d7cea7f74df30e660306c5e40a9e390c5c471488ade8940a20efc43794d553
512d1e6c120dbb1cad397f824c28f421d5a224b36e2c12c515e94dfcf07dd224
51ecd90ee6904a0a5af8404484d755d173e758766b5c84f55e298f7e551a010b
51fbe136f28f60bc09b2a92ec09f109e560fb76b14d564e46fbd39cc6020f425
523f7d71c6077dd4fc06bd8663ebedbb4719ac9a3c9385a6fdc43eea20a89553
52d5b82d79a395a8b487a5299517fd8f2b342e263628305ee78fc63533878c78
5388f8b6fc95b7858dc2906e0d479a47e1f20b670d3161c287f2a303b2251c70
53bbcf739b7dddca5a3db1801016fea58b679b47407fc8631b6e84c21973ad90
53f0fb3c6fcec2e85bb140165dc428f87be5ce97dd8ef32b6ab5eb7b5784cb1d
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5627412d3e69206acf1e8296f17c0fcaa034f24fdca2d881229d9c1ca458b98a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57841cac3489f419acc7b6d6ad1c741350957f7d06926564b4ef8fcc4ec3673b
58b32efe6b4ca06cba67576965064fded60fe48a436fa665cbf0d10a2fa748aa
594ebc800d95df8a4e1233264a1d5bdb856301f4cbd092933af01e786208e4d7
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a3fdd33eef5a838c25b2afe031bc8478dd97dcd175ce9b9d99c2a77163b6748
5a86ebfdef13a34b2af0f3aa12c75f9bf900dd158f7e453648daffd2da2da677
5b516097f94e24a1f0478d32ceddbc943283de33fbf3d648ae1abae8a723cbcf
5bae4ea6b8c1a2c8054109c0173dd5fb9ce6fbe3ef5a88ec9a6098c0b44e8898
5c11bb26581168d3f54fabc865935367fc07e44b7fe24281fbcbe2bca3285a39
5df41461e8c29072a827d5fd000d2506238b77e767a34642d6613b79ce49134c
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
5eac6edeadda690d9079926e2158acef5ae9d851e217eb27598deeae8f67412e
5ef68f00ee373a2138326e1eda9e2ea1a6c8d301965699d67c82ccdb753ae7e5
5efa1b5e5972e10b92416a0ce3304688ad78216582c3eebe930a37771f729fc1
5f3592a8b8037ea064764a2815799612063c6722d314d1d66d3a9391c3c16d66
5fb3612eff43b581b97b4ca8d65be1e7897ff0b214b74c74398c20a757c85ab7
6046670d0853c2ed5b1db6cfd830673ed1374365be0b224e78ca17d9dc54e9d3
6088012dda2274a27fa40ed153d9e3a6c96a22af1b177f8a2916368eb3e88bb0
60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda
626ba97ec31dcb7a6661152bf5445c3e9365ed7e90c2ee24ed740d64a3c6498a
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
631c3953d18876f7caa5fabc9aed8719631ef353b6160bcab29516daf88b320b
63271dcce1a2518271ecc2b0bdcc5afc9c5f0968a8635e0f97a4c9747309eb82
635eb7149aea502ca1ef78530e72e2baa05e2cdcda7270e0b08f8bfd48eed6f4
63cccaa69de7567f784a28e21c1374a1ddee0d02321b5bd4675398246cffe74c
63dccb64c2c75175607b583fe9d09e4834851c04d39f430ae2931577839580e1
6413b7dec6a597c00831914e8e4391b59538c6104cea547e13350840cc7c616b
65e2ac95ed2aca1533db461d2ddadf4692915655bfa2ef8221f0c7740000586a
662fa6bcdf71d8f92e29010d3e2e270e0071e5d19b1d14ce205654a78aa0a7a9
665b38c7f6c657c0c37829c761d90aa26fd2bed0021af10f93d04ece02c3617f
66aa7a521c13e429eeb95f5b58da6efd7714b11d19345ef8843a0cdf86f8ed77
674915d28d6b3b7b947e0784b76a18693eeb19edfe909481e5c5b6baeed5a66e
67a7b6680bd437cd630acce9006108088599dae744b51d50fa2af0dcb9f2b43b
67dee92456c9d6fae38706eaf11021251c0f127711cb29c8ffb80a142cc628f6
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
68bd56445654b09134e401e40a8f65959aa7cfe81c867786cff5f7e6a61bd911
6900ce64240e9aef93c5e413793d186ef2b77d0535a0c8c586a4421b3aba3042
69027204f18bef3a3126cad6b61a5a480f8c3f1b7cf29b5739df72a18039b1b7
6a081ef7a0f9d9ad92b6044730ec86ac2e3c9bfe9853fa7bc2c36e0f85bcc942
6a645c93a587df5075444babe7d852b13ed4e4d24e339e307551acf743e214ec
6a6e9c713116a114f45ec8482c08dc48128e396b758951f85a2cb064858002ec
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6ba928080ad9fe253e167252201523e5eb97c2a737b0c450c6941f5e2ed064f6
6c138576e7381d3ab0aa7b511adc3a7cbb7fe3a3d33768bad05577f5dfc60cad
6d54e11e9e0a4dfe77082dca8b931af5cdb50e00ff7b63161f5944c3c4674344
6d5ffb7a6865f92384727ce1ebf6f65e928617a718ed26e1cba400001a7ff952
6e4566c272234ac42ecdc0aee808ef9964b4ee209afc35b8c59add8f34a344c8
6f42ac86173bcd40e4697a11368ce401930b33dd1cc5d984c5388b0aa16b1cb2
6f55a5dc4a864122259790ca861842fa67dd29f310bc180ec6c20b0919896c1d
701e46658735a0ca01cfe72d1f8f8d626900805db2bb67a986b45c7da6080c7b
707d4c7f44dd33e874b5a09b6dba4702b12bfd3e19e470d601fcfc1d7009286c
70cde6486e50fb4f1298da4b0c964583d1d9b6bee4adbe776b1ec065499f75ea
71a1e2ed870b560f3557ed3006ee1b4e8e1e05f3798d56e142bb615f3188212b
7247ab73ad2aae2dc637c2d17bab23522dea07d0a6bc126bfd7dc0ccc7a628ff
7286b781e94d84e8da08d2ca157255ad70cda39f0158d91859e575891db24255
732d5765c33eff81c7825dcc5e8cd1eda32dc04f39da7cae66accf9580b1e3a7
733adb819b2c1d12c4f3ce71475f633d3f3559c85651b4478d305ad2b5db3eb2
73af65c1e5b508c2579327df5a38c69b31c04297ee49cd98c9ea2820a5674352
74a587c5c9706f95046b2dcf80f6bb90cd488ae4edb45e9bcd4507d3787a88d7
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
76f037243db426f4e0d4e74c809969c610b4cab9555c2e14a4472a9f2c449366
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d
777c97142579080b16a1c94580f0186d1598ce0cc2542ebd3a42da6689afd208
7798165ee5a3c6809310d8261dcbe7c8d0c12d795b7b09a71af3eb86ec8f33f2
78a79d5cefe3a91bfccc9d0e3522b756e142d8c2aeba35146f2bc399b71cf4ad
78e590d339d146235531f9f600281f37d38dfefee3a19c99129e992723d8512a
78e958d620d6e40a19e424eee3a9b23932cd9bfa4d7f736442048777d203052d
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416
7930e613f31018ee14b039c260bce8a213fa0d2ae430f100022a6d0b80e70327
7cc08243a55cd399ee78806a2499e42d872ebe79505134600822abd8d505a152
7cf05625f92f72679fe5a35540960375172fb2b6a3ba498b5c33ba8e82a1f5e7
7e2bc5e470644233e8d64d8a3d4b14cc16b67c966314f9c51cf48111d35e6b2a
7e43a2782a0568560787ff32b4fe9b893467a42b2b47ce55f789c6a31648507e
7f5b525210c05e9f2d1e4671c09ce7020d9789ce4f63f259c491ca3a2e9f7de5
7fde2711e90a60cb3d0c6c26679917d77d02ea9d3c29fa910692d6583a7ba5ed
8050f05c230d74be333b63cef230e786094e9100f55fa19c6c0831e95870768d
8075fe09e142b517a80252d1befdd7c1d6f4938ada76218ad6a2ac25d7aea997
80a00292879cee2064c73774c25e91c79fc1c5de1449e4254dc9e17a7e1b1ace
81edd9c9c0df311799f4b88da338dd345159a744bc5ac17ba5904ab63448023f
824fe3f702b288802cd91adbc0fb5cb289335c2ee754ee0718955c1276d77d5f
826a5f7c74ebfb3fbc9c11452d4bfd0228f87513e3859c538781957072186429
82e92136be291488f0755e572386d60e2e945ca1eb54d55703c5aaa5560b3336
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8356ab8d03967d3fac951d2ff5402c7cb4f9b48e0e62e975bd7f841eb61b40aa
843c7cd8bdeb2ea501f0df2b25abda0c1c20f86255d11c779838ede20a3dc804
847104f3ab8443474f93e5bab9771e8690fe4ac8c6c0552a8f7c48807cf0a13a
84e26c55c92f92e4fb8b04ce59c3a2e0e409947c2751bc98a1f970d8a775b1c0
85850ffc2439a5e355eb034d9f76c4af14dcce62a7fa6cf88f0ba52111412e9d
85e501a456a63328b148c7b8d186b7181f16dec22fd5e7e3b5ea4a35b597196e
85fa47de6b71bbce922b3d89b645018063f5d4b1c7ac1383ada0da3729de6702
86f505494adcc0e85d59f35383a6bb5107163838124974f7ce797f338cc334a7
8722bb03f2dcc60fbbfaab1c8dc201303695cbc1f2bcf237077acf9dfa2c9e80
872e92945bf01eb93ba6f0abeb77967200c89436220b543d7a41ce86af13e8ce
874ce89fe959deb46939037d3f5c17fecddada9e22a6027bfecd7d46983ed292
878a50823552b7ad1f85719c36d968db09f1b6ab5d0fc15f39f3b84f3691c665
87cf78ac0432f10cd3ad60d62048f97b56fc65ef74c9dc77be40c6b9bbb87bde
893ce9b68611c1d01a66862015ada21c580458e22e434b326eb67343e029719e
8c1afa07812029e47a523799a1cd487ae198957df103429182ac12cc55ccfc6d
8c27e973421237631c29cb0434e2a424ba47954cd3850def6f6e0cced37d5cd3
8e91957b3c50d1374f1db1c5a24172c85ce002c3cf1a47a9525cc99554d79d9b
8f51414c30b3370577599ded959cf31abe64c2245101f155d94157059420138e
8f6674a9531b0ed0944f50ebc22347234bce6ae47295227effdc78f3b53567c8
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
8ffa7a9f6b4d27659a43e52ecad22cdd82d10a360ce7637a92c1141b4c6ccd6b
905378579298997ef946e8ed56070c9e839d587629bae12a77904e34f739cb43
923a1217f37bae2b930f236d26773da178f8d4559d6fd46c486c7abe3e5e4e4f
929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f
92b6ce5aeea591dae741bfcc175b130351ca025dc47a604c51bc4bafc5079211
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9327663db171e3c01e351f3f5562ee5ed8f3d6bde6a7da57d966997f1a4b7a57
93653ab4eedd19fad959cddad1eaa73c9e4692db2a3278a77795950c026e2baf
9384744ef06bc563766e7913a308cff5a84795b9d6b50aa9d1620d412378f2af
9437f43a82634520a5e44d46216a8384bcb9fc7e13561c16f1000c410187a56c
94ae718015121a47c1270c8587ded3c42aed3fb63b64961f2ebe56263ce4ee39
9538cc2a4764f38462d2daab3e66676e0178312dc8cd76b8893b74f4b7024214
95ec3f1e6d6da82a61d034eb85e45f6dd94cc40e48520887f32483caedbfaeaf
96412e391f09be493b55f981abf34177f77d26762a18e7b6b87c0293a5c088c9
973960bfd5d01a34238de691886ac5848aaf98e5d2828db7540b3dbe79502a52
978e26ab0df85582cbfb7243910b85841d7acc3d44712913ea30dfbf2e0373b2
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9910d8e4621441bc75f74314bd41f6e03c2e93971c1431f988d3656b0c48be6c
992b58602147f002b41995da6179a06fcac92acd850f98429b6cdafe738ec14c
9949092e6802e3091dd4e866626045e22ed46324cc30360abdd4c15a1673705e
99fd27cd410417b5633d3fc37196751afc4b3f9ffa5853dedb73cfcb3e810d7c
9a5f751768fc13fc0def36ae104772a86cc4af4d031ec70951819f89cbed13f6
9ada1473bc761f4e90b850a3eaf49e6ff4a57a344ad90f4522fa61e46b5be803
9c19ae6e2ba96531e72633df1fad205a2759670d0c17d822e5c0be2615b2a7ea
9c78423da5100b27502ec4efd03740d4e3c121202f9dbcefff4c61070c18c04f
9cbea6255a864f807c0736e9632972403f499b2559339a9389c33665661c9e13
9ce15b5438604bf3eb4ff1b92cd0972d7df3940e9bcbd63c6eaac226cb52367e
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9d2d8043c302d3a9da9277374a53e2285c471d5dc8397885b4931b82771d5cae
9d7bdd879dad672e0e26dd18a174edd3115215d14e3b10149f8bbfdfe1928ced
9e4cac65c7a5ee0bd0743afefcabdd3e73854e1284ac9ac433813d6231f550f2
9f5edbb9a84f4a23ff17b6c8fd646ab7de1ad01df23adb85629a1eec3ba69641
a0e4b80e263f2fafbe88f70eb88374499318008574642c1bb4812ffd3bcc74d9
a10b3d6b29a48dabf9810b4e3d5512167ccfdb60ab206f47a1329b0875a63c6f
a1999737449d990f86a266a62e57fb225dd6e5d5521da2358d967c6bd662b314
a23f1a465fcd2f938fb8149cddb19ae75c16a276193c79516aefe65b5c0d56b8
a25e14865126cb8fb6fba6ec8e05a94bf93b5f999bcc8785a80b54001d120eb5
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a355f2718a8d0b7444670aca6fd1dfdc126f9b8e9931a34a52cac9c343a68e3f
a38ad295447097ea31684fb067ee13466f8a810797a28c48c658d68a1c53a874
a4776b92245ca7a79ce8723a83b8e4796fbe3105b139dcea0f3763717f8d71eb
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a51690a59260fd30a04d20955e8e5432f7f05f90c13f04c953789d67548a66b8
a5f27fa2ec95057ba31d09de0d1a10e0696b7c29541ff4ceec2a42e2e5880e54
a7372a5b2745ca7cb57080a23f81ce1a7e805d22aee90b1a351ebb444f5bce11
a93b797b21c47a6843fd99dbfdebaefa14f9a12bfab34b49cb3e164791e2a7f7
aa6e0af2db44c3941b0fea58d414430d083f5a0481b12c0414a7a6f91f2f94d5
aa706c43e8733a58224f514db36f253bed4ea01f56a90b66916c4aa6a656ec2d
ab0cafad80b60e9fd9d90124d745768376a6995d149af9f37636094d5fae9709
ab5122ab360a9afdc2695d4ecfdb5568aaa71fc0ca27c70c4f936307e1c89fdb
abc62642cae0286d2c99498596a49ae314284236dfa4adfbe637309ba4e69568
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ac9e4dfe7f4962cdfb0103aa466da363695acc8e8957ec5b248fa132ad3a8558
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
ad16e1b37490fca28df99d039d6373d2fee4d894fcd279d95b90ae872f4d860f
ae3167c489b881c581eef1dd54aca4dd6d2c55ba305e39cfc3e8b71c05930998
ae7007781238285bd305071452666ffb2b9456d039d43bbacb1228a28469b4dc
ae8652bef5db9166b582124f35c50287050244b14cc2a98d0e99c4866e525164
ae8dd8617d923f0098d9278754faf1693030212d957544608a5ccf7f51c88079
aeb5540c19002caf52af3502b43ff4d503ec33ace0119153b8ea525cf1e1d580
af935e1657b2a6b0f9e82845642ff6d13f621c957ead0e874e71cbb9b978b3b7
afeff1f2f0929ace50d45341a1a1ecb3b4a8012b6ea1f45a8e9fd0d46db1219e
b0c68a2243a46fe5208d06e97f63ab23dff7626f026a5fa8bda8dd1577f0993e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b15adda52043ab41ba5663be05a91676db5ff3ad95e82dfafe7c5047eedc3f26
b201ea1d99d8a0bc66f36c1a230ece4fe4e11cacbf7d8eb0714444e01b462cad
b32285045375aef8395099224e7b6ce5cd08cb9cc9085fd40647d6a82ba1562c
b399426776ef743fe70063d64cbfb224e6d59a2427df3e46d2ff21ca1d4c772c
b5b1e5b3772768841777a8b7189a2a0fe67e8c74cc21952b41b882771ceba1b8
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
b5c4c2dc15c504a4caba8854bc7ac9df88b2309a6366d9122065292e6ac3c38c
b6c2e81ea7fc3dcea125585c1ec8e78e9826f0fef1c1255d2caf451fff49b54c
b6cea4a8688630abdba053c6d781cb7e6a96d0e5994b3ed8d9cb49d351573132
b6eecdd9c3ee5be28efde691c4c427248bc3ce4121e67fd3cdb48d9b108591d7
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
b914ed3a33dc477bfbcfaba9dc28f729f6cd478132522f8832d20acc1e7de140
b9f426c6aeda05ebf83ed83a460b850ed0b06a49c1f5cacacc40f3ca5b8660bf
bbcd8c21e24392c2c8ef2c5df39578e95b2bff035be4930cbc53b996087783a6
bbe4f1029e40458992a7f81787a6c2ffd5e861f80e463620ec9ce7131919cb2e
bbeffb8ce60bcf715f0b0cf5ab6770dd1d50e65e7645e096fe540e12922b9a83
bc614a222ee109e8bdb51477ae20a05f17c6fc97f61be458626cb1f600f521dd
bc74d041700daa0b55f018f66136d6cab7b761093a6a84426181a58259cdc3fb
bced8533a3ecb808d3f165e99262c0bedb81531a301f4b20568439fa0bd7f9e6
bd30ffd9618eaa423abb4c900f4af01cac18be85d75265ba08d87d5230bf85b8
be5fd4e5de2016b275be9b0c90b16c74e2cafc3dd49967eba2cffaa7d7095a79
beb58bb9c6a40d9b57f41cf77bc6649bdd8deb733b8862310a3841cf22c44a88
c013112bfa535faee1451ee2845658b4594379c235d6d4946f352e2fd61a5ca2
c02e2b06d9126930b67bf7d73a9537dd60aa430a345a9e2773b645807ef0b4ec
c0d878be48df147411bdbd34bde68ce0f065ecd8fd745529bd02667c418d0f9d
c1acfa727754dab58bedc79995a642e235c6fde6449824c4fba4318fc060c91c
c1c53a4d300ac7532bec2ed085532b2fe66d27f2b592b3a9383aa649e42ed6fb
c3a17d28471e294f847b267c1cc852dc1f6d564049ffd6e98675ce3a1d67f454
c4680d0c58e0e1e593ff09ad98bf0b38b9f0515a237355309c7272c6931b0114
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
c516fb70b94293a61d199ee79bd1f7c82d3b907ec92586bf7d0271ec24cc94d6
c62021d50570366181641d49ce550aa1767a2142c672e3435b043d32f92d583d
c7c63b43903d698f7c8b28360ce19c81b574db3288a8db01a29ac72ffba1327b
c7cab0557ec1903f963ce5d115c0513ae5dda3669ddfd93b488165e2739fe939
c8bf0c92e9d760687900c78550d36be64b89a20978f6edda34dcae384dceb06e
c94a3fcd12f734dc95572525bb21ae54269eaa94037cc149b0599342a2602ec2
c9a0b5e3c7d47198f50124c220ff593348e5d7a62385eff10baf6109f3366c3a
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca498a0544c33a82ef0bb0ae018dbe98fa5143d50a8d05d518212ff9683fb93e
ca7e29d98e78392b39cb22bd9558dabda300c7216ad9e54f61c109ea374de798
cb5ba38bc7f23598a4cd121c2179848aad23c8256f9a5fb992a0750e494070d9
cca11cadd735ca563c70cc0e8865c4c8dafcdfe0d5294bae8c11a7362d988167
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
ce0e0e11e79156df3d3ba198dcc218afc14028fee592fbf2e90a3902e3430b95
ce2faa449d2aba085ddcf7a163a35e866bfc02f229139ccfc5406f959f1758fb
cf30cedeb987a5fd3ce2c458fe515fecb3e6805c6d364b2c5ef69b4a59cbf90e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf550f7fac98e2e3d175cc44d678f8152365f322e690b37bd493851b4f69cebd
d001753e373dfc1789e335e61eee39f0192707f9d5d10f9a66a1a72b63f42288
d05d164843ec0e47ddf7fca61f0e4bed73c23280c7eeb0fd0e9dc0c618b8eb90
d083cc000a794634cd8d17bf239fd28479835cb25ec1be65ed101eb2b89903ab
d31b12baad65082a7d404da9971cc9fed871e35f29a5893f815f468f1050491f
d3514819861026568dd0f01af2b86e14e6107da507743592627330fb01466808
d53f3cdaef8e7ce21a5761cf218c5e2728aef8c9efa371bf0cd37592aa748c9a
d5e8dd45e016659abf3f31bafbe99e0343c9757ecf450816d44ccaf49fdecaa3
d629949a714b64d9cddb6c0bf7cbf356ddb21821c4a36792c62b0edccba858d6
d6ae9c160eecee16065db5ddb29b956f0bebf65ef3d0978de7eeaf24b1f6329c
d94d376774b1d15ce89dd323ce3e0a1944384f4d7d79de25f1b91553d4e15869
da507f20462fb8811e74f0467e17cc3ba0b47419496589b08e93edba743a5eb2
da693f489b6d2662014f5d21377dbe57855e74f3e686bc23c9635096f6632a5d
dae0df258a8943f1e474c721170373a8282dd2443a714a1bb8ef9f2573bb91d5
daf4b32a87ae8820092eb9367d3360b045f0379737cd8585ebb97f48177d51fa
dafa636914d006f4a813591eb19fa3a512a658ca2f7018cadc254586e9416196
db2619c2d7a2c41b123c8bbca1cdade0ae40b5a90023a492926c827e63b18f97
db856c4f0af60b1443fc7f8ed8c23ba9637d7a94a546a3d2214076413f78c7b8
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dbe1042b7290f4f6d73d1e0ebe0b7f8dd9e9d3f8bdde4e749c151f36ac7c42c2
dbe699db5579e6b8f485d6d3fd23f6c5b77e4928bec888900fc95282e363fdb7
de34e56163cf7b887c17a511f4fcff7848ed39e769d40f621dfd5422c92471ba
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
dfef4a9f22e20b5b62f8e3209f7d19ca77bd628dba254e57b5255d6f6f6cd108
e08f08223af3fdb140f7aa9e3803f7be89116448acf98be7e9519b8cda825401
e0a0973c107379ea3f243805d2dda954827ced2e4b6c69b4559474d303414c54
e0c6725ad0c01557a29fef49091f321e333b792d2e5a4727f6f8bf716d8adeb1
e1c2041fc27e7fd38dd8821941394b66e75307de16228a0709bd2f4e62cf49fc
e2d1dec485bdae92432e5f17ec18a35954cb0da197908630d4019c93387a6e41
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b5202cd40276b18faadcc849c66a031af88bf5c249e08476b637e81486c68d
e4bc3946ec97b93a1b6afba423aeaef7ba8ea7836045d9095333372950bc3ce3
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5f5d2cdbc00ae1469e2cdb4d7bf88f206267ced9e0e047cffa716e1561a1a33
e73e15b86711ab100f6115cbb1c99e0732addc4bb0c070a990c4c6b5b32a6028
e8a0cdf16afdc033a01c83256cc29442726babba2d31e1d3ddd5c7475789dc14
e99927b117a431d002d016853f9d56ccf53065686c483f8ce0429fa938490271
e9dd5429c2cbf9c59c11784b04a58ffb8ef2dddefaa23743af3df52272f8642c
eb8624dd6fb8169edf09f31ff314ff8c244638b783924f3fcc89b2c6779fb771
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a
ec9f555293783e1fc77da97dbabfb27b29c2495be2bf735229482e2a0f14766f
ec9fd827749f1a790a6ff94fbf964c0ccdc3ba9fb9c69c82ac7b746a27fd83ff
ed00c08c8ff1dd3d7df61272130e7494d1114b164ac78f13fd7892b4f9bf3830
edf9ccc85631eec0bdb18adee99fcf339dbb1b2d17f47e87abef6f4f1241a72d
eecc9f4abadf636ac0d14d4dd07020b35e2e8686068df77f867ad7e6da2556da
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef25b9d3d8f48f3a0f8b96f3a287382cf19f23af16546ce72e4bf6f77fb2970b
efd7bcb3ff9569f6d0379e80d3f3a347cad0544208c8e56632544397129f9f92
f09b17140f8a24035fe930dae0ff63f5d11398ccc430ebe7b35b9a1b6ed2b993
f0b498080cf7e6717b596b9b7590f3f0a94f1ee14ee981dce61e40866a7f9de3
f123fae1ceff20dea7ee2ff8895276a22cddecc8e0ef503b5e95419e76909a54
f1a85b93b66af4ae83cf7c891b9ebe92bcdcf729bc8f9ba786112d2f2d555761
f21b7aa0d3d0b1295ac9d76d728e3975358e480e272f18c24388ca73ff719faa
f2688f97e72f0c4040553f967d8f90a0b3669aeece19e421e987e3c08b30ffb2
f27b4cdbd821100765224a52c7c8d544fa9fdd6d0aba21015eb66c11735e0989
f2ad40f9e0fb785aa013e7e0c92fe5769aa38002d5425aa1e933223d32411176
f36464f3791aa4b6611b05166ae3f015bce1dc4905bbf99ff0ec66b8b69e6d55
f367a4f4ecdf49dc57467020cf68b8de6443b110d2bdfc24379d6e4e4ab92c19
f3864682d9efe5a6ada4d3b3692461f8c251a56b8382b967174363077199f9d9
f4932fd84c133c25db2b4f03a9e800d1ba170c3207c1872a1a30e300cdf0ecce
f4b8023577f74f9e9ea6380f20ac14f9d711b0b54a5477b5f08c2557b76f881f
f50167bee40cd7fdd6c623efb794e0edddec7de87ef71f48c8b1b1413e1dfc4a
f698136a98282629b98902dc7249fbcf3383d547df08350e907991dff4f61c75
f8800772f0dd827877029d9d634a170a156ff82b6b6bdf251b62c750b73cfe93
f95ea8dc46d24e09af6f519e481fad2c42d03cedc808b64c3033da3b2b583795
f97c0872652460761415e9fdf3db6cc6f8bef4bbe4350bd072e572f489455aa8
f98fe2d1b58cfc0f428e3f48c20ad2028fac3dcf14e98484634a578e12666077
fb5161d5056eb7e4fe34ee1f83f4f9678146f6eb94417547b2eefac74c1b0eb0
fb8cbd2a68b8068930e22baa762a4463ffd66b91ac3905ef9123ea07203bc133
fbf57280833f63be3a67c650170d8ed7e26714816cb138516c9514b3743517f4
fc7ba06a76dcf3fde4d52c8667360d310504a7d961b330989c500e5c5ce4f382
fcb3ba32d938b01406682fcf2392f8aa999f31fe71645b5230967ca191795021
fcea863949651d32c48c40e5ea26ac29818235b292e50f9cec01a7243cd638b6
fe350550651039fc4dda6ec99bf2be5ee6ad01d87d9732efa3db30f6ede91c76
ff2285a1556eefe6f4605b2663674c973492213d144fada4ec669bc9e5ce802c
ff2e8d7d164d98cb0dd71282747c6d718236e79036bc2d3f3fecf10d9abb2872