URL: https://www.firstleaf.com/refer
Submission: On November 27 via api from US — Scanned from DE

Summary

This website contacted 63 IPs in 8 countries across 55 domains to perform 178 HTTP transactions. The main IP is 2606:4700:10::ac43:989, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.firstleaf.com.
TLS certificate: Issued by GTS CA 1P5 on October 30th 2023. Valid for: 3 months.
This is the only time www.firstleaf.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
51 2606:4700:10:... 13335 (CLOUDFLAR...)
11 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 104.64.112.151 16625 (AKAMAI-AS)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
5 159.223.149.188 14061 (DIGITALOC...)
2 2a03:2880:f08... 32934 (FACEBOOK)
4 2620:1ec:c11:... 8068 (MICROSOFT...)
1 35.244.142.80 15169 (GOOGLE)
3 35.201.112.186 396982 (GOOGLE-CL...)
1 7 35.227.244.1 15169 (GOOGLE)
3 2600:9000:206... 16509 (AMAZON-02)
1 23.53.43.18 20940 (AKAMAI-ASN1)
1 67.225.220.126 32244 (LIQUIDWEB)
2 35.204.89.238 396982 (GOOGLE-CL...)
4 104.18.72.113 13335 (CLOUDFLAR...)
1 2 54.225.101.234 14618 (AMAZON-AES)
2 2600:9000:231... 16509 (AMAZON-02)
3 18.239.18.104 16509 (AMAZON-02)
1 2600:1f16:ebf... 16509 (AMAZON-02)
2 2a03:2880:f17... 32934 (FACEBOOK)
4 2001:4860:480... 15169 (GOOGLE)
3 35.186.247.156 15169 (GOOGLE)
3 35.186.194.58 15169 (GOOGLE)
1 2400:52e0:1e0... 200325 (BUNNYCDN)
1 2600:9000:244... 16509 (AMAZON-02)
1 108.138.15.119 16509 (AMAZON-02)
4 138.197.61.175 14061 (DIGITALOC...)
1 51.77.64.70 16276 (OVH)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 104.16.51.111 13335 (CLOUDFLAR...)
1 3 2606:4700::68... 13335 (CLOUDFLAR...)
4 2606:4700:10:... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 3 185.89.210.141 29990 (ASN-APPNEX)
1 15.197.193.217 16509 (AMAZON-02)
3 54.186.23.98 16509 (AMAZON-02)
19 25 35.204.74.118 396982 (GOOGLE-CL...)
1 2600:9000:243... 16509 (AMAZON-02)
2 3 46.228.174.117 56396 (AMOBEE)
1 76.223.111.18 16509 (AMAZON-02)
1 2600:1f18:612... 14618 (AMAZON-AES)
1 2 34.111.113.62 396982 (GOOGLE-CL...)
1 1 18.195.188.44 16509 (AMAZON-02)
1 1 52.57.144.94 16509 (AMAZON-02)
1 18.239.69.109 16509 (AMAZON-02)
2 3 2600:1901:0:8... 396982 (GOOGLE-CL...)
4 4 142.250.74.194 15169 (GOOGLE)
1 2 18.198.126.47 16509 (AMAZON-02)
1 52.5.176.145 14618 (AMAZON-AES)
1 69.192.160.219 16625 (AKAMAI-AS)
1 34.241.138.233 16509 (AMAZON-02)
1 216.52.2.30 30282 (AS-INAPCD...)
1 35.244.174.68 15169 (GOOGLE)
1 1 142.250.185.130 15169 (GOOGLE)
1 3 2a00:1450:400... 15169 (GOOGLE)
2 3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 69.173.144.138 26667 (RUBICONPR...)
1 35.244.159.8 396982 (GOOGLE-CL...)
2 151.101.64.176 54113 (FASTLY)
1 52.40.111.159 16509 (AMAZON-02)
1 54.231.135.49 16509 (AMAZON-02)
1 35.190.54.17 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
178 63
Apex Domain
Subdomains
Transfer
60 firstleaf.com
www.firstleaf.com
images.firstleaf.com
rbv9j7km.firstleaf.com
fbapi.firstleaf.com
api.firstleaf.com
ct.firstleaf.com
2 MB
27 simpli.fi
tag.simpli.fi — Cisco Umbrella Rank: 4323
i.simpli.fi — Cisco Umbrella Rank: 3693
um.simpli.fi — Cisco Umbrella Rank: 795
12 KB
11 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 342
166 KB
9 doubleclick.net
cm.g.doubleclick.net — Cisco Umbrella Rank: 245
googleads.g.doubleclick.net — Cisco Umbrella Rank: 33
stats.g.doubleclick.net — Cisco Umbrella Rank: 78
4 KB
7 stripe.com
js.stripe.com — Cisco Umbrella Rank: 1287
q.stripe.com — Cisco Umbrella Rank: 7148
m.stripe.com — Cisco Umbrella Rank: 1249
142 KB
7 shop.pe
shop.pe — Cisco Umbrella Rank: 12607
shopper.shop.pe — Cisco Umbrella Rank: 14983
app.shop.pe — Cisco Umbrella Rank: 14525
11 KB
6 fullstory.com
edge.fullstory.com — Cisco Umbrella Rank: 2176
rs.fullstory.com — Cisco Umbrella Rank: 2183
141 KB
5 cybba.solutions
files1.cybba.solutions — Cisco Umbrella Rank: 35654
app.cybba.solutions — Cisco Umbrella Rank: 35847
26 KB
4 google.com
www.google.com — Cisco Umbrella Rank: 2
region1.analytics.google.com — Cisco Umbrella Rank: 3040
1 KB
4 cloudfunctions.net
us-central1-adaptive-growth.cloudfunctions.net — Cisco Umbrella Rank: 2957
163 B
4 zdassets.com
static.zdassets.com — Cisco Umbrella Rank: 2137
ekr.zdassets.com — Cisco Umbrella Rank: 2470
277 KB
4 cloudfront.net
d2mjzob2nc713b.cloudfront.net
d2rp1k1dldbai6.cloudfront.net
75 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 366
14 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 6862
670 B
3 pro-market.net
fei.pro-market.net — Cisco Umbrella Rank: 2436
pbid.pro-market.net — Cisco Umbrella Rank: 7860
1 KB
3 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 246
2 KB
3 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 6439
12 KB
3 sentry.io
sentry.io — Cisco Umbrella Rank: 171
480 B
3 trkn.us
aa.trkn.us — Cisco Umbrella Rank: 33777
trkn.us — Cisco Umbrella Rank: 2412
1 KB
2 stripe.network
m.stripe.network — Cisco Umbrella Rank: 1354
16 KB
2 exelator.com
loadm.exelator.com — Cisco Umbrella Rank: 1743
2 KB
2 agkn.com
aa.agkn.com — Cisco Umbrella Rank: 560
d.agkn.com — Cisco Umbrella Rank: 755
1 KB
2 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 487
1 KB
2 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 567
712 B
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
21 KB
2 lightboxcdn.com
www.lightboxcdn.com — Cisco Umbrella Rank: 5477
2 KB
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1610
insight.adsrvr.org — Cisco Umbrella Rank: 584
3 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 110
216 B
2 mczbf.com
www.mczbf.com — Cisco Umbrella Rank: 6049
18 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 174
171 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 35
199 KB
1 safeopt.com
manage.safeopt.com — Cisco Umbrella Rank: 22111
833 B
1 amazonaws.com
addshoppers.s3.amazonaws.com — Cisco Umbrella Rank: 18608
3 KB
1 openx.net
us-u.openx.net — Cisco Umbrella Rank: 522
273 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 376
239 B
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 145
546 B
1 rlcdn.com
idsync.rlcdn.com — Cisco Umbrella Rank: 415
98 B
1 lijit.com
ce.lijit.com — Cisco Umbrella Rank: 882
311 B
1 crwdcntrl.net
bcp.crwdcntrl.net — Cisco Umbrella Rank: 887
265 B
1 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 921
444 B
1 bfmio.com
sync.bfmio.com — Cisco Umbrella Rank: 1749
329 B
1 intentiq.com
sync.intentiq.com — Cisco Umbrella Rank: 886
1 tremorhub.com
simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6321
175 B
1 3lift.com
eb2.3lift.com — Cisco Umbrella Rank: 417
140 B
1 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1268
378 B
1 smaato.net
s.ad.smaato.net — Cisco Umbrella Rank: 716
237 B
1 zendesk.com
penrosehill.zendesk.com
1 KB
1 ip-api.com
pro.ip-api.com — Cisco Umbrella Rank: 6032
447 B
1 firstleaf.club
rbv9j7km.firstleaf.club
408 B
1 rtb123.com
www.rtb123.com — Cisco Umbrella Rank: 24250
2 KB
1 pdst.fm
cdn.pdst.fm — Cisco Umbrella Rank: 2918
6 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 590
312 B
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 899
7 KB
1 typography.com
cloud.typography.com — Cisco Umbrella Rank: 7152
446 B
0 nytrng.com Failed
nytrng.com Failed
178 55
Domain Requested by
49 www.firstleaf.com www.firstleaf.com
25 um.simpli.fi 19 redirects
11 cdn.cookielaw.org www.firstleaf.com
cdn.cookielaw.org
4 cm.g.doubleclick.net 4 redirects
4 app.cybba.solutions files1.cybba.solutions
4 us-central1-adaptive-growth.cloudfunctions.net www.firstleaf.com
edge.fullstory.com
4 bat.bing.com www.googletagmanager.com
bat.bing.com
www.firstleaf.com
4 rbv9j7km.firstleaf.com www.firstleaf.com
rbv9j7km.firstleaf.com
3 app.shop.pe www.firstleaf.com
3 www.google.de
3 www.google.com 2 redirects
3 googleads.g.doubleclick.net 1 redirects www.googletagmanager.com
3 q.stripe.com www.firstleaf.com
3 ib.adnxs.com 1 redirects edge.fullstory.com
3 api.firstleaf.com www.firstleaf.com
3 challenges.cloudflare.com 1 redirects www.firstleaf.com
challenges.cloudflare.com
3 rs.fullstory.com www.firstleaf.com
3 sentry.io www.firstleaf.com
3 js.stripe.com www.firstleaf.com
js.stripe.com
3 static.zdassets.com www.googletagmanager.com
static.zdassets.com
3 d2mjzob2nc713b.cloudfront.net www.firstleaf.com
shop.pe
3 shop.pe 1 redirects d2mjzob2nc713b.cloudfront.net
3 edge.fullstory.com www.firstleaf.com
edge.fullstory.com
2 stats.g.doubleclick.net www.googletagmanager.com
www.firstleaf.com
2 m.stripe.network js.stripe.com
m.stripe.network
2 loadm.exelator.com 1 redirects
2 fei.pro-market.net 2 redirects
2 pixel.tapad.com 1 redirects
2 sync.1rx.io 2 redirects
2 ct.firstleaf.com www.firstleaf.com
2 www.google-analytics.com www.googletagmanager.com
www.firstleaf.com
2 www.lightboxcdn.com www.firstleaf.com
2 www.facebook.com www.firstleaf.com
2 www.mczbf.com www.firstleaf.com
2 trkn.us 1 redirects www.firstleaf.com
2 connect.facebook.net www.firstleaf.com
connect.facebook.net
2 www.googletagmanager.com www.firstleaf.com
www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 manage.safeopt.com www.firstleaf.com
1 shopper.shop.pe shop.pe
1 addshoppers.s3.amazonaws.com d2mjzob2nc713b.cloudfront.net
1 m.stripe.com m.stripe.network
1 us-u.openx.net
1 pixel.rubiconproject.com
1 www.googleadservices.com 1 redirects
1 idsync.rlcdn.com
1 ce.lijit.com
1 bcp.crwdcntrl.net
1 stags.bluekai.com
1 sync.bfmio.com
1 pbid.pro-market.net
1 sync.intentiq.com
1 d.agkn.com 1 redirects
1 aa.agkn.com 1 redirects
1 simplifi.partners.tremorhub.com
1 eb2.3lift.com
1 sync.targeting.unrulymedia.com
1 s.ad.smaato.net
1 insight.adsrvr.org js.adsrvr.org
1 i.simpli.fi tag.simpli.fi
1 penrosehill.zendesk.com static.zdassets.com
1 pro.ip-api.com www.firstleaf.com
1 js.adsrvr.org www.rtb123.com
1 d2rp1k1dldbai6.cloudfront.net www.rtb123.com
1 files1.cybba.solutions www.rtb123.com
1 rbv9j7km.firstleaf.club rbv9j7km.firstleaf.com
1 fbapi.firstleaf.com connect.facebook.net
1 ekr.zdassets.com www.firstleaf.com
1 tag.simpli.fi www.googletagmanager.com
1 www.rtb123.com www.firstleaf.com
1 aa.trkn.us www.firstleaf.com
1 cdn.pdst.fm www.firstleaf.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 images.firstleaf.com www.firstleaf.com
1 static.cloudflareinsights.com www.firstleaf.com
1 cloud.typography.com 1 redirects
0 nytrng.com Failed d2mjzob2nc713b.cloudfront.net
178 77
Subject Issuer Validity Valid
firstleaf.com
GTS CA 1P5
2023-10-30 -
2024-01-28
3 months crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2023-04-01 -
2024-03-31
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-04-10 -
2024-04-09
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2023-11-13 -
2024-11-12
a year crt.sh
*.getrockerbox.com
*.getrockerbox.com
2019-06-06 -
2049-05-29
30 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-09-06 -
2023-12-05
3 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 01
2023-10-24 -
2024-04-21
6 months crt.sh
cdn.pdst.fm
GTS CA 1D4
2023-11-21 -
2024-02-19
3 months crt.sh
edge.fullstory.com
GTS CA 1D4
2023-11-14 -
2024-02-12
3 months crt.sh
cert1-prod.aut.a24365.net
R3
2023-11-23 -
2024-02-21
3 months crt.sh
rtb123.com
R3
2023-11-01 -
2024-01-30
3 months crt.sh
*.simpli.fi
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-11-07 -
2024-12-07
a year crt.sh
zdassets.com
E1
2023-10-23 -
2024-01-21
3 months crt.sh
www.mczbf.com
Amazon RSA 2048 M01
2023-05-21 -
2024-06-18
a year crt.sh
a.stripecdn.com
DigiCert SHA2 Extended Validation Server CA
2023-10-30 -
2024-01-25
3 months crt.sh
fbapi.firstleaf.com
Amazon RSA 2048 M01
2023-06-20 -
2024-07-18
a year crt.sh
misc.google.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
sentry.io
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-08-08 -
2024-09-07
a year crt.sh
rs.fullstory.com
GTS CA 1D4
2023-11-10 -
2024-02-08
3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2023-10-10 -
2024-09-19
a year crt.sh
files1.cybba.solutions
R3
2023-10-20 -
2024-01-18
3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2023-04-12 -
2024-05-13
a year crt.sh
*.cybba.solutions
Sectigo RSA Domain Validation Secure Server CA
2023-08-08 -
2024-06-17
10 months crt.sh
*.ip-api.com
Sectigo RSA Domain Validation Secure Server CA
2022-11-25 -
2023-12-26
a year crt.sh
lightboxcdn.com
Cloudflare Inc ECC CA-3
2023-10-09 -
2024-10-08
a year crt.sh
penrosehill.zendesk.com
Cloudflare Inc ECC CA-3
2023-04-16 -
2024-04-15
a year crt.sh
challenges.cloudflare.com
Cloudflare Inc ECC CA-3
2023-08-18 -
2024-08-17
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
*.shop.pe
RapidSSL TLS RSA CA G1
2023-07-13 -
2024-07-12
a year crt.sh
*.stripe.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-10-09 -
2024-01-18
3 months crt.sh
m.stripe.com
DigiCert TLS RSA SHA256 2020 CA1
2023-10-05 -
2024-01-18
3 months crt.sh
*.s3.amazonaws.com
Amazon RSA 2048 M01
2023-10-10 -
2024-07-03
9 months crt.sh
*.safeopt.com
GlobeSSL DV CA
2023-05-23 -
2024-06-14
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
www.google.de
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
*.google.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh

This page contains 8 frames:

Primary Page: https://www.firstleaf.com/refer
Frame ID: 4572556D57DB574B90E00704C5C6D5B0
Requests: 176 HTTP requests in this frame

Frame: https://static.zdassets.com/web_widget/classic/latest/web-widget-main-0345ad6.js
Frame ID: 10D61B5988D9F7D3A327EEEC91EA80EA
Requests: 3 HTTP requests in this frame

Frame: https://edge.fullstory.com/s/fs.js
Frame ID: 3D8755B02AABCB6A47CA026999170EA9
Requests: 1 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/n1a03/0x4AAAAAAAAughvt52C3nbMf/light/normal
Frame ID: BC6D0465B3CACF233885735DBD7A499E
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Frame ID: 89D8CEB24BBBA1C6C7469713DCA77FAB
Requests: 4 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=l7cyjy0&ref=https%3A%2F%2Fwww.firstleaf.com%2Frefer&upid=hm2fj8w&upv=1.1.0
Frame ID: 19F9008CF5079822CCED050F498B626E
Requests: 1 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: BC2834532C8885A14B77F7DB8D06FF7A
Requests: 4 HTTP requests in this frame

Frame: https://nytrng.com/iframe?vcp=4dd5h0np&as_id=0af2d3378c8344b98b9293723aa4f889
Frame ID: 30BE59A936F942A993897C0645274949
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Firstleaf: Refer a FriendFirstLeafFirstLeafBack ButtonSearch IconFilter Icon

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+data-react

Overall confidence: 100%
Detected patterns
  • js\.stripe\.com

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • lightbox(?:-plus-jquery)?.{0,32}\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

Page Statistics

178
Requests

83 %
HTTPS

39 %
IPv6

55
Domains

77
Subdomains

63
IPs

8
Countries

3894 kB
Transfer

14452 kB
Size

51
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://cloud.typography.com/7410416/6307592/css/fonts.css HTTP 302
  • https://www.firstleaf.com/fonts/863556/14C15B4DD1F268EF7.css
Request Chain 24
  • https://shop.pe/widget/widget_async.js HTTP 301
  • https://d2mjzob2nc713b.cloudfront.net/widget/widget_async.js
Request Chain 29
  • https://trkn.us/pixel/conv/ppt=18168;g=landing_page;gid=41654;ord=6830253 HTTP 302
  • https://trkn.us/pixel/conv/ppt=18168;g=landing_page;gid=41654;ord=6830253;ip=138.199.38.132;cuidchk=1
Request Chain 108
  • https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onTurnstileLoad HTTP 302
  • https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=onTurnstileLoad
Request Chain 136
  • https://um.simpli.fi/smaato HTTP 302
  • https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=241BB05AC6874DE49A9D79E2E1245205
Request Chain 137
  • https://um.simpli.fi/nexxen HTTP 302
  • https://sync.1rx.io/usersync/simplifi/241BB05AC6874DE49A9D79E2E1245205 HTTP 302
  • https://sync.1rx.io/usersync/simplifi/241BB05AC6874DE49A9D79E2E1245205?zcc=1&cb=1701115697129 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-6a347dbc-0a66-44c0-bc2b-9ca158ae9b7f-003
Request Chain 138
  • https://um.simpli.fi/triplelift HTTP 302
  • https://eb2.3lift.com/xuid?mid=7969&xuid=241BB05AC6874DE49A9D79E2E1245205&dongle=yf3
Request Chain 139
  • https://um.simpli.fi/telaria_p HTTP 302
  • https://simplifi.partners.tremorhub.com/sync?UISF=241BB05AC6874DE49A9D79E2E1245205
Request Chain 140
  • https://um.simpli.fi/tapad HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=241BB05AC6874DE49A9D79E2E1245205 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=241BB05AC6874DE49A9D79E2E1245205
Request Chain 141
  • https://um.simpli.fi/ad_advisor HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=241BB05AC6874DE49A9D79E2E1245205 HTTP 302
  • https://d.agkn.com/pixel/10751/?che=1701115697133&ip=138.199.38.132&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D217323104713005114337 HTTP 302
  • https://um.simpli.fi/aa_px?sk=217323104713005114337 HTTP 302
  • https://um.simpli.fi/empty.gif
Request Chain 142
  • https://um.simpli.fi/intentiq HTTP 302
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=241BB05AC6874DE49A9D79E2E1245205
Request Chain 145
  • https://um.simpli.fi/dtnx HTTP 302
  • https://fei.pro-market.net/engine?du=24;csync=241BB05AC6874DE49A9D79E2E1245205;mimetype=img; HTTP 302
  • https://fei.pro-market.net/engine?du=24;csync=241BB05AC6874DE49A9D79E2E1245205;mimetype=img;sr HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=datonics-ddp&google_cm&google_hm=LTI0MjQ5NjE5ODA4MTkwOTQ1NTA= HTTP 302
  • https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEDMHnJ75rLCldNmF3JWJ8BE&google_cver=1
Request Chain 146
  • https://um.simpli.fi/exelatem HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=2191&simid=241BB05AC6874DE49A9D79E2E1245205&j=0 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=2191&simid=241BB05AC6874DE49A9D79E2E1245205&j=0&xl8blockcheck=1
Request Chain 148
  • https://um.simpli.fi/beachfront HTTP 302
  • https://sync.bfmio.com/sync?pid=141&uid=241BB05AC6874DE49A9D79E2E1245205
Request Chain 149
  • https://um.simpli.fi/bluekai HTTP 302
  • https://stags.bluekai.com/site/29931?id=241BB05AC6874DE49A9D79E2E1245205
Request Chain 150
  • https://um.simpli.fi/crwdcntrl HTTP 302
  • https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=241BB05AC6874DE49A9D79E2E1245205
Request Chain 151
  • https://um.simpli.fi/lj_match HTTP 302
  • https://ce.lijit.com/merge?pid=2&3pid=241BB05AC6874DE49A9D79E2E1245205
Request Chain 152
  • https://um.simpli.fi/liveramp_match HTTP 302
  • https://idsync.rlcdn.com/419566.gif?partner_uid=241BB05AC6874DE49A9D79E2E1245205
Request Chain 153
  • https://www.googleadservices.com/pagead/conversion/1026675585/?random=1701115697003&cv=7&fst=1701115697003&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1161528875&cv=7&fst=1701115697003&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&ocp_id=MfdkZZaXA76r9u8P-pudIA&sscte=1&crd=&pscrd=IhMI1vPg5v3kggMVvpX9Bx36TQcE HTTP 302
  • https://www.google.com/pagead/1p-conversion/1026675585/?random=1161528875&cv=7&fst=1701115697003&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1vPg5v3kggMVvpX9Bx36TQcE&is_vtc=1&ocp_id=MfdkZZaXA76r9u8P-pudIA&cid=CAQSGwDICaaNsxQDhnovkZNnzDl_Tm1cMPvOHNwCKQ&random=3761023982 HTTP 302
  • https://www.google.de/pagead/1p-conversion/1026675585/?random=1161528875&cv=7&fst=1701115697003&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1vPg5v3kggMVvpX9Bx36TQcE&is_vtc=1&ocp_id=MfdkZZaXA76r9u8P-pudIA&cid=CAQSGwDICaaNsxQDhnovkZNnzDl_Tm1cMPvOHNwCKQ&random=3761023982&ipr=y
Request Chain 155
  • https://um.simpli.fi/an HTTP 302
  • https://ib.adnxs.com/setuid?entity=66&code=241BB05AC6874DE49A9D79E2E1245205 HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D241BB05AC6874DE49A9D79E2E1245205
Request Chain 156
  • https://um.simpli.fi/rb_match HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=241BB05AC6874DE49A9D79E2E1245205&expires=365
Request Chain 157
  • https://um.simpli.fi/ox_match HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072966&val=241BB05AC6874DE49A9D79E2E1245205
Request Chain 158
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm=&google_sc=&google_tc= HTTP 302
  • https://um.simpli.fi/g_match?id=&google_gid=CAESEA85cKH5qKQ_dpWntiIA_B4&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=241BB05AC6874DE49A9D79E2E1245205 HTTP 302
  • https://um.simpli.fi/g_match?id=
Request Chain 182
  • https://www.google.com/pagead/landing?gcs=G111&gcd=11t1t1l1l5&rnd=510321280.1701115699&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&dma_cps=sypham&dma=1&gtm=45He3b81n71TKCVNWv71863389&auid=295393694.1701115699 HTTP 302
  • https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=11t1t1l1l5&rnd=510321280.1701115699&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&dma_cps=sypham&dma=1&gtm=45He3b81n71TKCVNWv71863389&auid=295393694.1701115699

178 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request refer
www.firstleaf.com/
2 MB
270 KB
Document
General
Full URL
https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f21f8245d562612096485cd57291e067c42470042c18bdfb694fd21ef07c24d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language
de-DE,de;q=0.9

Response headers

cache-control
public, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
82cd007f5c6765ac-FRA
content-encoding
gzip
content-type
text/html
date
Mon, 27 Nov 2023 20:08:14 GMT
last-modified
Mon, 27 Nov 2023 17:43:55 GMT
server
cloudflare
vary
Accept-Encoding
via
1.1 af1da25c2dddf71cac076999aa9861e6.cloudfront.net (CloudFront)
x-amz-cf-id
4PMAkc4XHnP4Mz4syiCcBbpHXaNDihkuvntn98k0rffpqSuu535Dhg==
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ea1823078c462969eaa59d6ef62623c19d77b72e25a103105b043aefaa0769a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
/EzX6ku1+i8ak28m1WuIrw==
age
57656
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6841
x-ms-lease-status
unlocked
last-modified
Wed, 22 Nov 2023 17:38:25 GMT
server
cloudflare
etag
0x8DBEB81D4AA9473
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
7f5edf5c-201e-004a-17b1-1d9a0c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cd0080c8a01e51-FRA
14C15B4DD1F268EF7.css
www.firstleaf.com/fonts/863556/
Redirect Chain
  • https://cloud.typography.com/7410416/6307592/css/fonts.css
  • https://www.firstleaf.com/fonts/863556/14C15B4DD1F268EF7.css
251 KB
188 KB
Stylesheet
General
Full URL
https://www.firstleaf.com/fonts/863556/14C15B4DD1F268EF7.css
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
122604dbe0e33b2a80cff78e90bd1aefe742828d19a66b357bde8c250035ca33

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
via
1.1 8428d3ca0a47cd247ba9c371c08ccb6a.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
AMS58-P3
age
759
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 13 Jun 2023 18:04:53 GMT
server
cloudflare
etag
W/"01b0c035e870e010817990f18af07eeb"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=14400
cf-ray
82cd0081cfcf65ac-FRA
x-amz-cf-id
e-aWXiF37lpQCelfhy4G4bzzjMDkL3CAOeFBfCqa7q_AD_CpX1AMoA==

Redirect headers

Date
Mon, 27 Nov 2023 20:08:14 GMT
Last-Modified
Tue, 13 Jun 2023 18:10:29 GMT
Server
AkamaiNetStorage
X-HCo-pid
16
ETag
"9a52622c3b0b353cd052a5e4518bd213:1686679828.962264"
Content-Type
text/html
Location
https://www.firstleaf.com/fonts/863556/14C15B4DD1F268EF7.css
Cache-Control
must-revalidate, private
Connection
keep-alive
Content-Length
154
Expires
Mon, 27 November 2023 20:08:14 GMT
email-decode.min.js
www.firstleaf.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
848 B
Script
General
Full URL
https://www.firstleaf.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 16 Nov 2023 21:55:48 GMT
server
cloudflare
etag
W/"65568fe4-4d7"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
82cd0080de8b65ac-FRA
expires
Wed, 29 Nov 2023 20:08:14 GMT
app-5cb68fc105c1e2902956.js
www.firstleaf.com/
6 MB
2 MB
Script
General
Full URL
https://www.firstleaf.com/app-5cb68fc105c1e2902956.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
45a23ae649b70a4e21781f819bbe4a5ccd80721ee5154d0292984efd9fb60581

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
via
1.1 46e82159f07d7f814d9b72723b038152.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
AMS58-P3
age
765
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 27 Nov 2023 17:43:48 GMT
server
cloudflare
etag
W/"6e79e72b4acab1cc8092c12d1823c450-2"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000, immutable
cf-ray
82cd00811edd65ac-FRA
x-amz-cf-id
W1nc1sXRfPbCHbtQEFmGT1ixtIhGjrgLutf05QoUYoyupAv3bs70Vw==
framework-a08bc9de2f7ae97b3053.js
www.firstleaf.com/
146 KB
46 KB
Script
General
Full URL
https://www.firstleaf.com/framework-a08bc9de2f7ae97b3053.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
292105f3e2b9986f0cd0ccdbd5e7b6c77ac28631b7177931cc503b6a131a9496

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
via
1.1 524f30fc42ae138c5b6185cefbec064a.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
CDG50-C1
age
1308361
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
last-modified
Tue, 10 Jan 2023 16:53:13 GMT
server
cloudflare
etag
W/"fc7b78db7bf9648a0640f7723a6613ce"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000, immutable
cf-ray
82cd00814f1e65ac-FRA
x-amz-cf-id
EJd1XDiCUhVyeB27ulsML6Hc1ZW5EYN5TcD9Ab8usBAQtlnqbbCYoQ==
webpack-runtime-2c993c33eee389a52a56.js
www.firstleaf.com/
4 KB
2 KB
Script
General
Full URL
https://www.firstleaf.com/webpack-runtime-2c993c33eee389a52a56.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
512ab4fe263949fb64f4787bcf9d9e1d6f58812c785f71b6a0897c2c5e20de6e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
via
1.1 b6be6ee8d445cfa291adcacd75a3fb12.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
FRA56-P5
age
520925
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
last-modified
Tue, 21 Nov 2023 18:25:12 GMT
server
cloudflare
etag
W/"b26dd9addec171e3f4a6bec4e4553b56"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000, immutable
cf-ray
82cd00814f2165ac-FRA
x-amz-cf-id
PVyL-EsAly0g7-YUDn_hztPp-12RJVeTLNSaqu5v_sILK1yhNZoyAw==
v84a3a4012de94ce1a686ba8c167c359c1696973893317
static.cloudflareinsights.com/beacon.min.js/
20 KB
7 KB
Script
General
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer
https://www.firstleaf.com/
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
last-modified
Tue, 10 Oct 2023 21:38:13 GMT
server
cloudflare
etag
W/"2023.10.0"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
82cd00816ef3904c-FRA
d59f7da2-0cea-4d7b-9f00-32f1d3392306.json
cdn.cookielaw.org/consent/d59f7da2-0cea-4d7b-9f00-32f1d3392306/
5 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/d59f7da2-0cea-4d7b-9f00-32f1d3392306/d59f7da2-0cea-4d7b-9f00-32f1d3392306.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0484f7ea0df633b28919011c49461eaad52472558af2be1263617f40f828980
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
7184
content-md5
Pf71Q2KPhJn5whOraDCHMg==
content-length
1785
x-ms-lease-status
unlocked
last-modified
Thu, 02 Nov 2023 15:13:15 GMT
server
cloudflare
etag
0x8DBDBB63D1F9900
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
2d107f56-d01e-0071-6f9f-0ddfa8000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cd00813a945d9a-FRA
expires
Tue, 28 Nov 2023 20:08:14 GMT
gtm.js
www.googletagmanager.com/
368 KB
106 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW&gtm_auth=1BfIqc--iU-7Fmd2boouvg&gtm_preview=env-1&gtm_cookies_win=x
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
49dfef05d0297543d0e4cedc293b559aee6d585e01b1c84439a91b71f2b6ec9e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
107753
x-xss-protection
0
pragma
no-cache
server
Google Tag Manager
vary
*
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 01 Jan 1990 00:00:00 GMT
sp-at-v2-14-0.js
images.firstleaf.com/js/
98 KB
30 KB
Script
General
Full URL
https://images.firstleaf.com/js/sp-at-v2-14-0.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50cf303cfaa020fcbedd6ad1bf045a008cbb88dfc792f731f07235dd1ca13599

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
via
1.1 dca6db3c8f31f3cd48bb06d78a8be624.cloudfront.net (CloudFront)
cf-cache-status
HIT
last-modified
Mon, 27 Jul 2020 04:28:00 GMT
server
cloudflare
x-amz-cf-pop
FRA56-C2
age
765
etag
W/"8dba669b94e3865c9205ef8fd15ee4d1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=5356800
cf-ray
82cd00814f2365ac-FRA
x-amz-cf-id
1ZSHcJMhFRloFhNZpdtsRPAMBlidY1dne2teMbkHlXLZHf14XWFlRA==
truncated
/
85 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a5e3256799bc9eb6a1ad57001ad69b0946e4532d103092dd0557c02d84e6b4a7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
492 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
623c33b9ef9f3871f596b2f721d622b8c4a530b147cc6a9ec2e405f89fe68f7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
image/png
truncated
/
85 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5d5ac92cc9565d62cd713fe2d946793ffb805012b57f610830403afb67907030

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
568 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
02d0cddb81ecbfffffc3b2eba469a45372e7cc0244222faa422b502b3046a509

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
image/png
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e092bea366a94333d8ec48137987e2df19f61288f6e073032b2a8bdde6264d6a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
image/svg+xml
app_store.webp
www.firstleaf.com/static/0c1319a5c4fac32586a58822c813ff66/b5934/
4 KB
4 KB
Image
General
Full URL
https://www.firstleaf.com/static/0c1319a5c4fac32586a58822c813ff66/b5934/app_store.webp
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fefb5d7f9dba1b2071b036cd9893bc809f1d8701dcfbcfc0e1adb95bf96b1785

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
via
1.1 8428d3ca0a47cd247ba9c371c08ccb6a.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
AMS58-P3
age
1213618
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
3736
last-modified
Mon, 12 Jun 2023 21:04:27 GMT
server
cloudflare
etag
"bb8569255542e6bf30a0a2b246563788"
vary
Accept-Encoding
content-type
image/webp
cache-control
public, max-age=31536000, immutable
accept-ranges
bytes
cf-ray
82cd00816f4665ac-FRA
x-amz-cf-id
JLqzfH93M31YpAbzC8C-73jBNs5vo68StboymsqcHDXENM7hcz-Sfw==
google_play.webp
www.firstleaf.com/static/643138a8cf22e49297e7f623d0b627d0/08bd6/
8 KB
8 KB
Image
General
Full URL
https://www.firstleaf.com/static/643138a8cf22e49297e7f623d0b627d0/08bd6/google_play.webp
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d52d4524b6e0555d1de9842f1d22827ef845ddc5b3b5d78e0bb9c4288961096

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
via
1.1 df9ce120cad525bdb160f75cd7b807c2.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
ZRH55-P1
age
1376373
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
8450
last-modified
Mon, 12 Jun 2023 21:04:27 GMT
server
cloudflare
etag
"f5b84a3f47828ecf485e565d5d229972"
vary
Accept-Encoding
content-type
image/webp
cache-control
public, max-age=31536000, immutable
accept-ranges
bytes
cf-ray
82cd00816f4865ac-FRA
x-amz-cf-id
yU5jTFdgCMlbtE30I_Tpf2JVk7RYuOqd96Mn8miBW7nEQVp2qrVPnw==
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
66 B
312 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
82cd008199232bdc-FRA
access-control-allow-headers
Content-Type
js
www.googletagmanager.com/gtag/
305 KB
94 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-3TS4P88RE5&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW&gtm_auth=1BfIqc--iU-7Fmd2boouvg&gtm_preview=env-1&gtm_cookies_win=x
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
88cb675379978febde8e786534b6d607d2a01b814d0f8e041f8bea0b8fa59011
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
95635
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 27 Nov 2023 20:08:14 GMT
wxyz.cs.js
rbv9j7km.firstleaf.com/assets/
47 KB
11 KB
Script
General
Full URL
https://rbv9j7km.firstleaf.com/assets/wxyz.cs.js?rb_sync=rbv9j7km.firstleaf.club
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.223.149.188 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
metrics.production.nyc1.045
Software
openresty /
Resource Hash
29f3c804b625a9830c29615c4185d504f93b69411dfac6131586b9311e303e1e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:14 GMT
Content-Encoding
gzip
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
application/javascript
fbevents.js
connect.facebook.net/en_US/
202 KB
54 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Mon, 27 Nov 2023 20:08:14 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
54273
x-xss-protection
0
reporting-endpoints
pragma
public
x-fb-debug
+9rBXX9t4NMznqpHyeTT85L1sUJ9arwWZ18MsDo1IGXFqusqnhumC3YfpeSWxZ32bLUOJ6wLh8A4PhexrwpZ3g==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
bat.js
bat.bing.com/
45 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW&gtm_auth=1BfIqc--iU-7Fmd2boouvg&gtm_preview=env-1&gtm_cookies_win=x
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Mon, 27 Nov 2023 20:08:14 GMT
last-modified
Fri, 10 Nov 2023 20:09:55 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 049ADDB4BEEA42C8839332B5A48B6244 Ref B: FRA31EDGE0611 Ref C: 2023-11-27T20:08:14Z
etag
"80abcdf1114da1:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
13175
ping.min.js
cdn.pdst.fm/
26 KB
6 KB
Script
General
Full URL
https://cdn.pdst.fm/ping.min.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.142.80 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
80.142.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:04:21 GMT
content-encoding
gzip
age
233
x-guploader-uploadid
ABPtcPpqTQ2oH4aDP7HAZ-ZsNwitMgjT7wPTgJesxuu0Dt_6-MqRPoE7O7LF1nfpdQDIml8pxw4
x-goog-storage-class
STANDARD
x-goog-metageneration
4
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5774
last-modified
Fri, 28 May 2021 20:34:03 GMT
server
UploadServer
etag
"d001d1c9f5a942fa5524eeacb047e819"
vary
Accept-Encoding
x-goog-generation
1622234043862937
x-goog-hash
crc32c=oKoi/w==, md5=0AHRyfWpQvpVJO6ssEfoGQ==
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-stored-content-length
5774
accept-ranges
bytes
content-type
application/javascript;
expires
Mon, 27 Nov 2023 21:04:21 GMT
fs.js
edge.fullstory.com/s/
247 KB
68 KB
Script
General
Full URL
https://edge.fullstory.com/s/fs.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.112.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
186.112.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
878fa0dda1bf5303d4c094f42ba9f7b3aaff615c75b0f89ef4011ea9f5adcaf7

Request headers

Referer
https://www.firstleaf.com/
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:00:27 GMT
content-encoding
br
age
467
x-guploader-uploadid
ABPtcPoTuBEx4LefCmLP7rqnQ3MdojK3qWIkqfiWY6DLuWpccnBhcfrj12_CnLJFZ6GHV5Qdq-y59kpQtQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
br
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
69204
last-modified
Fri, 10 Nov 2023 14:06:35 GMT
server
UploadServer
etag
"76afec209977b7bdc80ad7f037ea3611"
vary
Accept-Encoding
x-goog-generation
1699625194984472
x-goog-hash
crc32c=LMNjrA==, md5=dq/sIJl3t73ICtfwN+o2EQ==
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600,no-transform
x-goog-stored-content-length
69204
accept-ranges
bytes
content-type
application/javascript
expires
Mon, 27 Nov 2023 21:00:27 GMT
widget_async.js
d2mjzob2nc713b.cloudfront.net/widget/
Redirect Chain
  • https://shop.pe/widget/widget_async.js
  • https://d2mjzob2nc713b.cloudfront.net/widget/widget_async.js
3 KB
2 KB
Script
General
Full URL
https://d2mjzob2nc713b.cloudfront.net/widget/widget_async.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Server
2600:9000:206f:8400:d:370a:51c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
78489cd5d39de9a624a385449f78ac3dac62f590f99e3d98195e7d06851edbc7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 19:13:10 GMT
content-encoding
gzip
via
1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
age
3305
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
1193
last-modified
Tue, 21 Nov 2023 15:55:08 GMT
server
AmazonS3
etag
"fc3afa6873ba21b89d491eae52174000"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=3600, public
accept-ranges
bytes
x-amz-cf-id
-Qk2QHwapgWQpJ4fG_bDfWTH_SCCwt-exYZY5kFhQ6Og3LjvXYgH1Q==
x-amz-meta-mtime
1700582104.43

Redirect headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-security-policy
frame-ancestors none;
referrer-policy
no-referrer-when-downgrade
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 google
server
nginx
x-frame-options
deny
content-type
text/html
location
https://d2mjzob2nc713b.cloudfront.net/widget/widget_async.js
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
178
cs.js
aa.trkn.us/1/e/
0
166 B
Script
General
Full URL
https://aa.trkn.us/1/e/cs.js?cid=c013&evid=993e96c8-4ada-4a23-91b5-8a29f749564b&suu=1&dmn=www.firstleaf.com
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.18 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-18.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:14 GMT
Cache-Control
private, max-age=3600
Connection
keep-alive
Expires
Mon, 27 Nov 2023 21:08:14 GMT
btp.js
www.rtb123.com/tags/A99F5C2A-533B-31BD-43AC-B834BAFF94CB/
5 KB
2 KB
Script
General
Full URL
https://www.rtb123.com/tags/A99F5C2A-533B-31BD-43AC-B834BAFF94CB/btp.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
67.225.220.126 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.rtb123.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
0f88056ae93eb3934cd9cd312a9766a14afadf3cb20c1d2a07d8a8d5344e46bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-powered-by-plesk
PleskWin
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
last-modified
Wed, 15 Nov 2023 18:43:00 GMT
server
Microsoft-IIS/10.0
etag
"092bb8ef317da1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
1649
4f1bd082-d454-42cb-bafd-026640e9800e
tag.simpli.fi/sifitag/
3 KB
2 KB
Script
General
Full URL
https://tag.simpli.fi/sifitag/4f1bd082-d454-42cb-bafd-026640e9800e
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW&gtm_auth=1BfIqc--iU-7Fmd2boouvg&gtm_preview=env-1&gtm_cookies_win=x
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.204.89.238 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
238.89.204.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
645ab215148e00ab2ba3fdfc7caec9aa6d0cd5a672078f1d033a01e0f5a44864

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
server
openresty
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
x-request-id
F5uTtg8sqWVEtTUXh3DD
expires
Thu, 01 Jan 1970 00:00:00 GMT
snippet.js
static.zdassets.com/ekr/
10 KB
5 KB
Script
General
Full URL
https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW&gtm_auth=1BfIqc--iU-7Fmd2boouvg&gtm_preview=env-1&gtm_cookies_win=x
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.72.113 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9f22f6e9d4852f8be0706b62fbd0eba20f6cb56171def5e387b2d95fcd07df01
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
x-amz-version-id
hKEbdq289Xo7bHrM.yPFOdJ37r5nFwfe
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=0
x-amz-request-id
SJN8N1JDMTD43WG0
age
56
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-id-2
OdnBjVcC5xsQvyjtpPVBe21NpgZXl51NRJfLydbGvh5Gu9AdfuYJ4+/g1Hhtqo28e16NzYJZ+wk=
last-modified
Wed, 09 Aug 2023 01:01:02 GMT
server
cloudflare
etag
W/"42d94c325a0b012e41f9c3907853625a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OZ74QjOwGZwSVsZ47Y5hHoXQKyoP0OL600wGVEDEchPxhMVv2v9QX63ool0HKkADiQmOknySNa%2Fi8W26i89NueOKBaz2WqZXqNiNWPg8mx0CIF6w%2FqyZmub2I6PewcRQxgVQ4YA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=3600, s-maxage=60
cf-ray
82cd0081e9da1e4d-FRA
ppt=18168;g=landing_page;gid=41654;ord=6830253;ip=138.199.38.132;cuidchk=1
trkn.us/pixel/conv/
Redirect Chain
  • https://trkn.us/pixel/conv/ppt=18168;g=landing_page;gid=41654;ord=6830253
  • https://trkn.us/pixel/conv/ppt=18168;g=landing_page;gid=41654;ord=6830253;ip=138.199.38.132;cuidchk=1
42 B
780 B
Image
General
Full URL
https://trkn.us/pixel/conv/ppt=18168;g=landing_page;gid=41654;ord=6830253;ip=138.199.38.132;cuidchk=1
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
HTTP/1.1
Server
54.225.101.234 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-225-101-234.compute-1.amazonaws.com
Software
Apache /
Resource Hash
b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Pragma
no-cache
Date
Mon, 27 Nov 2023 20:08:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sun, 9 Nov 1980 12:59:00 GMT
Server
Apache
Content-Type
image/gif
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection
keep-alive
Content-Length
42
Expires
Sun, 9 Nov 1980 12:58:00 GMT

Redirect headers

Date
Mon, 27 Nov 2023 20:08:14 GMT
X-Content-Type-Options
nosniff
Server
Apache
Content-Type
text/html; charset=UTF-8
Location
/pixel/conv/ppt=18168;g=landing_page;gid=41654;ord=6830253;ip=138.199.38.132;cuidchk=1
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection
keep-alive
Content-Length
0
tag.js
www.mczbf.com/tags/11334/
53 KB
17 KB
Script
General
Full URL
https://www.mczbf.com/tags/11334/tag.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2315:4e00:16:4ed5:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
26b31d6103923798e1cfb5cd7037f0863ea6a60627816a748fa0ad952d8398c7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 19:53:19 GMT
Content-Encoding
gzip
Via
1.1 f47fcc9b2aa47ced36c40c318e6f006a.cloudfront.net (CloudFront)
Server
nginx
X-Amz-Cf-Pop
DUS51-P2
Age
895
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
application/javascript; charset=UTF-8
Cache-Control
max-age=1800
Connection
keep-alive
X-Amz-Cf-Id
KtcOOsw9uEukom2p55qgb8TKiFAc51kkqkSvahZjqK5qOmlwzPUcug==
X-Request-ID
9cc0fe5a-8d5e-11ee-96fb-5b6196c15e5f
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202310.1.0/
426 KB
103 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202310.1.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
feeb83e3a11fb74465e062a5081f1f6f573ef66197f218a3a86447fefe3166f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
1/fYiRcAkidM+2Rc1fEXtg==
age
61757
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
104832
x-ms-lease-status
unlocked
last-modified
Thu, 26 Oct 2023 03:35:14 GMT
server
cloudflare
etag
0x8DBD5D490C850BD
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
e7356784-101e-0051-37a0-0ba40f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cd0081da321e51-FRA
1669030446688031
connect.facebook.net/signals/config/
380 KB
117 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1669030446688031?v=2.9.138&r=stable&domain=www.firstleaf.com
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
81e19781421dde74d381c435d7a9fd57617829f6c4d4e9a392043dc327003bd3
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Mon, 27 Nov 2023 20:08:14 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
119785
x-xss-protection
0
reporting-endpoints
pragma
public
x-fb-debug
FqfXSYos1cKdSzIUveVT36ACTvyFSQSkKkK17Su28b814BdzMXW8/4C/4fSTtxLrhpKDBAI/fiXDYZt+8hJs1w==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
en.json
cdn.cookielaw.org/consent/d59f7da2-0cea-4d7b-9f00-32f1d3392306/cf6da5f1-7903-48af-a1bf-d03112e5566b/
66 KB
14 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/d59f7da2-0cea-4d7b-9f00-32f1d3392306/cf6da5f1-7903-48af-a1bf-d03112e5566b/en.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c459bfad9c5f66b00ad2d8fc3afa0fe1be2af878921a7b4e804261bc77ea7db6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
7182
content-md5
Y3r9apUoWKC/Wm8K4VQqSg==
content-length
14000
x-ms-lease-status
unlocked
last-modified
Thu, 02 Nov 2023 15:13:22 GMT
server
cloudflare
etag
0x8DBDBB64114C6F9
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
e71022fc-c01e-0099-2f9f-0d463e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cd00823b755d9a-FRA
expires
Tue, 28 Nov 2023 20:08:14 GMT
v3
js.stripe.com/
556 KB
137 KB
Script
General
Full URL
https://js.stripe.com/v3
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/app-5cb68fc105c1e2902956.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.239.18.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-239-18-104.ams58.r.cloudfront.net
Software
Cloudfront /
Resource Hash
16125b67dd44a6df2eadad443e941af6085d45a67fad4421f2160d92fe605278
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:12 GMT
content-encoding
br
via
1.1 34dde22d7e4e8bb757cb687a7932a122.cloudfront.net (CloudFront)
strict-transport-security
max-age=31556926; includeSubDomains; preload
x-content-type-options
nosniff
age
2
x-amz-cf-pop
AMS58-P6
x-cache
Hit from cloudfront
last-modified
Tue, 21 Nov 2023 22:18:21 GMT
server
Cloudfront
etag
W/"e28d4375fad3ffbfb5f7bdf0303a2787"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=60
timing-allow-origin
*
x-amz-cf-id
EEOsmniBFNAmlxRi_Pp-YQXc89ONezVp_lyARMPHIJtwLycWRDV2qA==
682-242bd69790405d70c310.js
www.firstleaf.com/
97 KB
25 KB
Script
General
Full URL
https://www.firstleaf.com/682-242bd69790405d70c310.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/webpack-runtime-2c993c33eee389a52a56.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3fb1a29c99d1d739c54b237a8a3f6e27dc1097f643deb03739e2672bc455adcb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
via
1.1 b30b1c2659a3fb836783824fe37110ee.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
FRA56-P5
age
1535798
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 10 Jan 2023 16:53:12 GMT
server
cloudflare
etag
W/"02167d54d970352f44b8cfa13cd9b71b"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000, immutable
cf-ray
82cd008288ab65ac-FRA
x-amz-cf-id
8MCXQhLL27Fe87RQyAH6vHM_EAbWYzM461I2J1lC6p1Us5tIyh2Kog==
app-data.json
www.firstleaf.com/page-data/
50 B
350 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/app-data.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/app-5cb68fc105c1e2902956.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1fe373400327289754745162a830e9c366fd0cc7f082590447fe244f1cc00c66

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
via
1.1 ecbb6ac82f8f6ff46460b69097d121ec.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Mon, 27 Nov 2023 17:43:55 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"25b4e5912cb2d5a32c46daa57c870e40"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd008298ad65ac-FRA
x-amz-cf-id
D1gvxl6GiEQNCQLyUdVwi3vpLyt9qND6G9JBUkvi_gpMVSace8mnmQ==
page-data.json
www.firstleaf.com/page-data/refer/
472 B
516 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/refer/page-data.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/app-5cb68fc105c1e2902956.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9af55514373a031165feb55cc4e9bde932e0ce324bd591678861202f9d66885c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
via
1.1 73ce513d12556804240bd1d312686daa.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Thu, 02 Nov 2023 13:04:48 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"d47165d5bfb94fd370d138531015a581"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd008298af65ac-FRA
x-amz-cf-id
WTMZPEtNE2Gq_1OA2Lglriiey4CpQzYRKxsfFKcxOl1DIjl4lVzQww==
web
edge.fullstory.com/s/settings/134SPF/v1/
8 KB
2 KB
XHR
General
Full URL
https://edge.fullstory.com/s/settings/134SPF/v1/web
Requested by
Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.112.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
186.112.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
a6700195e8c83a7f13d99b7f33caabd96fc589156a6b0fbe3fe1a08187deef7d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 19:57:05 GMT
content-encoding
gzip
age
669
x-guploader-uploadid
ABPtcPqNT-q38T7qH32rqRI5boexhR7TyjoNg0oOfJWBVhBj0uT6QP5XxOxip9ULT2QaZfvlo2-PRaE
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2176
last-modified
Mon, 27 Nov 2023 19:50:47 GMT
server
UploadServer
etag
"b769f38a0b6eb62aee9ebe7d2a4f0029"
x-goog-generation
1701114647224398
x-goog-hash
crc32c=jtjeKg==, md5=t2nzigtutirunr59Kk8AKQ==
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public,max-age=900,no-transform
x-goog-stored-content-length
2176
accept-ranges
bytes
content-type
application/json
expires
Mon, 27 Nov 2023 20:12:05 GMT
b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
ekr.zdassets.com/compose/
1 KB
1 KB
Fetch
General
Full URL
https://ekr.zdassets.com/compose/b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.72.113 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ad4276f7c290bdcbcb4e468f88a3cff789687c8a70c6828956bcfcd4c2aa1a1
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
strict-transport-security
max-age=0
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies
none
content-encoding
br
status
200 OK
cdn-cache-control
max-age=60
x-xss-protection
1; mode=block
x-request-id
829962a1490e1261-SEA, 829962a1490e1261-SEA
x-runtime
0.024370
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"7ad4276f7c290bdcbcb4e468f88a3cff"
x-download-options
noopen
x-frame-options
SAMEORIGIN
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3i52YCWsUshK1OjWedO1c9XH%2FewDydFnUWaIWeKOgZGYHZwq2bPUW1CjxwLhhXHaf%2FsliHTAFn8oqNasHjLKOJnG5Pi95zKtebEunUl373azxpDuXvFOKa838LmUeHT54uY%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
vary
Accept, Origin, Accept-Encoding
cache-control
max-age=300, public, stale-while-revalidate=300, stale-if-error=21600
content-type
application/json; charset=utf-8
x-zendesk-zorg
yes
cf-ray
82cd00836a08bbd4-FRA
5565374.js
bat.bing.com/p/action/
0
117 B
Script
General
Full URL
https://bat.bing.com/p/action/5565374.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Mon, 27 Nov 2023 20:08:14 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: E27E2065871345F4A8A833AB14978377 Ref B: FRA31EDGE0611 Ref C: 2023-11-27T20:08:14Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/
0
286 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5565374&tm=gtm002&Ver=2&mid=9b2f6f14-1da5-43d2-90c9-5571ad1af641&sid=b27e75308d6011ee9f1259fe40208395&vid=b27e74408d6011eeb387c3a257912180&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Firstleaf%3A%20Refer%20a%20Friend&p=https%3A%2F%2Fwww.firstleaf.com%2Frefer&r=&lt=418&evt=pageLoad&sv=1&rn=910657
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 27 Nov 2023 20:08:14 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F5D8B5C255F64267B891025C1757EA74 Ref B: FRA31EDGE0611 Ref C: 2023-11-27T20:08:14Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
28fc69a6b106b8bbf4255e58732b4429691c375c33dd91683c594606975a1e52
fbapi.firstleaf.com/events/
0
349 B
XHR
General
Full URL
https://fbapi.firstleaf.com/events/28fc69a6b106b8bbf4255e58732b4429691c375c33dd91683c594606975a1e52
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/signals/config/1669030446688031?v=2.9.138&r=stable&domain=www.firstleaf.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f16:ebf:1f02:ca75:c788:2a66:4e1b Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://www.firstleaf.com
date
Mon, 27 Nov 2023 20:08:14 GMT
access-control-allow-credentials
true
content-length
0
vary
origin
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1669030446688031&ev=PageView&dl=https%3A%2F%2Fwww.firstleaf.com%2Frefer&rl=&if=false&ts=1701115694632&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1701115694630.345433077&hmd=346d66e82c3114f50a9a9e35&eid=ob3_plugin-set_d301fe95661e07537997026c26673311ddcc420796309b56dc97fa285658ead1&cs_est=true&ler=empty&it=1701115694406&coo=false&rqm=GET
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Mon, 27 Nov 2023 20:08:14 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.facebook.com/tr/
0
31 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1669030446688031&ev=Microdata&dl=https%3A%2F%2Fwww.firstleaf.com%2Frefer&rl=&if=false&ts=1701115694634&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Firstleaf%3A%20Refer%20a%20Friend%22%2C%22meta%3Adescription%22%3A%22Refer%20a%20friend%20to%20Firstleaf%20wine%20club%20%26%20they%27ll%20get%20their%20first%20wine%20box%20free%2C%20and%20you%27ll%20get%20%2430%20for%20your%20next%20order.%20Learn%20more%20about%20our%20Refer%20a%20Friend%20deal.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.138&r=stable&ec=1&o=4126&fbp=fb.1.1701115694630.345433077&hmd=346d66e82c3114f50a9a9e35&eid=ob3_plugin-set_65f73406e92896673ea62e94c432958d42968ee448ba99667208d19cad8222a0&ler=empty&it=1701115694406&coo=false&es=automatic&tm=3&rqm=GET
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Mon, 27 Nov 2023 20:08:14 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
otFlat.json
cdn.cookielaw.org/scripttemplates/202310.1.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202310.1.0/assets/otFlat.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
gA7tJXNyGFicHKODkM9Iaw==
age
7182
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
3017
x-ms-lease-status
unlocked
last-modified
Thu, 26 Oct 2023 03:35:07 GMT
server
cloudflare
etag
0x8DBD5D48CFC97D7
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
6298d6af-401e-004c-6ea5-08a9b3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cd00839d1e5d9a-FRA
otPcCenter.json
cdn.cookielaw.org/scripttemplates/202310.1.0/assets/v2/
62 KB
13 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202310.1.0/assets/v2/otPcCenter.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b0a210e89ac35b54a9b4ccb0336ea91c561e6dc5f8bda49574da98d40799c6e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
D6052jlcz/0opqTP4tUV1A==
age
7182
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
12708
x-ms-lease-status
unlocked
last-modified
Thu, 26 Oct 2023 03:35:10 GMT
server
cloudflare
etag
0x8DBD5D48E5675E0
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
309b0b36-d01e-003c-3232-0d1044000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cd00839d205d9a-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202310.1.0/assets/
21 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202310.1.0/assets/otCommonStyles.css
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
c7xAZ9MSGAobGaTYg/Qtag==
age
7182
x-ms-lease-status
unlocked
last-modified
Thu, 26 Oct 2023 03:35:19 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
c51002c9-601e-0029-0aa5-0807f7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
82cd00839d225d9a-FRA
truncated
/
16 KB
16 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
01af466f48d14857d97a67cd7025ce67c8a0b9ca83ddb6d3f313c7369c432868

Request headers

Referer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
application/x-font-woff2
truncated
/
5 KB
5 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
51b06909334339bd5f4027e70f4d2fd30a2a3977ee44cce7385b908ec8f51903

Request headers

Referer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
application/x-font-woff2
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a899a0398bbfbb8343c67e83098446254c1609aae412962cff6929087135a51c

Request headers

Referer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
application/x-font-woff2
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dddf04d190be2e7006f807221d5f5852bf45a97c2aad4c66b1f0a1661efa7dda

Request headers

Referer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
application/x-font-woff2
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c

Request headers

Referer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
application/x-font-woff2
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70

Request headers

Referer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
application/x-font-woff2
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393

Request headers

Referer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
application/x-font-woff2
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c

Request headers

Referer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
application/x-font-woff2
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ Frame
0
0
Preflight
General
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.firstleaf.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

access-control-allow-headers
Content-Type, Accept
access-control-allow-methods
GET, POST
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
gzip
content-length
22
content-type
text/html; charset=utf-8
date
Mon, 27 Nov 2023 20:08:14 GMT
function-execution-id
k6qg4pfgn568
server
Google Frontend
x-cloud-trace-context
6d59d445599a83a737136530215a7fd6
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/
2 B
122 B
Fetch
General
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept
application/json
Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
application/json

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
server
Google Frontend
access-control-allow-methods
GET, POST
content-type
text/html; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
055548ff5aa2f05e523f9e8000ba0c0e
cache-control
private
function-execution-id
wj0e6jntm2wk
access-control-allow-headers
Content-Type, Accept
content-length
22
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
pageInfo
www.mczbf.com/11334/
68 B
514 B
Fetch
General
Full URL
https://www.mczbf.com/11334/pageInfo
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2315:4e00:16:4ed5:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Accept
*/*
Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Mon, 27 Nov 2023 20:08:14 GMT
Via
1.1 271c2e1e305f31b0f14837cad3c843b0.cloudfront.net (CloudFront)
Server
nginx
X-Amz-Cf-Pop
DUS51-P2
X-Cache
Miss from cloudfront
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
no-store
Connection
keep-alive
Content-Length
68
X-Amz-Cf-Id
iWLG18Seb2hjG9fvCinYNS-y-bEMeUww-gu9RiHlJcufVrD-cW0_Aw==
X-Request-ID
b2921910-8d60-11ee-8b11-b78207dbeb0a
/
sentry.io/api/1397651/envelope/
2 B
324 B
Fetch
General
Full URL
https://sentry.io/api/1397651/envelope/?sentry_key=ff909656e90d411f9069253f654c00ac&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.26.0
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.247.156 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
156.247.186.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
text/plain;charset=UTF-8

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
server
nginx
vary
origin,access-control-request-method,access-control-request-headers
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
page
rs.fullstory.com/rec/
8 KB
2 KB
XHR
General
Full URL
https://rs.fullstory.com/rec/page
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.194.186.35.bc.googleusercontent.com
Software
/
Resource Hash
e0e97ac884c40424448ea871461024dd27f40176fcc2d3cbc310714d89ac3285

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.firstleaf.com
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
gzip
access-control-allow-credentials
true
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type
application/json; charset=utf-8
ot_close.svg
cdn.cookielaw.org/logos/static/
651 B
599 B
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/ot_close.svg
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
pcXWFGpuVeSg/jVnYCseRg==
age
59299
x-ms-lease-status
unlocked
last-modified
Wed, 22 Nov 2023 17:38:32 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
f5fdbe84-c01e-0020-34e5-1d4224000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
82cd00842e1d1e51-FRA
ot_guard_logo.svg
cdn.cookielaw.org/logos/static/
497 B
493 B
Fetch
General
Full URL
https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
tXyZydHjxQshFMbbBT1/8A==
age
7471
x-ms-lease-status
unlocked
last-modified
Mon, 27 Nov 2023 03:36:42 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
e36a9292-b01e-0005-2c1a-21eb58000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
82cd00843ddc5d9a-FRA
FL_Logotype_Purple_(3).png
cdn.cookielaw.org/logos/627cf43a-de0f-4b49-ad3a-54a9f94ef23e/8eb1dbf4-acc5-45da-85f8-9badfdf81305/49b98577-e68a-467a-877e-9da063be58e4/
17 KB
17 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/627cf43a-de0f-4b49-ad3a-54a9f94ef23e/8eb1dbf4-acc5-45da-85f8-9badfdf81305/49b98577-e68a-467a-877e-9da063be58e4/FL_Logotype_Purple_(3).png
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9fd678871d5c502175e5233f33bb7c2cb09eda96eebfa139f527b72683f8b92b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
kb6My5twzXAEkxk7pZWjFQ==
age
38207
content-length
17202
x-ms-lease-status
unlocked
last-modified
Wed, 29 Jun 2022 19:40:58 GMT
server
cloudflare
etag
0x8DA5A074A2ECBDD
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
60ce1f13-301e-000b-570d-15c2e8000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cd00843e3d1e51-FRA
powered_by_logo.svg
cdn.cookielaw.org/logos/static/
5 KB
2 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/powered_by_logo.svg
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
Y+c301RBZNK39PvKQWrIBw==
age
50788
x-ms-lease-status
unlocked
last-modified
Mon, 27 Nov 2023 03:36:43 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
ccf762a7-801e-0088-55e5-20dc8a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
82cd00843e411e51-FRA
triggerRunner.js
d2mjzob2nc713b.cloudfront.net/widget/
11 KB
4 KB
Script
General
Full URL
https://d2mjzob2nc713b.cloudfront.net/widget/triggerRunner.js?v=887112e
Requested by
Host: shop.pe
URL: https://shop.pe/widget/widget_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:8400:d:370a:51c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4b4c8cab5b08674a09cb0719abd984198123d97831844808b90ec48756571422

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Thu, 16 Nov 2023 23:56:37 GMT
content-encoding
gzip
via
1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
age
936698
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
3869
last-modified
Wed, 01 Nov 2023 14:59:06 GMT
server
AmazonS3
etag
"0d2e893332eb1e0d637434be6be2eeb5"
content-type
application/javascript; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
x-amz-cf-id
KsZU-DtkMKl6IZUzydXiwvpppvxVK9L48IrKSUfAUQKRdYEJnMemMQ==
x-amz-meta-mtime
1698850741.91
integrations
rbv9j7km.firstleaf.com/
48 B
252 B
Script
General
Full URL
https://rbv9j7km.firstleaf.com/integrations?source=firstleaf
Requested by
Host: rbv9j7km.firstleaf.com
URL: https://rbv9j7km.firstleaf.com/assets/wxyz.cs.js?rb_sync=rbv9j7km.firstleaf.club
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.223.149.188 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
metrics.production.nyc1.045
Software
openresty /
Resource Hash
4abfc20341515e0793cc89ece1d464349fdc7675f925e473fd6d99a0cc18a8b8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:14 GMT
Content-Encoding
gzip
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/javascript
jpuid
rbv9j7km.firstleaf.club/
67 B
408 B
Script
General
Full URL
https://rbv9j7km.firstleaf.club/jpuid?jsonp=RB.jsonPUID
Requested by
Host: rbv9j7km.firstleaf.com
URL: https://rbv9j7km.firstleaf.com/assets/wxyz.cs.js?rb_sync=rbv9j7km.firstleaf.club
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.223.149.188 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
metrics.production.nyc1.045
Software
openresty /
Resource Hash
999057c118070898bb135e956abf4b9439c674ed99b3388d6e32f0a9833dff96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:14 GMT
Content-Encoding
gzip
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/javascript
loader.min.js
files1.cybba.solutions/2856/
79 KB
24 KB
Script
General
Full URL
https://files1.cybba.solutions/2856/loader.min.js
Requested by
Host: www.rtb123.com
URL: https://www.rtb123.com/tags/A99F5C2A-533B-31BD-43AC-B834BAFF94CB/btp.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
f5582e2945dd2c8c1f74ddcd5cc53c031cf72c2be04b79f6c552ca105c1a2e73

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

cdn-requestpullsuccess
True
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
br
cdn-edgestorageid
1080
cdn-cachedat
09/14/2023 20:01:17
cdn-pullzone
116099
last-modified
Thu, 14 Sep 2023 14:30:07 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"650318ef-13a99"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
a080e070-2552-4896-b206-e42f1464eeab
cache-control
public, max-age=3600
cdn-requestid
c6fe0e262b994dc1b09184b26c0ecb79
cdn-requestcountrycode
DE
cdn-status
200
expires
Thu, 14 Sep 2023 21:01:17 GMT
cybba_latest.min.js
d2rp1k1dldbai6.cloudfront.net/
78 KB
21 KB
Script
General
Full URL
https://d2rp1k1dldbai6.cloudfront.net/cybba_latest.min.js
Requested by
Host: www.rtb123.com
URL: https://www.rtb123.com/tags/A99F5C2A-533B-31BD-43AC-B834BAFF94CB/btp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2440:1400:d:87ae:bb80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f33b9ff7c623861b226c359f20776dc8c86c9490764b0b48d973f427f00aaf0b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-amz-version-id
xnXmqAg0192IZMN5wnb_dU8pMiCd15HX
content-encoding
gzip
via
1.1 b0fa8632832c868a30d3acd573712a74.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 10:22:29 GMT
last-modified
Wed, 16 Aug 2023 13:22:03 GMT
server
AmazonS3
x-amz-cf-pop
DUS51-P3
age
35148
x-amz-server-side-encryption
AES256
etag
W/"8d008d0540dfa1c7074218def613069f"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
dVJLTegD3O9Glt9hxV3J3kuIHDWIck9ZOTrs8RERduwH1mkeFv72gg==
up_loader.1.1.0.js
js.adsrvr.org/
5 KB
3 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.rtb123.com
URL: https://www.rtb123.com/tags/A99F5C2A-533B-31BD-43AC-B834BAFF94CB/btp.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
108.138.15.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-15-119.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 02:56:46 GMT
Content-Encoding
gzip
Via
1.1 f1a22cc8d842b0950e4bd5bda60806f2.cloudfront.net (CloudFront)
Last-Modified
Mon, 20 Nov 2023 02:56:36 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA56-P7
Age
61889
x-amz-server-side-encryption
AES256
ETag
W/"b7474eac210849250426a8f6a39d00f3"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
I7gXyqSkBdhYhdEJvrYIioAaARIGEkp9-gag0qVIw6mjm2230uMIew==
widget.js
d2mjzob2nc713b.cloudfront.net/widget/
189 KB
48 KB
Script
General
Full URL
https://d2mjzob2nc713b.cloudfront.net/widget/widget.js?v=b1788c7
Requested by
Host: shop.pe
URL: https://shop.pe/widget/widget_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:8400:d:370a:51c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f60c4a84c845d054e8fd40c501965fd0f4afb725d54fb7fa48049d79fc29aae8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Fri, 03 Nov 2023 19:07:32 GMT
content-encoding
gzip
via
1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
age
2077243
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
48869
last-modified
Wed, 01 Nov 2023 14:59:05 GMT
server
AmazonS3
etag
"acf7a1e055a9acb551398e3c090c9548"
content-type
application/javascript; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
x-amz-cf-id
zrOe2n_9FrJcX1TC5-Jf25LwdQW6IsA3YwzfpWg2gu8ttdlcshbKPg==
x-amz-meta-mtime
1698850740.24
web-widget-main-0345ad6.js
static.zdassets.com/web_widget/classic/latest/ Frame 10D6
923 KB
265 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/classic/latest/web-widget-main-0345ad6.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.72.113 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5147cf5352bb6f99d31467dfec38f9573476d093433cda65441668df8617bbc
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
x-amz-version-id
4cbhc1.6rLf_h9ym68WJ6KIAscXI23.M
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=0
x-amz-request-id
5NGBX16WRWF7DSW1
age
1448178
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-id-2
+Ajtx2ABzNKgYpFlxKPmlS5D70waiNiWHkGseVNjR6Do+j/+xqVDmte+7SY+9KbOzSYQYXTFMdI=
last-modified
Mon, 06 Nov 2023 00:49:00 GMT
server
cloudflare
etag
W/"d21ab80a38e205ddac2cf2e5ff41ab5d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=303Th203LZlO018aRMHBPQb3ubT55Iit43aUQAskT5W2eL%2F52j6cGx3IG%2BnZdaE7H7XJgVQgxfKLcFpKs6V%2BOv9X18iVGeM5K8az4d8XvCahzChXSBRTBWiBUEOy6fYe5M8bUNM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
cf-ray
82cd00849e191e4d-FRA
expires
Tue, 05 Nov 2024 00:48:59 GMT
user
app.cybba.solutions/
126 B
488 B
Script
General
Full URL
https://app.cybba.solutions/user?callback=_vtsdk.User.callbackUser&shopId=2856&oldUserId=undefined&email=null&_ts=48094172
Requested by
Host: files1.cybba.solutions
URL: https://files1.cybba.solutions/2856/loader.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
138.197.61.175 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx, nginx /
Resource Hash
3d40fa2983d63b1f9b1158a6b05bb0983b5bbe5065e0782256e6e333f3624b09
Security Headers
Name Value
Strict-Transport-Security max-age=3600
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:16 GMT
Strict-Transport-Security
max-age=3600
Server
nginx, nginx
X-Frame-Options
deny
Content-Type
text/javascript;; charset=utf-8
Cache-Control
no-cache
Connection
close
X-Robots-Tag
noindex
Content-Length
126
x-process-time
0.18685388565063477
Expires
Mon, 27 Nov 2023 20:08:15 GMT
/
pro.ip-api.com/json/
291 B
447 B
XHR
General
Full URL
https://pro.ip-api.com/json/?key=aUoasJP8dMuydUf
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.77.64.70 , Germany, ASN16276 (OVH, FR),
Reverse DNS
de-fra-1.pro.ip-api.com
Software
/
Resource Hash
f88e6c1e4e0fe89939c77b77c4183a7ce74248aec2731d7fced0227506010785

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 27 Nov 2023 20:08:14 GMT
Content-Length
291
Content-Type
application/json; charset=utf-8
lightbox_speed.js
www.lightboxcdn.com/vendor/8158d925-0b30-4be6-bcc9-4670b48f34c8/
3 KB
1 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/8158d925-0b30-4be6-bcc9-4670b48f34c8/lightbox_speed.js?mb=1701115694869
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ecb0efb31f4df41b94ee044712042410aa65c1e2554ffaf79a9c6ffb16b79e0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:14 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
BYQBieU9L5FFKFrypp6G4w==
age
250
cf-polished
origSize=4971
x-ms-lease-status
unlocked
cf-bgj
minify
last-modified
Mon, 27 Nov 2023 15:14:46 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
cb81b53f-a01e-002d-1946-219bf0000000
cache-control
public, max-age=60
x-ms-version
2009-09-19
cf-ray
82cd00851dea373a-FRA
expires
Mon, 27 Nov 2023 20:09:14 GMT
en-us-json-0345ad6.js
static.zdassets.com/web_widget/classic/latest/web-widget-locales/classic/ Frame 10D6
25 KB
6 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/classic/latest/web-widget-locales/classic/en-us-json-0345ad6.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/classic/latest/web-widget-main-0345ad6.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.72.113 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a48fd35c61908d912b5ac9e1face12e0962a0d9ecc8679e87db4031697cec54e
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:14 GMT
x-amz-version-id
I_EA8shgdUVnTYVtPsngXZhS4fZlnaal
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=0
x-amz-request-id
XMH8WHSS3SHAKJMK
age
1275013
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-id-2
30QD48lw+Xk4Za/KTs3qUzuf+pyeSSso8S0TOdNcnw7ByTmU4mh5Pd0VGfA/Y4mrlADYzA+RWgM=
last-modified
Mon, 06 Nov 2023 00:49:02 GMT
server
cloudflare
etag
W/"6eb45e96a7cbb4b8ca10897f3cf09981"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FKuaoAdKayn2qbUE8Q2LolJws7ZLtDnVeJke9bHFQv3KZqKoBaz4p4KRcUWLtNvTLWaOYdclc8D%2F4Wzqalb9ugixLo3KeTftx6XeSD6tZtVy1o4pLQBP2Ms8Zk7aQLqy0F9ExLM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
cf-ray
82cd00859fc91e4d-FRA
expires
Tue, 05 Nov 2024 00:49:01 GMT
config
penrosehill.zendesk.com/embeddable/ Frame 10D6
751 B
1 KB
Fetch
General
Full URL
https://penrosehill.zendesk.com/embeddable/config
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/classic/latest/web-widget-main-0345ad6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.51.111 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
66588b9c23774d448f8e58d1a250f32845152730b25deb05decc869ff23489b3

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-zendesk-origin-server
embeddable-app-server-6c58497b58-ptwf5
x-cached
HIT
x-request-id
82ccff155b1fbbb0-FRA
x-runtime
0.002702
last-modified
Mon, 27 Nov 2023 20:02:34 GMT
server
cloudflare
access-control-max-age
7200
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UOdKZN88VQst2tdi%2F22p8BYMaj8IdCfya4dhWCAH%2FEf5R6zGJVOrmV4o0%2FLcTSCtFkGsO%2BTgD9%2FytnbNvkeKSC9n8V73bG639I47%2FEmPbwSz3d0mHdXIjJfYDtLgDPlR5WaN614iwSJX"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
cache-control
public, max-age=60, stale-while-revalidate=600, stale-if-error=3600
vary
Origin, Accept-Encoding
cf-ray
82cd0085babf9ba0-FRA
1070480137.json
www.firstleaf.com/page-data/sq/d/
17 KB
7 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/1070480137.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3deecf7765b0b5f7854ff9c962010e90c3a3ad5dcbf1f1436bed59daf6e20c57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 702b555619c53ec5f8f56dfeed61c334.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Thu, 23 Nov 2023 15:09:44 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"0952163831ffc4f2be00b941825451e2"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd00859cb265ac-FRA
x-amz-cf-id
lG2xx0iFpTxRIp0mW5NVvi9G7gH1rsQyDzJNEGTr89uqcpL69zE3ug==
1127810653.json
www.firstleaf.com/page-data/sq/d/
897 B
548 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/1127810653.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d0ca84e91e2f948c3e0e49dfad215cf9e3a4d84808423c401f75733cb2e92bb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
via
1.1 eb91f7d4f380e2793c00431a8fc93fe0.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Mon, 02 Oct 2023 21:16:01 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"ac848d73e63860eb9b84b90e40c707e4"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd00859cb765ac-FRA
x-amz-cf-id
yIgmeG1jVFZbjK8XgstYnT2RW8eZCTWuKu6swAkB_DwzHibl4cdhoQ==
1336607429.json
www.firstleaf.com/page-data/sq/d/
8 KB
2 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/1336607429.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cce753ae3b1e52fa4eaeff638550c3fea3040a4e4822adfc070918eb4f1e0b4e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 5090b605a7b968781de55827dd170bf2.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Tue, 05 Sep 2023 08:20:32 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"6d0f32099667dcd6d847a977984787a3"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd00859cba65ac-FRA
x-amz-cf-id
QZAID6F5qxew2TC9HOvFhqLS9CCPpv87sLVpFEOJtN6jTvkn6viA5A==
1417137468.json
www.firstleaf.com/page-data/sq/d/
15 KB
3 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/1417137468.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
192d30283f127c1503291bd628c5a8ce70eb7a04481fa3f616cc516e0e8a81d5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 c2c44e18165da827386e0ed36aeea344.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Mon, 27 Nov 2023 17:45:03 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"207b0747736e351e8ff821588358cc18"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd00859cbc65ac-FRA
x-amz-cf-id
UnCRUmh_DHlLuUxEPnQqxvUaPSk9ZSFYZypx79u3OkiuCUIqP_Hv-A==
1806462600.json
www.firstleaf.com/page-data/sq/d/
3 KB
715 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/1806462600.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
448d4d591156a0c14d4990f575daea57d7ca5ae8bb4021fc38d66445578e77b3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 ed6e39eea0e39e463514b9421b7a2806.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Thu, 12 Oct 2023 19:54:11 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"98900a93434132189ab0148c1acaf82b"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd00859cbd65ac-FRA
x-amz-cf-id
iChCfKwilpwcHviPCD_mB0xp_gcpTPLL8X1BBt3AHdtq23__GsqVvg==
1870208217.json
www.firstleaf.com/page-data/sq/d/
314 KB
56 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/1870208217.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99b01639ce493bb0e333c2bce444bfe29b86a23c0f53e16cad80ffc86a9fcd2d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 ecbb6ac82f8f6ff46460b69097d121ec.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Tue, 17 Oct 2023 18:03:41 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"31b1412f77efe12a40a1d0dfd3359577"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd00859cbe65ac-FRA
x-amz-cf-id
Ry4Bwx1Jc13-C2HdwWthLeLUKnyYtvYpLbTzjSxhtsSp9CbwTqtrCg==
2343482889.json
www.firstleaf.com/page-data/sq/d/
81 B
259 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/2343482889.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c472f5fc6038aa27db8aa76648236f916446c78b691d4211ef95a546411ca8b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
via
1.1 c3919dfed58c39e6da91faec1344110c.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Wed, 24 Aug 2022 12:51:27 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"bcbe45f39971408a2e07253a116c24f7"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd00859cc065ac-FRA
x-amz-cf-id
txPx64pjmOA1BIQ53yzdAzi1a0w0oEqN8E84jh7vl8lNOjMq94MUzA==
2446253125.json
www.firstleaf.com/page-data/sq/d/
2 KB
905 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/2446253125.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4733f202938d8b69cc376eb0ac3a609f358e05caae9f5b27b9a3a898dbed2fca

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 644a5a573cbbd5ac03f5c40fa8642914.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Wed, 24 Aug 2022 12:51:27 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"e63b0204b94e3645cd4a553ec3a1b4bb"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd00859cc165ac-FRA
x-amz-cf-id
bwMqSlI5VHEj-mKCPFjVdfsdU0YIYRQmjfc5Ms599tg2LtWSR750JQ==
2625547197.json
www.firstleaf.com/page-data/sq/d/
34 KB
6 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/2625547197.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5afba68268c3b07f1dc44f0cfe7be9c6b7504714f700fe7a5f061153f3c5f6bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 0f5a5feace742eb20ef71e34731fb1fa.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Mon, 27 Nov 2023 17:45:03 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"23f3ccc31abb7ab09cc522964290a0bc"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd00859cc465ac-FRA
x-amz-cf-id
yiaQqrRUWV2C7KXrpQhaGBST2O1iedukMD4nFjbUWLXaQDCzdAKN5A==
2727750032.json
www.firstleaf.com/page-data/sq/d/
1 KB
846 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/2727750032.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d58edbe448902b5aa44d767c44c298945a0e2985f214e651deacd9ec71ac87b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 704c8a207b209dd3861e2faa8d55cc08.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Mon, 24 Apr 2023 18:16:18 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"196f013f143e3f025ff9c87f585009e2"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd00859cc665ac-FRA
x-amz-cf-id
3NzeJHyoNJz6z0VbzN3IdOcLjWnDwOETbXd99CWBRMAEDcmPf0P--Q==
2729198856.json
www.firstleaf.com/page-data/sq/d/
7 KB
4 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/2729198856.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6396dedda9bcf5749f2cbbcd870a17297c4bf63f19a52d54d42d3abb4b0a3b87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 73ce513d12556804240bd1d312686daa.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Thu, 02 Nov 2023 13:06:51 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"6abb3127553464b77f2faa50e0c833c9"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085accc65ac-FRA
x-amz-cf-id
DZOl4zG5ZqbmfemmANXztuyWkCBeVBIH-apaFxNOtBaL2kULQ3Ojyg==
2734060729.json
www.firstleaf.com/page-data/sq/d/
20 KB
5 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/2734060729.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f83e9b440122162e26168f780eb567cbc84a351c4728c3cc8bd3679e8e362ff9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 eb91f7d4f380e2793c00431a8fc93fe0.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Thu, 16 Mar 2023 17:48:12 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"13482419a9f2c5b5a126e6d5bd4214a8"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085accd65ac-FRA
x-amz-cf-id
nlUGsoklAn3eODqoqD-lOvi7aqg4350eX9tUKF415CnMO74dQ8wWyg==
2754068927.json
www.firstleaf.com/page-data/sq/d/
4 KB
2 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/2754068927.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6aa2e6166c7e04afa18a7adecff919c61d92877b2285d2aef27127476e4b538a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 46e82159f07d7f814d9b72723b038152.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Thu, 21 Sep 2023 23:43:05 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"9bf2a50c53bddceb6e916d9b67ae5b54"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acce65ac-FRA
x-amz-cf-id
zhzY4iw3Aknj10sMwKjKaA-FznYJ1YF4eSG3-VwMpsg-BPBD4cD3SQ==
2764483679.json
www.firstleaf.com/page-data/sq/d/
3 KB
943 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/2764483679.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19bdfcbcd23b5134cd377c78bbf03971926795fa6398c62599782d4d6e381620

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 b038919df048ba1d1a170622840d275e.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Tue, 04 Oct 2022 15:55:32 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"f2aabd68d8137b9c2a2b980847ec0644"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085accf65ac-FRA
x-amz-cf-id
z_lZvwkIHtjBpDMKGB1_ud4qwy4nQtWgNGgfogbDDGsDpVarLfyorg==
2771237727.json
www.firstleaf.com/page-data/sq/d/
660 B
619 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/2771237727.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
adbd7d4779c904702783f318862565dcd83b6c8ed9f98bd465d4bb9edf5c61fd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
via
1.1 ad02191892ceb388ca997ca92099a6f4.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Thu, 26 Oct 2023 16:05:54 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"b7fefb2fcdafd5c758ba15bad011cc35"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acd165ac-FRA
x-amz-cf-id
ubT11S2QEV46r2VaOfRjU9n4ADEpCcCfK-X0Upr7GrfbtWQJepXXrA==
3065704166.json
www.firstleaf.com/page-data/sq/d/
607 B
527 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/3065704166.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1b042c650b6af4874dfcad48aa7fd53dc9b32a444a96fba1f7161a02607907a8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
via
1.1 702b555619c53ec5f8f56dfeed61c334.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Fri, 04 Aug 2023 20:23:09 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"62267b28fd2e454d403e7198dcbde8c4"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acd265ac-FRA
x-amz-cf-id
Pg-u5CQqXaRFucVb7xgRbZDnilxw7je0ER0DhlUG4guycy1IAq4R2Q==
3079672699.json
www.firstleaf.com/page-data/sq/d/
19 KB
11 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/3079672699.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c25dd5f5fe269775aff50152e1346d36a63a577e0183cab959292a0ab56d90da

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 c3919dfed58c39e6da91faec1344110c.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Tue, 17 Oct 2023 18:03:41 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"138ea3c9721d022e0c0065c9729cf5b2"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acd365ac-FRA
x-amz-cf-id
-cgMgvQU4e4hj-qPKzebgaE13wkCTZGbGOQASwmdtyhOmov3iaj-VA==
3102962149.json
www.firstleaf.com/page-data/sq/d/
8 KB
2 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/3102962149.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dae92dddf3101a40fa9588c6b89dc1326c599bd44a3559af863846c7116b9bfe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 64e65d847e47fbcbf4dc70bc1c185676.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Wed, 20 Sep 2023 14:28:41 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"7b7cb0eb122e927b3382c6ce8310794e"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acd565ac-FRA
x-amz-cf-id
t2P261ryhWfDO2PRMkBJOYZGyWwgpnZanDdTM_n5OTQmATtZP_pwhg==
3205276428.json
www.firstleaf.com/page-data/sq/d/
152 KB
40 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/3205276428.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5167eba6e2d9752d3e842f659a2cb597d54b2cac2e02fcf501c09eeed21bf68f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 b6e86319773f95421e5e42f048890d7c.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Thu, 09 Nov 2023 21:36:13 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"a74c64dc2a6edba1e2eefb5be1bcd6a6"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acd765ac-FRA
x-amz-cf-id
IXqWgr17fRInTU3Sz-umetcTmmnVKZamqNhUz-RbhX16pe5KTLKYWg==
3522674478.json
www.firstleaf.com/page-data/sq/d/
23 KB
5 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/3522674478.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd41d8ac5e4afa3d87487757ddd78478d0380adcbb8f6eb1d4c39ab2dda933f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 af1da25c2dddf71cac076999aa9861e6.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Wed, 18 Oct 2023 14:44:14 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"1e0ac256742d74c5428a0f330a06a09d"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acd865ac-FRA
x-amz-cf-id
ePxW-z4d00B-vTRXrpsLo8VBGoWDnvvd0PxPX0UQdfgI0YcsH60o7Q==
3679669099.json
www.firstleaf.com/page-data/sq/d/
26 KB
6 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/3679669099.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
853fe9b0a580de7f26b968747b3efab6a7984cf6413c375479a2f4507ca81a9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 ad02191892ceb388ca997ca92099a6f4.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Fri, 25 Aug 2023 19:20:12 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"1368ccc3d2ec57383e53d1abe2df2e18"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acda65ac-FRA
x-amz-cf-id
iM--NXoB1dLuKQHCCSkcKIld0TS9wtJxA00r8CDf2m8bbS2SAvnOkg==
384391487.json
www.firstleaf.com/page-data/sq/d/
388 B
398 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/384391487.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c03f3488eeb6bcad6fa76499431ef68b5e0283c9eb8d71ed52851c14ff9f5d5c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
via
1.1 c3919dfed58c39e6da91faec1344110c.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Wed, 24 Aug 2022 12:51:28 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"af315518cf9c83f1a5039ef893a09a9e"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acdb65ac-FRA
x-amz-cf-id
dYP9QNvuXwAR16t1necq2P_dGUkuVHlI8dM6Tl_x7_bs4AJjIExPTg==
3963807967.json
www.firstleaf.com/page-data/sq/d/
359 B
573 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/3963807967.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a6257c31f8e2e50e86df4fc1f6b716f5833d8bca16297addd17da973286f417

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
via
1.1 b6e86319773f95421e5e42f048890d7c.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Thu, 26 Oct 2023 16:05:54 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"20ef1b06854be571232342252585a1bb"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acdd65ac-FRA
x-amz-cf-id
e0KCRV6CReBNU9SlkbyYOSlq-SUpmoQifJlnvXMWibjBXJxeArQzvg==
4049699997.json
www.firstleaf.com/page-data/sq/d/
5 KB
2 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/4049699997.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d517a31c87468aa0c7f190013a3ae309f0ff6e5c1ed9073d5e82e3b7e54eec10

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 73ce513d12556804240bd1d312686daa.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Tue, 04 Oct 2022 15:55:32 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"7d9022fe7de129bfa9f162852dace6f6"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acde65ac-FRA
x-amz-cf-id
CO9j8QxAlKvmpaNI6RKkCfVGVfRCQo2pnMKzg7MMi1KW_X03wa7OPQ==
4076379186.json
www.firstleaf.com/page-data/sq/d/
8 KB
3 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/4076379186.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a3b270884bf94832ce02a8a93455cbbed697b0d6dd9722956997a25f6a018537

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 ecbb6ac82f8f6ff46460b69097d121ec.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Wed, 22 Nov 2023 18:15:12 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"5f60d541fcd30c29344b532082620b11"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085acdf65ac-FRA
x-amz-cf-id
lg9tvgtGee9FnU_85mbKpKYWijURlfNqbWrTMp3ydTiXxjhaFrEN3Q==
829245689.json
www.firstleaf.com/page-data/sq/d/
2 KB
968 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/sq/d/829245689.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
47c68758c3d5ccba91f970373f59a93485a94e5c4bc1a0454597ba5cfa7a4ace

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 5bf4ed1052f9d87875430429ad189f42.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Fri, 17 Mar 2023 14:40:04 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"7e30c192f8cdaded799e482bd3eec407"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd0085ace065ac-FRA
x-amz-cf-id
82i7Ci7L5FSBnS3fnK01Z0qTpYlOIcatMxhLnRAodvD2nzmmQy6Few==
digibox.gif
www.lightboxcdn.com/z9g/
35 B
297 B
Image
General
Full URL
https://www.lightboxcdn.com/z9g/digibox.gif?c=1701115695002&h=www.firstleaf.com&e=p&u=44194
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 20:08:15 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
age
1178092
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Fri, 02 Dec 2022 00:02:02 GMT
content-length
35
x-ms-lease-status
unlocked
cf-bgj
imgq:85,h2pri
last-modified
Fri, 02 Dec 2022 00:02:38 GMT
server
cloudflare
etag
0x8DAD3F8864E2F29
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
c47c8121-701e-0006-26b6-16ef48000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cd0085cec0373a-FRA
rb
rbv9j7km.firstleaf.com/v2/
44 B
337 B
Image
General
Full URL
https://rbv9j7km.firstleaf.com/v2/rb?url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&action=view&source=firstleaf&rb_source=firstleaf&script_version=wxyz.rb.js&sessionId=55fd11d2-4a77-469b-b07e-31b79b6f59f0&uid=rbos-80ff11e4-f9d5-4e7c-95e4-96a7c6b62ec8
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.223.149.188 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
metrics.production.nyc1.045
Software
openresty /
Resource Hash
039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:15 GMT
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
image/gif
rb
rbv9j7km.firstleaf.com/v2/
44 B
337 B
Image
General
Full URL
https://rbv9j7km.firstleaf.com/v2/rb?url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&action=identify&source=firstleaf&rb_source=firstleaf&podsights_session_id=111623adb6f0413e9ad565de91e406d7&script_version=wxyz.rb.js&sessionId=55fd11d2-4a77-469b-b07e-31b79b6f59f0&uid=rbos-80ff11e4-f9d5-4e7c-95e4-96a7c6b62ec8
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.223.149.188 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
metrics.production.nyc1.045
Software
openresty /
Resource Hash
039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:15 GMT
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
image/gif
fs.js
edge.fullstory.com/s/ Frame 3D87
247 KB
68 KB
Script
General
Full URL
https://edge.fullstory.com/s/fs.js
Requested by
Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.201.112.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
186.112.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
878fa0dda1bf5303d4c094f42ba9f7b3aaff615c75b0f89ef4011ea9f5adcaf7

Request headers

Referer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:00:27 GMT
content-encoding
br
age
468
x-guploader-uploadid
ABPtcPoTuBEx4LefCmLP7rqnQ3MdojK3qWIkqfiWY6DLuWpccnBhcfrj12_CnLJFZ6GHV5Qdq-y59kpQtQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
br
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
69204
last-modified
Fri, 10 Nov 2023 14:06:35 GMT
server
UploadServer
etag
"76afec209977b7bdc80ad7f037ea3611"
vary
Accept-Encoding
x-goog-generation
1699625194984472
x-goog-hash
crc32c=LMNjrA==, md5=dq/sIJl3t73ICtfwN+o2EQ==
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600,no-transform
x-goog-stored-content-length
69204
accept-ranges
bytes
content-type
application/javascript
expires
Mon, 27 Nov 2023 21:00:27 GMT
api.js
challenges.cloudflare.com/turnstile/v0/g/9914b343/
Redirect Chain
  • https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onTurnstileLoad
  • https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=onTurnstileLoad
33 KB
11 KB
Script
General
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=onTurnstileLoad
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
51cd12da61a7401c73472b2ac77067adfa30e9fc0545b4b7c240e9154e011fc7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
br
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=31536000
cf-ray
82cd0088f97892b4-FRA
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Mon, 27 Nov 2023 20:08:15 GMT
server
cloudflare
vary
accept-encoding
location
/turnstile/v0/g/9914b343/api.js?onload=onTurnstileLoad
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
82cd0088d95992b4-FRA
alt-svc
h3=":443"; ma=86400
checkouts.json
api.firstleaf.com/api/
2 KB
2 KB
XHR
General
Full URL
https://api.firstleaf.com/api/checkouts.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3e65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d80e46ea1ae15cc270710bb17a397d2c7e8688069b2d43eaabffb59b7fda9e61
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
a292352a-36d8-4afd-b711-e5da7a4bbe0b
x-runtime
0.119057
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"d80e46ea1ae15cc270710bb17a397d2c"
x-download-options
noopen
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET, POST, PATCH, PUT, OPTIONS, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.firstleaf.com
access-control-expose-headers
DNT,Keep-Alive,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control
max-age=0, private, must-revalidate
cf-ray
82cd0088ecd135e2-FRA
access-control-allow-headers
DNT,Keep-Alive,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
223-93477160dda2993c6123.js
www.firstleaf.com/
3 KB
2 KB
Script
General
Full URL
https://www.firstleaf.com/223-93477160dda2993c6123.js
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/webpack-runtime-2c993c33eee389a52a56.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4c521d5535bd16fa41564dc19a2043f492e87104fc8089b9fca8040813a0f80

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
content-encoding
gzip
via
1.1 18fab39b23fb6b3013058d6df5faf0bc.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
FRA60-P6
age
2182488
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 20 Jun 2023 15:54:17 GMT
server
cloudflare
etag
W/"f2c96b9ae25854b1e183ec2c3ad46955"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000, immutable
cf-ray
82cd0088c8f765ac-FRA
x-amz-cf-id
IZpHnmIVOU-lB75h_-I12c3EUU4seWUdDHaXgyCWw61GJ_FdxCrqpQ==
truncated
/
622 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2874b51187499aa0b6bcac160f72d5d0820dc644f979df11e5cbd7abb8dad2e

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
image/png
truncated
/
609 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
abcead7bca366f147d75f144149318ec4590a98bddae9131df5900f7b04aaba3

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
image/png
truncated
/
975 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c22ea4b441efa116b0fa35c99a1bfa8216692dab8dcc0eef07fa67b3a2056152

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
image/png
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW&gtm_auth=1BfIqc--iU-7Fmd2boouvg&gtm_preview=env-1&gtm_cookies_win=x
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 19:19:54 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
2901
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Mon, 27 Nov 2023 21:19:54 GMT
0
bat.bing.com/action/
0
121 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5565374&tm=gtm002&Ver=2&mid=9b2f6f14-1da5-43d2-90c9-5571ad1af641&sid=b27e75308d6011ee9f1259fe40208395&vid=b27e74408d6011eeb387c3a257912180&vids=0&msclkid=N&gtm_tag_source=ua_e&gc=USD&tpp=1&ea=page-ready&en=Y&p=https%3A%2F%2Fwww.firstleaf.com%2Frefer&sw=1600&sh=1200&sc=24&evt=custom&rn=110535
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 27 Nov 2023 20:08:15 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: BD122BE27ABB407294691CBC2BD3F7CE Ref B: FRA31EDGE0611 Ref C: 2023-11-27T20:08:15Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
app_store.webp
www.firstleaf.com/static/0c1319a5c4fac32586a58822c813ff66/b5934/
4 KB
4 KB
Image
General
Full URL
https://www.firstleaf.com/static/0c1319a5c4fac32586a58822c813ff66/b5934/app_store.webp
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fefb5d7f9dba1b2071b036cd9893bc809f1d8701dcfbcfc0e1adb95bf96b1785

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
via
1.1 8428d3ca0a47cd247ba9c371c08ccb6a.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
AMS58-P3
age
1213619
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
3736
last-modified
Mon, 12 Jun 2023 21:04:27 GMT
server
cloudflare
etag
"bb8569255542e6bf30a0a2b246563788"
vary
Accept-Encoding
content-type
image/webp
cache-control
public, max-age=31536000, immutable
accept-ranges
bytes
cf-ray
82cd0088f92f65ac-FRA
x-amz-cf-id
JLqzfH93M31YpAbzC8C-73jBNs5vo68StboymsqcHDXENM7hcz-Sfw==
google_play.webp
www.firstleaf.com/static/643138a8cf22e49297e7f623d0b627d0/08bd6/
8 KB
8 KB
Image
General
Full URL
https://www.firstleaf.com/static/643138a8cf22e49297e7f623d0b627d0/08bd6/google_play.webp
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d52d4524b6e0555d1de9842f1d22827ef845ddc5b3b5d78e0bb9c4288961096

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
via
1.1 df9ce120cad525bdb160f75cd7b807c2.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
ZRH55-P1
age
1376374
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
8450
last-modified
Mon, 12 Jun 2023 21:04:27 GMT
server
cloudflare
etag
"f5b84a3f47828ecf485e565d5d229972"
vary
Accept-Encoding
content-type
image/webp
cache-control
public, max-age=31536000, immutable
accept-ranges
bytes
cf-ray
82cd0088f93165ac-FRA
x-amz-cf-id
yU5jTFdgCMlbtE30I_Tpf2JVk7RYuOqd96Mn8miBW7nEQVp2qrVPnw==
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/n1a03/0x4AAAAAAAAughvt52C3nbMf/light/ Frame BC6D
0
0
Document
General
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/n1a03/0x4AAAAAAAAughvt52C3nbMf/light/normal
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onTurnstileLoad
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'

Request headers

Referer
https://www.firstleaf.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
82cd00894f7a18de-FRA
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Mon, 27 Nov 2023 20:08:15 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare
pipeline
ct.firstleaf.com/prh/ Frame
0
0
Preflight
General
Full URL
https://ct.firstleaf.com/prh/pipeline
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3e65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.firstleaf.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type, SP-Anonymous
access-control-allow-origin
https://www.firstleaf.com
access-control-max-age
600
cf-cache-status
DYNAMIC
cf-ray
82cd00899e1035e2-FRA
content-length
0
date
Mon, 27 Nov 2023 20:08:16 GMT
server
cloudflare
pipeline
ct.firstleaf.com/prh/
2 B
316 B
XHR
General
Full URL
https://ct.firstleaf.com/prh/pipeline
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
application/json; charset=UTF-8

Response headers

date
Mon, 27 Nov 2023 20:08:16 GMT
cf-cache-status
DYNAMIC
server
cloudflare
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.firstleaf.com
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
access-control-allow-credentials
true
cf-ray
82cd008caef265ac-FRA
content-length
2
/
sentry.io/api/1397651/envelope/
2 B
57 B
Fetch
General
Full URL
https://sentry.io/api/1397651/envelope/?sentry_key=ff909656e90d411f9069253f654c00ac&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.26.0
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.247.156 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
156.247.186.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
text/plain;charset=UTF-8

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
server
nginx
vary
origin,access-control-request-method,access-control-request-headers
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
/
sentry.io/api/1397651/envelope/
41 B
99 B
Fetch
General
Full URL
https://sentry.io/api/1397651/envelope/?sentry_key=ff909656e90d411f9069253f654c00ac&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.26.0
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.247.156 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
156.247.186.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
b555a629b6d5ab7a5bf47b53152316ca69cbb7f4f071416d2ba3da25df747826
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
text/plain;charset=UTF-8

Response headers

date
Mon, 27 Nov 2023 20:08:15 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
server
nginx
vary
origin,access-control-request-method,access-control-request-headers
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
41
v2
rs.fullstory.com/rec/bundle/
29 B
91 B
XHR
General
Full URL
https://rs.fullstory.com/rec/bundle/v2?OrgId=134SPF&UserId=1e8d16d8-3d0d-4c94-aa59-74e923a3934e&SessionId=bb0c4906-022c-45a8-b78a-e3192b287fc0&PageId=2155f291-cd64-4c6d-b612-5c4cf70e6871&Seq=1&PageStart=1701115694990&PrevBundleTime=0&LastActivity=511&IsNewSession=true
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.194.186.35.bc.googleusercontent.com
Software
/
Resource Hash
6226b929ae8529e375e6b444b960a464e74828592fbc140bf5f7a1e11740c1b3

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.firstleaf.com
date
Mon, 27 Nov 2023 20:08:16 GMT
via
1.1 google
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29
content-type
application/json; charset=utf-8
R748319934.json
api.firstleaf.com/api/v2/cart/
919 B
476 B
XHR
General
Full URL
https://api.firstleaf.com/api/v2/cart/R748319934.json?order_token=aS188ylLeBUQfSdCqLg0bg
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3e65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
809d0584362a8afc19641b28a2b61619d994261436522749705fd9e41f9729ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
d54890c5-776b-4fa3-a260-448628dbbe29
x-runtime
0.050001
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"809d0584362a8afc19641b28a2b61619"
x-download-options
noopen
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET, POST, PATCH, PUT, OPTIONS, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.firstleaf.com
access-control-expose-headers
DNT,Keep-Alive,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control
max-age=0, private, must-revalidate
cf-ray
82cd008caaa835e2-FRA
access-control-allow-headers
DNT,Keep-Alive,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7ba93f0c1f5b72395ea5024e97ba149d96cffbe73e8e4a2546921ba3404f146c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
image/svg+xml
ship_to_info.json
api.firstleaf.com/api/
14 B
163 B
XHR
General
Full URL
https://api.firstleaf.com/api/ship_to_info.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3e65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aca66b739fcde148403f4735fd9091fbc02455deb4e6c186ea52cb71692f6269
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
93c8e26e-04c8-4bd5-8e52-a2d6e5b02699
x-runtime
0.009837
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"aca66b739fcde148403f4735fd9091fb"
x-download-options
noopen
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET, POST, PATCH, PUT, OPTIONS, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.firstleaf.com
access-control-expose-headers
DNT,Keep-Alive,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control
max-age=0, private, must-revalidate
cf-ray
82cd008ddcf935e2-FRA
access-control-allow-headers
DNT,Keep-Alive,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
getuidj
ib.adnxs.com/
11 B
577 B
Fetch
General
Full URL
https://ib.adnxs.com/getuidj
Requested by
Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:16 GMT
an-x-request-uuid
db13f416-5d93-4227-b463-a136b1663dbb
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.firstleaf.com
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
138.199.38.132; 138.199.38.132; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
11
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
p
i.simpli.fi/
798 B
762 B
Script
General
Full URL
https://i.simpli.fi/p?cid=449212&cb=sifi_att_42656._hp
Requested by
Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/4f1bd082-d454-42cb-bafd-026640e9800e
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.204.89.238 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
238.89.204.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
59f2488b9df7d5f990cdf01dfe668b4d6068e342815b9aa004982a2a18fc06a4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:17 GMT
content-encoding
gzip
server
openresty
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
expires
Thu, 01 Jan 1970 00:00:00 GMT
m-outer-27c67c0d52761104439bb051c7856ab1.html
js.stripe.com/v3/ Frame 89D8
200 B
1 KB
Document
General
Full URL
https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.239.18.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-239-18-104.ams58.r.cloudfront.net
Software
Cloudfront /
Resource Hash
351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.firstleaf.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
3132
cache-control
max-age=31536000
content-length
200
content-security-policy
base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only
base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Mon, 27 Nov 2023 19:41:08 GMT
etag
"27c67c0d52761104439bb051c7856ab1"
last-modified
Fri, 10 Nov 2023 21:04:42 GMT
server
Cloudfront
strict-transport-security
max-age=31556926; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
via
1.1 34dde22d7e4e8bb757cb687a7932a122.cloudfront.net (CloudFront)
x-amz-cf-id
CPLVzCGWCtk79qR6I1dWDBjuqqufxd8ssgEBmicxn0xOv1wZmWalOA==
x-amz-cf-pop
AMS58-P6
x-cache
Hit from cloudfront
x-content-type-options
nosniff
params
shop.pe/widget/main/init/
260 B
744 B
Script
General
Full URL
https://shop.pe/widget/main/init/params?siteid=62725feabbf6c339ae0dfd75&product=Firstleaf%3A%20Refer%20a%20Friend&product_url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&image=&price=&currency=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&callback=AddShoppersWidget.load_widget&no_cookie_callback=AddShoppersWidget.load_no_cookie&rand=18184&cookie=&referer=
Requested by
Host: d2mjzob2nc713b.cloudfront.net
URL: https://d2mjzob2nc713b.cloudfront.net/widget/widget.js?v=b1788c7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.1 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.244.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ec95de79d79259d46fa5520928852ab57deda8a3d393857781271daa099b193c
Security Headers
Name Value
Content-Security-Policy frame-ancestors none;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
content-security-policy
frame-ancestors none;
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 google
p3p
policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
backend-version
47
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
data-regulation-gdpr-enforced
true
referrer-policy
no-referrer-when-downgrade
server
nginx
etag
W/"67f32401c7cc626ffac27a846aa788b6f8475f6c"
x-frame-options
deny
access-control-allow-methods
POST, GET, OPTIONS, DELETE, PATCH
content-type
text/javascript
access-control-allow-origin
https://my.addshoppers.com
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, Content-Type, X-XSRFToken
rum
www.firstleaf.com/cdn-cgi/
0
160 B
XHR
General
Full URL
https://www.firstleaf.com/cdn-cgi/rum?
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.firstleaf.com/refer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
content-type
application/json

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
x-content-type-options
nosniff
server
cloudflare
vary
Origin
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
https://www.firstleaf.com
x-frame-options
DENY
access-control-allow-credentials
true
cf-ray
82cd00924f7c65ac-FRA
up
insight.adsrvr.org/track/ Frame 19F9
0
60 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=l7cyjy0&ref=https%3A%2F%2Fwww.firstleaf.com%2Frefer&upid=hm2fj8w&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.firstleaf.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language
de-DE,de;q=0.9

Response headers

content-length
0
content-type
text/html
date
Mon, 27 Nov 2023 20:08:17 GMT
server
Kestrel
csp-report
q.stripe.com/ Frame 89D8
0
715 B
Other
General
Full URL
https://q.stripe.com/csp-report
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-186-23-98.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
application/csp-report

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1701115697450400
x-envoy-upstream-service-time
3
content-length
0
x-stripe-bg-intended-route-color
blue
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms
1
access-control-allow-origin
https://js.stripe.com
x-stripe-client-envoy-start-time-us
1701115697449693
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers
Server, Range, Content-Type
x-robots-tag
none
access-control-allow-headers
Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires
0
csp-report
q.stripe.com/ Frame 89D8
0
716 B
Other
General
Full URL
https://q.stripe.com/csp-report
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-186-23-98.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
application/csp-report

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1701115697450558
x-envoy-upstream-service-time
2
content-length
0
x-stripe-bg-intended-route-color
blue
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms
1
access-control-allow-origin
https://js.stripe.com
x-stripe-client-envoy-start-time-us
1701115697449730
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers
Server, Range, Content-Type
x-robots-tag
none
access-control-allow-headers
Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires
0
m-outer-6576085ca35ee42f2f484cda6763e4aa.js
js.stripe.com/v3/fingerprinted/js/ Frame 89D8
631 B
1 KB
Script
General
Full URL
https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.239.18.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-239-18-104.ams58.r.cloudfront.net
Software
Cloudfront /
Resource Hash
f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 19:12:20 GMT
via
1.1 34dde22d7e4e8bb757cb687a7932a122.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31556926; includeSubDomains; preload
age
3358
x-amz-cf-pop
AMS58-P6
x-cache
Hit from cloudfront
content-length
631
last-modified
Fri, 17 Nov 2023 21:03:17 GMT
server
Cloudfront
etag
"70cacf09ae81711ac6dcbc5ee59750c4"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
ruRDPFvcz3jbE_cGv9R0FoAi6Ql-mpVfmK4RQ_ATh6QSj7_07DwU5A==
/
s.ad.smaato.net/c/
Redirect Chain
  • https://um.simpli.fi/smaato
  • https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=241BB05AC6874DE49A9D79E2E1245205
0
237 B
Image
General
Full URL
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=241BB05AC6874DE49A9D79E2E1245205
Protocol
H2
Server
2600:9000:243d:6c00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
CloudFront /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
cache-control
no-cache, must-revalidate
via
1.1 d80c34bef63175e408b52241ca38d75e.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
DUS51-P4
x-amz-cf-id
E09NK83rMmzzI14UDqsDaXcRIxI_2ytnrqsnoYIxEPP3TB-F25TqgQ==
x-cache
Miss from cloudfront

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=241BB05AC6874DE49A9D79E2E1245205
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
RX-6a347dbc-0a66-44c0-bc2b-9ca158ae9b7f-003
sync.targeting.unrulymedia.com/csync/
Redirect Chain
  • https://um.simpli.fi/nexxen
  • https://sync.1rx.io/usersync/simplifi/241BB05AC6874DE49A9D79E2E1245205
  • https://sync.1rx.io/usersync/simplifi/241BB05AC6874DE49A9D79E2E1245205?zcc=1&cb=1701115697129
  • https://sync.targeting.unrulymedia.com/csync/RX-6a347dbc-0a66-44c0-bc2b-9ca158ae9b7f-003
43 B
378 B
Image
General
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-6a347dbc-0a66-44c0-bc2b-9ca158ae9b7f-003
Protocol
H2
Server
46.228.174.117 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
content-length
43
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location
https://sync.targeting.unrulymedia.com/csync/RX-6a347dbc-0a66-44c0-bc2b-9ca158ae9b7f-003
pragma
no-cache
date
Mon, 27 Nov 2023 20:08:17 GMT
cache-control
no-store, no-cache, must-revalidate
expires
0
content-type
text/html
xuid
eb2.3lift.com/
Redirect Chain
  • https://um.simpli.fi/triplelift
  • https://eb2.3lift.com/xuid?mid=7969&xuid=241BB05AC6874DE49A9D79E2E1245205&dongle=yf3
37 B
140 B
Image
General
Full URL
https://eb2.3lift.com/xuid?mid=7969&xuid=241BB05AC6874DE49A9D79E2E1245205&dongle=yf3
Protocol
H2
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://eb2.3lift.com/xuid?mid=7969&xuid=241BB05AC6874DE49A9D79E2E1245205&dongle=yf3
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
sync
simplifi.partners.tremorhub.com/
Redirect Chain
  • https://um.simpli.fi/telaria_p
  • https://simplifi.partners.tremorhub.com/sync?UISF=241BB05AC6874DE49A9D79E2E1245205
43 B
175 B
Image
General
Full URL
https://simplifi.partners.tremorhub.com/sync?UISF=241BB05AC6874DE49A9D79E2E1245205
Protocol
H2
Server
2600:1f18:612b:4216:7574:b4b8:a72d:d165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Mon, 27 Nov 2023 20:08:17 GMT
server
nginx
content-type
image/gif

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://simplifi.partners.tremorhub.com/sync?UISF=241BB05AC6874DE49A9D79E2E1245205
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain
  • https://um.simpli.fi/tapad
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=241BB05AC6874DE49A9D79E2E1245205
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=241BB05AC6874DE49A9D79E2E1245205
95 B
436 B
Image
General
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=241BB05AC6874DE49A9D79E2E1245205
Protocol
H2
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
Jetty(11.0.13) /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=241BB05AC6874DE49A9D79E2E1245205
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
empty.gif
um.simpli.fi/
Redirect Chain
  • https://um.simpli.fi/ad_advisor
  • https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=241BB05AC6874DE49A9D79E2E1245205
  • https://d.agkn.com/pixel/10751/?che=1701115697133&ip=138.199.38.132&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D217323104713005114337
  • https://um.simpli.fi/aa_px?sk=217323104713005114337
  • https://um.simpli.fi/empty.gif
43 B
361 B
Image
General
Full URL
https://um.simpli.fi/empty.gif
Protocol
H2
Server
35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
118.74.204.35.bc.googleusercontent.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
/empty.gif
access-control-allow-origin
*
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain
  • https://um.simpli.fi/intentiq
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=241BB05AC6874DE49A9D79E2E1245205
0
0
Image
General
Full URL
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=241BB05AC6874DE49A9D79E2E1245205
Protocol
H2
Server
18.239.69.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-239-69-109.ams58.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=241BB05AC6874DE49A9D79E2E1245205
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
pubmatic
um.simpli.fi/
43 B
409 B
Image
General
Full URL
https://um.simpli.fi/pubmatic
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
118.74.204.35.bc.googleusercontent.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Sun, 26 Nov 2023 20:08:17 GMT
freewheel
um.simpli.fi/
43 B
409 B
Image
General
Full URL
https://um.simpli.fi/freewheel
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
118.74.204.35.bc.googleusercontent.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Sun, 26 Nov 2023 20:08:17 GMT
engine
pbid.pro-market.net/
Redirect Chain
  • https://um.simpli.fi/dtnx
  • https://fei.pro-market.net/engine?du=24;csync=241BB05AC6874DE49A9D79E2E1245205;mimetype=img;
  • https://fei.pro-market.net/engine?du=24;csync=241BB05AC6874DE49A9D79E2E1245205;mimetype=img;sr
  • https://cm.g.doubleclick.net/pixel?google_nid=datonics-ddp&google_cm&google_hm=LTI0MjQ5NjE5ODA4MTkwOTQ1NTA=
  • https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEDMHnJ75rLCldNmF3JWJ8BE&google_cver=1
43 B
390 B
Image
General
Full URL
https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEDMHnJ75rLCldNmF3JWJ8BE&google_cver=1
Protocol
H2
Server
2600:1901:0:8eee:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:16 GMT
via
1.1 google
server
Apache-Coyote/1.1
anserver
gapp-eu-5.c.datonics-gcp-01.internal
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
access-control-allow-origin
*
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
content-length
43
expires
Mon, 1 Jan 1990 0:0:0 GMT

Redirect headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:17 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEDMHnJ75rLCldNmF3JWJ8BE&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
315
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
loadm.exelator.com/load/
Redirect Chain
  • https://um.simpli.fi/exelatem
  • https://loadm.exelator.com/load/?p=204&g=2191&simid=241BB05AC6874DE49A9D79E2E1245205&j=0
  • https://loadm.exelator.com/load/?p=204&g=2191&simid=241BB05AC6874DE49A9D79E2E1245205&j=0&xl8blockcheck=1
0
759 B
Image
General
Full URL
https://loadm.exelator.com/load/?p=204&g=2191&simid=241BB05AC6874DE49A9D79E2E1245205&j=0&xl8blockcheck=1
Protocol
H2
Server
18.198.126.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-198-126-47.eu-central-1.compute.amazonaws.com
Software
nginx / Undertow/1
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location
https://loadm.exelator.com/load/?p=204&g=2191&simid=241BB05AC6874DE49A9D79E2E1245205&j=0&xl8blockcheck=1
content-type
image/gif
cache-control
no-cache
access-control-allow-credentials
true
content-length
0
yahoo
um.simpli.fi/
43 B
409 B
Image
General
Full URL
https://um.simpli.fi/yahoo
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
118.74.204.35.bc.googleusercontent.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Sun, 26 Nov 2023 20:08:17 GMT
sync
sync.bfmio.com/
Redirect Chain
  • https://um.simpli.fi/beachfront
  • https://sync.bfmio.com/sync?pid=141&uid=241BB05AC6874DE49A9D79E2E1245205
0
329 B
Image
General
Full URL
https://sync.bfmio.com/sync?pid=141&uid=241BB05AC6874DE49A9D79E2E1245205
Protocol
HTTP/1.1
Server
52.5.176.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-5-176-145.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Connection
keep-alive
Date
Mon, 27 Nov 2023 20:08:17 GMT

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://sync.bfmio.com/sync?pid=141&uid=241BB05AC6874DE49A9D79E2E1245205
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
29931
stags.bluekai.com/site/
Redirect Chain
  • https://um.simpli.fi/bluekai
  • https://stags.bluekai.com/site/29931?id=241BB05AC6874DE49A9D79E2E1245205
62 B
444 B
Image
General
Full URL
https://stags.bluekai.com/site/29931?id=241BB05AC6874DE49A9D79E2E1245205
Protocol
H2
Server
69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a69-192-160-219.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date
Mon, 27 Nov 2023 20:08:17 GMT
content-length
62
content-type
image/gif

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://stags.bluekai.com/site/29931?id=241BB05AC6874DE49A9D79E2E1245205
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
tpid=241BB05AC6874DE49A9D79E2E1245205
bcp.crwdcntrl.net/map/c=7625/tp=SIMP/
Redirect Chain
  • https://um.simpli.fi/crwdcntrl
  • https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=241BB05AC6874DE49A9D79E2E1245205
49 B
265 B
Image
General
Full URL
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=241BB05AC6874DE49A9D79E2E1245205
Protocol
H2
Server
34.241.138.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-241-138-233.eu-west-1.compute.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:17 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.45.25.71
content-length
49
expires
0

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=241BB05AC6874DE49A9D79E2E1245205
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
merge
ce.lijit.com/
Redirect Chain
  • https://um.simpli.fi/lj_match
  • https://ce.lijit.com/merge?pid=2&3pid=241BB05AC6874DE49A9D79E2E1245205
0
311 B
Image
General
Full URL
https://ce.lijit.com/merge?pid=2&3pid=241BB05AC6874DE49A9D79E2E1245205
Protocol
HTTP/1.1
Server
216.52.2.30 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Expires
Fri, 20 Mar 2009 00:00:00 GMT
Pragma
no-cache
Date
Mon, 27 Nov 2023 20:08:17 GMT
X-MERGE
GDPR Optout true
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap6ams1
P3P
CP="CUR ADM OUR NOR STA NID"

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://ce.lijit.com/merge?pid=2&3pid=241BB05AC6874DE49A9D79E2E1245205
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
419566.gif
idsync.rlcdn.com/
Redirect Chain
  • https://um.simpli.fi/liveramp_match
  • https://idsync.rlcdn.com/419566.gif?partner_uid=241BB05AC6874DE49A9D79E2E1245205
0
98 B
Image
General
Full URL
https://idsync.rlcdn.com/419566.gif?partner_uid=241BB05AC6874DE49A9D79E2E1245205
Protocol
H2
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://idsync.rlcdn.com/419566.gif?partner_uid=241BB05AC6874DE49A9D79E2E1245205
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
/
www.google.de/pagead/1p-conversion/1026675585/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1026675585/?random=1701115697003&cv=7&fst=1701115697003&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1161528875&cv=7&fst=1701115697003&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&ocp_id=...
  • https://www.google.com/pagead/1p-conversion/1026675585/?random=1161528875&cv=7&fst=1701115697003&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1vPg5...
  • https://www.google.de/pagead/1p-conversion/1026675585/?random=1161528875&cv=7&fst=1701115697003&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1vPg5v...
42 B
455 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/1026675585/?random=1161528875&cv=7&fst=1701115697003&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1vPg5v3kggMVvpX9Bx36TQcE&is_vtc=1&ocp_id=MfdkZZaXA76r9u8P-pudIA&cid=CAQSGwDICaaNsxQDhnovkZNnzDl_Tm1cMPvOHNwCKQ&random=3761023982&ipr=y
Protocol
H2
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:17 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:17 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.de/pagead/1p-conversion/1026675585/?random=1161528875&cv=7&fst=1701115697003&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1vPg5v3kggMVvpX9Bx36TQcE&is_vtc=1&ocp_id=MfdkZZaXA76r9u8P-pudIA&cid=CAQSGwDICaaNsxQDhnovkZNnzDl_Tm1cMPvOHNwCKQ&random=3761023982&ipr=y
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
spotx_match
um.simpli.fi/
0
272 B
Image
General
Full URL
https://um.simpli.fi/spotx_match
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
118.74.204.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

access-control-allow-origin
*
date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
bounce
ib.adnxs.com/
Redirect Chain
  • https://um.simpli.fi/an
  • https://ib.adnxs.com/setuid?entity=66&code=241BB05AC6874DE49A9D79E2E1245205
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D241BB05AC6874DE49A9D79E2E1245205
43 B
893 B
Image
General
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D241BB05AC6874DE49A9D79E2E1245205
Protocol
H2
Server
185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:17 GMT
an-x-request-uuid
61a253cd-d76c-403f-b49c-e4396954a551
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
image/gif
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
138.199.38.132; 138.199.38.132; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
43
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:17 GMT
an-x-request-uuid
e6e271d4-3c81-405c-aab9-af739a20a334
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D241BB05AC6874DE49A9D79E2E1245205
cache-control
no-store, no-cache, private
x-proxy-origin
138.199.38.132; 138.199.38.132; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://um.simpli.fi/rb_match
  • https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=241BB05AC6874DE49A9D79E2E1245205&expires=365
0
239 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=241BB05AC6874DE49A9D79E2E1245205&expires=365
Protocol
HTTP/1.1
Server
69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
611afce88997db6fdd35eb213e662871
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=241BB05AC6874DE49A9D79E2E1245205&expires=365
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://um.simpli.fi/ox_match
  • https://us-u.openx.net/w/1.0/sd?id=537072966&val=241BB05AC6874DE49A9D79E2E1245205
43 B
273 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072966&val=241BB05AC6874DE49A9D79E2E1245205
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:17 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://us-u.openx.net/w/1.0/sd?id=537072966&val=241BB05AC6874DE49A9D79E2E1245205
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Sun, 26 Nov 2023 20:08:17 GMT
g_match
um.simpli.fi/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm=&google_sc=&google_tc=
  • https://um.simpli.fi/g_match?id=&google_gid=CAESEA85cKH5qKQ_dpWntiIA_B4&google_cver=1
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=241BB05AC6874DE49A9D79E2E1245205
  • https://um.simpli.fi/g_match?id=
0
320 B
Image
General
Full URL
https://um.simpli.fi/g_match?id=
Protocol
H2
Server
35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
118.74.204.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sun, 26 Nov 2023 20:08:17 GMT

Redirect headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:17 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://um.simpli.fi/g_match?id=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
229
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
inner.html
m.stripe.network/ Frame BC28
930 B
1 KB
Document
General
Full URL
https://m.stripe.network/inner.html
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.64.176 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Fastly /
Resource Hash
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
232
cache-control
max-age=300, public
content-encoding
br
content-length
540
content-security-policy
base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Mon, 27 Nov 2023 20:08:17 GMT
server
Fastly
strict-transport-security
max-age=31556926; includeSubDomains; preload
vary
Accept-Encoding, Origin
via
1.1 varnish
x-cache
HIT
x-cache-hits
218
x-content-type-options
nosniff
x-request-id
330b9c09-22fa-4937-8405-d8ed01f72d16
x-served-by
cache-fra-eddf8230090-FRA
x-timer
S1701115697.068184,VS0,VE0
csp-report
q.stripe.com/ Frame BC28
0
491 B
Other
General
Full URL
https://q.stripe.com/csp-report
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/refer
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-186-23-98.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://m.stripe.network/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
application/csp-report

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1701115697450149
x-envoy-upstream-service-time
1
content-length
0
x-stripe-bg-intended-route-color
blue
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
x-stripe-server-envoy-upstream-service-time-ms
0
x-stripe-client-envoy-start-time-us
1701115697449751
cache-control
max-age=0, no-cache, no-store, must-revalidate
x-robots-tag
none
expires
0
out-4.5.43.js
m.stripe.network/ Frame BC28
87 KB
15 KB
Script
General
Full URL
https://m.stripe.network/out-4.5.43.js
Requested by
Host: m.stripe.network
URL: https://m.stripe.network/inner.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.64.176 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Fastly /
Resource Hash
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://m.stripe.network/inner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
date
Mon, 27 Nov 2023 20:08:17 GMT
x-content-type-options
nosniff
content-encoding
br
via
1.1 varnish
age
167
x-cache
HIT
content-length
15509
x-request-id
2e67d3e8-7838-4103-b59d-9d7dfb4960b5
x-served-by
cache-fra-eddf8230090-FRA
server
Fastly
x-timer
S1701115697.078182,VS0,VE0
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=utf-8
cache-control
max-age=300, public
accept-ranges
bytes
x-cache-hits
153
6
m.stripe.com/ Frame BC28
156 B
669 B
XHR
General
Full URL
https://m.stripe.com/6
Requested by
Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.111.159 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-111-159.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
6bfd21c277b587b22f14eb92cc8f83987d584b151f900bff0ca2948a31946ff5
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://m.stripe.network/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color
green
date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1701115697568611
server
nginx
content-type
application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms
3
access-control-allow-origin
https://m.stripe.network
x-stripe-client-envoy-start-time-us
1701115697568295
access-control-allow-credentials
true
access-control-allow-headers
Content-Type
content-length
156
params
shop.pe/widget/main/init/
1 KB
658 B
Script
General
Full URL
https://shop.pe/widget/main/init/params?siteid=62725feabbf6c339ae0dfd75&product=Firstleaf%3A%20Refer%20a%20Friend&product_url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&image=&price=&currency=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&callback=AddShoppersWidget.load_widget&rand=73110&cookie=2%7C1%3A0%7C10%3A1701115697%7C15%3Aaddshoppers.com%7C44%3AMGFmMmQzMzc4YzgzNDRiOThiOTI5MzcyM2FhNGY4ODk%3D%7C0164b25631e3156c90a6003e9f7502add1e96af7f508e10da1113dbb5c719b5b&referer=
Requested by
Host: d2mjzob2nc713b.cloudfront.net
URL: https://d2mjzob2nc713b.cloudfront.net/widget/widget.js?v=b1788c7
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.227.244.1 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.244.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
b09e8762d91058fa49494a1b1e7ebdd18f76e7b15f3e3f7c32fec949c8b5e7e4
Security Headers
Name Value
Content-Security-Policy frame-ancestors none;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
content-security-policy
frame-ancestors none;
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 google
p3p
policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
backend-version
47
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
data-regulation-gdpr-enforced
true
referrer-policy
no-referrer-when-downgrade
server
nginx
etag
W/"30563d3a00adb05502e925233ab0caef248d42a4"
x-frame-options
deny
access-control-allow-methods
POST, GET, OPTIONS, DELETE, PATCH
content-type
text/javascript
access-control-allow-origin
https://my.addshoppers.com
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, Content-Type, X-XSRFToken
ba5cd1e2255e4f75a0ae1c1cd34f0620.js
addshoppers.s3.amazonaws.com/customize/62725feabbf6c339ae0dfd75/
12 KB
3 KB
Script
General
Full URL
https://addshoppers.s3.amazonaws.com/customize/62725feabbf6c339ae0dfd75/ba5cd1e2255e4f75a0ae1c1cd34f0620.js?_t=1700213485
Requested by
Host: d2mjzob2nc713b.cloudfront.net
URL: https://d2mjzob2nc713b.cloudfront.net/widget/widget.js?v=b1788c7
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.135.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
b932e2d6a3930cea2d5303d7badb47e4d7f735fe0f5d09231cf5d5199a1d992f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:18 GMT
Content-Encoding
gzip
x-amz-version-id
DlAMMWKDtdU1.o6s1Bt_YlezKjuSavIr
Last-Modified
Fri, 17 Nov 2023 09:31:26 GMT
Server
AmazonS3
x-amz-request-id
DVJ6V49YXST1AEXY
ETag
"d3e7d399af3f8146792d505cb2f26d0e"
x-amz-server-side-encryption
AES256
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=2592000, public
Accept-Ranges
bytes
Content-Length
2143
x-amz-id-2
wWjiaePcUjjjoqj4LjSZN/BMlCUp+onJbsbZiCsxL1czBdD2YMcBZqUsZTTIcrAm+251ByH6KH0=
input.js
shopper.shop.pe/
26 KB
9 KB
Script
General
Full URL
https://shopper.shop.pe/input.js
Requested by
Host: shop.pe
URL: https://shop.pe/widget/widget_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.54.17 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
17.54.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
eaef61a693bec2483439247f48dd8def6558804ed706f02ae6a346f32b80a92c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 17:53:55 GMT
content-encoding
gzip
age
8062
x-guploader-uploadid
ABPtcPpcIlgguiklRRb_sNg-oLqbewyxS6Zot1R3K1ZqvtSi3n6E7jljXJlDmeiA7uAq4Ww6HNg
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8792
last-modified
Fri, 20 Oct 2023 20:23:22 GMT
server
UploadServer
etag
"c2fb6547f7ca4184ed1f192012cca195"
vary
Accept-Encoding
x-goog-generation
1697833401935127
x-goog-hash
crc32c=pxoFVg==, md5=wvtlR/fKQYTtHxkgEsyhlQ==
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public, max-age=14400
x-goog-stored-content-length
8792
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
expires
Mon, 27 Nov 2023 21:53:55 GMT
status
app.shop.pe/app/datapartners/
34 B
509 B
XHR
General
Full URL
https://app.shop.pe/app/datapartners/status?usersite_id=62725feabbf6c339ae0dfd75
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.1 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.244.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
b4435b5ac2f1916ed1135fb1738a1cef87cb666f4356a6678fb1c77e1273f9e1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
via
1.1 google
server
nginx
etag
W/"0467ba22658b680d6de72dc567071b5bc495547f"
x-frame-options
deny
access-control-allow-methods
POST, GET, OPTIONS, DELETE, PATCH
p3p
policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
access-control-allow-origin
*
content-type
application/json; charset=UTF-8
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, Content-Type, X-XSRFToken
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
consent
manage.safeopt.com/
0
833 B
XHR
General
Full URL
https://manage.safeopt.com/consent
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.1 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.244.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 google
p3p
policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
data-regulation-gdpr-enforced
true
server
nginx
etag
"da39a3ee5e6b4b0d3255bfef95601890afd80709"
x-frame-options
deny
access-control-allow-methods
HEAD, GET, POST
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
Data-Regulation-Gdpr-Enforced
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, Content-Type, Data-Regulation-Gdpr-Enforced
update
app.cybba.solutions/event/2856/
79 B
442 B
Script
General
Full URL
https://app.cybba.solutions/event/2856/update?data=%7B%22userId%22%3A%223555918542269482%22%2C%22type%22%3A%22update%22%2C%22lastVisitDate%22%3A1701115694845%2C%22device%22%3A%22desktop%22%7D&callback=_vtsdk.eventApi.callbackEvent&_bqstore=0&_ts=5734512
Requested by
Host: files1.cybba.solutions
URL: https://files1.cybba.solutions/2856/loader.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
138.197.61.175 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx, nginx /
Resource Hash
7ff4f326a701b935db6fa9bb8b44ca58f6c5646ce9ceecd6e393bae47bd70ab1
Security Headers
Name Value
Strict-Transport-Security max-age=3600
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:17 GMT
Strict-Transport-Security
max-age=3600
Server
nginx, nginx
X-Frame-Options
deny
Content-Type
text/javascript;; charset=utf-8
Cache-Control
no-cache
Connection
close
X-Robots-Tag
noindex
Content-Length
79
x-process-time
0.0005772113800048828
Expires
Mon, 27 Nov 2023 20:08:16 GMT
iframe
nytrng.com/ Frame 30BE
0
0

triggered_email_attribution
app.shop.pe/app/ Frame
0
0
Preflight
General
Full URL
https://app.shop.pe/app/triggered_email_attribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.1 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.244.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options deny

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.firstleaf.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, Content-Type, X-XSRFToken
access-control-allow-methods
POST, GET, OPTIONS, DELETE, PATCH
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 27 Nov 2023 20:08:17 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 google
x-frame-options
deny
triggered_email_attribution
app.shop.pe/app/
29 B
69 B
XHR
General
Full URL
https://app.shop.pe/app/triggered_email_attribution
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.227.244.1 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.244.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
85ad9c4586b439a1f2ce5516c218bed3c64110ac93bb7c916894240392503053
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options deny

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
application/json

Response headers

date
Mon, 27 Nov 2023 20:08:17 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
via
1.1 google
server
nginx
x-frame-options
deny
access-control-allow-methods
POST, GET, OPTIONS, DELETE, PATCH
p3p
policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
access-control-allow-origin
*
content-type
application/json; charset=UTF-8
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, Content-Type, X-XSRFToken
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
generic
app.cybba.solutions/event/2856/
79 B
442 B
Script
General
Full URL
https://app.cybba.solutions/event/2856/generic?data=%7B%22userId%22%3A%223555918542269482%22%2C%22type%22%3A%22generic%22%2C%22generic%22%3A%7B%22event_name%22%3A%22zandruid%22%2C%22itemId%22%3A%220%22%7D%2C%22device%22%3A%22desktop%22%7D&callback=_vtsdk.eventApi.callbackEvent&_ts=86449909
Requested by
Host: files1.cybba.solutions
URL: https://files1.cybba.solutions/2856/loader.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
138.197.61.175 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx, nginx /
Resource Hash
7ff4f326a701b935db6fa9bb8b44ca58f6c5646ce9ceecd6e393bae47bd70ab1
Security Headers
Name Value
Strict-Transport-Security max-age=3600
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:18 GMT
Strict-Transport-Security
max-age=3600
Server
nginx, nginx
X-Frame-Options
deny
Content-Type
text/javascript;; charset=utf-8
Cache-Control
no-cache
Connection
close
X-Robots-Tag
noindex
Content-Length
79
x-process-time
0.0008425712585449219
Expires
Mon, 27 Nov 2023 20:08:17 GMT
pageview
app.cybba.solutions/event/2856/
79 B
442 B
Script
General
Full URL
https://app.cybba.solutions/event/2856/pageview?data=%7B%22userId%22%3A%223555918542269482%22%2C%22type%22%3A%22pageview%22%2C%22url%22%3A%22https%3A%2F%2Fwww.firstleaf.com%2Frefer%22%2C%22generic%22%3A%7B%22itemId%22%3A%22DE%7CHesse%22%7D%2C%22device%22%3A%22desktop%22%7D&callback=_vtsdk.eventApi.callbackEvent&_ts=37508568
Requested by
Host: files1.cybba.solutions
URL: https://files1.cybba.solutions/2856/loader.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
138.197.61.175 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx, nginx /
Resource Hash
7ff4f326a701b935db6fa9bb8b44ca58f6c5646ce9ceecd6e393bae47bd70ab1
Security Headers
Name Value
Strict-Transport-Security max-age=3600
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date
Mon, 27 Nov 2023 20:08:18 GMT
Strict-Transport-Security
max-age=3600
Server
nginx, nginx
X-Frame-Options
deny
Content-Type
text/javascript;; charset=utf-8
Cache-Control
no-cache
Connection
close
X-Robots-Tag
noindex
Content-Length
79
x-process-time
0.0006422996520996094
Expires
Mon, 27 Nov 2023 20:08:17 GMT
page-data.json
www.firstleaf.com/page-data/store/
0
94 KB
Other
General
Full URL
https://www.firstleaf.com/page-data/store/page-data.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/app-5cb68fc105c1e2902956.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.firstleaf.com/refer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:19 GMT
content-encoding
gzip
via
1.1 702b555619c53ec5f8f56dfeed61c334.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Mon, 27 Nov 2023 17:43:58 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"16a97f8da1826ff331ed972bfd5ed0a0"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd009c3e5c65ac-FRA
x-amz-cf-id
9eJk6sVn70yCZnzEi-CunlvjhXvo2TgkslIaSpaT2FlHMpyuQgufgw==
page-data.json
www.firstleaf.com/page-data/gifts/
0
694 B
Other
General
Full URL
https://www.firstleaf.com/page-data/gifts/page-data.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/app-5cb68fc105c1e2902956.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.firstleaf.com/refer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:19 GMT
content-encoding
gzip
via
1.1 64e65d847e47fbcbf4dc70bc1c185676.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Thu, 02 Nov 2023 13:04:48 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"327b0e4a89527cb30ac505b1c5d8305f"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd009c3e6165ac-FRA
x-amz-cf-id
A2FxaS1Bjhg2xuEDyDMwP3vpPPmk7aLRQY2gYvGPWsCUvVRykE8mtw==
page-data.json
www.firstleaf.com/page-data/accessibility/
0
546 B
Other
General
Full URL
https://www.firstleaf.com/page-data/accessibility/page-data.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/app-5cb68fc105c1e2902956.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.firstleaf.com/refer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:19 GMT
via
1.1 ecbb6ac82f8f6ff46460b69097d121ec.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Thu, 02 Nov 2023 13:04:47 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"be6636c2b28bac25d6d38ce028b16f74"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd009c3e6465ac-FRA
x-amz-cf-id
SRsZQSEmamzWRudXQyvQuLp5H2Tn_CNh2-YHv9KIVGMVkUz9FjqEFg==
page-data.json
www.firstleaf.com/page-data/quiz/
0
527 B
Other
General
Full URL
https://www.firstleaf.com/page-data/quiz/page-data.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/app-5cb68fc105c1e2902956.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.firstleaf.com/refer
Origin
https://www.firstleaf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:19 GMT
via
1.1 73ce513d12556804240bd1d312686daa.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Thu, 02 Nov 2023 13:04:48 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"d4549ab29f1701c70dd80ae788b88c0e"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd009c3e6865ac-FRA
x-amz-cf-id
ifUi9couL3BQcxR2NqPe9DmuHqaLgPh-fN4edWYzErHwv-u_ljovHQ==
page-data.json
www.firstleaf.com/page-data/accessibility/
488 B
470 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/accessibility/page-data.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ccc79e05c98f2716fae11e9500d35a8fc6c13d9146bb5758bbe12c3f922f258

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:19 GMT
via
1.1 704c8a207b209dd3861e2faa8d55cc08.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Thu, 02 Nov 2023 13:04:47 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"be6636c2b28bac25d6d38ce028b16f74"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd009eda3d65ac-FRA
x-amz-cf-id
J12SErA_cx60bm8V1DKNwNYfP-T2CmYnzN4-AfG_1lymrtKrD7G7Xg==
page-data.json
www.firstleaf.com/page-data/store/
667 KB
94 KB
XHR
General
Full URL
https://www.firstleaf.com/page-data/store/page-data.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1b7de306f62fd1672cacd7e196e2ca68d89706e1dc50a883c4ceba7a8e7abe80

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:19 GMT
content-encoding
gzip
via
1.1 c3919dfed58c39e6da91faec1344110c.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Mon, 27 Nov 2023 17:43:58 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"16a97f8da1826ff331ed972bfd5ed0a0"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd009eda4065ac-FRA
x-amz-cf-id
6IvlAQJYX5xmfTvMlgF-MCW2rgeHDtNG5UVESxJTe8PNc1PucJLdKw==
page-data.json
www.firstleaf.com/page-data/quiz/
483 B
478 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/quiz/page-data.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f9b91bc270628f5b5bc95b5882b70db32e5c45731c133c57720efefae11c6c2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:19 GMT
via
1.1 b038919df048ba1d1a170622840d275e.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Thu, 02 Nov 2023 13:04:48 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"d4549ab29f1701c70dd80ae788b88c0e"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd009eda4865ac-FRA
x-amz-cf-id
ABCNzaCG9_6sl9pJb2JMBqudAxPO0bQwm4hJNramIeGFGITJFCBDyw==
page-data.json
www.firstleaf.com/page-data/gifts/
1 KB
665 B
XHR
General
Full URL
https://www.firstleaf.com/page-data/gifts/page-data.json
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:989 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72e6cbb75b81d80051dc06834d41cfcb6e3a56e22eec45e830567a55a8336c2b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/refer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date
Mon, 27 Nov 2023 20:08:19 GMT
content-encoding
gzip
via
1.1 b6e86319773f95421e5e42f048890d7c.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
last-modified
Thu, 02 Nov 2023 13:04:48 GMT
server
cloudflare
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
etag
W/"327b0e4a89527cb30ac505b1c5d8305f"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/json
cache-control
public, max-age=0, must-revalidate
cf-ray
82cd009eea5865ac-FRA
x-amz-cf-id
7NK7ZUfUOokMCEuaGlmg61vGqnBf3GBgopkeyumeqIxXOiYBVvsngg==
landing
googleads.g.doubleclick.net/pagead/
Redirect Chain
  • https://www.google.com/pagead/landing?gcs=G111&gcd=11t1t1l1l5&rnd=510321280.1701115699&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&dma_cps=sypham&dma=1&gtm=45He3b81n71TKCVNWv71863389&auid=295393694...
  • https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=11t1t1l1l5&rnd=510321280.1701115699&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&dma_cps=sypham&dma=1&gtm=45He3b81n71TKCVNWv71863389&a...
42 B
64 B
Ping
General
Full URL
https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=11t1t1l1l5&rnd=510321280.1701115699&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&dma_cps=sypham&dma=1&gtm=45He3b81n71TKCVNWv71863389&auid=295393694.1701115699
Protocol
H3
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:19 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:19 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=11t1t1l1l5&rnd=510321280.1701115699&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&dma_cps=sypham&dma=1&gtm=45He3b81n71TKCVNWv71863389&auid=295393694.1701115699
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/935608953/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/935608953/?random=1701115695478&cv=11&fst=1701115695478&bg=ffffff&guid=ON&async=1&gtm=45He3b81v71863389&gcd=11t1t1l1l5&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&hn=www.googleadservices.com&frm=0&tiba=Firstleaf%3A%20Refer%20a%20Friend&auid=295393694.1701115699&uamb=0&uaw=0&data=event%3Dpage_view%3Bgoogle_business_vertical%3Dretail%3Becomm_pagetype%3Dother%3Bdynx_pagetype%3Dother&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW&gtm_auth=1BfIqc--iU-7Fmd2boouvg&gtm_preview=env-1&gtm_cookies_win=x
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9793cb2d0f10c1b242ebd752a13e7e1888fe952fbd0d09fb7f678cddc4c597f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:19 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1324
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
255 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-3TS4P88RE5&gtm=45je3b81v887522027z871863389&_p=1701115694279&_gaz=1&gcs=G111&gcd=11t1t1l1l5&dma_cps=sypham&dma=1&cid=157331981.1701115699&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1701115694&sct=1&seg=0&dl=https%3A%2F%2Fwww.firstleaf.com%2Frefer&dt=Firstleaf%3A%20Refer%20a%20Friend&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=5493
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3TS4P88RE5&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:19 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.firstleaf.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
47 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-3TS4P88RE5&cid=157331981.1701115699&gtm=45je3b81v887522027z871863389&aip=1&dma=1&dma_cps=sypham&gcs=G111&gcd=11t1t1l1l5
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3TS4P88RE5&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:19 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.firstleaf.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
4 B
210 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1512406488&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstleaf.com%2Frefer&dp=%2Frefer&ul=en-us&de=UTF-8&dt=Firstleaf%3A%20Refer%20a%20Friend&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDACEABFAAAACAAI~&jid=722621938&gjid=1280206970&cid=157331981.1701115699&tid=UA-68049103-4&_gid=26575089.1701115699&_r=1&_slc=1&gtm=45He3b81n71TKCVNWv71863389&cd1=variant-member-pricing&cd2=member-pricing-130323&gcs=G111&gcd=11t1t1l1l5&dma_cps=sypham&dma=1&z=659138885
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.firstleaf.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-3TS4P88RE5&cid=157331981.1701115699&gtm=45je3b81v887522027z871863389&aip=1&dma=1&dma_cps=sypham&gcs=G111&gcd=11t1t1l1l5&z=1068702545
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:19 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/935608953/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/935608953/?random=1701115695478&cv=11&fst=1701115200000&bg=ffffff&guid=ON&async=1&gtm=45He3b81v71863389&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&frm=0&tiba=Firstleaf%3A%20Refer%20a%20Friend&data=event%3Dpage_view%3Bgoogle_business_vertical%3Dretail%3Becomm_pagetype%3Dother%3Bdynx_pagetype%3Dother&fmt=3&is_vtc=1&cid=CAQSKQDICaaNrZ41YymvwVl5-jOxgq6Fsh8BjphtKUsFFSiuI99syC1j3ITv&random=10983298&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:19 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/935608953/
42 B
108 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/935608953/?random=1701115695478&cv=11&fst=1701115200000&bg=ffffff&guid=ON&async=1&gtm=45He3b81v71863389&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstleaf.com%2Frefer&frm=0&tiba=Firstleaf%3A%20Refer%20a%20Friend&data=event%3Dpage_view%3Bgoogle_business_vertical%3Dretail%3Becomm_pagetype%3Dother%3Bdynx_pagetype%3Dother&fmt=3&is_vtc=1&cid=CAQSKQDICaaNrZ41YymvwVl5-jOxgq6Fsh8BjphtKUsFFSiuI99syC1j3ITv&random=10983298&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.firstleaf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 20:08:19 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
1 B
347 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-68049103-4&cid=157331981.1701115699&jid=722621938&gjid=1280206970&_gid=26575089.1701115699&_u=aCDACEAAFAAAACAAI~&z=35940043
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Mon, 27 Nov 2023 20:08:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.firstleaf.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/
2 B
41 B
Fetch
General
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Requested by
Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept
application/json
Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
application/json

Response headers

date
Mon, 27 Nov 2023 20:08:19 GMT
content-encoding
gzip
server
Google Frontend
access-control-allow-methods
GET, POST
content-type
text/html; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
8c3dde46fb890146185264ec6530439e
cache-control
private
function-execution-id
xlh95dgc0iwf
access-control-allow-headers
Content-Type, Accept
content-length
22
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
v2
rs.fullstory.com/rec/bundle/
29 B
43 B
XHR
General
Full URL
https://rs.fullstory.com/rec/bundle/v2?OrgId=134SPF&UserId=1e8d16d8-3d0d-4c94-aa59-74e923a3934e&SessionId=bb0c4906-022c-45a8-b78a-e3192b287fc0&PageId=2155f291-cd64-4c6d-b612-5c4cf70e6871&Seq=2&PageStart=1701115694990&PrevBundleTime=1701115696121&LastActivity=4504&IsNewSession=true
Requested by
Host: www.firstleaf.com
URL: https://www.firstleaf.com/682-242bd69790405d70c310.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.194.186.35.bc.googleusercontent.com
Software
/
Resource Hash
4dc6ccacc18d6018e056ff1ab26e9bcd6b1e30f11a9e53c668ad1878fdf18e4f

Request headers

Referer
https://www.firstleaf.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.firstleaf.com
date
Mon, 27 Nov 2023 20:08:20 GMT
via
1.1 google
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29
content-type
application/json; charset=utf-8
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ Frame
0
0
Preflight
General
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.firstleaf.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

access-control-allow-headers
Content-Type, Accept
access-control-allow-methods
GET, POST
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
gzip
content-length
22
content-type
text/html; charset=utf-8
date
Mon, 27 Nov 2023 20:08:19 GMT
function-execution-id
g50u2skh0y3m
server
Google Frontend
x-cloud-trace-context
3afe6a0bbc263f779a380c659e6ece7e

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
nytrng.com
URL
https://nytrng.com/iframe?vcp=4dd5h0np&as_id=0af2d3378c8344b98b9293723aa4f889

Verdicts & Comments Add Verdict or Comment

280 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| documentPictureInPicture object| OneTrustStub function| OptanonWrapper object| dataLayer object| GlobalSnowplowNamespace function| snowplow string| pagePath string| ___webpackCompilationHash object| ___chunkMapping object| webpackChunkfirstleaf object| google_tag_manager object| google_tag_data object| RB object| f string| cookieName number| cookieValue number| expirationTime string| date number| dateTimeNow function| fbq function| _fbq object| cj function| pdst boolean| _fs_debug string| _fs_host string| _fs_script string| _fs_org string| _fs_namespace function| FS object| AddShoppersWidgetOptions object| _pxDataLayer function| __pxDataTag object| pxcelData object| s object| __cfBeacon string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData function| ownKeys function| _objectSpread function| _defineProperty function| _typeof object| Snowplow function| onYouTubeIframeAPIReady number| 2f1acc6c3a606b082e5eef5e54414ffb object| DD_RUM object| asyncRequires object| ___emitter object| ___loader function| ___push function| ___replace function| ___navigate string| _fs_loaded function| _fs_shutdown function| UET function| UET_init function| UET_push object| sifi_att_42656 object| zEWebpackACJsonp function| zE function| zEmbed object| ueto_4753214152 object| uetq object| regeneratorRuntime object| CJApi object| cjApi object| Optanon object| OneTrust object| webpackChunkStripeJSouter function| noop function| Stripe object| __SENTRY__ object| Sentry object| AddShoppersLoader object| AddShoppersLoaderErrorHandlers function| ju_init function| setCookieCYB string| shopUrlCYB function| createCybbaPixel function| createCybbaScript function| loadTTDCybba function| waitForConfirmCYB object| _vteq function| AddShoppersTriggerRunner function| as_cleanse_field function| as_detect_cc function| as_gaPageView function| as_gaSocial function| as_gaEvent function| as_gaSet function| as_logMessage function| DataPartnerStatusGeo function| as_logError function| as_resolveEnvironmentURL object| _mag object| AddShoppersWidget function| AddShoppersWidget_plus_one object| SchemaParser object| _add number| ieVer object| obj number| AddShoppersWidgetLoaded object| AddShoppersWidgetLang function| ttd_dom_ready function| TTDUniversalPixelApi boolean| zEACLoaded function| incrementalityCYB function| readyOnsiteContent function| correctXCYB function| pingAff function| framePing function| dropCSSCYB function| closeOnsiteCYB function| closePromoBarCYB function| fireCampaignCYB function| fireOnConfirmCYB function| setOverlayZIndex function| mobileFixesCYB function| trackDisplayCYB function| cybClickCheck function| runAsyncTasksCYB function| forceCSSCYB function| determineOverlayClick function| copyPromoCYB function| firePromoBarCYB function| closeAppropriateCYB function| removeTrackingCYB function| trackEventCYB function| sendEventCYB function| displayOSTabCYB function| grabOSTabCYB function| geoDataCYB function| isEUCYB function| triggerDelayCYB function| processUrlsCYB function| initCYB function| gseCYB function| checkShouldMakeRequestCYB function| initAfterPromoBars function| checkNeedsClickCYB function| isURLCYB function| addCustomCSSCYB function| handlePromobarInitCYB function| determineOnloadCYB function| determinePersistenceCYB function| checkPBarCanFire function| inactivityPbar function| displayTriggersCYB function| getCookieCYB function| deleteCookieCYB function| createABSplitCYB function| simpleABCYB function| allowOnCloseCYB function| fireCybId function| onCloseHelperCYB function| xThresholdCYB function| isMousedOutCYB function| trigDataCYB function| resetZIndexCYB function| createScript function| mobileOnExitCYB function| listenersCYB function| inactivityTimerCYB function| oeSeenCYB function| pbarSeenCYB function| onOnsiteShownCYB function| attachPromoEventsCYB function| getCampaignIdsCYB function| attachProdEventsCYB function| addClickHandlerCYB function| makeRequestCYB function| setSessionMgmtCYB function| formFireNotOkay function| formFireOkay function| displayLogDataCYB function| getDollarValueCYB function| urlParamCYB function| hasBasketValueCYB function| isInListCYB function| nestedVarDefined function| isMobileCYB function| deviceTypeCYB function| travelClickCYB function| synxisCYB function| beSynxisInfoCYB function| rezTripCYB function| windSurfCYB function| dynamicPFCYB function| returnImageSrc function| storeProdHistoryCYB function| promobarCountDownCYB function| sizePromoBarCYB function| addClassPBarCYB function| addClassPBarCYBCheck function| sizePromoBarCYBCheck function| stickyNavScrollCYB function| deviceInfoCYB function| injectCYBScript function| confirmObjExistsCYB function| getSessionObjCYB function| getLocalObjCYB function| returnLoadedCampaignsCYB function| returnCustomJSCYB function| validateEmailCYB function| triggerOnsiteCYB function| pageViewCYB function| cybConversion function| cybPFData function| validSelectorExistsCYB function| grabSelectorValueCYB function| validateCartItemsCYB function| varExistsCYB function| vtsdkEmailStatusCYB function| scanForOrderData function| formatOrderValueCYB function| sendEmailEventCYB function| listenForEmails function| loginEmailEvent function| onepageConversion function| checkDomainsCYB function| getCybbaAuth function| processSMSCYB function| cybbaUSRequest function| trackSMSClicks function| waitForCybDataCYB function| doInitCYB function| parseResponseCYB function| cybAnonID function| cybZandrUID object| cybCDN function| cookieDeleteCYB function| removeCookieCYB function| cookieRemoveCYB function| cybCookieDelete function| cybCookieRemove function| cybDeleteCookie function| cybRemoveCookie function| cybGetCookie function| cookieGetCYB function| cybCookieGet function| cookieSetCYB function| cybCookieSet function| cybSetCookie function| checkInit object| vtstore object| vtlodash object| _vtsdk boolean| sessChanged string| el object| _vtshop function| $zopim object| __sentry_instrumentation_handlers__ object| DIGIOH_LOADER boolean| SENT_LIGHTBOX_PV string| pageTests string| pageVariant function| onTurnstileLoad string| GoogleAnalyticsObject function| ga object| gaplugins object| turnstile boolean| defined boolean| ssCYB object| result boolean| _iml boolean| is_mocked function| asIsProductPage function| asCartRows function| asCartItems function| asCart object| GooglebQhCsO object| gaGlobal object| gaData

51 Cookies

Domain/Path Name / Value
.fbapi.firstleaf.com/events/28fc69a6b106b8bbf4255e58732b4429691c375c33dd91683c594606975a1e52 Name: cee
Value: hlLSoNkAIoqCmHa7vUJpl2njHyvziZ7XeSBz2Dm8t5I%3D.%7B%22cee_id%22%3A%22cee.1701115694984.39814%22%7D
.firstleaf.com/ Name: FL_Referrer
Value: 2
.firstleaf.com/ Name: _sp_ses.bd58
Value: *
.simpli.fi/ Name: suid
Value: 241BB05AC6874DE49A9D79E2E1245205
.firstleaf.com/ Name: _fbp
Value: fb.1.1701115694630.345433077
www.firstleaf.com/ Name: __pdst
Value: b2ccf96f7c774a00b56f1d0c3a469d02
.firstleaf.com/ Name: cjConsent
Value: MHxZfDB8Tnww
.bing.com/ Name: MUID
Value: 0B0C8E0456DE6BED2BA69DD257556A98
.firstleaf.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Mon+Nov+27+2023+21%3A08%3A14+GMT%2B0100+(Central+European+Standard+Time)&version=202310.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.firstleaf.com%2Frefer&groups=C0003%3A0%2CC0004%3A0%2CC0002%3A0%2CC0001%3A1
.trkn.us/ Name: barometric[cuid]
Value: cuid_4443d553-ab38-4dc1-8f57-6c6caf8a7a7e
.www.firstleaf.com/ Name: _vt_shop
Value: 2856
.lightboxcdn.com/ Name: _cfuvid
Value: HoH.XVhiCuChePh_uR_hR_9J_RZK81bIyToYJvCj0x4-1701115694905-0-604800000
.firstleaf.com/ Name: fs_lua
Value: 1.1701115694989
.firstleaf.com/ Name: fs_uid
Value: #134SPF#1e8d16d8-3d0d-4c94-aa59-74e923a3934e:bb0c4906-022c-45a8-b78a-e3192b287fc0:1701115694989::1#/1732651694
.firstleaf.club/ Name: rbuid
Value: rbos-80ff11e4-f9d5-4e7c-95e4-96a7c6b62ec8
.firstleaf.com/ Name: rbuid
Value: rbos-80ff11e4-f9d5-4e7c-95e4-96a7c6b62ec8
.firstleaf.com/ Name: _uetsid
Value: b27e75308d6011ee9f1259fe40208395
.firstleaf.com/ Name: _uetvid
Value: b27e74408d6011eeb387c3a257912180
.firstleaf.com/ Name: _sp_id.bd58
Value: f997ac04-5bf1-434e-80f3-e1e5500c662f.1701115694.1.1701115696.1701115694.ff6a84da-fa51-4c3a-9898-f573612a3cb1
www.firstleaf.com/ Name: storeOrder
Value: %7B%22token%22%3A%22aS188ylLeBUQfSdCqLg0bg%22%2C%22number%22%3A%22R748319934%22%7D
www.firstleaf.com/ Name: shipToState
Value: %7B%7D
.firstleaf.com/ Name: sp
Value: e843b651-1c92-44fd-aeff-fc8be69be284
.www.firstleaf.com/ Name: _vt_user
Value: 3555918542269482_1_false_false
.firstleaf.com/ Name: c_64ei
Value: ZmFsc2U=
.simpli.fi/ Name: uid_syncd_secure
Value: true
.doubleclick.net/ Name: IDE
Value: AHWqTUn01JXdNaBH01hrW1nJHYKHYkX-1RMFJsS67fjio7iEvyW39zxPpCn6eQTu-bk
shop.pe/ Name: addshoppers
Value: "2|1:0|10:1701115697|11:addshoppers|44:MGFmMmQzMzc4YzgzNDRiOThiOTI5MzcyM2FhNGY4ODk=|11eeb6a19ca08e7f37e261351c2d3d5f6b299944b98b784412dbbcb57fc1cf65"
www.firstleaf.com/ Name: addshoppers.com
Value: 2%7C1%3A0%7C10%3A1701115697%7C15%3Aaddshoppers.com%7C44%3AMGFmMmQzMzc4YzgzNDRiOThiOTI5MzcyM2FhNGY4ODk%3D%7C0164b25631e3156c90a6003e9f7502add1e96af7f508e10da1113dbb5c719b5b
.tapad.com/ Name: TapAd_TS
Value: 1701115697117
.tapad.com/ Name: TapAd_DID
Value: 61ff27fc-cb62-48ab-9c4f-4b50f08fe230
.agkn.com/ Name: ab
Value: 0001%3Ak0haAR%2FubNFyW0kGdV5ZOUwnVT6NTTTO
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-6a347dbc-0a66-44c0-bc2b-9ca158ae9b7f-003%22%7D
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.adnxs.com/ Name: uuid2
Value: 5982716642589087491
.adnxs.com/ Name: anj
Value: dTM7k!M4.FE:2jUF']wIg2In9hPTf8!]tbPl1N!7On*M$=BWbki+oHJjFzxsdZI+Ojatseie*#njbC>kfQhXPck7d'bC1///X%W#.wL4W1Qw2'u*`O.
.pro-market.net/ Name: anHistory
Value: "-if95a2vgqyae+2+!#7%.%d!aAh"
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-6a347dbc-0a66-44c0-bc2b-9ca158ae9b7f-003%22%7D
.agkn.com/ Name: u
Value: C|0AAAAAAAALPezsQAAAAAA
.exelator.com/ Name: EE
Value: "a9caba0f0aa2029ca1bd3895d1cf7f76"
.pro-market.net/ Name: anProfile
Value: "-if95a2vgqyae+1+1f=1+1g=1+1j=41+rs=s+rt=2A026EA0C71B0000101117CB1395BD38+s2=(s4st9t)+vm=24-241BB05AC6874DE49A9D79E2E1245205:53-CAESEDMHnJ75rLCldNmF3JWJ8BE"
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQSHRMjkxKdEgzSAx0cjACMgxTEoxtrA0TTFMTjNPMzdbXJZatGBpaXFqStKhJRU5JTlNq8viQx3j3Rx9PX0ilzlnFOXnpq4AC4W5Bi2yNFqSX5SZvsjFdXFRShrDopLiU8HHOI0BvYUqGw%253D%253D"
.bluekai.com/ Name: bku
Value: blx99ecljsU8lURN
.bluekai.com/ Name: bkpa
Value: KJy9nyexd02pSUHknp/8mE1hwtkAwE/61DJY1ePOxpRTBpHWHEx8xEkWBpka1ADh1MxN1M9N9y972yra
m.stripe.com/ Name: m
Value: a781b768-9392-4e58-8013-20c7ccc28efe2044c3
.www.firstleaf.com/ Name: __stripe_mid
Value: 20a004c0-d4c6-4b9b-ac1c-548c20c2e4e0e972dc
.www.firstleaf.com/ Name: __stripe_sid
Value: 8fe82902-e4a2-49e5-a7c3-8d8cb4eb886b17d3fc
.firstleaf.com/ Name: _gcl_au
Value: 1.1.295393694.1701115699
.firstleaf.com/ Name: _ga_3TS4P88RE5
Value: GS1.1.1701115694.1.0.1701115694.60.0.0
.firstleaf.com/ Name: _ga
Value: GA1.2.157331981.1701115699
.firstleaf.com/ Name: _gid
Value: GA1.2.26575089.1701115699
.firstleaf.com/ Name: _gat_UA-68049103-4
Value: 1

4 Console Messages

Source Level URL
Text
security error (Line 6)
Message:
[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
network error URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=241BB05AC6874DE49A9D79E2E1245205
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://idsync.rlcdn.com/419566.gif?partner_uid=241BB05AC6874DE49A9D79E2E1245205
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=241BB05AC6874DE49A9D79E2E1245205
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
aa.trkn.us
addshoppers.s3.amazonaws.com
api.firstleaf.com
app.cybba.solutions
app.shop.pe
bat.bing.com
bcp.crwdcntrl.net
cdn.cookielaw.org
cdn.pdst.fm
ce.lijit.com
challenges.cloudflare.com
cloud.typography.com
cm.g.doubleclick.net
connect.facebook.net
ct.firstleaf.com
d.agkn.com
d2mjzob2nc713b.cloudfront.net
d2rp1k1dldbai6.cloudfront.net
eb2.3lift.com
edge.fullstory.com
ekr.zdassets.com
fbapi.firstleaf.com
fei.pro-market.net
files1.cybba.solutions
geolocation.onetrust.com
googleads.g.doubleclick.net
i.simpli.fi
ib.adnxs.com
idsync.rlcdn.com
images.firstleaf.com
insight.adsrvr.org
js.adsrvr.org
js.stripe.com
loadm.exelator.com
m.stripe.com
m.stripe.network
manage.safeopt.com
nytrng.com
pbid.pro-market.net
penrosehill.zendesk.com
pixel.rubiconproject.com
pixel.tapad.com
pro.ip-api.com
q.stripe.com
rbv9j7km.firstleaf.club
rbv9j7km.firstleaf.com
region1.analytics.google.com
rs.fullstory.com
s.ad.smaato.net
sentry.io
shop.pe
shopper.shop.pe
simplifi.partners.tremorhub.com
stags.bluekai.com
static.cloudflareinsights.com
static.zdassets.com
stats.g.doubleclick.net
sync.1rx.io
sync.bfmio.com
sync.intentiq.com
sync.targeting.unrulymedia.com
tag.simpli.fi
trkn.us
um.simpli.fi
us-central1-adaptive-growth.cloudfunctions.net
us-u.openx.net
www.facebook.com
www.firstleaf.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.lightboxcdn.com
www.mczbf.com
www.rtb123.com
nytrng.com
104.16.51.111
104.18.72.113
104.64.112.151
108.138.15.119
138.197.61.175
142.250.185.130
142.250.74.194
15.197.193.217
151.101.64.176
159.223.149.188
18.195.188.44
18.198.126.47
18.239.18.104
18.239.69.109
185.89.210.141
2001:4860:4802:34::36
2001:4860:4802:36::36
216.52.2.30
23.53.43.18
2400:52e0:1e00::1080:1
2600:1901:0:8eee::
2600:1f16:ebf:1f02:ca75:c788:2a66:4e1b
2600:1f18:612b:4216:7574:b4b8:a72d:d165
2600:9000:206f:8400:d:370a:51c0:93a1
2600:9000:2315:4e00:16:4ed5:12c0:93a1
2600:9000:243d:6c00:1b:5138:8a40:93a1
2600:9000:2440:1400:d:87ae:bb80:21
2606:4700:10::6816:3e65
2606:4700:10::ac43:989
2606:4700:4400::ac40:9b77
2606:4700::6810:3865
2606:4700::6811:3b8
2606:4700::6812:83ec
2606:4700::6813:d383
2620:1ec:c11::200
2a00:1450:4001:80e::200e
2a00:1450:4001:810::2008
2a00:1450:4001:827::2003
2a00:1450:4001:828::2002
2a00:1450:4001:829::2004
2a00:1450:400c:c04::9a
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
34.111.113.62
34.241.138.233
35.186.194.58
35.186.247.156
35.190.54.17
35.201.112.186
35.204.74.118
35.204.89.238
35.227.244.1
35.244.142.80
35.244.159.8
35.244.174.68
46.228.174.117
51.77.64.70
52.40.111.159
52.5.176.145
52.57.144.94
54.186.23.98
54.225.101.234
54.231.135.49
67.225.220.126
69.173.144.138
69.192.160.219
76.223.111.18
01af466f48d14857d97a67cd7025ce67c8a0b9ca83ddb6d3f313c7369c432868
02d0cddb81ecbfffffc3b2eba469a45372e7cc0244222faa422b502b3046a509
039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b0a210e89ac35b54a9b4ccb0336ea91c561e6dc5f8bda49574da98d40799c6e
0f88056ae93eb3934cd9cd312a9766a14afadf3cb20c1d2a07d8a8d5344e46bc
122604dbe0e33b2a80cff78e90bd1aefe742828d19a66b357bde8c250035ca33
16125b67dd44a6df2eadad443e941af6085d45a67fad4421f2160d92fe605278
192d30283f127c1503291bd628c5a8ce70eb7a04481fa3f616cc516e0e8a81d5
19bdfcbcd23b5134cd377c78bbf03971926795fa6398c62599782d4d6e381620
1b042c650b6af4874dfcad48aa7fd53dc9b32a444a96fba1f7161a02607907a8
1b7de306f62fd1672cacd7e196e2ca68d89706e1dc50a883c4ceba7a8e7abe80
1fe373400327289754745162a830e9c366fd0cc7f082590447fe244f1cc00c66
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
26b31d6103923798e1cfb5cd7037f0863ea6a60627816a748fa0ad952d8398c7
292105f3e2b9986f0cd0ccdbd5e7b6c77ac28631b7177931cc503b6a131a9496
29f3c804b625a9830c29615c4185d504f93b69411dfac6131586b9311e303e1e
2c472f5fc6038aa27db8aa76648236f916446c78b691d4211ef95a546411ca8b
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a
351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9
3d0ca84e91e2f948c3e0e49dfad215cf9e3a4d84808423c401f75733cb2e92bb
3d40fa2983d63b1f9b1158a6b05bb0983b5bbe5065e0782256e6e333f3624b09
3deecf7765b0b5f7854ff9c962010e90c3a3ad5dcbf1f1436bed59daf6e20c57
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3ecb0efb31f4df41b94ee044712042410aa65c1e2554ffaf79a9c6ffb16b79e0
3fb1a29c99d1d739c54b237a8a3f6e27dc1097f643deb03739e2672bc455adcb
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
448d4d591156a0c14d4990f575daea57d7ca5ae8bb4021fc38d66445578e77b3
45a23ae649b70a4e21781f819bbe4a5ccd80721ee5154d0292984efd9fb60581
4733f202938d8b69cc376eb0ac3a609f358e05caae9f5b27b9a3a898dbed2fca
47c68758c3d5ccba91f970373f59a93485a94e5c4bc1a0454597ba5cfa7a4ace
49dfef05d0297543d0e4cedc293b559aee6d585e01b1c84439a91b71f2b6ec9e
4abfc20341515e0793cc89ece1d464349fdc7675f925e473fd6d99a0cc18a8b8
4b4c8cab5b08674a09cb0719abd984198123d97831844808b90ec48756571422
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4dc6ccacc18d6018e056ff1ab26e9bcd6b1e30f11a9e53c668ad1878fdf18e4f
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
50cf303cfaa020fcbedd6ad1bf045a008cbb88dfc792f731f07235dd1ca13599
512ab4fe263949fb64f4787bcf9d9e1d6f58812c785f71b6a0897c2c5e20de6e
5167eba6e2d9752d3e842f659a2cb597d54b2cac2e02fcf501c09eeed21bf68f
51b06909334339bd5f4027e70f4d2fd30a2a3977ee44cce7385b908ec8f51903
51cd12da61a7401c73472b2ac77067adfa30e9fc0545b4b7c240e9154e011fc7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
59f2488b9df7d5f990cdf01dfe668b4d6068e342815b9aa004982a2a18fc06a4
5afba68268c3b07f1dc44f0cfe7be9c6b7504714f700fe7a5f061153f3c5f6bc
5d5ac92cc9565d62cd713fe2d946793ffb805012b57f610830403afb67907030
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
6226b929ae8529e375e6b444b960a464e74828592fbc140bf5f7a1e11740c1b3
623c33b9ef9f3871f596b2f721d622b8c4a530b147cc6a9ec2e405f89fe68f7a
6396dedda9bcf5749f2cbbcd870a17297c4bf63f19a52d54d42d3abb4b0a3b87
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
645ab215148e00ab2ba3fdfc7caec9aa6d0cd5a672078f1d033a01e0f5a44864
66588b9c23774d448f8e58d1a250f32845152730b25deb05decc869ff23489b3
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6aa2e6166c7e04afa18a7adecff919c61d92877b2285d2aef27127476e4b538a
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bfd21c277b587b22f14eb92cc8f83987d584b151f900bff0ca2948a31946ff5
6ccc79e05c98f2716fae11e9500d35a8fc6c13d9146bb5758bbe12c3f922f258
6d52d4524b6e0555d1de9842f1d22827ef845ddc5b3b5d78e0bb9c4288961096
6d58edbe448902b5aa44d767c44c298945a0e2985f214e651deacd9ec71ac87b
6f21f8245d562612096485cd57291e067c42470042c18bdfb694fd21ef07c24d
72e6cbb75b81d80051dc06834d41cfcb6e3a56e22eec45e830567a55a8336c2b
78489cd5d39de9a624a385449f78ac3dac62f590f99e3d98195e7d06851edbc7
7a6257c31f8e2e50e86df4fc1f6b716f5833d8bca16297addd17da973286f417
7ad4276f7c290bdcbcb4e468f88a3cff789687c8a70c6828956bcfcd4c2aa1a1
7ba93f0c1f5b72395ea5024e97ba149d96cffbe73e8e4a2546921ba3404f146c
7f9b91bc270628f5b5bc95b5882b70db32e5c45731c133c57720efefae11c6c2
7ff4f326a701b935db6fa9bb8b44ca58f6c5646ce9ceecd6e393bae47bd70ab1
809d0584362a8afc19641b28a2b61619d994261436522749705fd9e41f9729ae
81e19781421dde74d381c435d7a9fd57617829f6c4d4e9a392043dc327003bd3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
853fe9b0a580de7f26b968747b3efab6a7984cf6413c375479a2f4507ca81a9e
85ad9c4586b439a1f2ce5516c218bed3c64110ac93bb7c916894240392503053
878fa0dda1bf5303d4c094f42ba9f7b3aaff615c75b0f89ef4011ea9f5adcaf7
88cb675379978febde8e786534b6d607d2a01b814d0f8e041f8bea0b8fa59011
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
9793cb2d0f10c1b242ebd752a13e7e1888fe952fbd0d09fb7f678cddc4c597f4
999057c118070898bb135e956abf4b9439c674ed99b3388d6e32f0a9833dff96
99b01639ce493bb0e333c2bce444bfe29b86a23c0f53e16cad80ffc86a9fcd2d
9af55514373a031165feb55cc4e9bde932e0ce324bd591678861202f9d66885c
9ea1823078c462969eaa59d6ef62623c19d77b72e25a103105b043aefaa0769a
9f22f6e9d4852f8be0706b62fbd0eba20f6cb56171def5e387b2d95fcd07df01
9fd678871d5c502175e5233f33bb7c2cb09eda96eebfa139f527b72683f8b92b
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a3b270884bf94832ce02a8a93455cbbed697b0d6dd9722956997a25f6a018537
a48fd35c61908d912b5ac9e1face12e0962a0d9ecc8679e87db4031697cec54e
a5e3256799bc9eb6a1ad57001ad69b0946e4532d103092dd0557c02d84e6b4a7
a6700195e8c83a7f13d99b7f33caabd96fc589156a6b0fbe3fe1a08187deef7d
a899a0398bbfbb8343c67e83098446254c1609aae412962cff6929087135a51c
abcead7bca366f147d75f144149318ec4590a98bddae9131df5900f7b04aaba3
aca66b739fcde148403f4735fd9091fbc02455deb4e6c186ea52cb71692f6269
adbd7d4779c904702783f318862565dcd83b6c8ed9f98bd465d4bb9edf5c61fd
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b09e8762d91058fa49494a1b1e7ebdd18f76e7b15f3e3f7c32fec949c8b5e7e4
b2874b51187499aa0b6bcac160f72d5d0820dc644f979df11e5cbd7abb8dad2e
b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d
b4435b5ac2f1916ed1135fb1738a1cef87cb666f4356a6678fb1c77e1273f9e1
b555a629b6d5ab7a5bf47b53152316ca69cbb7f4f071416d2ba3da25df747826
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c
b932e2d6a3930cea2d5303d7badb47e4d7f735fe0f5d09231cf5d5199a1d992f
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd41d8ac5e4afa3d87487757ddd78478d0380adcbb8f6eb1d4c39ab2dda933f8
c03f3488eeb6bcad6fa76499431ef68b5e0283c9eb8d71ed52851c14ff9f5d5c
c22ea4b441efa116b0fa35c99a1bfa8216692dab8dcc0eef07fa67b3a2056152
c25dd5f5fe269775aff50152e1346d36a63a577e0183cab959292a0ab56d90da
c459bfad9c5f66b00ad2d8fc3afa0fe1be2af878921a7b4e804261bc77ea7db6
c5147cf5352bb6f99d31467dfec38f9573476d093433cda65441668df8617bbc
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342
cce753ae3b1e52fa4eaeff638550c3fea3040a4e4822adfc070918eb4f1e0b4e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0484f7ea0df633b28919011c49461eaad52472558af2be1263617f40f828980
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
d4c521d5535bd16fa41564dc19a2043f492e87104fc8089b9fca8040813a0f80
d517a31c87468aa0c7f190013a3ae309f0ff6e5c1ed9073d5e82e3b7e54eec10
d80e46ea1ae15cc270710bb17a397d2c7e8688069b2d43eaabffb59b7fda9e61
dae92dddf3101a40fa9588c6b89dc1326c599bd44a3559af863846c7116b9bfe
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dddf04d190be2e7006f807221d5f5852bf45a97c2aad4c66b1f0a1661efa7dda
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
e092bea366a94333d8ec48137987e2df19f61288f6e073032b2a8bdde6264d6a
e0e97ac884c40424448ea871461024dd27f40176fcc2d3cbc310714d89ac3285
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0
eaef61a693bec2483439247f48dd8def6558804ed706f02ae6a346f32b80a92c
ec95de79d79259d46fa5520928852ab57deda8a3d393857781271daa099b193c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947
f33b9ff7c623861b226c359f20776dc8c86c9490764b0b48d973f427f00aaf0b
f5582e2945dd2c8c1f74ddcd5cc53c031cf72c2be04b79f6c552ca105c1a2e73
f60c4a84c845d054e8fd40c501965fd0f4afb725d54fb7fa48049d79fc29aae8
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70
f83e9b440122162e26168f780eb567cbc84a351c4728c3cc8bd3679e8e362ff9
f88e6c1e4e0fe89939c77b77c4183a7ce74248aec2731d7fced0227506010785
f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b
feeb83e3a11fb74465e062a5081f1f6f573ef66197f218a3a86447fefe3166f6
fefb5d7f9dba1b2071b036cd9893bc809f1d8701dcfbcfc0e1adb95bf96b1785