urlscan.io logo urlscan.io
SecurityTrails logo

secure.retailmenot.com Open in urlscan Pro
2606:4700::6812:697  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://links.mail.retailmenot.com/ss/c/dY12ryrRIjsisKsPomPoPmxP7KgTsCCQgaZGuPBLEIIi0YI9XxJTn6KaY7PqwC7KRhSCksv2HVKOxd3IXY3KWlQlX4r...
Effective URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_te...
Submission: On January 12 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 3 countries across 8 domains to perform 60 HTTP transactions. The main IP is 2606:4700::6812:697, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure.retailmenot.com. The Cisco Umbrella rank of the primary domain is 137661.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 30th 2022. Valid for: a year.
This is the only time secure.retailmenot.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.115.56 11377 (SENDGRID)
1 1 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 34.243.19.114 16509 (AMAZON-02)
11 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a03:2880:f02... 32934 (FACEBOOK)
2 2a00:1450:400... 15169 (GOOGLE)
8 2a00:1450:400... 15169 (GOOGLE)
2 2001:4860:480... 15169 (GOOGLE)
1 54.146.178.38 14618 (AMAZON-AES)
1 13.32.110.31 16509 (AMAZON-02)
20 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 3.217.206.77 14618 (AMAZON-AES)
1 2 143.204.215.128 16509 (AMAZON-02)
1 3.234.25.89 14618 (AMAZON-AES)
5 54.204.202.163 14618 (AMAZON-AES)
60 14
1    167.89.115.56 (Herndon, United States)

ASN11377 (SENDGRID, US)
PTR: o16789115x56.outbound-mail.sendgrid.net
links.mail.retailmenot.com
1    2606:4700::6811:e52d (United States)

ASN13335 (CLOUDFLARENET, US)
ar.retailmenot.com
1    34.243.19.114 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-243-19-114.eu-west-1.compute.amazonaws.com
zdbb.net
11    2606:4700::6812:697 (United States)

ASN13335 (CLOUDFLARENET, US)
secure.retailmenot.com
2    2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
2    2a00:1450:400d:807::200e (Ireland)

ASN15169 (GOOGLE, US)
apis.google.com
8    2a00:1450:400d:807::2004 (Ireland)

ASN15169 (GOOGLE, US)
www.google.com
2    2001:4860:4802:36::178 (United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    54.146.178.38 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-178-38.compute-1.amazonaws.com
a.retailmenot.com
1    13.32.110.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-110-31.vie50.r.cloudfront.net
2c5de9923d36.cdn4.forter.com
20    2a00:1450:400d:80d::2003 (Ireland)

ASN15169 (GOOGLE, US)
www.gstatic.com
fonts.gstatic.com
3    2a00:1450:400d:803::200d (Ireland)

ASN15169 (GOOGLE, US)
accounts.google.com
1    3.217.206.77 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-217-206-77.compute-1.amazonaws.com
cdn3.forter.com
2    143.204.215.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-128.fra53.r.cloudfront.net
cdn9.forter.com
1    3.234.25.89 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-234-25-89.compute-1.amazonaws.com
80535309e47248fd8fa6c13793d30e0e-2c5de9923d36.cdn.forter.com
5    54.204.202.163 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-204-202-163.compute-1.amazonaws.com
cdn0.forter.com
Apex Domain
Subdomains		 Transfer
20 gstatic.com
www.gstatic.com
fonts.gstatic.com
869 KB
14 retailmenot.com
links.mail.retailmenot.com — Cisco Umbrella Rank: 348206
ar.retailmenot.com — Cisco Umbrella Rank: 316657
secure.retailmenot.com — Cisco Umbrella Rank: 137661
a.retailmenot.com — Cisco Umbrella Rank: 33220
219 KB
13 google.com
apis.google.com — Cisco Umbrella Rank: 97
www.google.com — Cisco Umbrella Rank: 2
accounts.google.com — Cisco Umbrella Rank: 72
154 KB
10 forter.com
2c5de9923d36.cdn4.forter.com — Cisco Umbrella Rank: 93915
cdn3.forter.com — Cisco Umbrella Rank: 4169
cdn9.forter.com — Cisco Umbrella Rank: 4584
80535309e47248fd8fa6c13793d30e0e-2c5de9923d36.cdn.forter.com
cdn0.forter.com — Cisco Umbrella Rank: 4747
135 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
20 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 150
89 KB
1 zdbb.net
zdbb.net — Cisco Umbrella Rank: 10723
402 B
0 doubleclick.net Failed
stats.g.doubleclick.net Failed
60 8
Domain Requested by
13 www.gstatic.com www.google.com
accounts.google.com
www.gstatic.com
11 secure.retailmenot.com secure.retailmenot.com
www.google-analytics.com
8 www.google.com secure.retailmenot.com
www.gstatic.com
www.google.com
7 fonts.gstatic.com www.google.com
5 cdn0.forter.com
3 accounts.google.com apis.google.com
secure.retailmenot.com
www.gstatic.com
2 cdn9.forter.com 1 redirects
2 www.google-analytics.com secure.retailmenot.com
www.google-analytics.com
2 apis.google.com secure.retailmenot.com
apis.google.com
2 connect.facebook.net secure.retailmenot.com
connect.facebook.net
1 80535309e47248fd8fa6c13793d30e0e-2c5de9923d36.cdn.forter.com
1 cdn3.forter.com
1 2c5de9923d36.cdn4.forter.com secure.retailmenot.com
1 a.retailmenot.com secure.retailmenot.com
1 zdbb.net 1 redirects
1 ar.retailmenot.com 1 redirects
1 links.mail.retailmenot.com 1 redirects
0 stats.g.doubleclick.net Failed www.google-analytics.com
60 18

This site contains links to these domains. Also see Links.

Domain
www.retailmenot.com
help.retailmenot.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-05-30 -
2023-05-30		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-10-21 -
2023-01-19		 3 months crt.sh
*.apis.google.com
GTS CA 1C3		 2022-12-12 -
2023-03-06		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-12-12 -
2023-03-06		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-12-12 -
2023-03-06		 3 months crt.sh
a.retailmenot.com
Amazon		 2022-07-03 -
2023-08-01		 a year crt.sh
*.cdn4.forter.com
GeoTrust RSA CA 2018		 2022-12-08 -
2024-01-08		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
accounts.google.com
GTS CA 1C3		 2022-12-12 -
2023-03-06		 3 months crt.sh
*.google.com
GTS CA 1C3		 2022-12-12 -
2023-03-06		 3 months crt.sh
cdn3.forter.com
GeoTrust RSA CA 2018		 2022-06-27 -
2023-07-04		 a year crt.sh
*.cdn.forter.com
GeoTrust RSA CA 2018		 2022-06-27 -
2023-07-27		 a year crt.sh
cdn0.forter.com
GeoTrust RSA CA 2018		 2022-06-27 -
2023-07-07		 a year crt.sh

This page contains 6 frames:

Primary Page: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Frame ID: 72B2FC8EA83F98F04D4942CC55E5C957
Requests: 28 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: 79462F071921DE69B0B4999A879963C9
Requests: 5 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=xymx38hr0o24
Frame ID: 9E63A3F9205AA70814F35EA8DE90E6F9
Requests: 7 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=pj0s0fwbji3
Frame ID: 0614FBB72540D62A31600C702CD7D6C5
Requests: 7 HTTP requests in this frame

Frame: https://secure.retailmenot.com/accounts/-/csp-report
Frame ID: 642BE28322E72030E779D7AC528DA34E
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
Frame ID: 13F94C7521C443775056BD99BE99AD48
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

RegisterRetailMeNot

Page URL History Show full URLs

  1. http://links.mail.retailmenot.com/ss/c/dY12ryrRIjsisKsPomPoPmxP7KgTsCCQgaZGuPBLEIIi0YI9XxJTn6KaY7PqwC7KRhSCksv... HTTP 302
    https://ar.retailmenot.com/v1.0/emailClick?campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&emailUuid=NINB5HYXXB... HTTP 303
    https://zdbb.net/rmn/?rdrct=https%3A%2F%2Fsecure.retailmenot.com%2Faccounts%2Fregister%3Futm_... HTTP 303
    https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_sour... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • apis\.google\.com/js/platform\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • forter\.com
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • apis\.google\.com/js/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

60
Requests

95 %
HTTPS

50 %
IPv6

8
Domains

18
Subdomains

14
IPs

3
Countries

1485 kB
Transfer

3655 kB
Size

14
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://links.mail.retailmenot.com/ss/c/dY12ryrRIjsisKsPomPoPmxP7KgTsCCQgaZGuPBLEIIi0YI9XxJTn6KaY7PqwC7KRhSCksv2HVKOxd3IXY3KWlQlX4rg2D33K5lNmHWTD6izmWVo0PoyEd4d64ca37lu1ZDUSu7C2JnboOfXISNIVad6VJWiZv0Wm3_yq_51qGmidp1VxfZwXyV7xu7LGjkDKv5rD7xxTYrrcI-50iD9zTkbptVWVY0DL5i86AKLL0TX52zJ3HP8tqnr1WlzwpIF5GFqBzaAPYKmDPiuB6C1lS55uABKOcpusBps_hPli9mk69nI4Ix5_4pSl2S2QAyLAB9PPGHTDBMfI6eWDwaBa_Qb3E1xwJDtsxdBNcxt1EbRV3ZvyzYnjN0u7_qrtpe-4t9HwZaT5OOpzuaLZadXkagRwW6OOJUnDcQ0kyBFBpmS7wvhWSrP0OT-3bX6PTNXsbQgpz0mAwlOzflXRG4RNCpfVpTi-Occiq66_wpDXusqIv4wo2uw4Vs1D4HYa885V5pWKqLNDG3V8HSAby4NEoHmKxkgdZGblsEsSi7bLQYjupeE3SPN7L9F-9sEmbdvV4EEQ01NdXPKzZkB9DG6HHHr6MSVGf5A6264GD1aG02GInh0hHZE71WTJq1cdC7z/3ss/8ZMVsgemQmiDAvR0CF_KsQ/h23/PbQFprA6eA-L2GlhT99Fd7phzlm9-oJYNwiOztS2xdo HTTP 302
    https://ar.retailmenot.com/v1.0/emailClick?campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&emailUuid=NINB5HYXXBBX3OZP5AIODBN4KA&userUuid=X6NRK74L6BBFXJ7MKLYS3ODJHI&type=SIGN_UP&redirectUrl=https%3A%2F%2Fsecure.retailmenot.com%2Faccounts%2Fregister%3Futm_medium%3Demail%26utm_campaign%3D2023_01_12%26ch%3Dnewsl%26utm_source%3Dnewsletter%26utm_term%3DCashBackActivated%26cus.ptp%3Dproduct%26campaignUuid%3DGKELLABLEJE3ZDAVB4NR6JZOAQ%26ei%3DNINB5HYXXBBX3OZP5AIODBN4KA%26ESP%3D2 HTTP 303
    https://zdbb.net/rmn/?rdrct=https%3A%2F%2Fsecure.retailmenot.com%2Faccounts%2Fregister%3Futm_medium%3Demail%26utm_campaign%3D2023_01_12%26ch%3Dnewsl%26utm_source%3Dnewsletter%26utm_term%3DCashBackActivated%26cus.ptp%3Dproduct%26campaignUuid%3DGKELLABLEJE3ZDAVB4NR6JZOAQ%26ESP%3D2%26ei%3DNINB5HYXXBBX3OZP5AIODBN4KA&cid=GKELLABLEJE3ZDAVB4NR6JZOAQ&eid=NINB5HYXXBBX3OZP5AIODBN4KA&type=sign_up&hk=c4e5ae8d7616533e8f5bac6ff06471e9 HTTP 303
    https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42
  • https://cdn9.forter.com/vchk2 HTTP 301
  • https://cdn9.forter.com/vchk2/v1/76bf5f9839492c726820b51818a650ebf8e5cf0d7d894562b1e5355cbf91c241ac7f4bc9601253e7def84ad6a274

60 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request register
secure.retailmenot.com/accounts/
Redirect Chain
  • http://links.mail.retailmenot.com/ss/c/dY12ryrRIjsisKsPomPoPmxP7KgTsCCQgaZGuPBLEIIi0YI9XxJTn6KaY7PqwC7KRhSCksv2HVKOxd3IXY3KWlQlX4rg2D33K5lNmHWTD6izmWVo0PoyEd4d64ca37lu1ZDUSu7C2JnboOfXISNIVad6VJWiZv...
  • https://ar.retailmenot.com/v1.0/emailClick?campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&emailUuid=NINB5HYXXBBX3OZP5AIODBN4KA&userUuid=X6NRK74L6BBFXJ7MKLYS3ODJHI&type=SIGN_UP&redirectUrl=https%3A%2F%2Fse...
  • https://zdbb.net/rmn/?rdrct=https%3A%2F%2Fsecure.retailmenot.com%2Faccounts%2Fregister%3Futm_medium%3Demail%26utm_campaign%3D2023_01_12%26ch%3Dnewsl%26utm_source%3Dnewsletter%26utm_term%3DCashBackA...
  • https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR...
45 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b024d0eb200df7947237f01345568fa6b77302c65adbc8cde14f29db23e31ba9
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; default-src 'none'; child-src 'self' https://*.facebook.com https://*.google.com; connect-src 'self' https://*.facebook.com https://www.google-analytics.com https://*.forter.com https://d2o5idwacg3gyw.cloudfront.net https://*.oktapreview.com https://a.retailmenot.com https://owenett.wsmeco.com; font-src; form-action 'self'; frame-src https://*.facebook.com https://*.google.com https://www.paypal.com; img-src 'self' https://*.facebook.com https://*.facebook.net https://*.fbcdn.net https://www.google-analytics.com https://www.paypalobjects.com https://a.retailmenot.com https://owenett.wsmeco.com; report-uri -/csp-report; script-src 'self' https://*.facebook.net https://*.facebook.com https://apis.google.com https://www.google-analytics.com https://www.google.com https://www.gstatic.com https://*.forter.com https://d35u1vg1q28b3w.cloudfront.net 'strict-dynamic' 'nonce-245c39842deb4a889fdb86fe586e17bd'; style-src 'self' 'unsafe-inline' ; worker-src 'none'
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
788740dfafb52c1b-FRA
content-encoding
br
content-security-policy
block-all-mixed-content; default-src 'none'; child-src 'self' https://*.facebook.com https://*.google.com; connect-src 'self' https://*.facebook.com https://www.google-analytics.com https://*.forter.com https://d2o5idwacg3gyw.cloudfront.net https://*.oktapreview.com https://a.retailmenot.com https://owenett.wsmeco.com; font-src; form-action 'self'; frame-src https://*.facebook.com https://*.google.com https://www.paypal.com; img-src 'self' https://*.facebook.com https://*.facebook.net https://*.fbcdn.net https://www.google-analytics.com https://www.paypalobjects.com https://a.retailmenot.com https://owenett.wsmeco.com; report-uri -/csp-report; script-src 'self' https://*.facebook.net https://*.facebook.com https://apis.google.com https://www.google-analytics.com https://www.google.com https://www.gstatic.com https://*.forter.com https://d35u1vg1q28b3w.cloudfront.net 'strict-dynamic' 'nonce-245c39842deb4a889fdb86fe586e17bd'; style-src 'self' 'unsafe-inline' ; worker-src 'none'
content-type
text/html; charset=utf-8
date
Thu, 12 Jan 2023 16:26:22 GMT
expires
0
pragma
no-cache
referrer-policy
origin-when-cross-origin
server
cloudflare
strict-transport-security
max-age=31536000;
surrogate-control
no-store
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
deny
x-request-id
62UAWE4UDRGNRACOFLWEMKZJJE
x-view-instance-uuid
E2MXK5EXMRA4NMFUQWQHUZSHGI
x-xss-protection
1; mode=block

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
content-length
0
content-type
text/html; charset=utf-8
date
Thu, 12 Jan 2023 16:26:21 GMT
expires
0
location
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
p3p
CP="ALL DSP COR NID"
pragma
no-cache
server
Ziff Davis BuyerBase
manifest.7efb7146.js
secure.retailmenot.com/accounts/static/ 		1 KB
975 B 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.retailmenot.com/accounts/static/manifest.7efb7146.js
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0341bc291ed6de27516d9bdf210e251a9122e932da221e8c780c3f41a4976f9e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 16:26:22 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
69689
cf-polished
origSize=1546
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 14 Sep 2022 20:46:46 GMT
cf-bgj
minify
server
cloudflare
etag
W/"63223db6-60a"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
788740e17c992c1b-FRA
expires
Fri, 12 Jan 2024 16:26:22 GMT
vendor.24390944.js
secure.retailmenot.com/accounts/static/ 		621 KB
173 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.retailmenot.com/accounts/static/vendor.24390944.js
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
861a2b1af40e75080c52ddbc35d0542e75d64b067afd50911ecf5b9e3bbbde8a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 16:26:22 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
69689
cf-polished
origSize=636833
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 14 Sep 2022 20:46:46 GMT
cf-bgj
minify
server
cloudflare
etag
W/"63223db6-9b7a1"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
788740e17c9c2c1b-FRA
expires
Fri, 12 Jan 2024 16:26:22 GMT
main.ebde28cb.js
secure.retailmenot.com/accounts/static/ 		30 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.retailmenot.com/accounts/static/main.ebde28cb.js
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08a25ddab076e49d9db334a21869820ea22121e525e1af3b0bb0019cc649c9aa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 16:26:22 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
69689
cf-polished
origSize=30727
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 14 Sep 2022 20:46:46 GMT
cf-bgj
minify
server
cloudflare
etag
W/"63223db6-7807"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
788740e18cba2c1b-FRA
expires
Fri, 12 Jan 2024 16:26:22 GMT
sdk.js
connect.facebook.net/en_US/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
bb3c83a910aa16f1c061b6b860bb5ff1aab4632ff67daebd5c0ba2c5b3385562
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 12 Jan 2023 16:26:22 GMT
content-md5
QTwbt6WUGDUQ9b3w2yCXPA==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1686
x-fb-rlafr
0
x-fb-debug
AMgRinSMxhoNxWqHYhNluET/bkhZxJRMWa8lL85ks0c/IHXVj29b8zp4TNCs5b623baNpURkeb/dZwIVZjjeqA==
x-fb-trip-id
917726464
x-fb-content-md5
2c4bb8deb707a9d10c73e17cb741a703
cross-origin-opener-policy
same-origin-allow-popups
etag
"067c35a647e5fc55fb6073590d34be53"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin
*
expires
Thu, 12 Jan 2023 16:27:51 GMT
platform.js
apis.google.com/js/ 		54 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/platform.js?onload=googleInit
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:807::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
336c128e8ebc017d585cb898df7544ffc0912664cedd2a64d5b1b7736cfd14fe
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 12 Jan 2023 16:26:22 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20932
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="gapi-team"
etag
"a180f7917a208406"
vary
Accept-Encoding
report-to
{"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
private, max-age=1800, stale-while-revalidate=1800
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 12 Jan 2023 16:26:22 GMT
api.js
www.google.com/recaptcha/ 		884 B
996 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
2937063d006009cc4618837d069642d587bfe62cb310cd3a8f59e80a2bdab2be
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 16:26:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
583
x-xss-protection
1; mode=block
expires
Thu, 12 Jan 2023 16:26:22 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 12 Jan 2023 16:06:10 GMT
last-modified
Tue, 27 Sep 2022 22:01:05 GMT
server
Golfe2
age
1212
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20039
expires
Thu, 12 Jan 2023 18:06:10 GMT
csp-report
secure.retailmenot.com/accounts/-/ 		2 B
212 B 		Other
General
Check archive.org
Download Go to
Full URL
https://secure.retailmenot.com/accounts/-/csp-report
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/csp-report

Response headers

pragma
no-cache
date
Thu, 12 Jan 2023 16:26:22 GMT
cf-cache-status
DYNAMIC
x-view-instance-uuid
OLETT7GWZRB7LD26ICHFTOXUEQ
server
cloudflare
x-powered-by
Express
surrogate-control
no-store
vary
Accept-Encoding
content-type
text/plain; charset=utf-8
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray
788740e17cac2c1b-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2
x-request-id
TKDSYDG3QFFFHIRD4LRK4BHEXQ
expires
0
Site_LoginSignup_Illustration.png
secure.retailmenot.com/accounts/static/images/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.retailmenot.com/accounts/static/images/Site_LoginSignup_Illustration.png
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d1e638e1e9b8f4898d56d42130b40cea68e62b11334dff7bd5526373dbf74968
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 16:26:22 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
69689
cf-polished
origFmt=png, origSize=17476
content-disposition
inline; filename="Site_LoginSignup_Illustration.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
16008
last-modified
Wed, 14 Sep 2022 20:46:46 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"63223db6-4444"
vary
Accept, Accept-Encoding
content-type
image/webp
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
788740e18cbf2c1b-FRA
expires
Fri, 12 Jan 2024 16:26:22 GMT
sdk.js
connect.facebook.net/en_US/ 		306 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=9644a6384b7ad62e98eea6fda6b3b824
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
28382ff982468e9c902eb78dc77e38dc2c705e9af77c46ea5a0c03c6eefa9224
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://secure.retailmenot.com/
Origin
https://secure.retailmenot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 12 Jan 2023 16:26:22 GMT
content-md5
W/TPKBdVPVesmWM1ZOIQ5A==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
88404
x-fb-rlafr
0
x-fb-debug
9eouO58ENEIFWUl5LonElJHzCjO568VZNV0wEeMZfW9EBYWuR81h7eAqAcTqqiG4hNCjvJpLMUGjVqqqvM0FYg==
x-fb-content-md5
bf9e4e9a598d213bcae9edc391782908
cross-origin-opener-policy
same-origin-allow-popups
etag
"74148693dc6b7798f282f5e6d67be3bd"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin
*
priority
u=3,i
expires
Fri, 12 Jan 2024 13:10:39 GMT
apple
secure.retailmenot.com/accounts/api/auth/callback/ 		318 B
695 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://secure.retailmenot.com/accounts/api/auth/callback/apple
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/static/main.ebde28cb.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
be1b4ec60b7c18db1c1a05b0532064e0aae2ce82a2d39461d208bf66bf4fa5bb

Request headers

Referer
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
x-view-instance-uuid
E2MXK5EXMRA4NMFUQWQHUZSHGI
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
content-type
application/json

Response headers

pragma
no-cache
date
Thu, 12 Jan 2023 16:26:22 GMT
content-encoding
br
cf-cache-status
DYNAMIC
x-view-instance-uuid
E2MXK5EXMRA4NMFUQWQHUZSHGI
server
cloudflare
surrogate-control
no-store
vary
Accept-Encoding
content-type
application/json; charset=utf-8
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray
788740e23bd12c20-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id
DOW2NNDERZEGLPAZDYR7AHSLGI
expires
0
__wsm.gif
a.retailmenot.com// 		35 B
618 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://a.retailmenot.com//__wsm.gif
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/static/vendor.24390944.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.178.38 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-178-38.compute-1.amazonaws.com
Software
openresty/1.11.2.5 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

Referer
https://secure.retailmenot.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache, no-cache
Date
Thu, 12 Jan 2023 16:26:22 GMT
X-Content-Type-Options
nosniff, nosniff
Last-Modified
Wed, 21 Jan 2004 19:51:30 GMT
Server
openresty/1.11.2.5
Content-Type
image/gif
Access-Control-Allow-Origin
https://secure.retailmenot.com, https://secure.retailmenot.com
Cache-Control
no-cache, private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
Expires
Mon, 14 Jan 2013 16:26:22 GMT
collect
www.google-analytics.com/j/ 		2 B
211 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j98&a=639344817&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.retailmenot.com%2Faccounts%2Fregister%3Futm_medium%3Demail%26utm_campaign%3D2023_01_12%26ch%3Dnewsl%26utm_source%3Dnewsletter%26utm_term%3DCashBackActivated%26cus.ptp%3Dproduct%26campaignUuid%3DGKELLABLEJE3ZDAVB4NR6JZOAQ%26ESP%3D2%26ei%3DNINB5HYXXBBX3OZP5AIODBN4KA&ul=en-us&de=UTF-8&dt=Register&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABEAAAACAAI~&jid=107396143&gjid=573206276&cid=1138230888.1673540782&tid=UA-54628-3&_gid=1030648979.1673540782&_r=1&cd1=Anonymous&z=1688284279
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://secure.retailmenot.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 12 Jan 2023 16:26:22 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://secure.retailmenot.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
script.js
2c5de9923d36.cdn4.forter.com/sn/2c5de9923d36/ 		270 KB
132 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://2c5de9923d36.cdn4.forter.com/sn/2c5de9923d36/script.js
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/static/main.ebde28cb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.110.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-110-31.vie50.r.cloudfront.net
Software
/
Resource Hash
879d0cfbda254cc663a0c7fe7b2e7d8764b1f0263e521c76e3782c661620680f
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Wed, 11 Jan 2023 13:00:06 GMT
strict-transport-security
max-age=86400; includeSubDomains
content-encoding
br
via
1.1 c855d201fddbb6ef22989607fe8f5d1e.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-C2
age
98776
x-cache
Hit from cloudfront
last-modified
Wed, 11 Jan 2023 13:00:06 GMT
x-sourcemap
https://cdn4.forter.com/map/suid/2c5de9923d36/13052601903
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=300
timing-allow-origin
*
x-amz-cf-id
QGxfVVWYS-LOPB6xSMPaBEL5mm30LpREE3rt3njbeG8VNxLPqi_R6Q==
expires
Wed, 11 Jan 2023 13:05:06 GMT
csp-report
secure.retailmenot.com/accounts/-/ 		2 B
339 B 		Other
General
Check archive.org
Download Go to
Full URL
https://secure.retailmenot.com/accounts/-/csp-report
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/csp-report

Response headers

pragma
no-cache
date
Thu, 12 Jan 2023 16:26:22 GMT
cf-cache-status
DYNAMIC
x-view-instance-uuid
PVACTCKETNHQRFKEF2HQEDWDLI
server
cloudflare
x-powered-by
Express
surrogate-control
no-store
vary
Accept-Encoding
content-type
text/plain; charset=utf-8
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray
788740e26c2f2c20-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2
x-request-id
2LF4K4627FD5FAEOMPNPPVUT5Q
expires
0
collect
stats.g.doubleclick.net/j/ 		0
0
recaptcha__de.js
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/ 		407 KB
163 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f100138cf28abcaac287d3bb245b80679c7ba9305591ed01b1055af5e7084f20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://secure.retailmenot.com/
Origin
https://secure.retailmenot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 08:51:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
27311
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
166478
x-xss-protection
0
last-modified
Thu, 15 Dec 2022 05:24:10 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 12 Jan 2024 08:51:11 GMT
cb=gapi.loaded_0
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.ylZHJEOsguo.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8pkjVD5D2Liisn6U69GtDkc_fqFA/ 		109 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.ylZHJEOsguo.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8pkjVD5D2Liisn6U69GtDkc_fqFA/cb=gapi.loaded_0?le=scs
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/platform.js?onload=googleInit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:807::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6e53945eb5c19b339fd89d67adb6d68ba1f4ef7a78826122ab98a65be0e1167
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Tue, 10 Jan 2023 19:13:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
162770
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36874
x-xss-protection
0
last-modified
Tue, 06 Dec 2022 15:21:53 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="social-frontend-mpm-access"
vary
Accept-Encoding
report-to
{"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 10 Jan 2024 19:13:32 GMT
csp-report
secure.retailmenot.com/accounts/-/ Frame 7946 		0
0
iframe
accounts.google.com/o/oauth2/ Frame 7946 		280 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/o/oauth2/iframe
Requested by
Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.ylZHJEOsguo.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8pkjVD5D2Liisn6U69GtDkc_fqFA/cb=gapi.loaded_0?le=scs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:803::200d , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
5c828f3ecb0217dd1ad573b5d1341ddc19fe4c3c30aa23cfa0ce3b074b2280dc
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-tKJuuulpJDOuX3N9BQHTKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://secure.retailmenot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-tKJuuulpJDOuX3N9BQHTKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin; report-to="IdpIFrameHttp"
cross-origin-resource-policy
cross-origin
date
Thu, 12 Jan 2023 16:26:22 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma
no-cache
report-to
{"group":"IdpIFrameHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdpIFrameHttp/external"}]}
server
ESF
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-xss-protection
0
csp-report
secure.retailmenot.com/accounts/-/ 		2 B
340 B 		Other
General
Check archive.org
Download Go to
Full URL
https://secure.retailmenot.com/accounts/-/csp-report
Requested by
Host:
URL: (program):2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/csp-report

Response headers

pragma
no-cache
date
Thu, 12 Jan 2023 16:26:22 GMT
cf-cache-status
DYNAMIC
x-view-instance-uuid
7UJFRWUGUVGOJKPE7WXVYUH6WI
server
cloudflare
x-powered-by
Express
surrogate-control
no-store
vary
Accept-Encoding
content-type
text/plain; charset=utf-8
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray
788740e31dcb2c20-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2
x-request-id
IJKTTMATLREIRERSQ3DLUF2W5E
expires
0
anchor
www.google.com/recaptcha/api2/ Frame 9E63 		42 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=xymx38hr0o24
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__de.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
3aa81c28191b5502dbe1b408905495c7e05d2147c7aee50e9fcb4a8d9302b40e
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-eAULtmAP3JNSZrH9ylg30g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://secure.retailmenot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-length
22577
content-security-policy
script-src 'report-sample' 'nonce-eAULtmAP3JNSZrH9ylg30g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 12 Jan 2023 16:26:22 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
anchor
www.google.com/recaptcha/api2/ Frame 0614 		43 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=pj0s0fwbji3
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__de.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
211482bc5fc43f64f50191322568ac2ae1e4b82cd8c535fe070fbb87a89a0ddf
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-snGNwAWvjcX58ycT1nfyeQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://secure.retailmenot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-length
23026
content-security-policy
script-src 'report-sample' 'nonce-snGNwAWvjcX58ycT1nfyeQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 12 Jan 2023 16:26:22 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
cspreport
accounts.google.com/_/IdpIFrameHttp/ Frame 7946 		2 KB
913 B 		Other
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/_/IdpIFrameHttp/cspreport
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:803::200d , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
99aa949344e1bf4c28bd606afb8d503957d73c7cfc2d13837778970786cedffa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://accounts.google.com/o/oauth2/iframe
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/csp-report

Response headers

pragma
no-cache
date
Thu, 12 Jan 2023 16:26:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
1; mode=block
expires
Mon, 01 Jan 1990 00:00:00 GMT
m=base
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.de.ybpqvoGBK4E.es5.O/d=1/rs=AOaEmlEbHkAy9-dVN0hUkdOI98tnJRrDjQ/ Frame 7946 		100 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.de.ybpqvoGBK4E.es5.O/d=1/rs=AOaEmlEbHkAy9-dVN0hUkdOI98tnJRrDjQ/m=base
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce3935d9d1d084d10ebfe6359efc10cf290691a9e96c60c10d8bc7fad2babba9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://accounts.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Wed, 11 Jan 2023 03:16:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
133766
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35181
x-xss-protection
0
last-modified
Wed, 28 Dec 2022 19:40:25 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="boq-infra/identity-boq-js-css-signers"
vary
Accept-Encoding, Origin
report-to
{"group":"boq-infra/identity-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signers"}]}
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
expires
Thu, 11 Jan 2024 03:16:56 GMT
styles__ltr.css
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/ Frame 9E63 		52 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=xymx38hr0o24
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4a59bb42cb945084820cd1eb370a22a68fa9451b9e57abb1daada408d2ff64e1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 07 Jan 2023 09:22:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
457421
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24262
x-xss-protection
0
last-modified
Thu, 15 Dec 2022 05:24:10 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sun, 07 Jan 2024 09:22:41 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/ Frame 9E63 		407 KB
163 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=xymx38hr0o24
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f100138cf28abcaac287d3bb245b80679c7ba9305591ed01b1055af5e7084f20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 08:51:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
27311
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
166478
x-xss-protection
0
last-modified
Thu, 15 Dec 2022 05:24:10 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 12 Jan 2024 08:51:11 GMT
styles__ltr.css
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/ Frame 0614 		52 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=pj0s0fwbji3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4a59bb42cb945084820cd1eb370a22a68fa9451b9e57abb1daada408d2ff64e1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 07 Jan 2023 09:22:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
457421
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24262
x-xss-protection
0
last-modified
Thu, 15 Dec 2022 05:24:10 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sun, 07 Jan 2024 09:22:41 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/ Frame 0614 		407 KB
163 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=pj0s0fwbji3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f100138cf28abcaac287d3bb245b80679c7ba9305591ed01b1055af5e7084f20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 08:51:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
27311
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
166478
x-xss-protection
0
last-modified
Thu, 15 Dec 2022 05:24:10 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 12 Jan 2024 08:51:11 GMT
iframerpc
accounts.google.com/o/oauth2/ Frame 7946 		49 B
97 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fsecure.retailmenot.com&client_id=771936173007-u6au73kae344unr8d6fjjtendldufja4.apps.googleusercontent.com
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.de.ybpqvoGBK4E.es5.O/d=1/rs=AOaEmlEbHkAy9-dVN0hUkdOI98tnJRrDjQ/m=base
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:803::200d , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4836b6031bc4af96767f0121fa458714583340054aea6338ef99a1bc4011f43b
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-b-Xax8obHMpsv3jQGElLEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://accounts.google.com/o/oauth2/iframe
X-Requested-With
XmlHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 16:26:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
script-src 'report-sample' 'nonce-b-Xax8obHMpsv3jQGElLEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport
content-encoding
gzip
cross-origin-embedder-policy
require-corp
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy
same-site
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin; report-to="IdpIFrameHttp"
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Origin
report-to
{"group":"IdpIFrameHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdpIFrameHttp/external"}]}
content-type
application/json; charset=utf-8
cache-control
private, max-age=3600
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
expires
Thu, 12 Jan 2023 16:26:22 GMT
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 9E63 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Tue, 10 Jan 2023 15:21:21 GMT
x-content-type-options
nosniff
age
176702
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Tue, 17 Jan 2023 15:21:21 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 9E63 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=xymx38hr0o24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Fri, 06 Jan 2023 09:20:58 GMT
x-content-type-options
nosniff
age
543925
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 06 Jan 2024 09:20:58 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 9E63 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=xymx38hr0o24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 05 Jan 2023 22:15:01 GMT
x-content-type-options
nosniff
age
583882
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 05 Jan 2024 22:15:01 GMT
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 0614 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Tue, 10 Jan 2023 15:21:21 GMT
x-content-type-options
nosniff
age
176702
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Tue, 17 Jan 2023 15:21:21 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 0614 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=pj0s0fwbji3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Fri, 06 Jan 2023 09:20:58 GMT
x-content-type-options
nosniff
age
543925
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 06 Jan 2024 09:20:58 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 0614 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=pj0s0fwbji3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 05 Jan 2023 22:15:01 GMT
x-content-type-options
nosniff
age
583882
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 05 Jan 2024 22:15:01 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame 9E63 		102 B
134 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=5qcenVbrhOy8zihcc2aHOWD4
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=xymx38hr0o24
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
7647724bcc7afde27000c02ce20b80535467b8f60f1330013a1ee3b575479a81
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=xymx38hr0o24
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 16:26:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
112
x-xss-protection
1; mode=block
expires
Thu, 12 Jan 2023 16:26:23 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame 0614 		102 B
134 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=5qcenVbrhOy8zihcc2aHOWD4
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=pj0s0fwbji3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
7647724bcc7afde27000c02ce20b80535467b8f60f1330013a1ee3b575479a81
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&size=invisible&cb=pj0s0fwbji3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 16:26:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
112
x-xss-protection
1; mode=block
expires
Thu, 12 Jan 2023 16:26:23 GMT
csp-report
secure.retailmenot.com/accounts/-/ Frame 642B 		2 B
339 B 		Other
General
Check archive.org
Download Go to
Full URL
https://secure.retailmenot.com/accounts/-/csp-report
Requested by
Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/csp-report

Response headers

pragma
no-cache
date
Thu, 12 Jan 2023 16:26:23 GMT
cf-cache-status
DYNAMIC
x-view-instance-uuid
BEBSFZWPVVECPKMZ4ZPCIQIVYE
server
cloudflare
x-powered-by
Express
surrogate-control
no-store
vary
Accept-Encoding
content-type
text/plain; charset=utf-8
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray
788740e5fd0a2c20-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2
x-request-id
6AV6UY5X2FEYRB2XI6TIURRRPQ
expires
0
events
cdn3.forter.com/ 		0
245 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://cdn3.forter.com/events
Requested by
Host:
URL: (program):2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.217.206.77 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-217-206-77.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

Referer
https://secure.retailmenot.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
text/plain; charset=utf-8

Response headers

pragma
no-cache
date
Thu, 12 Jan 2023 16:26:23 GMT
strict-transport-security
max-age=86400; includeSubDomains
vary
Origin
access-control-allow-origin
https://secure.retailmenot.com
cache-control
private, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*
expires
-1
csp-report
secure.retailmenot.com/accounts/-/ 		2 B
339 B 		Other
General
Check archive.org
Download Go to
Full URL
https://secure.retailmenot.com/accounts/-/csp-report
Requested by
Host:
URL: (program):2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://secure.retailmenot.com/accounts/register?utm_medium=email&utm_campaign=2023_01_12&ch=newsl&utm_source=newsletter&utm_term=CashBackActivated&cus.ptp=product&campaignUuid=GKELLABLEJE3ZDAVB4NR6JZOAQ&ESP=2&ei=NINB5HYXXBBX3OZP5AIODBN4KA
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/csp-report

Response headers

pragma
no-cache
date
Thu, 12 Jan 2023 16:26:23 GMT
cf-cache-status
DYNAMIC
x-view-instance-uuid
A7J4FQ6SDZB5HKR4GMPT3I7YBU
server
cloudflare
x-powered-by
Express
surrogate-control
no-store
vary
Accept-Encoding
content-type
text/plain; charset=utf-8
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray
788740e6ae5c2c20-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2
x-request-id
LXOILCO7QREGHNHFHJFV7GP7GU
expires
0
bframe
www.google.com/recaptcha/api2/ Frame 13F9 		7 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
67a48805f29ee991676a1ca5b37598f502d54031c00a7af5f2976d92c05fda95
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-xhnXPH70-xQO7uS91qCbfg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://secure.retailmenot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-length
1115
content-security-policy
script-src 'report-sample' 'nonce-xhnXPH70-xQO7uS91qCbfg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 12 Jan 2023 16:26:23 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
76bf5f9839492c726820b51818a650ebf8e5cf0d7d894562b1e5355cbf91c241ac7f4bc9601253e7def84ad6a274
cdn9.forter.com/vchk2/v1/
Redirect Chain
  • https://cdn9.forter.com/vchk2
  • https://cdn9.forter.com/vchk2/v1/76bf5f9839492c726820b51818a650ebf8e5cf0d7d894562b1e5355cbf91c241ac7f4bc9601253e7def84ad6a274
0
323 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn9.forter.com/vchk2/v1/76bf5f9839492c726820b51818a650ebf8e5cf0d7d894562b1e5355cbf91c241ac7f4bc9601253e7def84ad6a274
Protocol
H2
Server
143.204.215.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-128.fra53.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 16:26:23 GMT
via
1.1 b073c20359d711b751afd124dda34076.cloudfront.net (CloudFront)
strict-transport-security
max-age=86400; includeSubDomains
x-amz-cf-pop
FRA53-C1
x-cache
Miss from cloudfront
access-control-allow-origin
*
cache-control
private, s-maxage=0, proxy-revalidate
timing-allow-origin
*
x-amz-cf-id
O8yDaxpnReYcdLTPkOPdE6cG2_eNZxt-N4ID8NNlAx0sv7gdvhLtAA==

Redirect headers

date
Thu, 12 Jan 2023 16:26:23 GMT
via
1.1 b073c20359d711b751afd124dda34076.cloudfront.net (CloudFront)
strict-transport-security
max-age=86400; includeSubDomains
x-amz-cf-pop
FRA53-C1
x-cache
Miss from cloudfront
location
https://cdn9.forter.com/vchk2/v1/76bf5f9839492c726820b51818a650ebf8e5cf0d7d894562b1e5355cbf91c241ac7f4bc9601253e7def84ad6a274
access-control-allow-origin
*
cache-control
private, s-maxage=0, proxy-revalidate
timing-allow-origin
*
x-amz-cf-id
grHcuciXaCDAWlvAyKgLLGgiHmjBliTlB88pAt5blh60rPo7i9HOew==
prop.json
80535309e47248fd8fa6c13793d30e0e-2c5de9923d36.cdn.forter.com/ 		2 B
630 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://80535309e47248fd8fa6c13793d30e0e-2c5de9923d36.cdn.forter.com/prop.json
Requested by
Host:
URL: (program):2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.234.25.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-234-25-89.compute-1.amazonaws.com
Software
Apache /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
https://secure.retailmenot.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Thu, 12 Jan 2023 16:26:23 GMT
Connection
close
Content-Length
2
Pragma
no-cache
Last-Modified
Mon, 26 Dec 2022 12:09:02 GMT
Server
Apache
ETag
"2-5f0ba00447b29"
Access-Control-Allow-Methods
PUT, GET, POST, DELETE, OPTIONS
Content-Type
application/json
Access-Control-Allow-Origin
https://secure.retailmenot.com
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
origin, x-requested-with, content-type, x-csrf-token
Expires
Wed, 11 Jan 1984 05:00:00 GMT
styles__ltr.css
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/ Frame 13F9 		52 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4a59bb42cb945084820cd1eb370a22a68fa9451b9e57abb1daada408d2ff64e1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 07 Jan 2023 09:22:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
457422
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24262
x-xss-protection
0
last-modified
Thu, 15 Dec 2022 05:24:10 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sun, 07 Jan 2024 09:22:41 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/ Frame 13F9 		407 KB
163 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f100138cf28abcaac287d3bb245b80679c7ba9305591ed01b1055af5e7084f20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 08:51:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
27312
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
166478
x-xss-protection
0
last-modified
Thu, 15 Dec 2022 05:24:10 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 12 Jan 2024 08:51:11 GMT
reload
www.google.com/recaptcha/api2/ Frame 13F9 		40 KB
24 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/reload?k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
e1b0462fdc4cabf746495d5e3ae2680d0a8955ec839e0cc766e88d900ee6f8c1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.google.com/recaptcha/api2/bframe?hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/x-protobuffer

Response headers

date
Thu, 12 Jan 2023 16:26:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24463
x-xss-protection
1; mode=block
expires
Thu, 12 Jan 2023 16:26:23 GMT
refresh_2x.png
www.gstatic.com/recaptcha/api2/ Frame 13F9 		600 B
624 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/refresh_2x.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Mon, 09 Jan 2023 15:58:49 GMT
x-content-type-options
nosniff
age
260854
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
600
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Mon, 16 Jan 2023 15:58:49 GMT
audio_2x.png
www.gstatic.com/recaptcha/api2/ Frame 13F9 		530 B
554 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/audio_2x.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Tue, 10 Jan 2023 15:21:00 GMT
x-content-type-options
nosniff
age
176723
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
530
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Tue, 17 Jan 2023 15:21:00 GMT
info_2x.png
www.gstatic.com/recaptcha/api2/ Frame 13F9 		665 B
689 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/info_2x.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 07 Jan 2023 19:37:20 GMT
x-content-type-options
nosniff
age
420543
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
665
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Sat, 14 Jan 2023 19:37:20 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 13F9 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Fri, 06 Jan 2023 09:20:58 GMT
x-content-type-options
nosniff
age
543925
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 06 Jan 2024 09:20:58 GMT
KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 13F9 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Wed, 11 Jan 2023 17:40:57 GMT
x-content-type-options
nosniff
age
81926
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15340
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:16 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 11 Jan 2024 17:40:57 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 13F9 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 05 Jan 2023 22:15:01 GMT
x-content-type-options
nosniff
age
583882
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 05 Jan 2024 22:15:01 GMT
payload
www.google.com/recaptcha/api2/ Frame 13F9 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/recaptcha/api2/payload?p=06AD1IbLAEPik5s69GMPRZN3UW1Ll_XL2Rhp9pKXHODGuHv5vvl7IEruKvU5M6tsgVKog1viO13gyZDCqiHSXxz3g0wzBCNk5MBZNDH5cnCIHEAnYX01uNf-r8jHosbRgjOpnwtHFIulFBt5Ikwmd3Wabf2NQlSVcAKftoeZsXO44KHHcFtrQdOQIRoSqSbF_jWjM9cIhnESX1mzl6sa0iqZG0k6gZP9rxsA&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
297534d1527ba0b4f5347526fc316cdb4b3fe04638dfbff06e0b110195d58fdf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/bframe?hl=de&v=5qcenVbrhOy8zihcc2aHOWD4&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Thu, 12 Jan 2023 16:26:23 GMT
content-security-policy
frame-ancestors 'self'
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
private, max-age=30
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23382
x-xss-protection
1; mode=block
expires
Thu, 12 Jan 2023 16:26:23 GMT
prop.json
cdn0.forter.com/2c5de9923d36/80535309e47248fd8fa6c13793d30e0e/ 		20 B
366 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn0.forter.com/2c5de9923d36/80535309e47248fd8fa6c13793d30e0e/prop.json?_=1673540784147
Requested by
Host:
URL: (program):2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.204.202.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-204-202-163.compute-1.amazonaws.com
Software
/
Resource Hash
912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 12 Jan 2023 16:26:24 GMT
Vary
Origin
Transfer-Encoding
chunked
Content-Type
application/json
Access-Control-Allow-Origin
https://secure.retailmenot.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
Expires
-1
prop.json
cdn0.forter.com/2c5de9923d36/80535309e47248fd8fa6c13793d30e0e/ 		20 B
366 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn0.forter.com/2c5de9923d36/80535309e47248fd8fa6c13793d30e0e/prop.json?_=1673540784545
Requested by
Host:
URL: (program):2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.204.202.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-204-202-163.compute-1.amazonaws.com
Software
/
Resource Hash
912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 12 Jan 2023 16:26:24 GMT
Vary
Origin
Transfer-Encoding
chunked
Content-Type
application/json
Access-Control-Allow-Origin
https://secure.retailmenot.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
Expires
-1
prop.json
cdn0.forter.com/2c5de9923d36/80535309e47248fd8fa6c13793d30e0e/ 		20 B
366 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn0.forter.com/2c5de9923d36/80535309e47248fd8fa6c13793d30e0e/prop.json?_=1673540784735
Requested by
Host:
URL: (program):2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.204.202.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-204-202-163.compute-1.amazonaws.com
Software
/
Resource Hash
912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure.retailmenot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 12 Jan 2023 16:26:24 GMT
Vary
Origin
Transfer-Encoding
chunked
Content-Type
application/json
Access-Control-Allow-Origin
https://secure.retailmenot.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
Expires
-1
wpt.json
cdn0.forter.com/2c5de9923d36/80535309e47248fd8fa6c13793d30e0e/ 		20 B
423 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn0.forter.com/2c5de9923d36/80535309e47248fd8fa6c13793d30e0e/wpt.json
Requested by
Host:
URL: (program):2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.204.202.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-204-202-163.compute-1.amazonaws.com
Software
/
Resource Hash
912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d

Request headers

Referer
https://secure.retailmenot.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 12 Jan 2023 16:26:25 GMT
ETag
W/"14-Y53wuE/mmbSikKcT/WualL1N65U"
Vary
Origin
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://secure.retailmenot.com
Cache-Control
private, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
20
Expires
-1
wpt.json
cdn0.forter.com/2c5de9923d36/80535309e47248fd8fa6c13793d30e0e/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://cdn0.forter.com/2c5de9923d36/80535309e47248fd8fa6c13793d30e0e/wpt.json
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.204.202.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-204-202-163.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://secure.retailmenot.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Access-Control-Allow-Headers
content-type
Access-Control-Allow-Methods
GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin
*
Connection
keep-alive
Content-Length
0
Date
Thu, 12 Jan 2023 16:26:25 GMT
Vary
Access-Control-Request-Headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
stats.g.doubleclick.net
URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-54628-3&cid=1138230888.1673540782&jid=107396143&gjid=573206276&_gid=1030648979.1673540782&_u=aEBAAEAAEAAAACAAI~&z=467484543
Domain
secure.retailmenot.com
URL
https://secure.retailmenot.com/accounts/-/csp-report

Verdicts & Comments Add Verdict or Comment

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| oncontentvisibilityautostatechange object| webpackJsonp object| google_tag_data function| ga object| gaplugins object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| RMNAccounts function| fbAsyncInit function| googleInit object| FB object| gaGlobal object| gaData number| ftr__startScriptLoad object| gapi object| ___jsl object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| __buffer object| osapi function| u066 function| S4rr function| Z044 function| f9cc object| ftr__ext function| ftr__ object| ftr__scriptLoadOptions object| ftr__bufferW object| recaptcha object| closure_lm_985607 object| ftr__JSON3

14 Cookies

Domain/Path Name / Value
www.google.com/recaptcha Name: _GRECAPTCHA
Value: 09AJ4Tk-4ZB6W7CNre7_HzZZxqg36OSScK4U7KS96whvG7c9JzSXEZ6oe3OC5E9cdkmxTY_DLavtPngEiP30F_WdA
.retailmenot.com/ Name: deviceFingerprint
Value: AJBC5PLNLZEBFJL3UBQ53GG5FQ
.retailmenot.com/ Name: session
Value: VKPYDC5WYVFWLO3JTEPPJSEB4I
.retailmenot.com/ Name: jwt
Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ijc4YzA1NWIwLTM2NmYtMTFlNy1iZTY3LWE1NzZiMzBlYWE0MSJ9.eyJhdWQiOiJyZXRhaWxtZW5vdC5jb20iLCJleHAiOjE3MDUwNzY3ODIsImlhdCI6MTY3MzU0MDc4MiwiaXNzIjoic2VjdXJlLnJldGFpbG1lbm90LmNvbSIsImp0aSI6ImUxZmI3YjVjMjk5MTQxYzdhMjkyNWZhMGZkMDU2NTlmIiwibmJmIjoxNjczNTQwNzgyfQ.DWx7uw3q40KsuJUnYqBp9YQuCFTOTpmQJ2tUTdwzeb-oehGiJtE3X33_iT-Uc2jIIJFOBLfiKShJM21iiHvERtF6F-PojOX7rQkEsCo8ry_7PehU2QaNVzBxmXETxW31fkzWdq2TBEHuw3tHgyXKrBjSxBDWC531eeqVpBPY2ZjDfBTE2Gbx4saw-spAH-hdplzQ1QnXzm9M0nBYHwJANo5ZUjljBTMcTj_sC9OGEjetdHXOfQiXGuIPxYY6ipcC6352bGXKyjW5kWFB4J6YcuR0Erv0wD6ElABs0tXx9WDZq6mJPylnvTOsZqolg-vEcGd8ojoZAzbslzhziVvzslPhMQi6-E_YhZX-hhpmKBfKdR_Grcz1jMRVYtP7tIrFje4iqYHsF5QXszcxPEIKzrvQs1RDEqYulmNpWepn6YC4q6uq-BqR-sCllHf-xfIH8q25_bDECs9IoAbSWiqBLkkN_2fZQgI1rPoD6k9TmQ73C2RM4Q1w5rPar1D3eMkz
.secure.retailmenot.com/ Name: jwts
Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ijc4YzA1NWIwLTM2NmYtMTFlNy1iZTY3LWE1NzZiMzBlYWE0MSJ9.eyJhdWQiOiJzZWN1cmUucmV0YWlsbWVub3QuY29tIiwiZXhwIjoxNjczNTQyNTgyLCJpYXQiOjE2NzM1NDA3ODIsImlzcyI6InNlY3VyZS5yZXRhaWxtZW5vdC5jb20iLCJqdGkiOiI2MTBmZGJjZDQyOTM0ODM0OGY0ZDE2MTkxZWQ5YmYwYyIsIm5iZiI6MTY3MzU0MDc4Miwicm1uX2NzcmYiOiI4NzI1ZjhiN2Q1MDM0OGZhYmIwMDBjZDg1MDk3ODRkYiJ9.ZQOSel6DqqNUSthpwbb14SmmMRPY_13MOrs1bfP5JwYPV4t70BZCLLweG1yuxYHFWDpTsouEofVgjyIXnipIx5vQwd_zAckIB3lgRo-tLbO78YTU73wPZj1QGYwjkhtfp37E6hM8j3nQzGriYMZwr1KJyr9suZsBNtt9Gcj_RiEcNwYBHIYB68OKtGIaJfk1kI8_t8DcEB--KbOppwm5eWEwfrUibD42xZN2sLY82kXdsBypeC_qd3Z4gdEtwOBTwCs_ytBCnmjpzi1VZiKoQOfSqMEsjKIbLToZJ1wOb8Y3rJsziBrk9gTdLm8jE-KNQRJIfCagQo1f1yTOXwcpUWKXfc6cqQmjtxnac3d4LfBXt4qktehO9dMUC5szxczyvPIUrqSD5gFnOILNj4p-b6AALZrkV3qU75dZ4uaLZfmqUJ1VP0EOXUanl6sAcSr1bsEDHAiyRI3qs4C4E_bMtFJvJaDSDb9EdANURrLAcpW13ahQtiale6rxfaUUbmT9
.retailmenot.com/ Name: userQualifier
Value: CHLLEY5H3FFX7GVLQRSGUUKPAI
.retailmenot.com/ Name: overlord_viewInstanceUuid
Value: 5MNLJH6V2NAJFKP2CHFD23OVZM
.retailmenot.com/ Name: _ga
Value: GA1.2.1138230888.1673540782
.retailmenot.com/ Name: _gid
Value: GA1.2.1030648979.1673540782
.retailmenot.com/ Name: _gat
Value: 1
.secure.retailmenot.com/ Name: G_ENABLED_IDPS
Value: google
.google.com/ Name: NID
Value: 511=YSz-vsKSyHVZAwNU988T2Z84CDk4zQHLWmAvuMhcs3HYDLoz9NmxFdS-C5Usp1I21tWe6CqJFY-wFXEO8KtU6qhJhl8HbiHnAVas6mK6XEJHl-qFSnEyrwEimAdohpb3pN3XjrLpKfqLW8HGZRpcdNdVPgz-u9VqTKc8ppe4Ueg
.retailmenot.com/ Name: ftr_ncd
Value: 6
.retailmenot.com/ Name: forterToken
Value: 80535309e47248fd8fa6c13793d30e0e_1673540782449__UDF43_9ck

6 Console Messages

Source Level URL
Text
security error URL: https://www.google-analytics.com/analytics.js(Line 42)
Message:
Refused to connect to 'https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-54628-3&cid=1138230888.1673540782&jid=107396143&gjid=573206276&_gid=1030648979.1673540782&_u=aEBAAEAAEAAAACAAI~&z=467484543' because it violates the following Content Security Policy directive: "connect-src 'self' https://*.facebook.com https://www.google-analytics.com https://*.forter.com https://d2o5idwacg3gyw.cloudfront.net https://*.oktapreview.com https://a.retailmenot.com https://owenett.wsmeco.com".
security warning URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.ylZHJEOsguo.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8pkjVD5D2Liisn6U69GtDkc_fqFA/cb=gapi.loaded_0?le=scs(Line 220)
Message:
An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can remove its sandboxing.
security error URL: (program):2
Message:
Refused to create a worker from 'blob:https://secure.retailmenot.com/e6de0311-7ed2-4ef8-8b4b-778f21904d42' because it violates the following Content Security Policy directive: "worker-src 'none'".
security error (Line 6)
Message:
This document requires 'TrustedScript' assignment.
network error URL: https://accounts.google.com/_/IdpIFrameHttp/cspreport
Message:
Failed to load resource: the server responded with a status of 400 ()
security error URL: (program):2
Message:
Refused to create a worker from 'blob:https://secure.retailmenot.com/a969d224-1f36-4517-aa10-e50150ccb5ff' because it violates the following Content Security Policy directive: "worker-src 'none'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy block-all-mixed-content; default-src 'none'; child-src 'self' https://*.facebook.com https://*.google.com; connect-src 'self' https://*.facebook.com https://www.google-analytics.com https://*.forter.com https://d2o5idwacg3gyw.cloudfront.net https://*.oktapreview.com https://a.retailmenot.com https://owenett.wsmeco.com; font-src; form-action 'self'; frame-src https://*.facebook.com https://*.google.com https://www.paypal.com; img-src 'self' https://*.facebook.com https://*.facebook.net https://*.fbcdn.net https://www.google-analytics.com https://www.paypalobjects.com https://a.retailmenot.com https://owenett.wsmeco.com; report-uri -/csp-report; script-src 'self' https://*.facebook.net https://*.facebook.com https://apis.google.com https://www.google-analytics.com https://www.google.com https://www.gstatic.com https://*.forter.com https://d35u1vg1q28b3w.cloudfront.net 'strict-dynamic' 'nonce-245c39842deb4a889fdb86fe586e17bd'; style-src 'self' 'unsafe-inline' ; worker-src 'none'
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2c5de9923d36.cdn4.forter.com
80535309e47248fd8fa6c13793d30e0e-2c5de9923d36.cdn.forter.com
a.retailmenot.com
accounts.google.com
apis.google.com
ar.retailmenot.com
cdn0.forter.com
cdn3.forter.com
cdn9.forter.com
connect.facebook.net
fonts.gstatic.com
links.mail.retailmenot.com
secure.retailmenot.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.gstatic.com
zdbb.net
secure.retailmenot.com
stats.g.doubleclick.net
13.32.110.31
143.204.215.128
167.89.115.56
2001:4860:4802:36::178
2606:4700::6811:e52d
2606:4700::6812:697
2a00:1450:400d:803::200d
2a00:1450:400d:807::2004
2a00:1450:400d:807::200e
2a00:1450:400d:80d::2003
2a03:2880:f02d:12:face:b00c:0:3
3.217.206.77
3.234.25.89
34.243.19.114
54.146.178.38
54.204.202.163
0341bc291ed6de27516d9bdf210e251a9122e932da221e8c780c3f41a4976f9e
08a25ddab076e49d9db334a21869820ea22121e525e1af3b0bb0019cc649c9aa
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
211482bc5fc43f64f50191322568ac2ae1e4b82cd8c535fe070fbb87a89a0ddf
28382ff982468e9c902eb78dc77e38dc2c705e9af77c46ea5a0c03c6eefa9224
2937063d006009cc4618837d069642d587bfe62cb310cd3a8f59e80a2bdab2be
297534d1527ba0b4f5347526fc316cdb4b3fe04638dfbff06e0b110195d58fdf
336c128e8ebc017d585cb898df7544ffc0912664cedd2a64d5b1b7736cfd14fe
3aa81c28191b5502dbe1b408905495c7e05d2147c7aee50e9fcb4a8d9302b40e
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
4836b6031bc4af96767f0121fa458714583340054aea6338ef99a1bc4011f43b
4a59bb42cb945084820cd1eb370a22a68fa9451b9e57abb1daada408d2ff64e1
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5c828f3ecb0217dd1ad573b5d1341ddc19fe4c3c30aa23cfa0ce3b074b2280dc
67a48805f29ee991676a1ca5b37598f502d54031c00a7af5f2976d92c05fda95
7647724bcc7afde27000c02ce20b80535467b8f60f1330013a1ee3b575479a81
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
861a2b1af40e75080c52ddbc35d0542e75d64b067afd50911ecf5b9e3bbbde8a
879d0cfbda254cc663a0c7fe7b2e7d8764b1f0263e521c76e3782c661620680f
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d
99aa949344e1bf4c28bd606afb8d503957d73c7cfc2d13837778970786cedffa
b024d0eb200df7947237f01345568fa6b77302c65adbc8cde14f29db23e31ba9
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
bb3c83a910aa16f1c061b6b860bb5ff1aab4632ff67daebd5c0ba2c5b3385562
be1b4ec60b7c18db1c1a05b0532064e0aae2ce82a2d39461d208bf66bf4fa5bb
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
ce3935d9d1d084d10ebfe6359efc10cf290691a9e96c60c10d8bc7fad2babba9
d1e638e1e9b8f4898d56d42130b40cea68e62b11334dff7bd5526373dbf74968
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e1b0462fdc4cabf746495d5e3ae2680d0a8955ec839e0cc766e88d900ee6f8c1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f100138cf28abcaac287d3bb245b80679c7ba9305591ed01b1055af5e7084f20
f6e53945eb5c19b339fd89d67adb6d68ba1f4ef7a78826122ab98a65be0e1167