g2agiftcard.com Open in urlscan Pro
185.128.34.117 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://photo-choice.com/c/d?i=tlwSZn6x9
Effective URL:
https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publ...
Submission: On May 22 via manual (May 22nd 2020, 9:35:12 pm UTC) from SI

Summary HTTP 82 Redirects Links 29 Behaviour Indicators

Summary

This website contacted 23 IPs in 5 countries across 24 domains to perform 82 HTTP transactions. The main IP is 185.128.34.117, located in Netherlands and belongs to EUROFIBER-UNET EUROFIBER / UNET Network, NL. The main domain is g2agiftcard.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 4th 2020. Valid for: 3 months.

This is the only time g2agiftcard.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	95.211.228.83 95.211.228.83	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
5	104.26.14.191 104.26.14.191	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE)
1	5.79.100.220 5.79.100.220	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	2606:4700::68... 2606:4700::6810:84e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:814::200a	15169 (GOOGLE) (GOOGLE)
9	104.26.15.191 104.26.15.191	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
1 4	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
1	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE)
2 6	2a00:1450:400... 2a00:1450:4001:81d::200e	15169 (GOOGLE) (GOOGLE)
2	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:400c:c03::9d	15169 (GOOGLE) (GOOGLE)
2 2	2a00:1450:400... 2a00:1450:4001:816::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1 1	18.214.129.53 18.214.129.53	14618 (AMAZON-AES) (AMAZON-AES)
1 2	2606:4700:303... 2606:4700:3037::6812:33dc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	185.128.34.117 185.128.34.117	29396 (EUROFIBER...) (EUROFIBER-UNET EUROFIBER / UNET Network)
1 1	2600:9000:215... 2600:9000:2156:8200:2:7bf5:a0c0:21	16509 (AMAZON-02) (AMAZON-02)
1	94.228.142.45 94.228.142.45	41887 (PROLOCATI...) (PROLOCATION Transit policy pref 100)
12	2600:9000:20e... 2600:9000:20eb:f400:b:413c:b700:93a1	16509 (AMAZON-02) (AMAZON-02)
1	130.211.115.4 130.211.115.4	15169 (GOOGLE) (GOOGLE)
1	151.101.114.110 151.101.114.110	54113 (FASTLY) (FASTLY)
2	185.221.86.34 185.221.86.34	206998 (NEW-2) (NEW-2)
82	23

3 95.211.228.83 (Netherlands) 1 redirects

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

photo-choice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.26.14.191 (United States)

ASN13335 (CLOUDFLARENET, US)

main2.vodonet.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 5.79.100.220 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

a.magetic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:84e5 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:814::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 104.26.15.191 (United States)

ASN13335 (CLOUDFLARENET, US)

img.vodonet.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:6b8::1:119 (Moscow, Russian Federation) 1 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:81d::200e (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c03::9d (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.214.129.53 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-214-129-53.compute-1.amazonaws.com

lg.aivilors.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3037::6812:33dc (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

click.trlxcf01.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 185.128.34.117 (Netherlands)

ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL)

g2agiftcard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:8200:2:7bf5:a0c0:21 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

djjcyqvteia9v.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.228.142.45 (Netherlands)

ASN41887 (PROLOCATION Transit policy pref 100, NL)

ehawk.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2600:9000:20eb:f400:b:413c:b700:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.cloudcnt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 130.211.115.4 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 4.115.211.130.bc.googleusercontent.com

data.ad-score.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.110 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.221.86.34 (Germany)

ASN206998 (NEW-2, DE)

bam.eu01.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	g2agiftcard.com g2agiftcard.com	640 KB
14	vodonet.net main2.vodonet.net img.vodonet.net	779 KB
12	cloudcnt.com cdn.cloudcnt.com	135 KB
8	gstatic.com fonts.gstatic.com	86 KB
6	google-analytics.com 2 redirects www.google-analytics.com	68 KB
6	googleapis.com ajax.googleapis.com fonts.googleapis.com	37 KB
4	yandex.ru 1 redirects mc.yandex.ru	94 KB
3	doubleclick.net 2 redirects stats.g.doubleclick.net googleads.g.doubleclick.net	2 KB
3	photo-choice.com 1 redirects photo-choice.com	6 KB
2	nr-data.net bam.eu01.nr-data.net	457 B
2	trlxcf01.com 1 redirects click.trlxcf01.com	3 KB
2	google.de www.google.de	259 B
2	google.com 2 redirects www.google.com	713 B
2	googleadservices.com www.googleadservices.com	13 KB
1	newrelic.com js-agent.newrelic.com	10 KB
1	ad-score.com data.ad-score.com	715 B
1	ehawk.net ehawk.net	14 KB
1	cloudfront.net 1 redirects djjcyqvteia9v.cloudfront.net	299 B
1	aivilors.com 1 redirects lg.aivilors.com	1 KB
1	googletagmanager.com www.googletagmanager.com	25 KB
1	aspnetcdn.com ajax.aspnetcdn.com	30 KB
1	cloudflare.com cdnjs.cloudflare.com	4 KB
1	magetic.com a.magetic.com	636 B
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	10 KB
82	24

	Domain	Requested by
17	g2agiftcard.com	g2agiftcard.com
12	cdn.cloudcnt.com	g2agiftcard.com
9	img.vodonet.net	photo-choice.com ajax.googleapis.com
8	fonts.gstatic.com	ajax.googleapis.com g2agiftcard.com ehawk.net
6	www.google-analytics.com	2 redirects www.googletagmanager.com g2agiftcard.com www.google-analytics.com
5	fonts.googleapis.com	photo-choice.com g2agiftcard.com
5	main2.vodonet.net	photo-choice.com
4	mc.yandex.ru	1 redirects photo-choice.com
3	photo-choice.com	1 redirects
2	bam.eu01.nr-data.net	js-agent.newrelic.com
2	click.trlxcf01.com	1 redirects photo-choice.com
2	www.google.de	photo-choice.com
2	www.google.com	2 redirects
2	stats.g.doubleclick.net	1 redirects g2agiftcard.com
2	www.googleadservices.com	www.googletagmanager.com www.googleadservices.com
1	js-agent.newrelic.com	g2agiftcard.com
1	data.ad-score.com	g2agiftcard.com
1	ehawk.net	g2agiftcard.com
1	djjcyqvteia9v.cloudfront.net	1 redirects
1	lg.aivilors.com	1 redirects
1	googleads.g.doubleclick.net	1 redirects
1	www.googletagmanager.com	photo-choice.com
1	ajax.aspnetcdn.com	photo-choice.com
1	cdnjs.cloudflare.com	photo-choice.com
1	a.magetic.com	photo-choice.com
1	ajax.googleapis.com	photo-choice.com
1	maxcdn.bootstrapcdn.com	photo-choice.com
82	27

This site contains links to these domains. Also see Links.

Domain
gfunsubscribe.com
www.facebook.com
support.google.com
support.apple.com
support.mozilla.org
privacy.microsoft.com
www.outspot.be
emgroup.dk
eneco.be
www.traveldeal.nl
www.mycollections.com
www.inboxagency.com
www.bluemediaads.com
www.hotmeetups.com
www.roularta.be
www.miranda-clairvoyant.com
40pluslove.com
www.dpgmedia.be
adviceglobal.com.mt
www.test-achats.be
www.proximus.be
www.webbdone.com
www.westbespaarcoach.nl
hoteldeal.nl
www.6deals.nl
www.koopjedeal.nl
www.dekbed-discounter.nl
www.woonq.nl

Subject Issuer	Validity	Valid
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-11-21` - `2020-10-09`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
a.magetic.com Let's Encrypt Authority X3	`2020-04-21` - `2020-07-20`	3 months	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh
*.vo.msecnd.net Microsoft IT TLS CA 2	`2020-03-18` - `2022-03-18`	2 years	crt.sh
mc.yandex.ru Yandex CA	`2019-09-23` - `2020-09-22`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
photo-choice.com Let's Encrypt Authority X3	`2020-04-07` - `2020-07-06`	3 months	crt.sh
g2agiftcard.com Let's Encrypt Authority X3	`2020-03-04` - `2020-06-02`	3 months	crt.sh
*.ehawk.net Sectigo RSA Domain Validation Secure Server CA	`2020-01-13` - `2021-01-13`	a year	crt.sh
*.cloudcnt.com Amazon	`2019-07-18` - `2020-08-18`	a year	crt.sh
*.ad-score.com Go Daddy Secure Certificate Authority - G2	`2019-09-02` - `2020-11-01`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
f4.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-05-06` - `2021-05-07`	a year	crt.sh
*.eu01.nr-data.net DigiCert SHA2 Secure Server CA	`2020-02-04` - `2022-02-08`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
Frame ID: 9548C6EDA7E2936AE3B43B1054950F55
Requests: 82 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://photo-choice.com/c/d?i=tlwSZn6x9 Page URL
http://photo-choice.com/c/store?s=9697&b=15520&ymid=5tlwSZn6x9 HTTP 302
https://photo-choice.com/c/redirect?http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9... Page URL
http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520 HTTP 302
https://click.trlxcf01.com/click/m7Rh4AQiOMrhWgEVtl?affid=100329&c1=021452d1-9545-4c5e-9f2a-195480a7eb3... HTTP 302
https://click.trlxcf01.com/main/d.php?s=1&link=https%3A%2F%2Fg2agiftcard.com%2Fnl_be%2Ftr_bfphone11prob... Page URL
https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&n... Page URL

Detected technologies

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

82
Requests

87 %
HTTPS

56 %
IPv6

24
Domains

27
Subdomains

23
IPs

5
Countries

1949 kB
Transfer

3333 kB
Size

0
Cookies

29 Outgoing links

These are links going to different origins than the main page.

URL: https://gfunsubscribe.com/
Title: terugtrekkenzonder

Search URL Search Domain Scan URL

URL: https://www.facebook.com/policies/cookies/
Title: beleid

Search URL Search Domain Scan URL

URL: https://www.facebook.com/privacy/explanation
Title: deze

Search URL Search Domain Scan URL

URL: https://support.google.com/chrome/answer/95647?hl=nl
Title: Chrome

Search URL Search Domain Scan URL

URL: https://support.apple.com/nl-nl/HT201265
Title: Safari

Search URL Search Domain Scan URL

URL: https://support.mozilla.org/nl/kb/cookies-verwijderen-gegevens-wissen-websites-opgeslagen
Title: Firefox

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/nl-nl/windows-10-microsoft-edge-and-privacy
Title: Internet Explorer Edge

Search URL Search Domain Scan URL

URL: https://www.outspot.be/nl/privacybeleid
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://emgroup.dk/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://eneco.be/nl/privacybeleid
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.traveldeal.nl/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.mycollections.com/includes/privacypolicynl.pdf
Title: Privacy policy

Search URL Search Domain Scan URL

URL: http://www.inboxagency.com/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://www.bluemediaads.com/gtc.html
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.hotmeetups.com/privacy/policy
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://www.roularta.be/nl/privacy-policy
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.miranda-clairvoyant.com/terms.html
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://40pluslove.com/en/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.dpgmedia.be/nl/privacy
Title: Privacy policy

Search URL Search Domain Scan URL

URL: http://adviceglobal.com.mt/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.test-achats.be/nt/nc/institutionnel/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.proximus.be/nl/id_cr_warnland/particulieren/producten/r-orphans/wettelijke-informatie.html
Title: Privacy policy

Search URL Search Domain Scan URL

URL: http://www.webbdone.com/informativa-privacy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.westbespaarcoach.nl/over-ons/privacy-en-cookieverklaring/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://hoteldeal.nl/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.6deals.nl/service/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.koopjedeal.nl/privacy
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.dekbed-discounter.nl/service/privacy-policy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.woonq.nl/service/privacy/
Title: Privacy policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://photo-choice.com/c/d?i=tlwSZn6x9 Page URL
http://photo-choice.com/c/store?s=9697&b=15520&ymid=5tlwSZn6x9 HTTP 302
https://photo-choice.com/c/redirect?http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520 Page URL
http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520 HTTP 302
https://click.trlxcf01.com/click/m7Rh4AQiOMrhWgEVtl?affid=100329&c1=021452d1-9545-4c5e-9f2a-195480a7eb33&c3=4729&fname=&lname=&email=&bday=&bmonth=&byear=&gender= HTTP 302
https://click.trlxcf01.com/main/d.php?s=1&link=https%3A%2F%2Fg2agiftcard.com%2Fnl_be%2Ftr_bfphone11probenlnopre%3Fclickid%3DqG0AU8k7F5-5ec8457ebf5888121a21a26f%26networkid%3D100329%26publisher%3D4729%26c6%3D%26c7%3D%26fname%3D%26lname%3D%26email%3D%26bday%3D%26bmonth%3D%26byear%3D%26gender%3D%26ept2%3Dc2b564e4-94da-485d-9f92-5fd3e4f59e54 Page URL
https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 23

https://www.google-analytics.com/r/collect?v=1&_v=j82&a=1003218810&t=pageview&_s=1&dl=http%3A%2F%2Fphoto-choice.com%2Fc%2Fd%3Fi%3DtlwSZn6x9&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=1501987040&gjid=1171997007&cid=412778539.1590183284&tid=UA-78186952-1&_gid=506572151.1590183284&_r=1&gtm=2wg5e1NF2NMTW&z=1263549936 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-78186952-1&cid=412778539.1590183284&jid=1501987040&_gid=506572151.1590183284&gjid=1171997007&_v=j82&z=1263549936 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-78186952-1&cid=412778539.1590183284&jid=1501987040&_v=j82&z=1263549936 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-78186952-1&cid=412778539.1590183284&jid=1501987040&_v=j82&z=1263549936&slf_rd=1&random=438444686

Request Chain 28

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/693039449/?random=1846836877&cv=9&fst=*&num=1&value=0&label=JnwqCMKnjMABENniu8oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg5e1&sendb=1&ig=1&frm=0&url=http://photo-choice.com/c/d%3Fi%3DtlwSZn6x9&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=c0XIXvmuOr3D7_UPiNeZ6Aw&sscte=1&crd=&gtd=&eitems=ChAI8PCd9gUQ6Y3r25rVuvRzEh0AYss0muITfJlpWI3NP7IyRd9Ox9YxUQ9yogq5tQ HTTP 302
https://www.google.com/pagead/1p-conversion/693039449/?random=1846836877&cv=9&fst=*&num=1&value=0&label=JnwqCMKnjMABENniu8oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg5e1&sendb=1&ig=1&frm=0&url=http://photo-choice.com/c/d%3Fi%3DtlwSZn6x9&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=c0XIXvmuOr3D7_UPiNeZ6Aw&eitems=ChAI8PCd9gUQ6Y3r25rVuvRzEh0AYss0mvg4DqF1zTAGsZg0N8I4KCmvAZ9dNr4k1A&random=3257682710&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/693039449/?random=1846836877&cv=9&fst=*&num=1&value=0&label=JnwqCMKnjMABENniu8oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg5e1&sendb=1&ig=1&frm=0&url=http://photo-choice.com/c/d%3Fi%3DtlwSZn6x9&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=c0XIXvmuOr3D7_UPiNeZ6Aw&eitems=ChAI8PCd9gUQ6Y3r25rVuvRzEh0AYss0mvg4DqF1zTAGsZg0N8I4KCmvAZ9dNr4k1A&random=3257682710&resp=GooglemKTybQhCsO&ipr=y

Request Chain 29

https://mc.yandex.ru/watch/56890888?wmode=7&page-url=http%3A%2F%2Fphoto-choice.com%2Fc%2Fd%3Fi%3DtlwSZn6x9%23!%2Fsth&charset=utf-8&browser-info=ti%3A10%3Ans%3A1590183283429%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200522233444%3Aet%3A1590183284%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A1185167606673%3Arqn%3A1%3Arn%3A587749612%3Ahid%3A816535856%3Ads%3A13%2C13%2C193%2C1%2C0%2C0%2C0%2C236%2C53%2C%2C%2C%2C459%3Afp%3A530%3Awn%3A13212%3Ahl%3A3%3Agdpr%3A14%3Av%3A1869%3Awv%3A2%3Arqnl%3A1%3Ast%3A1590183284%3Au%3A1590183284428697608 HTTP 302
https://mc.yandex.ru/watch/56890888/1?wmode=7&page-url=http%3A%2F%2Fphoto-choice.com%2Fc%2Fd%3Fi%3DtlwSZn6x9%23%21%2Fsth&charset=utf-8&browser-info=ti%3A10%3Ans%3A1590183283429%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200522233444%3Aet%3A1590183284%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A1185167606673%3Arqn%3A1%3Arn%3A587749612%3Ahid%3A816535856%3Ads%3A13%2C13%2C193%2C1%2C0%2C0%2C0%2C236%2C53%2C%2C%2C%2C459%3Afp%3A530%3Awn%3A13212%3Ahl%3A3%3Agdpr%3A14%3Av%3A1869%3Awv%3A2%3Arqnl%3A1%3Ast%3A1590183284%3Au%3A1590183284428697608

Request Chain 31

http://photo-choice.com/c/store?s=9697&b=15520&ymid=5tlwSZn6x9 HTTP 302
https://photo-choice.com/c/redirect?http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520

Request Chain 32

http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520 HTTP 302
https://click.trlxcf01.com/click/m7Rh4AQiOMrhWgEVtl?affid=100329&c1=021452d1-9545-4c5e-9f2a-195480a7eb33&c3=4729&fname=&lname=&email=&bday=&bmonth=&byear=&gender= HTTP 302
https://click.trlxcf01.com/main/d.php?s=1&link=https%3A%2F%2Fg2agiftcard.com%2Fnl_be%2Ftr_bfphone11probenlnopre%3Fclickid%3DqG0AU8k7F5-5ec8457ebf5888121a21a26f%26networkid%3D100329%26publisher%3D4729%26c6%3D%26c7%3D%26fname%3D%26lname%3D%26email%3D%26bday%3D%26bmonth%3D%26byear%3D%26gender%3D%26ept2%3Dc2b564e4-94da-485d-9f92-5fd3e4f59e54

Request Chain 42

https://djjcyqvteia9v.cloudfront.net/EHawkTalon.js HTTP 301
https://ehawk.net/talon-cdn/EHawkTalon.js

Request Chain 59

https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=1752430361&t=pageview&_s=1&dl=https%3A%2F%2Fg2agiftcard.com%2Fnl_be%2Ftr_bfphone11probenlnopre%3Fclickid%3DqG0AU8k7F5-5ec8457ebf5888121a21a26f%26networkid%3D100329%26publisher%3D4729%26c6%3D%26c7%3D%26fname%3D%26lname%3D%26email%3D%26bday%3D%26bmonth%3D%26byear%3D%26gender%3D%26ept2%3Dc2b564e4-94da-485d-9f92-5fd3e4f59e54&ul=en-us&de=UTF-8&dt=Win!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAAEADQ~&jid=1313421116&gjid=247584484&cid=1354547350.1590183296&tid=UA-112265078-1&_gid=902357654.1590183296&_r=1&z=1326353428 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-112265078-1&cid=1354547350.1590183296&jid=1313421116&_gid=902357654.1590183296&gjid=247584484&_v=j82&z=1326353428

82 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK d Show response
photo-choice.com/c/ 14 KB
5 KB 220ms
193ms Document
text/html 95.211.228.83
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: HTTP/1.1
Server: 95.211.228.83 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3f9fdd61ce78b1d97cc9fb77214c41aa92bc7ee843a3a110d313e3a597034004

Request headers

Host: photo-choice.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
Server: Apache/2.2.15 (CentOS)
P3P: CP="ALL DSP COR PSAa PSDa OUR NOR ONL UNI COM NAV"
Referrer-Policy: no-referrer
Set-cookie: id=45tlwSZn6x9; path=/; expires=Sat, 23-May-2020 21:34:43 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4295
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.3.4/js/ 35 KB
10 KB 28ms
9ms Script
text/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/js/bootstrap.min.js

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:33:51 GMT
status: 200
etag: "1544639631"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 9538

GET
H2 200 site.css
main2.vodonet.net/SHTICK_TEMPLATOR/ 869 B
559 B 110ms
31ms Stylesheet
text/css 104.26.14.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://main2.vodonet.net/SHTICK_TEMPLATOR/site.css
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.14.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3aeb555b764bd40e3904c9fc6af91b3631f94c831ae160cc680eb1e813f32097

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:43 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 02 Jan 2012 19:29:08 GMT
server: cloudflare
age: 733
etag: W/"8008a9-365-4b59098a96900"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 5979a9b36bcf0bfd-AMS
cf-request-id: 02dfe8641d00000bfd1d202200000001

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.3/ 94 KB
33 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 May 2020 02:11:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 501792
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33507
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 17 May 2021 02:11:31 GMT

GET
H2 200 script.js Show response
main2.vodonet.net/SHTICK_TEMPLATOR/script/ 9 KB
3 KB 116ms
38ms Script
text/javascript 104.26.14.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://main2.vodonet.net/SHTICK_TEMPLATOR/script/script.js?date=17.8.2012
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.14.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9eae45417473d8f1a0eb841b452e9ddbf2d2cf2286e227cb7ad49b6e10070676

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:43 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Tue, 28 Jan 2020 11:17:16 GMT
server: cloudflare
etag: W/"146880f-22d2-59d315dc98700"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5979a9b36bd10bfd-AMS
cf-request-id: 02dfe8641d00000bfd1d203200000001

GET
H2 200 mobpop.js Show response
main2.vodonet.net/SHTICK_TEMPLATOR/script/ 6 KB
2 KB 108ms
29ms Script
text/javascript 104.26.14.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://main2.vodonet.net/SHTICK_TEMPLATOR/script/mobpop.js
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.14.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2a3e219ea51de330906090021bab55254a48287f73226256a9c24f49e0291d9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:43 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 09 Dec 2013 10:39:49 GMT
server: cloudflare
age: 733
etag: W/"a011c5-186e-4ed179d83bb70"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: max-age=14400
cf-ray: 5979a9b36bd20bfd-AMS
cf-request-id: 02dfe8641d00000bfd1d204200000001

GET
H2 200 email_check.js Show response
main2.vodonet.net/SHTICK_TEMPLATOR/script/ 188 B
529 B 107ms
29ms Script
text/javascript 104.26.14.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://main2.vodonet.net/SHTICK_TEMPLATOR/script/email_check.js
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.14.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32bd9b94367a02c30759ca3bf7bfeea38a06c89499e502638f938b66cac71c5d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:43 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 06 Aug 2012 16:20:47 GMT
server: cloudflare
age: 733
etag: W/"8e1436-bc-4c69b42a235c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: max-age=14400
cf-ray: 5979a9b36bd40bfd-AMS
cf-request-id: 02dfe8641d00000bfd1d205200000001

GET
H2 200 phone_check.js Show response
main2.vodonet.net/c/ 545 B
327 B 126ms
48ms Script
application/javascript 104.26.14.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://main2.vodonet.net/c/phone_check.js?geo=BE&date=17.8.2012
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.14.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8be0813709ee8727bf3277493fc930262d38eda54daaef67f1f08f69ce37d789

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:43 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 5979a9b36bd60bfd-AMS
cf-request-id: 02dfe8641d00000bfd1d206200000001

GET
H/1.1 200
OK tag Show response
a.magetic.com/ 13 B
636 B 119ms
22ms Script
text/html 5.79.100.220
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://a.magetic.com/tag?sid=42935&pub_id=1000000&click_id=
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 5.79.100.220 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: / Express
Resource Hash: 3af1a4527bfd82dae0214205a83c7adc80478843438b454643585071d27058af

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 22 May 2020 21:34:43 GMT
X-Powered-By: Express
ETag: W/"d-uCvyCHaYJYM9m3WSVQLmA5qV4d0"
Content-Length: 13
Content-Type: text/html; charset=utf-8

GET
H2 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/3.5.2/ 52 KB
4 KB 14ms
13ms Stylesheet
text/css 2606:4700::6810:84e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/3.5.2/animate.min.css

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:84e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:43 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 9119806
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 02dfe863c900001f398a248200000001
served-in-seconds: 0.002
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:15:36 GMT
server: cloudflare
etag: W/"5afd4838-ce35"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5979a9b2dab21f39-FRA
expires: Wed, 12 May 2021 21:34:43 GMT

GET
H2 200 css
fonts.googleapis.com/ 1 KB
522 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Pavanam

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1d4908d1171d35ebed5c3d50755491e895cc052c8a025a18820cec68cafb48d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 22 May 2020 21:34:43 GMT
server: ESF
date: Fri, 22 May 2020 21:34:43 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 May 2020 21:34:43 GMT

GET
H/1.1 200
OK uhfnmCgHUtPlMjM.png
img.vodonet.net/ 105 KB
106 KB 73ms
38ms Image
image/png 104.26.15.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.vodonet.net/uhfnmCgHUtPlMjM.png
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: HTTP/1.1
Server: 104.26.15.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4fe23d8a0301c250ece41fa2fcfed6c52b2e450b8d7d76b604a2f776825ad882

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
CF-Cache-Status: HIT
Last-Modified: Mon, 23 Dec 2019 08:44:16 GMT
Server: cloudflare
Age: 490
ETag: "8e7c6c-1a540-59a5b08589b89"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5979a9b3fe36fa7c-AMS
Content-Length: 107840
cf-request-id: 02dfe864780000fa7cbcb98200000001

GET
H/1.1 200
OK rQbJGn0T2M91mTV.png
img.vodonet.net/ 251 KB
252 KB 72ms
36ms Image
image/png 104.26.15.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.vodonet.net/rQbJGn0T2M91mTV.png
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: HTTP/1.1
Server: 104.26.15.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f6af9e53a9996f54961e43245921385dc5637ad380bb69a49859780effafa08

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
CF-Cache-Status: HIT
Last-Modified: Mon, 23 Dec 2019 08:52:53 GMT
Server: cloudflare
Age: 490
ETag: "8e7c6b-3ed4d-59a5b2730f780"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5979a9b3fef40c31-AMS
Content-Length: 257357
cf-request-id: 02dfe8647800000c31be1aa200000001

GET
H/1.1 200
OK UlNL9upHHxAGvlX.png
img.vodonet.net/ 8 KB
9 KB 72ms
37ms Image
image/png 104.26.15.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.vodonet.net/UlNL9upHHxAGvlX.png
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: HTTP/1.1
Server: 104.26.15.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b571c1d96e7fed55d3bbb59c04b8dd387bf9ec5e891fc0bab6993e50789f64f0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
CF-Cache-Status: HIT
Last-Modified: Fri, 20 Dec 2019 15:39:55 GMT
Server: cloudflare
Age: 490
ETag: "8e7c65-2153-59a247d503427"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5979a9b3fbf8c761-AMS
Content-Length: 8531
cf-request-id: 02dfe864780000c76134b7f200000001

GET
H/1.1 200
OK gv1x_R01omDqw60.gif
img.vodonet.net/ 38 KB
39 KB 69ms
34ms Image
image/gif 104.26.15.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.vodonet.net/gv1x_R01omDqw60.gif
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: HTTP/1.1
Server: 104.26.15.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f2ce3469fc38efad7d3d53256178849a2be5606e6e60792e2f2c48254c325f1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
CF-Cache-Status: HIT
Last-Modified: Fri, 07 Apr 2017 08:05:33 GMT
Server: cloudflare
Age: 490
ETag: "8e4b6b-97c5-54c8f16fc240e"
Vary: Accept-Encoding
Content-Type: image/gif
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5979a9b3f890fa40-AMS
Content-Length: 38853
cf-request-id: 02dfe864780000fa4003806200000001

GET
H/1.1 200
OK yKN6DbfAg2_eg09.png
img.vodonet.net/ 141 KB
141 KB 71ms
36ms Image
image/png 104.26.15.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.vodonet.net/yKN6DbfAg2_eg09.png
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: HTTP/1.1
Server: 104.26.15.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2992756a2aa4d02f12daa0dbff7dcce68ae59cc2b02f89baab0e7b56cdab3b83

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
CF-Cache-Status: HIT
Last-Modified: Mon, 23 Dec 2019 09:05:36 GMT
Server: cloudflare
Age: 490
ETag: "8e7c70-2332f-59a5b54a89351"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5979a9b3f9ae0c11-AMS
Content-Length: 144175
cf-request-id: 02dfe8647700000c11e31fc200000001

GET
H/1.1 200
OK RAYCOKivjBad9KD.png
img.vodonet.net/ 7 KB
7 KB 76ms
40ms Image
image/png 104.26.15.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.vodonet.net/RAYCOKivjBad9KD.png
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: HTTP/1.1
Server: 104.26.15.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10b11436f956b48d61a74e6e31bc7a2aa5727303643c864cf58cf8d39352aef2

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
CF-Cache-Status: HIT
Last-Modified: Tue, 28 Jan 2020 14:06:11 GMT
Server: cloudflare
Age: 490
ETag: "8e7dd1-1b8d-59d33b9e3e23d"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5979a9b3fcc52bec-AMS
Content-Length: 7053
cf-request-id: 02dfe8647800002becb6925200000001

GET
H/1.1 200
OK yBRbLO57dOExNat.png
img.vodonet.net/ 115 KB
116 KB 32ms
31ms Image
image/png 104.26.15.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.vodonet.net/yBRbLO57dOExNat.png
Requested by: Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9
Protocol: HTTP/1.1
Server: 104.26.15.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78a065fe74643f76882996ab435e2da297293d8ee035ef093193aad01a4f7a6a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
CF-Cache-Status: HIT
Last-Modified: Mon, 23 Dec 2019 09:02:39 GMT
Server: cloudflare
Age: 489
ETag: "8e7c6f-1cc77-59a5b4a164e76"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5979a9b42c59c761-AMS
Content-Length: 117879
cf-request-id: 02dfe8649a0000c76134b81200000001

GET
H2 200 jquery-2.2.1.min.js Show response
ajax.aspnetcdn.com/ajax/jQuery/ 84 KB
30 KB 81ms
20ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-2.2.1.min.js

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/8AE6) /

Resource Hash

82f420005cd31fab6b4ab016a07d623e8f5773de90c526777de5ba91e9be3b4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23944332
x-cache: HIT
status: 200
content-length: 29962
x-xss-protection: 1; mode=block
last-modified: Mon, 31 Oct 2016 23:11:06 GMT
server: ECAcc (ama/8AE6)
etag: "021b1ecc33d21:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK tag.js Show response
mc.yandex.ru/metrika/ 359 KB
91 KB 190ms
94ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

10ad93a3602068c768e39b1a132e9bb748eadbb70f35c6bfd36c08928a9f602c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
Content-Encoding: br
Last-Modified: Tue, 19 May 2020 08:28:20 GMT
Server: nginx/1.14.2
ETag: "5ec398a4-16ba9"
Strict-Transport-Security: max-age=31536000
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Content-Length: 93097
Expires: Fri, 22 May 2020 22:34:43 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 63 KB
25 KB 18ms
17ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NF2NMTW

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ebec06556ab1604a7b604f013c8181e645f77fe926000b8d7d7c521ab2a36e26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:43 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25024
x-xss-protection: 0
last-modified: Fri, 22 May 2020 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 22 May 2020 21:34:43 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NF2NMTW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 30 Apr 2020 21:54:13 GMT
server: Golfe2
age: 2304
date: Fri, 22 May 2020 20:56:19 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18433
expires: Fri, 22 May 2020 22:56:19 GMT

GET
H/1.1 200
OK conversion_async.js Show response
www.googleadservices.com/pagead/ 28 KB
11 KB 57ms
42ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NF2NMTW

Protocol

HTTP/1.1

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

65a1850028118c64febbde9b109da293910bfff6ee261caf0087d3d3364359ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Fri, 22 May 2020 21:34:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 12200185889747903800
Vary: Accept-Encoding
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 10877
X-XSS-Protection: 0
Expires: Fri, 22 May 2020 21:34:43 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j82&a=1003218810&t=pageview&_s=1&dl=http%3A%2F%2Fphoto-choice.com%2Fc%2Fd%3Fi%3DtlwSZn6x9&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-78186952-1&cid=412778539.1590183284&jid=1501987040&_gid=506572151.1590183284&gjid=1171997007&_v=j82&z=1263549936
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-78186952-1&cid=412778539.1590183284&jid=1501987040&_v=j82&z=1263549936
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-78186952-1&cid=412778539.1590183284&jid=1501987040&_v=j82&z=1263549936&slf_rd=1&random=438444686

42 B
106 B

16ms
16ms

Image
image/gif

2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-78186952-1&cid=412778539.1590183284&jid=1501987040&_v=j82&z=1263549936&slf_rd=1&random=438444686

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 May 2020 21:34:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 22 May 2020 21:34:43 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-78186952-1&cid=412778539.1590183284&jid=1501987040&_v=j82&z=1263549936&slf_rd=1&random=438444686
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/693039449/ 2 KB
2 KB 94ms
37ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/693039449/?random=1590183283876&cv=9&fst=1590183283876&num=1&value=0&label=JnwqCMKnjMABENniu8oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg5e1&sendb=1&ig=1&frm=0&url=http%3A%2F%2Fphoto-choice.com%2Fc%2Fd%3Fi%3DtlwSZn6x9&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

0700e2849177f98f69d14a826e8e98129f793c0c9c3286418d00575b29d06da9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 May 2020 21:34:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1151
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK K7ghHjc_58tkFQo.jpg
img.vodonet.net/ 101 KB
101 KB 30ms
29ms Image
image/jpeg 104.26.15.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.vodonet.net/K7ghHjc_58tkFQo.jpg
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Protocol: HTTP/1.1
Server: 104.26.15.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c83a05556e8864fe229589842ee405bb6727c742fb1110553d509fec4395054

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
CF-Cache-Status: HIT
Last-Modified: Fri, 13 Sep 2019 14:02:27 GMT
Server: cloudflare
Age: 489
ETag: "8e7771-1930e-5926fb4489c7f"
Vary: Accept-Encoding
Content-Type: image/jpeg
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5979a9b46961fa40-AMS
Content-Length: 103182
cf-request-id: 02dfe864bd0000fa400380b200000001
Cf-Bgj: h2pri

GET
H/1.1 200
OK 1XH81cHytEkKLPX.png
img.vodonet.net/ 1 KB
2 KB 33ms
32ms Image
image/png 104.26.15.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.vodonet.net/1XH81cHytEkKLPX.png
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Protocol: HTTP/1.1
Server: 104.26.15.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a556dc3e5f97b92e7efdff2299ba8ec84543a90290d6b240e7703a267a594dca

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:43 GMT
CF-Cache-Status: HIT
Last-Modified: Fri, 07 Apr 2017 07:48:02 GMT
Server: cloudflare
Age: 489
ETag: "8e4b65-45b-54c8ed85868ed"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5979a9b46cfc2bec-AMS
Content-Length: 1115
cf-request-id: 02dfe864bc00002becb6927200000001

GET
H2 200 BXRrvF_aiezLh0xPPOxa9EX3UcA.woff2
fonts.gstatic.com/s/pavanam/v4/ 10 KB
10 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/pavanam/v4/BXRrvF_aiezLh0xPPOxa9EX3UcA.woff2

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4226b9e8f6738653444fba42e42b9826322ebf45e5ae3d1e0d28f50ffd48fbaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Pavanam
Origin: http://photo-choice.com

Response headers

date: Wed, 20 May 2020 16:03:48 GMT
x-content-type-options: nosniff
last-modified: Tue, 16 Jul 2019 03:00:48 GMT
server: sffe
age: 192655
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10144
x-xss-protection: 0
expires: Thu, 20 May 2021 16:03:48 GMT

GET
H2

200

/
www.google.de/pagead/1p-conversion/693039449/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/693039449/?random=1846836877&cv=9&fst=*&num=1&value=0&label=JnwqCMKnjMABENniu8oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_a...
https://www.google.com/pagead/1p-conversion/693039449/?random=1846836877&cv=9&fst=*&num=1&value=0&label=JnwqCMKnjMABENniu8oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd...
https://www.google.de/pagead/1p-conversion/693039449/?random=1846836877&cv=9&fst=*&num=1&value=0&label=JnwqCMKnjMABENniu8oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=...

42 B
153 B

20ms
19ms

Image
image/gif

2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/693039449/?random=1846836877&cv=9&fst=*&num=1&value=0&label=JnwqCMKnjMABENniu8oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg5e1&sendb=1&ig=1&frm=0&url=http://photo-choice.com/c/d%3Fi%3DtlwSZn6x9&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=c0XIXvmuOr3D7_UPiNeZ6Aw&eitems=ChAI8PCd9gUQ6Y3r25rVuvRzEh0AYss0mvg4DqF1zTAGsZg0N8I4KCmvAZ9dNr4k1A&random=3257682710&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 May 2020 21:34:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 22 May 2020 21:34:44 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-conversion/693039449/?random=1846836877&cv=9&fst=*&num=1&value=0&label=JnwqCMKnjMABENniu8oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg5e1&sendb=1&ig=1&frm=0&url=http://photo-choice.com/c/d%3Fi%3DtlwSZn6x9&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=c0XIXvmuOr3D7_UPiNeZ6Aw&eitems=ChAI8PCd9gUQ6Y3r25rVuvRzEh0AYss0mvg4DqF1zTAGsZg0N8I4KCmvAZ9dNr4k1A&random=3257682710&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1 Show response
mc.yandex.ru/watch/56890888/
Redirect Chain

https://mc.yandex.ru/watch/56890888?wmode=7&page-url=http%3A%2F%2Fphoto-choice.com%2Fc%2Fd%3Fi%3DtlwSZn6x9%23!%2Fsth&charset=utf-8&browser-info=ti%3A10%3Ans%3A1590183283429%3As%3A1600x1200x24%3Ask%...
https://mc.yandex.ru/watch/56890888/1?wmode=7&page-url=http%3A%2F%2Fphoto-choice.com%2Fc%2Fd%3Fi%3DtlwSZn6x9%23%21%2Fsth&charset=utf-8&browser-info=ti%3A10%3Ans%3A1590183283429%3As%3A1600x1200x24%3...

206 B
757 B

95ms
47ms

XHR
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/watch/56890888/1?wmode=7&page-url=http%3A%2F%2Fphoto-choice.com%2Fc%2Fd%3Fi%3DtlwSZn6x9%23%21%2Fsth&charset=utf-8&browser-info=ti%3A10%3Ans%3A1590183283429%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200522233444%3Aet%3A1590183284%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A1185167606673%3Arqn%3A1%3Arn%3A587749612%3Ahid%3A816535856%3Ads%3A13%2C13%2C193%2C1%2C0%2C0%2C0%2C236%2C53%2C%2C%2C%2C459%3Afp%3A530%3Awn%3A13212%3Ahl%3A3%3Agdpr%3A14%3Av%3A1869%3Awv%3A2%3Arqnl%3A1%3Ast%3A1590183284%3Au%3A1590183284428697608

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

cbfb8dd7bd9eb476c5cae0c10fefa71b4062c11af541404c2bd4a7ea6ff2a8f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 22 May 2020 21:34:44 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 22-May-2020 21:34:44 GMT
Server: nginx/1.14.2
Strict-Transport-Security: max-age=31536000
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: http://photo-choice.com
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 206
X-XSS-Protection: 1; mode=block
Expires: Fri, 22-May-2020 21:34:44 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 22 May 2020 21:34:44 GMT
Last-Modified: Fri, 22-May-2020 21:34:44 GMT
Server: nginx/1.14.2
Access-Control-Allow-Origin: http://photo-choice.com
Strict-Transport-Security: max-age=31536000
Location: /watch/56890888/1?wmode=7&page-url=http%3A%2F%2Fphoto-choice.com%2Fc%2Fd%3Fi%3DtlwSZn6x9%23%21%2Fsth&charset=utf-8&browser-info=ti%3A10%3Ans%3A1590183283429%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200522233444%3Aet%3A1590183284%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A1185167606673%3Arqn%3A1%3Arn%3A587749612%3Ahid%3A816535856%3Ads%3A13%2C13%2C193%2C1%2C0%2C0%2C0%2C236%2C53%2C%2C%2C%2C459%3Afp%3A530%3Awn%3A13212%3Ahl%3A3%3Agdpr%3A14%3Av%3A1869%3Awv%3A2%3Arqnl%3A1%3Ast%3A1590183284%3Au%3A1590183284428697608
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Fri, 22-May-2020 21:34:44 GMT

GET
H/1.1 200
OK advert.gif
mc.yandex.ru/metrika/ 43 B
425 B 87ms
47ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/metrika/advert.gif

Requested by

Host: photo-choice.com
URL: http://photo-choice.com/c/d?i=tlwSZn6x9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:44 GMT
Last-Modified: Fri, 17 Jan 2020 08:05:01 GMT
Server: nginx/1.14.2
ETag: "5e216aad-2b"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Fri, 22 May 2020 22:34:44 GMT

GET
H/1.1

200
OK

redirect
photo-choice.com/c/
Redirect Chain

http://photo-choice.com/c/store?s=9697&b=15520&ymid=5tlwSZn6x9
https://photo-choice.com/c/redirect?http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520

703 B
612 B

113ms
27ms

Document
text/html

95.211.228.83
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://photo-choice.com/c/redirect?http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 95.211.228.83 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: photo-choice.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: id=45tlwSZn6x9; _ga=GA1.2.412778539.1590183284; _gid=GA1.2.506572151.1590183284; _gat_UA-78186952-1=1; _ym_uid=1590183284428697608; _ym_d=1590183284; _ym_isad=2; _ym_visorc_56890888=b
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://photo-choice.com/c/d?i=tlwSZn6x9#!/sth

Response headers

Date: Fri, 22 May 2020 21:34:52 GMT
Server: Apache/2.2.15 (CentOS)
Referrer-Policy: no-referrer
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 367
Connection: close
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 22 May 2020 21:34:52 GMT
Server: Apache/2.2.15 (CentOS)
Referrer-Policy: no-referrer
Location: https://photo-choice.com/c/redirect?http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520
Connection: close
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8

GET
H2

200

d.php
click.trlxcf01.com/main/
Redirect Chain

http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520
https://click.trlxcf01.com/click/m7Rh4AQiOMrhWgEVtl?affid=100329&c1=021452d1-9545-4c5e-9f2a-195480a7eb33&c3=4729&fname=&lname=&email=&bday=&bmonth=&byear=&gender=
https://click.trlxcf01.com/main/d.php?s=1&link=https%3A%2F%2Fg2agiftcard.com%2Fnl_be%2Ftr_bfphone11probenlnopre%3Fclickid%3DqG0AU8k7F5-5ec8457ebf5888121a21a26f%26networkid%3D100329%26publisher%3D47...

310 B
645 B

369ms
369ms

Document
text/html

2606:4700:3037::6812:33dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://click.trlxcf01.com/main/d.php?s=1&link=https%3A%2F%2Fg2agiftcard.com%2Fnl_be%2Ftr_bfphone11probenlnopre%3Fclickid%3DqG0AU8k7F5-5ec8457ebf5888121a21a26f%26networkid%3D100329%26publisher%3D4729%26c6%3D%26c7%3D%26fname%3D%26lname%3D%26email%3D%26bday%3D%26bmonth%3D%26byear%3D%26gender%3D%26ept2%3Dc2b564e4-94da-485d-9f92-5fd3e4f59e54
Requested by: Host: photo-choice.com
URL: https://photo-choice.com/c/redirect?http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6812:33dc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: click.trlxcf01.com
:scheme: https
:path: /main/d.php?s=1&link=https%3A%2F%2Fg2agiftcard.com%2Fnl_be%2Ftr_bfphone11probenlnopre%3Fclickid%3DqG0AU8k7F5-5ec8457ebf5888121a21a26f%26networkid%3D100329%26publisher%3D4729%26c6%3D%26c7%3D%26fname%3D%26lname%3D%26email%3D%26bday%3D%26bmonth%3D%26byear%3D%26gender%3D%26ept2%3Dc2b564e4-94da-485d-9f92-5fd3e4f59e54
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=dfe1bb1a4e1ecac98afdcbd7d11b18a1a1590183294; AWSALB=3BydadVAWVppVbqqaSE38L4tagy2wd+Y5iWe82mA86/cMSBD+Ykij+cZ5Hagq9bpoydncPrw74tiKICsdrs/Y3g5qcVtaZwId6eqDtfa1hYu8WptDG+wLOekL1iy; AWSALBCORS=3BydadVAWVppVbqqaSE38L4tagy2wd+Y5iWe82mA86/cMSBD+Ykij+cZ5Hagq9bpoydncPrw74tiKICsdrs/Y3g5qcVtaZwId6eqDtfa1hYu8WptDG+wLOekL1iy; XSRF-TOKEN=eyJpdiI6ImVFbW1IY3BjRnp4R0ZFaXRNXC93aFJRPT0iLCJ2YWx1ZSI6IjhJaFpHelplWDJ6WHkxdE9kWU92QlBIeWQwdXFoYmh0QnJLdnpRZjdUMVBySVpUZnpKXC82c0NIUW9wV0x5bnM4ZU5RY3dpb1wvTFVzeHJwRzZ5XC9aQlZ3PT0iLCJtYWMiOiJjOGZiNzBmNmMxMmMzNGJlYWM0Nzg1NDNhNmFjZmNhZDg3MDQ5OWRhMThmMDRkYmE3OWFiYTgzZmUxNjY2OTM2In0%3D; session=eyJpdiI6Ijd6Z2FQOFdQK0trMldvQ1o5OVBLeGc9PSIsInZhbHVlIjoiQTJGUEtDWUpMc3kxMDFaWVU2YWZLWURBM0o5c0hqTWJqcE9ueUdXa1crdWNjMEtIbjRHc2djZ2FROCthQTgxOTFnd3FDK3ZUNzBDMHJod202aTVBTnc9PSIsIm1hYyI6ImUwM2RhMTgyM2E5MjMzZGE1ZmE0Y2I4NmY5ZDAyZmQ4OTg5MjNlYTE4MDA0OTg4OGM1ZDE1OTZmYTZjOGRiMmYifQ%3D%3D; ept2=eyJpdiI6Im5wbGczMGpOejR4NFNVb1RmWkZIUFE9PSIsInZhbHVlIjoiSmdhM2RvYnE2SnBGWDcwaDBmXC9xSHZGaklqbW1qYmpnbGhIVlV2QVRCTVBQODVEcnFaYTBCcVNxWTM4N3Nxb0hFMEg3cFk3anpoR2J5RDlkeTV4MlJoSzh5dXJCZ3gxN1hXeU5hQVhVZ0Rybk5jSGpCNGpEWitHbFlYYUpNTFVcL1BsaGtuK2VIODdITGpnbGZGM0dnZFdsd3BObmx5dU9MUHNxT2puckZsclhYUngrYnBJUitCdEk2aEN6NHlLOSsiLCJtYWMiOiJmZmExYWU4ZmE1YmIyNzViNTYxZDRlODM5Y2M1YmU5YzhkNGRlZDQ1NjllY2IxMGI3NjE0N2Q1ODExOGQxYzVkIn0%3D; bEhSXLHxNUOCJJTJS77pC2sXA2TQxEpQqRsu2Iq5=eyJpdiI6InB5Mzl4c3dFdU5DeDVJWUVBTVZTQXc9PSIsInZhbHVlIjoicVRKb2RQK21Dck50SE4zWlI1bSt6elBZbUtMR0lZVU5OMXlTbmJSTHVPSDlYVWtGQ2hYWEhVQitrZ2JIaFFMZDJDTTY1UVwvSzJLMkNEbjJjcStKNHNRTmxjVGhoMnRpazRaRkwwZWI5NlpMZ3NhOU5sQWxcL1ZpUm5SR2lkVUZQZ3FGbTFDeG5FVFNHc3FFMGNZa0M0bDJ1NHNzMVVPbElvZGFPMVNHRzNnMFJKZ0JGRDFsRFNQYUZVVnNucnFOSk12dUdncWY1cjcra05LZE9oRXNYTFwvQVYxaFRZMkc0Nzg1YjJZOVRUQkQ1YTZoOHhhWElcL3RKM1wvRGlUaDhKdG5nMmJBR25ucVpuc1lGMk9maUxISzdcL2Vjb3UxRXJGd0hxWGY0SkZEdzlXVTR3ZmhrTzlYTTBoZHBQWnQyMkFScnFhUjZSUWtUWlZCcjlGclNPOHpDQ01sMkpVNzk3N0pcL0VFZEFwajNLclJFUVh1Ukh4UzZiWmNNV0o2eThLbTVGQm03Q2duWENnZmxzOFwvWThFb0h1R1wvaFhqZnZCR0FGRTFrZHVSRkd3MzVrcWVMZ05EM0RLSjFIQm1HbW5ldGJkSlwvdDAybW9naXdWNUhPZ3U2U1U5Z2FtZ3VSSlZvQStJOFJUdDYwQnBPWXBMM0VJS2NqWVdYU2trcjR5d3JMa2Z4OEdnN2l0K24rUk1nbmJ4VU9ldXhYRkNLb0JOckJyTnlXMGFuaFBNSmJyYVM3dDhBeFJadVo2bFAxdDhvSkFcLzZVM3VuMGhGRldBWVhsaE9XRTBXOTIxYWRQU3huYkd3UVQ4bFJTZHNNQWE3b1ZITG5sSGI3TFgzK09OcVY3V3k4ajQ0R2RzUUxsUmhwdmI5bHZ2Y29xZG0rVUJBaEVPMDNFT0VsUFlwNUJxd1wvVmZkT1JQWlh0NnI2NThrdGorZ29vbmtPWjFLc3dLRExHbEFOQTJ5MGFRPT0iLCJtYWMiOiJiY2MxZmM1NzRmNjk4NDBlMzI3NWU4ZTRlZTI5M2NmNDc0MDliNjUyMDdiNjhjYTY1MzRjMTZiYjBkODIyZDg4In0%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://photo-choice.com/c/redirect?http://lg.aivilors.com/t/clk?id=NLzsNR2TVrQ4svEkRho&s2=12533568-9c74-11ea-b38d-28924a3ab82c&s1=15520

Response headers

status: 200
date: Fri, 22 May 2020 21:34:55 GMT
content-type: text/html; charset=UTF-8
set-cookie: AWSALB=v29d4lYOdRx28SRpYXyD7u4PfZwhwDC5X2KJpX73lxEawY7UauYo9v2NI3fDCahSg1qQXHHMBCtk5mTl3BWzCZaX8xtY5/rkVXQZ2fslhdBtIvTYT8oIxD+Ktujl; Expires=Fri, 29 May 2020 21:34:55 GMT; Path=/ AWSALBCORS=v29d4lYOdRx28SRpYXyD7u4PfZwhwDC5X2KJpX73lxEawY7UauYo9v2NI3fDCahSg1qQXHHMBCtk5mTl3BWzCZaX8xtY5/rkVXQZ2fslhdBtIvTYT8oIxD+Ktujl; Expires=Fri, 29 May 2020 21:34:55 GMT; Path=/; SameSite=None
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5979a9fa5c27dfcf-FRA
content-encoding: br
cf-request-id: 02dfe890770000dfcf39ad1200000001

Redirect headers

status: 302
date: Fri, 22 May 2020 21:34:55 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=dfe1bb1a4e1ecac98afdcbd7d11b18a1a1590183294; expires=Sun, 21-Jun-20 21:34:54 GMT; path=/; domain=.trlxcf01.com; HttpOnly; SameSite=Lax AWSALB=3BydadVAWVppVbqqaSE38L4tagy2wd+Y5iWe82mA86/cMSBD+Ykij+cZ5Hagq9bpoydncPrw74tiKICsdrs/Y3g5qcVtaZwId6eqDtfa1hYu8WptDG+wLOekL1iy; Expires=Fri, 29 May 2020 21:34:54 GMT; Path=/ AWSALBCORS=3BydadVAWVppVbqqaSE38L4tagy2wd+Y5iWe82mA86/cMSBD+Ykij+cZ5Hagq9bpoydncPrw74tiKICsdrs/Y3g5qcVtaZwId6eqDtfa1hYu8WptDG+wLOekL1iy; Expires=Fri, 29 May 2020 21:34:54 GMT; Path=/; SameSite=None XSRF-TOKEN=eyJpdiI6ImVFbW1IY3BjRnp4R0ZFaXRNXC93aFJRPT0iLCJ2YWx1ZSI6IjhJaFpHelplWDJ6WHkxdE9kWU92QlBIeWQwdXFoYmh0QnJLdnpRZjdUMVBySVpUZnpKXC82c0NIUW9wV0x5bnM4ZU5RY3dpb1wvTFVzeHJwRzZ5XC9aQlZ3PT0iLCJtYWMiOiJjOGZiNzBmNmMxMmMzNGJlYWM0Nzg1NDNhNmFjZmNhZDg3MDQ5OWRhMThmMDRkYmE3OWFiYTgzZmUxNjY2OTM2In0%3D; expires=Fri, 22-May-2020 23:34:54 GMT; Max-Age=7200; path=/ session=eyJpdiI6Ijd6Z2FQOFdQK0trMldvQ1o5OVBLeGc9PSIsInZhbHVlIjoiQTJGUEtDWUpMc3kxMDFaWVU2YWZLWURBM0o5c0hqTWJqcE9ueUdXa1crdWNjMEtIbjRHc2djZ2FROCthQTgxOTFnd3FDK3ZUNzBDMHJod202aTVBTnc9PSIsIm1hYyI6ImUwM2RhMTgyM2E5MjMzZGE1ZmE0Y2I4NmY5ZDAyZmQ4OTg5MjNlYTE4MDA0OTg4OGM1ZDE1OTZmYTZjOGRiMmYifQ%3D%3D; expires=Fri, 22-May-2020 23:34:54 GMT; Max-Age=7200; path=/; HttpOnly ept2=eyJpdiI6Im5wbGczMGpOejR4NFNVb1RmWkZIUFE9PSIsInZhbHVlIjoiSmdhM2RvYnE2SnBGWDcwaDBmXC9xSHZGaklqbW1qYmpnbGhIVlV2QVRCTVBQODVEcnFaYTBCcVNxWTM4N3Nxb0hFMEg3cFk3anpoR2J5RDlkeTV4MlJoSzh5dXJCZ3gxN1hXeU5hQVhVZ0Rybk5jSGpCNGpEWitHbFlYYUpNTFVcL1BsaGtuK2VIODdITGpnbGZGM0dnZFdsd3BObmx5dU9MUHNxT2puckZsclhYUngrYnBJUitCdEk2aEN6NHlLOSsiLCJtYWMiOiJmZmExYWU4ZmE1YmIyNzViNTYxZDRlODM5Y2M1YmU5YzhkNGRlZDQ1NjllY2IxMGI3NjE0N2Q1ODExOGQxYzVkIn0%3D; expires=Sat, 23-May-2020 21:34:54 GMT; Max-Age=86400; path=/; HttpOnly bEhSXLHxNUOCJJTJS77pC2sXA2TQxEpQqRsu2Iq5=eyJpdiI6InB5Mzl4c3dFdU5DeDVJWUVBTVZTQXc9PSIsInZhbHVlIjoicVRKb2RQK21Dck50SE4zWlI1bSt6elBZbUtMR0lZVU5OMXlTbmJSTHVPSDlYVWtGQ2hYWEhVQitrZ2JIaFFMZDJDTTY1UVwvSzJLMkNEbjJjcStKNHNRTmxjVGhoMnRpazRaRkwwZWI5NlpMZ3NhOU5sQWxcL1ZpUm5SR2lkVUZQZ3FGbTFDeG5FVFNHc3FFMGNZa0M0bDJ1NHNzMVVPbElvZGFPMVNHRzNnMFJKZ0JGRDFsRFNQYUZVVnNucnFOSk12dUdncWY1cjcra05LZE9oRXNYTFwvQVYxaFRZMkc0Nzg1YjJZOVRUQkQ1YTZoOHhhWElcL3RKM1wvRGlUaDhKdG5nMmJBR25ucVpuc1lGMk9maUxISzdcL2Vjb3UxRXJGd0hxWGY0SkZEdzlXVTR3ZmhrTzlYTTBoZHBQWnQyMkFScnFhUjZSUWtUWlZCcjlGclNPOHpDQ01sMkpVNzk3N0pcL0VFZEFwajNLclJFUVh1Ukh4UzZiWmNNV0o2eThLbTVGQm03Q2duWENnZmxzOFwvWThFb0h1R1wvaFhqZnZCR0FGRTFrZHVSRkd3MzVrcWVMZ05EM0RLSjFIQm1HbW5ldGJkSlwvdDAybW9naXdWNUhPZ3U2U1U5Z2FtZ3VSSlZvQStJOFJUdDYwQnBPWXBMM0VJS2NqWVdYU2trcjR5d3JMa2Z4OEdnN2l0K24rUk1nbmJ4VU9ldXhYRkNLb0JOckJyTnlXMGFuaFBNSmJyYVM3dDhBeFJadVo2bFAxdDhvSkFcLzZVM3VuMGhGRldBWVhsaE9XRTBXOTIxYWRQU3huYkd3UVQ4bFJTZHNNQWE3b1ZITG5sSGI3TFgzK09OcVY3V3k4ajQ0R2RzUUxsUmhwdmI5bHZ2Y29xZG0rVUJBaEVPMDNFT0VsUFlwNUJxd1wvVmZkT1JQWlh0NnI2NThrdGorZ29vbmtPWjFLc3dLRExHbEFOQTJ5MGFRPT0iLCJtYWMiOiJiY2MxZmM1NzRmNjk4NDBlMzI3NWU4ZTRlZTI5M2NmNDc0MDliNjUyMDdiNjhjYTY1MzRjMTZiYjBkODIyZDg4In0%3D; expires=Fri, 22-May-2020 23:34:54 GMT; Max-Age=7200; path=/; HttpOnly
cache-control: no-cache, private
location: /main/d.php?s=1&link=https%3A%2F%2Fg2agiftcard.com%2Fnl_be%2Ftr_bfphone11probenlnopre%3Fclickid%3DqG0AU8k7F5-5ec8457ebf5888121a21a26f%26networkid%3D100329%26publisher%3D4729%26c6%3D%26c7%3D%26fname%3D%26lname%3D%26email%3D%26bday%3D%26bmonth%3D%26byear%3D%26gender%3D%26ept2%3Dc2b564e4-94da-485d-9f92-5fd3e4f59e54
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5979a9f50ff3dfcf-FRA
cf-request-id: 02dfe88d260000dfcf39aa4200000001

GET
H/1.1 200
OK Primary Request Cookie set tr_bfphone11probenlnopre Show response
g2agiftcard.com/nl_be/ 122 KB
28 KB 249ms
146ms Document
text/html 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

f198360e7b7d63f562f3879f007430765b9e5a4975b373579de02638be78ba21

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: g2agiftcard.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx
Date: Fri, 22 May 2020 21:34:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: visitId=9a83b0cfd7af03913602267f68ef5477b90d2f6197ac4d7f55c3deed8aeb5bb0a%3A2%3A%7Bi%3A0%3Bs%3A7%3A%22visitId%22%3Bi%3A1%3Bs%3A35%3A%22qG0AU8k7F5-5ec8457ebf5888121a21a26f%22%3B%7D; expires=Sun, 21-Jun-2020 21:34:55 GMT; Max-Age=2592000; path=/; HttpOnly _csrf-frontend=cc34e733d1f3272d66df88d70e31a3f6ffbdae10e447450b353b02a88634f7a1a%3A2%3A%7Bi%3A0%3Bs%3A14%3A%22_csrf-frontend%22%3Bi%3A1%3Bs%3A32%3A%22276mO0lUPQSUZg8wVTwMfCu7x1KHV78M%22%3B%7D; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip

GET
H/1.1 200
OK common.css
g2agiftcard.com/bundles/ 2 KB
1 KB 34ms
26ms Stylesheet
text/css 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/bundles/common.css?v=1589994414

Requested by

Host: g2agiftcard.com
URL: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

93e6339751a6bc8510b53241e6885b89c1bf6fc6f27a24366b4b7ecf0d024ddb

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:06:54 GMT
Server: nginx
ETag: W/"5ec563ae-72b"
Vary: Accept-Encoding
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK flamingo_main_style.css
g2agiftcard.com/bundles/ 132 KB
28 KB 64ms
29ms Stylesheet
text/css 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/bundles/flamingo_main_style.css?v=1589994438

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

0a4190251bfc46f0fc3a68c06841fa91ad094e2b8b7f12c2ac0ddb5b9bf97554

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:07:18 GMT
Server: nginx
ETag: W/"5ec563c6-20fab"
Vary: Accept-Encoding
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK flamingo_layout_layout-4steps.css
g2agiftcard.com/bundles/ 105 KB
22 KB 96ms
28ms Stylesheet
text/css 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/bundles/flamingo_layout_layout-4steps.css?v=1589994438

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

d340e7bbc9bd29d4ae937c6eed8c21e91b1657df950f933b80f75400824abee9

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:07:18 GMT
Server: nginx
ETag: W/"5ec563c6-1a483"
Vary: Accept-Encoding
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK flamingo_color_white.css
g2agiftcard.com/bundles/ 12 KB
2 KB 97ms
24ms Stylesheet
text/css 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/bundles/flamingo_color_white.css?v=1589994440

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

8c63ee1c9d488d8f070c5865f4d8f32d0396ca6adf054fc6bb0e9e2e4186172a

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:07:03 GMT
Server: nginx
ETag: W/"5ec563b7-30dd"
Vary: Accept-Encoding
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK flamingo_brand_zara-uk.css
g2agiftcard.com/bundles/ 8 KB
2 KB 98ms
25ms Stylesheet
text/css 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/bundles/flamingo_brand_zara-uk.css?v=1589994442

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

97d0aed607dd7dac79da4db96ef87c28a1e48216aab918c75f40f7a61b58d432

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:07:05 GMT
Server: nginx
ETag: W/"5ec563b9-1fb7"
Vary: Accept-Encoding
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK flamingo_extra_empty.css
g2agiftcard.com/bundles/ 0
413 B 97ms
24ms Stylesheet
text/css 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/bundles/flamingo_extra_empty.css?v=1589994446

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:07:26 GMT
Server: nginx
ETag: "5ec563ce-0"
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK 2_6a732fe1ef79fe6c70d52a2b4cc4bdc0.png
g2agiftcard.com/uploads/landings/11268/main/ 216 KB
216 KB 31ms
26ms Image
image/png 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g2agiftcard.com/uploads/landings/11268/main/2_6a732fe1ef79fe6c70d52a2b4cc4bdc0.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

55f04e537bd12b8fbc0a026ecc49417bd72e9aac7084a5e32a3a97a9aa76a126

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 11 Sep 2019 09:56:37 GMT
Server: nginx
ETag: "5d78c4d5-35ed9"
Content-Type: image/png
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 220889
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK 3_46b271f8306cb8ffe567230b80eedfcb.jpg
g2agiftcard.com/uploads/landings/11268/main/ 34 KB
34 KB 31ms
27ms Image
image/jpeg 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g2agiftcard.com/uploads/landings/11268/main/3_46b271f8306cb8ffe567230b80eedfcb.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

573dad1af8b17c2226b0fcb2f77614e7084228f2fd25573fe1b04ec6477d3aee

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 11 Sep 2019 09:56:37 GMT
Server: nginx
ETag: "5d78c4d5-863a"
Content-Type: image/jpeg
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 34362
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK placeholder.png
g2agiftcard.com/images/ 30 KB
30 KB 30ms
26ms Image
image/png 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g2agiftcard.com/images/placeholder.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

93453aeb09ee83e223ec77a93aab60cbcf79be3436401817b49bf11093e6adc1

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:04:56 GMT
Server: nginx
ETag: "5ec56338-762f"
Content-Type: image/png
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30255
X-Content-Type-Options: nosniff

GET
H/1.1

200
OK

EHawkTalon.js Show response
ehawk.net/talon-cdn/
Redirect Chain

https://djjcyqvteia9v.cloudfront.net/EHawkTalon.js
https://ehawk.net/talon-cdn/EHawkTalon.js

43 KB
14 KB

223ms
38ms

Script
text/javascript

94.228.142.45
PROLOCATION Trans...

General

Check archive.org

Show headers Download Go to

Full URL

https://ehawk.net/talon-cdn/EHawkTalon.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

94.228.142.45 , Netherlands, ASN41887 (PROLOCATION Transit policy pref 100, NL),

Reverse DNS

Software

Apache /

Resource Hash

1a2a572f006b242096d76275e8c9edb114f9aa65cbd67fd1c4d57053da83932f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.ehawk.net/

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:56 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 04 May 2020 17:54:16 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN, ALLOW-FROM https://www.ehawk.net/
Content-Type: text/javascript
Cache-Control: max-age=290304000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 13571

Redirect headers

date: Fri, 22 May 2020 02:22:49 GMT
via: 1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
server: Apache
age: 69126
status: 301
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: text/html; charset=iso-8859-1
location: https://ehawk.net/talon-cdn/EHawkTalon.js
x-amz-cf-pop: FRA50-C1
content-length: 314
x-amz-cf-id: NaNMKkxP8FPnXvzSEg0hhRZ9jy-jMzOzPbCtuAB_emag0IIFAy5Okg==

GET
H2 200 5caf02536774b.png
cdn.cloudcnt.com/uploads/entityLogos/ 3 KB
4 KB 72ms
7ms Image
image/png 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/uploads/entityLogos/5caf02536774b.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

bfe854925ea083ffd5d883a565d6deb7104539a443f0a7367975962ca706003a

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 111773
x-cache: Hit from cloudfront
status: 200
date: Fri, 22 May 2020 01:55:52 GMT
content-length: 3423
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 11 Apr 2019 09:01:07 GMT
server: nginx
etag: "5caf0253-d5f"
content-type: image/png
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: sOGfulUIuy_-IrbYu42GbFsTgr70VuncVAuh99XMNWP04zyQM2O0VQ==

GET
H/1.1 200
OK common.js Show response
g2agiftcard.com/bundles/ 415 KB
117 KB 29ms
28ms Script
application/javascript 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/bundles/common.js?v=1589994414

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

1fe402a959d5f3c0658f5338b86f0c005f6d204ca388a3b3d7e17d1c44324ecd

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:06:41 GMT
Server: nginx
ETag: W/"5ec563a1-67b80"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK Form.js Show response
g2agiftcard.com/assets/bc87e039/js/ 9 KB
2 KB 30ms
25ms Script
application/javascript 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/assets/bc87e039/js/Form.js?v=1589994450

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

7090c8ce3dc1702e3f2c0408de14f7a8f677586187b7b41d46826d157de36b82

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:07:30 GMT
Server: nginx
ETag: W/"5ec563d2-2275"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK scripts.js Show response
g2agiftcard.com/assets/878e9fcb/js/ 2 KB
1 KB 28ms
24ms Script
application/javascript 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/assets/878e9fcb/js/scripts.js?v=1589994450

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

89ad71822e874a1edddd658dd450f9013a97d4847fb6c9efed59134aba4e6b16

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:07:30 GMT
Server: nginx
ETag: W/"5ec563d2-7d2"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
X-Content-Type-Options: nosniff

GET
H2 200 css
fonts.googleapis.com/ 35 KB
1 KB 17ms
16ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ba6a04fe8e549687a74fe53d14f44185cf1a62b2e7da4a16a573c367d89819ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 22 May 2020 21:34:55 GMT
server: ESF
date: Fri, 22 May 2020 21:34:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 May 2020 21:34:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 432 B
421 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Indie+Flower

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

60be40bf02cb3a188131b1b23820333b0d6e1bd386f89924c91dcf79ef6e15fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 22 May 2020 21:34:55 GMT
server: ESF
date: Fri, 22 May 2020 21:34:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 May 2020 21:34:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 12 KB
901 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&subset=cyrillic-ext

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

84e6ba10a3ea0dbddf004cdd014b1621c5fe8a7065a3f15271307272befea438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 22 May 2020 21:34:55 GMT
server: ESF
date: Fri, 22 May 2020 21:34:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 May 2020 21:34:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 6 KB
649 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Libre+Franklin:300,400,500,600,700,800,900&subset=latin-ext

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

54de54b8aaf9245d016bf0adb5cf807195b6c883648f313e197a753f9f723410

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 22 May 2020 21:34:55 GMT
server: ESF
date: Fri, 22 May 2020 21:34:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 May 2020 21:34:55 GMT

GET
H/1.1 200
OK cors Show response
data.ad-score.com/score/ 65 B
715 B 484ms
125ms Script
text/plain 130.211.115.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/score/cors?s=1&callback=adScoreCORS&cb=0.4039180696119664&pid=1000432&&tid=100329&l1=BE&l2=4729&l3=tr_bfphone11probenlnopre&pub_domain=g2agiftcard.com
Requested by: Host: g2agiftcard.com
URL: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 6b2ee4913b17657576bb1390520e292b6c373289a44a381d62daf18bab312fdb

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 22 May 2020 21:34:56 GMT
Age: 0
Access-Control-Allow-Methods: GET,POST
P3p: CP="CURa ADMa DEVa TAIi PSAi PSDi IVAi IVDi CONi HISa TELi OUR IND DSP CAO COR"
Access-Control-Allow-Origin: *
Cache-Control: post-check=0, pre-check=0, false, proxy-revalidate, no-cache, no-cache=Set-Cookie, no-store, must-revalidate, max-age=0, s-maxage=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/plain; charset=utf-8
Content-Length: 65

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 8ms
5ms Script
text/javascript 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 30 Apr 2020 21:54:13 GMT
server: Golfe2
age: 2316
date: Fri, 22 May 2020 20:56:19 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18433
expires: Fri, 22 May 2020 22:56:19 GMT

GET
H/1.1 200
OK 1_a0e718ed939d444d40cecb7769288782.jpg
g2agiftcard.com/uploads/landings/11268/main/ 142 KB
143 KB 29ms
28ms Image
image/jpeg 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g2agiftcard.com/uploads/landings/11268/main/1_a0e718ed939d444d40cecb7769288782.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

7506aebc2ae895e946c85ebf48fda8c4fed2dbc863cbda4c352cf2a822676a4d

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 11 Sep 2019 09:54:05 GMT
Server: nginx
ETag: "5d78c43d-239a4"
Content-Type: image/jpeg
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 145828
X-Content-Type-Options: nosniff

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&subset=cyrillic-ext
Origin: https://g2agiftcard.com

Response headers

date: Wed, 20 May 2020 07:39:04 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:31:11 GMT
server: sffe
age: 222951
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9080
x-xss-protection: 0
expires: Thu, 20 May 2021 07:39:04 GMT

GET
H/1.1 200
OK lock_grey.png
g2agiftcard.com/bundles/878e9fcb/images/ 2 KB
3 KB 24ms
24ms Image
image/png 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g2agiftcard.com/bundles/878e9fcb/images/lock_grey.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

e507babf987b47de747a47fb3bd2d3ed3438528784241632f8fc776e290e15eb

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/bundles/flamingo_layout_layout-4steps.css?v=1589994438
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:55 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:06:22 GMT
Server: nginx
ETag: "5ec5638e-898"
Content-Type: image/png
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2200
X-Content-Type-Options: nosniff

GET
H2 200 mem5YaGs126MiZpBA-UN8rsOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN8rsOUuhpKKSTjw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8ccc36d648469ae72535a1ec5e23def10a53deff594eabfe2a6fa5d4ee4ce2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&subset=cyrillic-ext
Origin: https://g2agiftcard.com

Response headers

date: Tue, 19 May 2020 00:14:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:53 GMT
server: sffe
age: 335997
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9192
x-xss-protection: 0
expires: Wed, 19 May 2021 00:14:58 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&subset=cyrillic-ext
Origin: https://g2agiftcard.com

Response headers

date: Fri, 22 May 2020 20:44:13 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
server: sffe
age: 3042
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Sat, 22 May 2021 20:44:13 GMT

GET
H2 200 js Show response
www.google-analytics.com/gtm/ 133 KB
32 KB 30ms
30ms Script
application/javascript 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-WZBJQ3C&cid=1354547350.1590183296

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ae415cd6f453bf9e7895ee02e40927465d0255567a87e759dedd14de1d859e1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:56 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32212
x-xss-protection: 0
expires: Fri, 22 May 2020 21:34:56 GMT

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=1752430361&t=pageview&_s=1&dl=https%3A%2F%2Fg2agiftcard.com%2Fnl_be%2Ftr_bfphone11probenlnopre%3Fclickid%3DqG0AU8k7F5-5ec8457ebf5888121...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-112265078-1&cid=1354547350.1590183296&jid=1313421116&_gid=902357654.1590183296&gjid=247584484&_v=j82&z=1326353428

35 B
133 B

16ms
16ms

Image
image/gif

2a00:1450:400c:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-112265078-1&cid=1354547350.1590183296&jid=1313421116&_gid=902357654.1590183296&gjid=247584484&_v=j82&z=1326353428

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c03::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 22 May 2020 21:34:56 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 22 May 2020 21:34:56 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 302
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-112265078-1&cid=1354547350.1590183296&jid=1313421116&_gid=902357654.1590183296&gjid=247584484&_v=j82&z=1326353428
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 419
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2

Requested by

Host: ehawk.net
URL: https://ehawk.net/talon-cdn/EHawkTalon.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&subset=cyrillic-ext
Origin: https://g2agiftcard.com

Response headers

date: Sat, 16 May 2020 07:38:14 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:37 GMT
server: sffe
age: 568602
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9016
x-xss-protection: 0
expires: Sun, 16 May 2021 07:38:14 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_bZF3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v14/ 13 KB
13 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v14/JTURjIg1_i6t8kCHKm45_bZF3gnD_vx3rCs.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6de304c233a1b4d07424cb88ba16dc46fb015b3f659cdb2b2357e96af161082

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Montserrat:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i
Origin: https://g2agiftcard.com

Response headers

date: Sat, 16 May 2020 07:58:07 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:46:50 GMT
server: sffe
age: 567409
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13464
x-xss-protection: 0
expires: Sun, 16 May 2021 07:58:07 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v14/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v14/JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Montserrat:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i
Origin: https://g2agiftcard.com

Response headers

date: Thu, 21 May 2020 09:52:31 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:47:06 GMT
server: sffe
age: 128545
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13612
x-xss-protection: 0
expires: Fri, 21 May 2021 09:52:31 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_cJD3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v14/ 13 KB
13 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v14/JTURjIg1_i6t8kCHKm45_cJD3gnD_vx3rCs.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03b52a1594b643f27fdfc0ad86291bf36368dde44df9f07e1206b6fd3563bcab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Montserrat:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i
Origin: https://g2agiftcard.com

Response headers

date: Sun, 17 May 2020 09:25:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:46:37 GMT
server: sffe
age: 475743
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13560
x-xss-protection: 0
expires: Mon, 17 May 2021 09:25:53 GMT

GET
H/1.1 200
OK valid.png
g2agiftcard.com/bundles/878e9fcb/images/ 3 KB
4 KB 24ms
24ms Image
image/png 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g2agiftcard.com/bundles/878e9fcb/images/valid.png

Requested by

Host: g2agiftcard.com
URL: https://g2agiftcard.com/bundles/common.js?v=1589994414

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

219be728c7e01deabaf9c0391fcd6b511002585c3f04b55d8fb431eeea3d680a

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/bundles/flamingo_main_style.css?v=1589994438
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:56 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 20 May 2020 17:06:31 GMT
Server: nginx
ETag: "5ec56397-d7d"
Content-Type: image/png
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3453
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK sponsor Show response
g2agiftcard.com/ 24 KB
6 KB 48ms
47ms XHR
application/json 185.128.34.117
EUROFIBER-UNET EU...

General

Check archive.org

Show headers Download Go to

Full URL

https://g2agiftcard.com/sponsor?externalId=qG0AU8k7F5-5ec8457ebf5888121a21a26f

Requested by

Host: g2agiftcard.com
URL: https://g2agiftcard.com/bundles/common.js?v=1589994414

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.128.34.117 , Netherlands, ASN29396 (EUROFIBER-UNET EUROFIBER / UNET Network, NL),

Reverse DNS

Software

nginx /

Resource Hash

2708765c16255d0a73eeb1e3b3971de9ca1766e69947614cbf9421779cc63149

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 22 May 2020 21:34:56 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: nginx
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Connection: keep-alive
X-Content-Type-Options: nosniff

GET
H2 200 collect
www.google-analytics.com/ 35 B
119 B 7ms
6ms Image
image/gif 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j82&aip=1&a=1752430361&t=event&_s=2&dl=https%3A%2F%2Fg2agiftcard.com%2Fnl_be%2Ftr_bfphone11probenlnopre%3Fclickid%3DqG0AU8k7F5-5ec8457ebf5888121a21a26f%26networkid%3D100329%26publisher%3D4729%26c6%3D%26c7%3D%26fname%3D%26lname%3D%26email%3D%26bday%3D%26bmonth%3D%26byear%3D%26gender%3D%26ept2%3Dc2b564e4-94da-485d-9f92-5fd3e4f59e54&ul=en-us&de=UTF-8&dt=Win!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=tr_bfphone11probenlnopre.100329.4729&ea=01.%20home&_u=aGBAAEADQ~&jid=&gjid=&cid=1354547350.1590183296&tid=UA-112265078-1&_gid=902357654.1590183296&z=58168501

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 May 2020 08:49:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 391508
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 5ea0006f9dd33.jpg
cdn.cloudcnt.com/content/image/ 5 KB
6 KB 12ms
8ms Image
image/jpeg 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5ea0006f9dd33.jpg?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b64f6cb52f10fd384a5ca79f9ed99350179f361162cdf2298deef59e25aef291

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 09:07:46 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 44830
x-cache: Hit from cloudfront
content-type: image/JPEG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: ExpUMSNa7gmrgkExfGIaf_IQdoCpo4x7IYpQTXaCF3ee3kUQoefjjQ==
x-xss-protection: 1; mode=block

GET
H2 200 5e9ffd41edb87.png
cdn.cloudcnt.com/content/image/ 13 KB
14 KB 11ms
8ms Image
image/png 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5e9ffd41edb87.png?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d55ff6f67848f14ab43cf88dcf5394c229b44f6114959135cb283473fb1e3d71

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 08:17:10 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 47866
x-cache: Hit from cloudfront
content-type: image/PNG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: pKywdLYQJ0jadXJyr4O39M9uEM-Xo7cInSuzlwQvZjZVuONzGdBXQQ==
x-xss-protection: 1; mode=block

GET
H2 200 5b8fceef340ca.jpg
cdn.cloudcnt.com/content/image/ 11 KB
12 KB 14ms
11ms Image
image/jpeg 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5b8fceef340ca.jpg?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

58336cbeb4aeacdcf7bb2168c425b6d8c1b1ddf08ab4dfbfa15bc195027a4a2b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 05:30:07 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 144289
x-cache: Hit from cloudfront
content-type: image/JPEG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: XJUEF7rABGQZzTGjRFDFnNIZe0_Au3aYJlXoaOQF5KEM7HHp79J2AQ==
x-xss-protection: 1; mode=block

GET
H2 200 5c4ef2fce78eb.png
cdn.cloudcnt.com/content/image/ 10 KB
11 KB 15ms
12ms Image
image/png 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5c4ef2fce78eb.png?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b6481d535d8543b212cf31d22be4e5967341084fbf7d8720aa3d98d945e522c8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 05:49:53 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 143103
x-cache: Hit from cloudfront
content-type: image/PNG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: eP4iWvUqr6aJr6rR3pvthYtvgXuNE5w4gFw9aE9JRXNzzwwmPFd83g==
x-xss-protection: 1; mode=block

GET
H2 200 5cb745402a785.png
cdn.cloudcnt.com/content/image/ 7 KB
8 KB 25ms
23ms Image
image/png 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5cb745402a785.png?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ee34ed97c1081765a58102d39cace0e69ae54fae5eba3ae186e324252b76c066

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 20:06:38 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 5298
x-cache: Hit from cloudfront
content-type: image/PNG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: wB3YR0Bu2uV8o0B7Ezh6-HcQGWgl2CqLbVyMaAvTAtzhDZh_PqqHZw==
x-xss-protection: 1; mode=block

GET
H2 200 5d03a19d487bd.png
cdn.cloudcnt.com/content/image/ 7 KB
8 KB 25ms
22ms Image
image/png 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5d03a19d487bd.png?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

0a915444319a350b530c78f190fad9322c900a3a4d605dcdaa03664abcfe9659

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 20:06:38 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 5298
x-cache: Hit from cloudfront
content-type: image/PNG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: wJauZZMN3omZbTOCY_AlgoCBj09SvhNd4lhqTN_O9f682q4q141vHw==
x-xss-protection: 1; mode=block

GET
H2 200 5d692fe39fcd6.png
cdn.cloudcnt.com/content/image/ 11 KB
12 KB 16ms
14ms Image
image/png 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5d692fe39fcd6.png?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

6ecb5aa063f2738eae817a7e772e5f5aa0958bd4d1bacff96774903387b9a773

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 10:08:58 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 41158
x-cache: Hit from cloudfront
content-type: image/PNG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: Qk3I8vm8do1XiWkumUmAVA-tPekSKgHlhMJwwxfoKmP_bV-dOwnO3w==
x-xss-protection: 1; mode=block

GET
H2 200 5e9ffddae44fa.png
cdn.cloudcnt.com/content/image/ 9 KB
9 KB 20ms
18ms Image
image/png 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5e9ffddae44fa.png?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

daea9bbd208d8988b4a85bb71dd19a02fc975b8f5227216941c9fff01bb386ca

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 08:28:55 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 47161
x-cache: Hit from cloudfront
content-type: image/PNG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: Z640s1Gr8aDmaoOQ3bfufjeVuJupzDsdhKqtWOOyu_xjsIcaPsvdwQ==
x-xss-protection: 1; mode=block

GET
H2 200 5dc56d4865f82.png
cdn.cloudcnt.com/content/image/ 19 KB
20 KB 22ms
20ms Image
image/png 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5dc56d4865f82.png?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

09b8e060508d8bc0b0bd1a9feeec159f1bd63a6fda5a0fb671f720da4570faae

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 14:03:05 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 113511
x-cache: Hit from cloudfront
content-type: image/PNG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: nVSCExPE4iCVrxu-o7HBhz8JqjZHX-x02ww93HD39Ess2cGXMYr1JQ==
x-xss-protection: 1; mode=block

GET
H2 200 5e9ffd7db1061.png
cdn.cloudcnt.com/content/image/ 12 KB
13 KB 18ms
16ms Image
image/png 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5e9ffd7db1061.png?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c191f4a65b5c877fe1a7eceaac25e7ade426de48cd08d65ce303f8ac4566fc61

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 08:18:04 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 47812
x-cache: Hit from cloudfront
content-type: image/PNG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: c5Gysgw66-8JczG-d83FAEY2HjzSP77HVwyAh5Tyd2Pyrip4Z8GGeA==
x-xss-protection: 1; mode=block

GET
H2 200 5e9ffdac26df8.png
cdn.cloudcnt.com/content/image/ 20 KB
21 KB 20ms
19ms Image
image/png 2600:9000:20eb:f400:b:413c:b700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudcnt.com/content/image/5e9ffdac26df8.png?size=300

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:f400:b:413c:b700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

aa200befe8237e9e4f491182ba98a1ad96d9e05a9c680a8c47eaf91ad3632d9e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 08:18:35 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
server: nginx
age: 47781
x-cache: Hit from cloudfront
content-type: image/PNG
status: 200
cache-control: max-age=259200
x-content-type-options: nosniff
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: ajNM5CWrC-9nZNdPkqZbwoEMKRQGPyWFdIP9WCxP7lmkAyZY0Bcpfg==
x-xss-protection: 1; mode=block

GET
H2 200 nr-1167.min.js Show response
js-agent.newrelic.com/ 26 KB
10 KB 71ms
21ms Script
application/javascript 151.101.114.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1167.min.js
Requested by: Host: g2agiftcard.com
URL: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f4ae8a2c83e0a851fd331bbf34d7a6f9184b3e31b6f2e681e8377fb8a8edc10f

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 21:34:56 GMT
content-encoding: gzip
x-amz-request-id: 9F168BA697B778D0
x-cache: HIT
status: 200
content-length: 10178
x-amz-id-2: yYgBioLjCplIhDxMZm/PKonf0xZGo/IH9CxBrQAf8lWo1+WyLnApygFOHARQZ+4eJQtQu20EMwQ=
x-served-by: cache-hhn4068-HHN
last-modified: Fri, 07 Feb 2020 23:39:55 GMT
server: AmazonS3
x-timer: S1590183297.522313,VS0,VE0
etag: "8155781ab74e51eee2ead2c1d5902e63"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 28515

GET
H/1.1 200
OK NRJS-9facc869c359219f55d Show response
bam.eu01.nr-data.net/1/ 57 B
275 B 103ms
24ms Script
text/javascript 185.221.86.34
NEW-2

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.eu01.nr-data.net/1/NRJS-9facc869c359219f55d?a=32509574&v=1167.2a4546b&to=MhBSZQoZCBFYABZcWAtaZUMRVw8MXQYaG0cNBQ%3D%3D&rst=1365&ref=https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre&ap=117&be=262&fe=906&dc=758&perf=%7B%22timing%22:%7B%22of%22:1590183295557,%22n%22:0,%22f%22:1,%22dn%22:2,%22dne%22:33,%22c%22:33,%22s%22:47,%22ce%22:104,%22rq%22:104,%22rp%22:250,%22rpe%22:268,%22dl%22:253,%22di%22:757,%22ds%22:757,%22de%22:757,%22dc%22:906,%22l%22:906,%22le%22:906%7D,%22navigation%22:%7B%7D%7D&fp=458&fcp=458&at=HldRE0IDGx8%3D&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1167.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.221.86.34 , Germany, ASN206998 (NEW-2, DE),
Reverse DNS
Software: /
Resource Hash: d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 57
Content-Type: text/javascript;charset=ISO-8859-1

POST
H/1.1 200
OK NRJS-9facc869c359219f55d
bam.eu01.nr-data.net/events/1/ 24 B
182 B 26ms
25ms XHR
image/gif 185.221.86.34
NEW-2

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.eu01.nr-data.net/events/1/NRJS-9facc869c359219f55d?a=32509574&v=1167.2a4546b&to=MhBSZQoZCBFYABZcWAtaZUMRVw8MXQYaG0cNBQ%3D%3D&rst=11365&ref=https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1167.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.221.86.34 , Germany, ASN206998 (NEW-2, DE),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://g2agiftcard.com/nl_be/tr_bfphone11probenlnopre?clickid=qG0AU8k7F5-5ec8457ebf5888121a21a26f&networkid=100329&publisher=4729&c6=&c7=&fname=&lname=&email=&bday=&bmonth=&byear=&gender=&ept2=c2b564e4-94da-485d-9f92-5fd3e4f59e54
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type: text/plain

Response headers

Access-Control-Allow-Origin: https://g2agiftcard.com
Access-Control-Allow-Credentials: true
Content-Length: 24
Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

71 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.magetic.com
ajax.aspnetcdn.com
ajax.googleapis.com
bam.eu01.nr-data.net
cdn.cloudcnt.com
cdnjs.cloudflare.com
click.trlxcf01.com
data.ad-score.com
djjcyqvteia9v.cloudfront.net
ehawk.net
fonts.googleapis.com
fonts.gstatic.com
g2agiftcard.com
googleads.g.doubleclick.net
img.vodonet.net
js-agent.newrelic.com
lg.aivilors.com
main2.vodonet.net
maxcdn.bootstrapcdn.com
mc.yandex.ru
photo-choice.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
104.26.14.191
104.26.15.191
130.211.115.4
151.101.114.110
152.199.19.160
172.217.16.130
18.214.129.53
185.128.34.117
185.221.86.34
2001:4de0:ac19::1:b:3a
2600:9000:20eb:f400:b:413c:b700:93a1
2600:9000:2156:8200:2:7bf5:a0c0:21
2606:4700:3037::6812:33dc
2606:4700::6810:84e5
2a00:1450:4001:801::2003
2a00:1450:4001:809::2002
2a00:1450:4001:809::200a
2a00:1450:4001:814::200a
2a00:1450:4001:816::2004
2a00:1450:4001:81c::2008
2a00:1450:4001:81d::200e
2a00:1450:4001:825::2003
2a00:1450:400c:c03::9d
2a02:6b8::1:119
5.79.100.220
94.228.142.45
95.211.228.83
03b52a1594b643f27fdfc0ad86291bf36368dde44df9f07e1206b6fd3563bcab
0700e2849177f98f69d14a826e8e98129f793c0c9c3286418d00575b29d06da9
09b8e060508d8bc0b0bd1a9feeec159f1bd63a6fda5a0fb671f720da4570faae
0a4190251bfc46f0fc3a68c06841fa91ad094e2b8b7f12c2ac0ddb5b9bf97554
0a915444319a350b530c78f190fad9322c900a3a4d605dcdaa03664abcfe9659
0f6af9e53a9996f54961e43245921385dc5637ad380bb69a49859780effafa08
10ad93a3602068c768e39b1a132e9bb748eadbb70f35c6bfd36c08928a9f602c
10b11436f956b48d61a74e6e31bc7a2aa5727303643c864cf58cf8d39352aef2
1a2a572f006b242096d76275e8c9edb114f9aa65cbd67fd1c4d57053da83932f
1d4908d1171d35ebed5c3d50755491e895cc052c8a025a18820cec68cafb48d8
1fe402a959d5f3c0658f5338b86f0c005f6d204ca388a3b3d7e17d1c44324ecd
219be728c7e01deabaf9c0391fcd6b511002585c3f04b55d8fb431eeea3d680a
2708765c16255d0a73eeb1e3b3971de9ca1766e69947614cbf9421779cc63149
2992756a2aa4d02f12daa0dbff7dcce68ae59cc2b02f89baab0e7b56cdab3b83
2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac
32bd9b94367a02c30759ca3bf7bfeea38a06c89499e502638f938b66cac71c5d
3aeb555b764bd40e3904c9fc6af91b3631f94c831ae160cc680eb1e813f32097
3af1a4527bfd82dae0214205a83c7adc80478843438b454643585071d27058af
3f9fdd61ce78b1d97cc9fb77214c41aa92bc7ee843a3a110d313e3a597034004
4226b9e8f6738653444fba42e42b9826322ebf45e5ae3d1e0d28f50ffd48fbaa
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
4fe23d8a0301c250ece41fa2fcfed6c52b2e450b8d7d76b604a2f776825ad882
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
54de54b8aaf9245d016bf0adb5cf807195b6c883648f313e197a753f9f723410
55f04e537bd12b8fbc0a026ecc49417bd72e9aac7084a5e32a3a97a9aa76a126
573dad1af8b17c2226b0fcb2f77614e7084228f2fd25573fe1b04ec6477d3aee
58336cbeb4aeacdcf7bb2168c425b6d8c1b1ddf08ab4dfbfa15bc195027a4a2b
5c83a05556e8864fe229589842ee405bb6727c742fb1110553d509fec4395054
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
60be40bf02cb3a188131b1b23820333b0d6e1bd386f89924c91dcf79ef6e15fd
65a1850028118c64febbde9b109da293910bfff6ee261caf0087d3d3364359ba
6b2ee4913b17657576bb1390520e292b6c373289a44a381d62daf18bab312fdb
6ecb5aa063f2738eae817a7e772e5f5aa0958bd4d1bacff96774903387b9a773
7090c8ce3dc1702e3f2c0408de14f7a8f677586187b7b41d46826d157de36b82
7506aebc2ae895e946c85ebf48fda8c4fed2dbc863cbda4c352cf2a822676a4d
78a065fe74643f76882996ab435e2da297293d8ee035ef093193aad01a4f7a6a
82f420005cd31fab6b4ab016a07d623e8f5773de90c526777de5ba91e9be3b4d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e6ba10a3ea0dbddf004cdd014b1621c5fe8a7065a3f15271307272befea438
89ad71822e874a1edddd658dd450f9013a97d4847fb6c9efed59134aba4e6b16
8be0813709ee8727bf3277493fc930262d38eda54daaef67f1f08f69ce37d789
8c63ee1c9d488d8f070c5865f4d8f32d0396ca6adf054fc6bb0e9e2e4186172a
8f2ce3469fc38efad7d3d53256178849a2be5606e6e60792e2f2c48254c325f1
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
93453aeb09ee83e223ec77a93aab60cbcf79be3436401817b49bf11093e6adc1
93e6339751a6bc8510b53241e6885b89c1bf6fc6f27a24366b4b7ecf0d024ddb
97d0aed607dd7dac79da4db96ef87c28a1e48216aab918c75f40f7a61b58d432
9eae45417473d8f1a0eb841b452e9ddbf2d2cf2286e227cb7ad49b6e10070676
a2a3e219ea51de330906090021bab55254a48287f73226256a9c24f49e0291d9
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a556dc3e5f97b92e7efdff2299ba8ec84543a90290d6b240e7703a267a594dca
a6de304c233a1b4d07424cb88ba16dc46fb015b3f659cdb2b2357e96af161082
aa200befe8237e9e4f491182ba98a1ad96d9e05a9c680a8c47eaf91ad3632d9e
ae415cd6f453bf9e7895ee02e40927465d0255567a87e759dedd14de1d859e1d
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
b571c1d96e7fed55d3bbb59c04b8dd387bf9ec5e891fc0bab6993e50789f64f0
b6481d535d8543b212cf31d22be4e5967341084fbf7d8720aa3d98d945e522c8
b64f6cb52f10fd384a5ca79f9ed99350179f361162cdf2298deef59e25aef291
ba6a04fe8e549687a74fe53d14f44185cf1a62b2e7da4a16a573c367d89819ea
bfe854925ea083ffd5d883a565d6deb7104539a443f0a7367975962ca706003a
c191f4a65b5c877fe1a7eceaac25e7ade426de48cd08d65ce303f8ac4566fc61
cbfb8dd7bd9eb476c5cae0c10fefa71b4062c11af541404c2bd4a7ea6ff2a8f4
d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1
d340e7bbc9bd29d4ae937c6eed8c21e91b1657df950f933b80f75400824abee9
d55ff6f67848f14ab43cf88dcf5394c229b44f6114959135cb283473fb1e3d71
d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8
d8ccc36d648469ae72535a1ec5e23def10a53deff594eabfe2a6fa5d4ee4ce2e
daea9bbd208d8988b4a85bb71dd19a02fc975b8f5227216941c9fff01bb386ca
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e507babf987b47de747a47fb3bd2d3ed3438528784241632f8fc776e290e15eb
ebec06556ab1604a7b604f013c8181e645f77fe926000b8d7d7c521ab2a36e26
ee34ed97c1081765a58102d39cace0e69ae54fae5eba3ae186e324252b76c066
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f198360e7b7d63f562f3879f007430765b9e5a4975b373579de02638be78ba21
f4ae8a2c83e0a851fd331bbf34d7a6f9184b3e31b6f2e681e8377fb8a8edc10f

g2agiftcard.com Open in urlscan Pro 185.128.34.117 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

82 Requests

87 %HTTPS

56 %IPv6

24 Domains

27 Subdomains

23 IPs

5 Countries

1949 kBTransfer

3333 kBSize

0 Cookies

29 Outgoing links

Page URL History

Redirected requests

82 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

g2agiftcard.com Open in urlscan Pro
185.128.34.117 Public Scan

Screenshot
Live screenshot

Full Image

82
Requests

87 %
HTTPS

56 %
IPv6

24
Domains

27
Subdomains

23
IPs

5
Countries

1949 kB
Transfer

3333 kB
Size

0
Cookies

82 HTTP transactions
0 data transactions