www.elfcosmetics.com Open in urlscan Pro
204.2.131.64 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.elfdosmetics.com/
Effective URL:
https://www.elfcosmetics.com/?utm_source=Paid_Search&utm_medium=cpc&utm_campaign=connexity&cnxclid=16875344456998080343310090...
Submission: On June 23 via api (June 23rd 2023, 3:34:09 pm UTC) from US — Scanned from US

Summary HTTP 29 Redirects Behaviour Indicators

Summary

This website contacted 16 IPs in 1 countries across 18 domains to perform 29 HTTP transactions. The main IP is 204.2.131.64, located in and belongs to . The main domain is www.elfcosmetics.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 8th 2022. Valid for: a year.

This is the only time www.elfcosmetics.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.172.228.26 167.172.228.26	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1 2	52.117.247.211 52.117.247.211	36351 (SOFTLAYER) (SOFTLAYER)
2	52.116.53.146 52.116.53.146	36351 (SOFTLAYER) (SOFTLAYER)
1	52.116.53.151 52.116.53.151	36351 (SOFTLAYER) (SOFTLAYER)
1 3	192.138.218.207 192.138.218.207	14332 (SHOPZILLA) (SHOPZILLA)
1	2607:f8b0:400... 2607:f8b0:4006:817::2008	15169 (GOOGLE) (GOOGLE)
1	108.139.29.103 108.139.29.103	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2001:4998:14:... 2001:4998:14:800::1000	14777 (YAHOO) (YAHOO)
2 2	50.16.197.56 50.16.197.56	14618 (AMAZON-AES) (AMAZON-AES)
1	64.19.224.208 64.19.224.208	14332 (SHOPZILLA) (SHOPZILLA)
2	2607:f8b0:400... 2607:f8b0:4006:823::2002	15169 (GOOGLE) (GOOGLE)
2	76.13.32.146 76.13.32.146	26101 (YAHOO-BF1) (YAHOO-BF1)
4	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2607:f8b0:400... 2607:f8b0:4006:824::2004	15169 (GOOGLE) (GOOGLE)
1 1	192.138.218.139 192.138.218.139	14332 (SHOPZILLA) (SHOPZILLA)
1	204.2.131.64 204.2.131.64	() ()
29	16

1 167.172.228.26 (Clifton, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

www.elfdosmetics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.117.247.211 (United States) 1 redirects

ASN36351 (SOFTLAYER, US)
PTR: d3.f7.7534.ip4.static.sl-reverse.com

myckdom.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p374591.myckdom.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.116.53.146 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 92.35.7434.ip4.static.sl-reverse.com

clkdeals.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.116.53.151 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 97.35.7434.ip4.static.sl-reverse.com

241.trackingms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.138.218.207 (United States) 1 redirects

ASN14332 (SHOPZILLA, US)
PTR: rd.bizrate.com

go.shopyourlikes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rd.bizrate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:817::2008 (Flushing, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.29.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-29-103.jfk50.r.cloudfront.net

s5.cnnx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4998:14:800::1000 (United States)

ASN14777 (YAHOO, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.16.197.56 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-197-56.compute-1.amazonaws.com

loadus.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.19.224.208 (United States)

ASN14332 (SHOPZILLA, US)

pxl.connexity.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:823::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.13.32.146 (Lockport, United States)

ASN26101 (YAHOO-BF1, US)
PTR: spdc.pbp.vip.bf1.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:824::2004 (Flushing, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.138.218.139 (United States) 1 redirects

ASN14332 (SHOPZILLA, US)
PTR: rd.connexity.net

rd.connexity.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 204.2.131.64 (None, )

ASN- ()

www.elfcosmetics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 101	301 B
4	bing.com bat.bing.com — Cisco Umbrella Rank: 389	13 KB
2	google.com www.google.com — Cisco Umbrella Rank: 3	563 B
2	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1156	878 B
2	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 57	4 KB
2	connexity.net 1 redirects pxl.connexity.net — Cisco Umbrella Rank: 5853 rd.connexity.net — Cisco Umbrella Rank: 53769	2 KB
2	exelator.com 2 redirects loadus.exelator.com — Cisco Umbrella Rank: 1428	2 KB
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 531	7 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 176	115 KB
2	bizrate.com rd.bizrate.com — Cisco Umbrella Rank: 66780	17 KB
2	clkdeals.com clkdeals.com — Cisco Umbrella Rank: 246408	393 B
2	myckdom.com 1 redirects myckdom.com — Cisco Umbrella Rank: 57146 p374591.myckdom.com — Cisco Umbrella Rank: 317269	2 KB
1	elfcosmetics.com www.elfcosmetics.com
1	cnnx.io s5.cnnx.io — Cisco Umbrella Rank: 107360	540 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 82	68 KB
1	shopyourlikes.com 1 redirects go.shopyourlikes.com — Cisco Umbrella Rank: 216881	790 B
1	trackingms.com 241.trackingms.com — Cisco Umbrella Rank: 752856	601 B
1	elfdosmetics.com 1 redirects www.elfdosmetics.com	1 KB
29	18

	Domain	Requested by
4	www.facebook.com	rd.bizrate.com
4	bat.bing.com	rd.bizrate.com bat.bing.com
2	www.google.com	rd.bizrate.com
2	sp.analytics.yahoo.com	rd.bizrate.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	loadus.exelator.com	2 redirects
2	s.yimg.com	rd.bizrate.com s.yimg.com
2	connect.facebook.net	rd.bizrate.com connect.facebook.net
2	rd.bizrate.com	241.trackingms.com rd.bizrate.com
2	clkdeals.com	p374591.myckdom.com 241.trackingms.com
1	www.elfcosmetics.com	rd.bizrate.com
1	rd.connexity.net	1 redirects
1	pxl.connexity.net	rd.bizrate.com
1	s5.cnnx.io	rd.bizrate.com
1	www.googletagmanager.com	rd.bizrate.com
1	go.shopyourlikes.com	1 redirects
1	241.trackingms.com	p374591.myckdom.com
1	p374591.myckdom.com
1	myckdom.com	1 redirects
1	www.elfdosmetics.com	1 redirects
29	20

This site contains no links.

Subject Issuer	Validity	Valid
*.myckdom.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-20` - `2024-03-20`	a year	crt.sh
www.clkdeals.com Sectigo RSA Domain Validation Secure Server CA	`2022-12-07` - `2023-12-29`	a year	crt.sh
*.trackingms.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-26` - `2024-03-17`	a year	crt.sh
*.bizrate.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-19` - `2023-09-19`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
s1.cnnx.io Amazon RSA 2048 M01	`2023-02-28` - `2023-09-27`	7 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-04-02` - `2023-07-01`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2023-02-16` - `2023-08-16`	6 months	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-05-22` - `2023-07-12`	2 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-05-30` - `2023-11-22`	6 months	crt.sh
www.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.elfcosmetics.com Sectigo RSA Domain Validation Secure Server CA	`2022-11-08` - `2023-10-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.elfcosmetics.com/?utm_source=Paid_Search&utm_medium=cpc&utm_campaign=connexity&cnxclid=16875344456998080343310090301008005&utm_term=16875344456998080343310090301008005
Frame ID: EE47798C79F4590D469EF530A9EE18BC
Requests: 29 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.elfdosmetics.com/ HTTP 302
https://myckdom.com/aS/feedclick?s=R40UBoveGXf0bBi43pBLOrYUp7aBBDBgb4wz1M5huC7Q_PmFw_FpuZ5tV7Jmg... HTTP 302
https://p374591.myckdom.com/adServe/domainClick?ai=KH3sNciCPPoYAgm9ynsJlM98ZrHj-N0rl_kLECECCYSa2U3E2kWB7... Page URL
https://241.trackingms.com/adServe/aff?oid=989963&pid=294080&subid=90450520367&dp1=442569856&dp3=UNKNOWN Page URL
https://go.shopyourlikes.com/pi/39a9f07405e997116e7281a26286308da686ac75?afId=725724&afCampaignId=MF&afPl... HTTP 302
https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm... Page URL
https://rd.connexity.net/rd2?mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac77... HTTP 302
https://www.elfcosmetics.com/?utm_source=Paid_Search&utm_medium=cpc&utm_campaign=connexity&cnxclid=168753... Page URL

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

29
Requests

93 %
HTTPS

39 %
IPv6

18
Domains

20
Subdomains

16
IPs

1
Countries

229 kB
Transfer

782 kB
Size

23
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.elfdosmetics.com/ HTTP 302
https://myckdom.com/aS/feedclick?s=R40UBoveGXf0bBi43pBLOrYUp7aBBDBgb4wz1M5huC7Q_PmFw_FpuZ5tV7JmgQXznIFjje5HrPodK7X5QIc3n0hfs9IVa7UG37q4Cgpg75MByokIpjiFKluxNC_VCHffxlOmzgR5fh3nQoQZVtH1UcHY6z5T2K7NFT_4ZRcycYhE4SNQnhYuCq47aVe8VVuvpDyo0kGcuudEMhzzZpchcmxaAzSho9pxyqpyIidsASsYSBAQB2fMkjJtSgZQdDs018-XicrluTDqa2p45GuQe8RlWwkvJg8ArT2IKh5kVZCiCPFc_zyXZ9N7vkfsGnhdE6tJh50ePq0CWuZBF__XRfyTG5eAU8OEm0WcIk5CjctO3HgbgfoxDzKQ32MLFJfBXf_wGGB2oAAcuwcJ89KZnEeyVm8YsSx26hSR5myopA51aQM1EcJa7G2FCalHYuHH6aE1gD8L_85dDRPRco3JGvWDYV-JOCRH_ihlCAlcbsL7lBP-QtFcT0qgiHi-OjP79CM1BZ4ZkIQBQBYMDLi19EL3mJ1fMJn4e36knggGCOUrgUBC_fa-jeCAQgDPcZhHc1F94GMDmHIShZ-Myef3CBKRGHYfWP4IDJCkWbm3-JFAwHJi7WkQ6dIF4zgMVI2cClzvNqL-1RZgceDIjFgEtu2OZLc6rkXHJRTy4fyEXvIT0ghm7iiQ2pxKl-X_-tSVPXnV6M2OLPD4OExbA3r81LQ3LDJ_Ra4UiTmE0jWl-0gmJEJfDIerjckG8M2JZhMh99646nWdIwOtucxeG_5h4EH0nUhDKx5AhfQ9fHccYIPW8XK2IpbhETz-4M-MQChoAAsPJtv8nraHbI6sAmMiTi1MmOP4hZorJBKg5jNdcdW0k9gkD_akWxrew9s0eFgrLXiuQKN30t-7cWkTeXmz7BHZABAqatY049mw77l8JmD0ucfgbBzE4YZUtPfy0fYrONM_q14QRJwbaROIuTSPMyy7Jg3N4BvyjBgr8RxJ-yqMSg1HhNV09dT2REAwNar-9kZbPT-SsFbIG1IXJj3zlVgRkbNLfOJrEt_MwyH4htZwABjVGEzvwMdm8bcVUwELFymS2zSzkH7h8R3jd6QQOGtVIBS1uuJ0esyVLHU1d7ueFaEf6KKHRuQwq1Q051dLuPbZZy59kg0SittliUGUCaCeAD1IvhNaP8sUppB90IhXvMYORdOEXp_FHNfEhKooIbr4ScI-uON36n1-VC-CuKifHwHvWXoIxb8tkShtl8myBJmW7EcHPTumAeTpY7x42mqi9EcDwDmFCjhA5kocz4dfzLroTowgOMWmM7434roY8Aq80GeFJ9V7jhrzl3d6i2L-4COsWdTlIP5ptT_pYjn_q6kDsj-WyJAd6rmO7rC1Szk2K9l-az4BBFBnL75OuRp9IZ9PqNglKQ_i888FitqMNepuTgne9vEfyhULVGoMy8k-NgY5J4MdXugF-4u8BQTtb1Vp_izROz_X8anx4xiQBNYDtneRs2I4PkEiFU3IkB3quY7usGIcGtotJtDDnejpmc3HcWnGB-tLhVn5T8yjc1oJ9zm27tPSf7OiZpqNnci3mDGaOSS1uwyeiHCAKxbXxiYPJyfsF85xQnl6Cg4p8Vb4BQcus3Om_gBin-7u8O8Uo6IQKXXUObesJXL3JTu6AXYz7K4ZFlltCXfWPI2pq31lqDxoGeDYFDo8O3x3vlFiwZLMDxgfmhPsHt9YbChDiKbZCj7dAM6fo_EBoQ HTTP 302
https://p374591.myckdom.com/adServe/domainClick?ai=KH3sNciCPPoYAgm9ynsJlM98ZrHj-N0rl_kLECECCYSa2U3E2kWB7tcRSvuwOr-V7tPSf7OiZprzn3Hig8mF4FhGdKUqq2eWoKe_r3SbM0YzW8vUbE2iDs7Tejv1_e9UbxjNS0ztqciY-sGiQOkCSV22tRDsvu5tje0dlVJ5w2bi9eDmkAdZ9eQwq1Q051dLuPbZZy59kg0SittliUGUCUqBvPRUX_5Yf_1vyTLYjVsU7XNcAuIUwl5eqluxZjCfXaThdUnMcle7DZRrR8TT5Zf5CxAhAgmEp0OdqGvuTddiVnQIGgxQDiU7ugF2M-yuGRZZbQl31jyNqat9Zag8aCT4wVIzB4sUVr5zdXV-roWAvsy17o8fXd3zJRthYC80Q_sfkUz57CLHl0cP40PY-tOuCg1e2kATdM5ECUeELJfkQmjZE96sjp8DPbGbSNtJN0JJKTQdChujiGYQ-VGfM1BKQ8__OyXIDNNXbzOl0z0Fy9LbfW_6duFoOnPfBtp4E6PC1ui2TsUW0YeVoTdAMXo_8JgIlG3qsxh9qK6j9vM&ui=R40UBoveGXf0bBi43pBLOvbWwvziNp_1xLgNeF8Zj-hlk-W7NzGmtgd3Jdb3FXnHJSkP4vPPBYrajDXqbk4J3vbxH8oVC1RqDMvJPjYGOSdZL025KMOWwQ&si=1&oref=40e4dd1dffdebf956ec44f4e69a0954c&optunit=Z3ZTVPoyhs5hFIh15jir-2WSQsQHXjql&rb=xpilJuU8uhk&rr=1&isco=t&abtg=0 Page URL
https://241.trackingms.com/adServe/aff?oid=989963&pid=294080&subid=90450520367&dp1=442569856&dp3=UNKNOWN Page URL
https://go.shopyourlikes.com/pi/39a9f07405e997116e7281a26286308da686ac75?afId=725724&afCampaignId=MF&afPlacementId=186631&afRid=90450488112 HTTP 302
https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913 Page URL
https://rd.connexity.net/rd2?mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913&t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3D16875344456998080343310090301008005%26utm_term%3D16875344456998080343310090301008005&br=16875344454062730138502010301003762&rf=cldaf1&vsc=dau&rdrSerial=7536e4dc-6af6-4a0e-b5f8-35e0bda5e5f8&redirectId=16875344456998080343310090301008005 HTTP 302
https://www.elfcosmetics.com/?utm_source=Paid_Search&utm_medium=cpc&utm_campaign=connexity&cnxclid=16875344456998080343310090301008005&utm_term=16875344456998080343310090301008005 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.elfdosmetics.com/ HTTP 302
https://myckdom.com/aS/feedclick?s=R40UBoveGXf0bBi43pBLOrYUp7aBBDBgb4wz1M5huC7Q_PmFw_FpuZ5tV7JmgQXznIFjje5HrPodK7X5QIc3n0hfs9IVa7UG37q4Cgpg75MByokIpjiFKluxNC_VCHffxlOmzgR5fh3nQoQZVtH1UcHY6z5T2K7NFT_4ZRcycYhE4SNQnhYuCq47aVe8VVuvpDyo0kGcuudEMhzzZpchcmxaAzSho9pxyqpyIidsASsYSBAQB2fMkjJtSgZQdDs018-XicrluTDqa2p45GuQe8RlWwkvJg8ArT2IKh5kVZCiCPFc_zyXZ9N7vkfsGnhdE6tJh50ePq0CWuZBF__XRfyTG5eAU8OEm0WcIk5CjctO3HgbgfoxDzKQ32MLFJfBXf_wGGB2oAAcuwcJ89KZnEeyVm8YsSx26hSR5myopA51aQM1EcJa7G2FCalHYuHH6aE1gD8L_85dDRPRco3JGvWDYV-JOCRH_ihlCAlcbsL7lBP-QtFcT0qgiHi-OjP79CM1BZ4ZkIQBQBYMDLi19EL3mJ1fMJn4e36knggGCOUrgUBC_fa-jeCAQgDPcZhHc1F94GMDmHIShZ-Myef3CBKRGHYfWP4IDJCkWbm3-JFAwHJi7WkQ6dIF4zgMVI2cClzvNqL-1RZgceDIjFgEtu2OZLc6rkXHJRTy4fyEXvIT0ghm7iiQ2pxKl-X_-tSVPXnV6M2OLPD4OExbA3r81LQ3LDJ_Ra4UiTmE0jWl-0gmJEJfDIerjckG8M2JZhMh99646nWdIwOtucxeG_5h4EH0nUhDKx5AhfQ9fHccYIPW8XK2IpbhETz-4M-MQChoAAsPJtv8nraHbI6sAmMiTi1MmOP4hZorJBKg5jNdcdW0k9gkD_akWxrew9s0eFgrLXiuQKN30t-7cWkTeXmz7BHZABAqatY049mw77l8JmD0ucfgbBzE4YZUtPfy0fYrONM_q14QRJwbaROIuTSPMyy7Jg3N4BvyjBgr8RxJ-yqMSg1HhNV09dT2REAwNar-9kZbPT-SsFbIG1IXJj3zlVgRkbNLfOJrEt_MwyH4htZwABjVGEzvwMdm8bcVUwELFymS2zSzkH7h8R3jd6QQOGtVIBS1uuJ0esyVLHU1d7ueFaEf6KKHRuQwq1Q051dLuPbZZy59kg0SittliUGUCaCeAD1IvhNaP8sUppB90IhXvMYORdOEXp_FHNfEhKooIbr4ScI-uON36n1-VC-CuKifHwHvWXoIxb8tkShtl8myBJmW7EcHPTumAeTpY7x42mqi9EcDwDmFCjhA5kocz4dfzLroTowgOMWmM7434roY8Aq80GeFJ9V7jhrzl3d6i2L-4COsWdTlIP5ptT_pYjn_q6kDsj-WyJAd6rmO7rC1Szk2K9l-az4BBFBnL75OuRp9IZ9PqNglKQ_i888FitqMNepuTgne9vEfyhULVGoMy8k-NgY5J4MdXugF-4u8BQTtb1Vp_izROz_X8anx4xiQBNYDtneRs2I4PkEiFU3IkB3quY7usGIcGtotJtDDnejpmc3HcWnGB-tLhVn5T8yjc1oJ9zm27tPSf7OiZpqNnci3mDGaOSS1uwyeiHCAKxbXxiYPJyfsF85xQnl6Cg4p8Vb4BQcus3Om_gBin-7u8O8Uo6IQKXXUObesJXL3JTu6AXYz7K4ZFlltCXfWPI2pq31lqDxoGeDYFDo8O3x3vlFiwZLMDxgfmhPsHt9YbChDiKbZCj7dAM6fo_EBoQ HTTP 302
https://p374591.myckdom.com/adServe/domainClick?ai=KH3sNciCPPoYAgm9ynsJlM98ZrHj-N0rl_kLECECCYSa2U3E2kWB7tcRSvuwOr-V7tPSf7OiZprzn3Hig8mF4FhGdKUqq2eWoKe_r3SbM0YzW8vUbE2iDs7Tejv1_e9UbxjNS0ztqciY-sGiQOkCSV22tRDsvu5tje0dlVJ5w2bi9eDmkAdZ9eQwq1Q051dLuPbZZy59kg0SittliUGUCUqBvPRUX_5Yf_1vyTLYjVsU7XNcAuIUwl5eqluxZjCfXaThdUnMcle7DZRrR8TT5Zf5CxAhAgmEp0OdqGvuTddiVnQIGgxQDiU7ugF2M-yuGRZZbQl31jyNqat9Zag8aCT4wVIzB4sUVr5zdXV-roWAvsy17o8fXd3zJRthYC80Q_sfkUz57CLHl0cP40PY-tOuCg1e2kATdM5ECUeELJfkQmjZE96sjp8DPbGbSNtJN0JJKTQdChujiGYQ-VGfM1BKQ8__OyXIDNNXbzOl0z0Fy9LbfW_6duFoOnPfBtp4E6PC1ui2TsUW0YeVoTdAMXo_8JgIlG3qsxh9qK6j9vM&ui=R40UBoveGXf0bBi43pBLOvbWwvziNp_1xLgNeF8Zj-hlk-W7NzGmtgd3Jdb3FXnHJSkP4vPPBYrajDXqbk4J3vbxH8oVC1RqDMvJPjYGOSdZL025KMOWwQ&si=1&oref=40e4dd1dffdebf956ec44f4e69a0954c&optunit=Z3ZTVPoyhs5hFIh15jir-2WSQsQHXjql&rb=xpilJuU8uhk&rr=1&isco=t&abtg=0

Request Chain 4

https://go.shopyourlikes.com/pi/39a9f07405e997116e7281a26286308da686ac75?afId=725724&afCampaignId=MF&afPlacementId=186631&afRid=90450488112 HTTP 302
https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913

Request Chain 10

https://loadus.exelator.com/load/?p=204&g=92&j=0 HTTP 302
https://loadus.exelator.com/load/?p=204&g=92&j=0&xl8blockcheck=1 HTTP 302
https://pxl.connexity.net/c/cse?a=R&A=292&D=6a0d&V=9&I0k=ptnrid&I0v=78380866f9a0323d365ac0f0daced818&b=1687534446171

29 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

domainClick Show response
p374591.myckdom.com/adServe/
Redirect Chain

https://www.elfdosmetics.com/
https://myckdom.com/aS/feedclick?s=R40UBoveGXf0bBi43pBLOrYUp7aBBDBgb4wz1M5huC7Q_PmFw_FpuZ5tV7JmgQXznIFjje5HrPodK7X5QIc3n0hfs9IVa7UG37q4Cgpg75MByokIpjiFKluxNC_VCHffxlOmzgR5fh3nQoQZVtH1UcHY6z5T2K7NFT...
https://p374591.myckdom.com/adServe/domainClick?ai=KH3sNciCPPoYAgm9ynsJlM98ZrHj-N0rl_kLECECCYSa2U3E2kWB7tcRSvuwOr-V7tPSf7OiZprzn3Hig8mF4FhGdKUqq2eWoKe_r3SbM0YzW8vUbE2iDs7Tejv1_e9UbxjNS0ztqciY-sGiQO...

665 B
731 B

105ms
82ms

Document
text/html

52.117.247.211
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://p374591.myckdom.com/adServe/domainClick?ai=KH3sNciCPPoYAgm9ynsJlM98ZrHj-N0rl_kLECECCYSa2U3E2kWB7tcRSvuwOr-V7tPSf7OiZprzn3Hig8mF4FhGdKUqq2eWoKe_r3SbM0YzW8vUbE2iDs7Tejv1_e9UbxjNS0ztqciY-sGiQOkCSV22tRDsvu5tje0dlVJ5w2bi9eDmkAdZ9eQwq1Q051dLuPbZZy59kg0SittliUGUCUqBvPRUX_5Yf_1vyTLYjVsU7XNcAuIUwl5eqluxZjCfXaThdUnMcle7DZRrR8TT5Zf5CxAhAgmEp0OdqGvuTddiVnQIGgxQDiU7ugF2M-yuGRZZbQl31jyNqat9Zag8aCT4wVIzB4sUVr5zdXV-roWAvsy17o8fXd3zJRthYC80Q_sfkUz57CLHl0cP40PY-tOuCg1e2kATdM5ECUeELJfkQmjZE96sjp8DPbGbSNtJN0JJKTQdChujiGYQ-VGfM1BKQ8__OyXIDNNXbzOl0z0Fy9LbfW_6duFoOnPfBtp4E6PC1ui2TsUW0YeVoTdAMXo_8JgIlG3qsxh9qK6j9vM&ui=R40UBoveGXf0bBi43pBLOvbWwvziNp_1xLgNeF8Zj-hlk-W7NzGmtgd3Jdb3FXnHJSkP4vPPBYrajDXqbk4J3vbxH8oVC1RqDMvJPjYGOSdZL025KMOWwQ&si=1&oref=40e4dd1dffdebf956ec44f4e69a0954c&optunit=Z3ZTVPoyhs5hFIh15jir-2WSQsQHXjql&rb=xpilJuU8uhk&rr=1&isco=t&abtg=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.117.247.211 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: d3.f7.7534.ip4.static.sl-reverse.com
Software: nginx /
Resource Hash: 704e1a0faf14742902dc882439df4eb1d40f1b88500999412e7045bb4da13723

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=ISO-8859-1
date: Fri, 23 Jun 2023 15:34:04 GMT
server: nginx
vary: Accept-Encoding

Redirect headers

content-length: 0
date: Fri, 23 Jun 2023 15:34:04 GMT
location: https://p374591.myckdom.com/adServe/domainClick?ai=KH3sNciCPPoYAgm9ynsJlM98ZrHj-N0rl_kLECECCYSa2U3E2kWB7tcRSvuwOr-V7tPSf7OiZprzn3Hig8mF4FhGdKUqq2eWoKe_r3SbM0YzW8vUbE2iDs7Tejv1_e9UbxjNS0ztqciY-sGiQOkCSV22tRDsvu5tje0dlVJ5w2bi9eDmkAdZ9eQwq1Q051dLuPbZZy59kg0SittliUGUCUqBvPRUX_5Yf_1vyTLYjVsU7XNcAuIUwl5eqluxZjCfXaThdUnMcle7DZRrR8TT5Zf5CxAhAgmEp0OdqGvuTddiVnQIGgxQDiU7ugF2M-yuGRZZbQl31jyNqat9Zag8aCT4wVIzB4sUVr5zdXV-roWAvsy17o8fXd3zJRthYC80Q_sfkUz57CLHl0cP40PY-tOuCg1e2kATdM5ECUeELJfkQmjZE96sjp8DPbGbSNtJN0JJKTQdChujiGYQ-VGfM1BKQ8__OyXIDNNXbzOl0z0Fy9LbfW_6duFoOnPfBtp4E6PC1ui2TsUW0YeVoTdAMXo_8JgIlG3qsxh9qK6j9vM&ui=R40UBoveGXf0bBi43pBLOvbWwvziNp_1xLgNeF8Zj-hlk-W7NzGmtgd3Jdb3FXnHJSkP4vPPBYrajDXqbk4J3vbxH8oVC1RqDMvJPjYGOSdZL025KMOWwQ&si=1&oref=40e4dd1dffdebf956ec44f4e69a0954c&optunit=Z3ZTVPoyhs5hFIh15jir-2WSQsQHXjql&rb=xpilJuU8uhk&rr=1&isco=t&abtg=0
server: nginx

GET
H2 200 track
clkdeals.com/adServe/ 49 B
197 B 209ms
66ms Image
image/gif 52.116.53.146
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clkdeals.com/adServe/track?subid=90450520367&prdid=2750&price=0
Requested by: Host: p374591.myckdom.com
URL: https://p374591.myckdom.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.116.53.146 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 92.35.7434.ip4.static.sl-reverse.com
Software: nginx /
Resource Hash: 8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 15:34:04 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
content-length: 49
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 aff Show response
241.trackingms.com/adServe/ 735 B
601 B 296ms
142ms Document
text/html 52.116.53.151
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://241.trackingms.com/adServe/aff?oid=989963&pid=294080&subid=90450520367&dp1=442569856&dp3=UNKNOWN
Requested by: Host: p374591.myckdom.com
URL: https://p374591.myckdom.com/adServe/domainClick?ai=KH3sNciCPPoYAgm9ynsJlM98ZrHj-N0rl_kLECECCYSa2U3E2kWB7tcRSvuwOr-V7tPSf7OiZprzn3Hig8mF4FhGdKUqq2eWoKe_r3SbM0YzW8vUbE2iDs7Tejv1_e9UbxjNS0ztqciY-sGiQOkCSV22tRDsvu5tje0dlVJ5w2bi9eDmkAdZ9eQwq1Q051dLuPbZZy59kg0SittliUGUCUqBvPRUX_5Yf_1vyTLYjVsU7XNcAuIUwl5eqluxZjCfXaThdUnMcle7DZRrR8TT5Zf5CxAhAgmEp0OdqGvuTddiVnQIGgxQDiU7ugF2M-yuGRZZbQl31jyNqat9Zag8aCT4wVIzB4sUVr5zdXV-roWAvsy17o8fXd3zJRthYC80Q_sfkUz57CLHl0cP40PY-tOuCg1e2kATdM5ECUeELJfkQmjZE96sjp8DPbGbSNtJN0JJKTQdChujiGYQ-VGfM1BKQ8__OyXIDNNXbzOl0z0Fy9LbfW_6duFoOnPfBtp4E6PC1ui2TsUW0YeVoTdAMXo_8JgIlG3qsxh9qK6j9vM&ui=R40UBoveGXf0bBi43pBLOvbWwvziNp_1xLgNeF8Zj-hlk-W7NzGmtgd3Jdb3FXnHJSkP4vPPBYrajDXqbk4J3vbxH8oVC1RqDMvJPjYGOSdZL025KMOWwQ&si=1&oref=40e4dd1dffdebf956ec44f4e69a0954c&optunit=Z3ZTVPoyhs5hFIh15jir-2WSQsQHXjql&rb=xpilJuU8uhk&rr=1&isco=t&abtg=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.116.53.151 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 97.35.7434.ip4.static.sl-reverse.com
Software: nginx /
Resource Hash: a12af41bcd5b65ea43314443ec9d531768e5ad497f6e8c1c531adf980c7b9b3c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=ISO-8859-1
date: Fri, 23 Jun 2023 15:34:04 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 track
clkdeals.com/adServe/ 49 B
196 B 68ms
66ms Image
image/gif 52.116.53.146
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clkdeals.com/adServe/track?subid=90450488112&prdid=2750&price=0
Requested by: Host: 241.trackingms.com
URL: https://241.trackingms.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.116.53.146 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 92.35.7434.ip4.static.sl-reverse.com
Software: nginx /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 15:34:04 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
content-length: 49
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

rd2 Show response
rd.bizrate.com/
Redirect Chain

https://go.shopyourlikes.com/pi/39a9f07405e997116e7281a26286308da686ac75?afId=725724&afCampaignId=MF&afPlacementId=186631&afRid=90450488112
https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mi...

15 KB
16 KB

444ms
165ms

Document
text/html

192.138.218.207
SHOPZILLA

General

Check archive.org

Show headers Download Go to

Full URL: https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913
Requested by: Host: 241.trackingms.com
URL: https://241.trackingms.com/adServe/aff?oid=989963&pid=294080&subid=90450520367&dp1=442569856&dp3=UNKNOWN
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.138.218.207 , United States, ASN14332 (SHOPZILLA, US),
Reverse DNS: rd.bizrate.com
Software: nginx/1.20.1 /
Resource Hash: f3307f4a100558839aa3be6600bbba289d19bf194cb85cb0e5cb674477009e87

Request headers

Referer: https://241.trackingms.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache no-store
Connection: keep-alive
Content-Language: en-US
Content-Type: text/html;charset=UTF-8
Date: Fri, 23 Jun 2023 15:34:05 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP ADM DEV PSD TAI OUR IND STP PRE NAV UNI"
Pragma: no-cache
Server: nginx/1.20.1
Transfer-Encoding: chunked

Redirect headers

Connection: keep-alive
Date: Fri, 23 Jun 2023 15:34:05 GMT
Location: https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913
P3P: CP="NON DSP ADM DEV PSD TAI OUR IND STP PRE NAV UNI"
Server: nginx/1.20.1
Transfer-Encoding: chunked

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 186 KB
68 KB 336ms
92ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1070533785

Requested by

Host: rd.bizrate.com
URL: https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d5e8c8a77ee331ce0472277e3adf0f703bb71569f17af73300292f6ca26280d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 15:34:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69384
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 23 Jun 2023 15:34:06 GMT

GET
H/1.1 200
OK ads.js Show response
s5.cnnx.io/s2static/us/br/7010a908/br3/js/ 22 B
540 B 305ms
63ms Script
application/javascript 108.139.29.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s5.cnnx.io/s2static/us/br/7010a908/br3/js/ads.js?a=1&ad_code=1
Requested by: Host: rd.bizrate.com
URL: https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.29.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-29-103.jfk50.r.cloudfront.net
Software: nginx/1.20.1 /
Resource Hash: a3148adeb204b3a8581d4774b05c2c46a9dca4c18e1b183223603ebb53375799

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 15 Jun 2023 05:10:33 GMT
Via: 1.1 3a80316ee74668c7049eb31054a07168.cloudfront.net (CloudFront)
Last-Modified: Thu, 18 May 2023 18:51:04 GMT
Server: nginx/1.20.1
X-Amz-Cf-Pop: JFK50-P2
Age: 728613
ETag: "16-5fbfc49521600"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22
X-Amz-Cf-Id: 3jcQ7eYS_kyayCTiiCd88oECs8Iv3OCmQOmmRynz_YiEuniRXk1-Cw==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 112 KB
29 KB 295ms
66ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b9d9c248d1c87f59c7f19b198c5ed7310a4bfd0f57759dd87d649b00ec9fdb5b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 23 Jun 2023 15:34:06 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 28296
x-xss-protection: 0
pragma: public
x-fb-debug: SSMfpwwHmU38njLR1R4psw6ZxnhSyTWgqXrcwA4BvY0sI9S6+kO5nlmd7VWS79mDzDlCRxrm1pKOT+15mNkNuA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 40 KB
12 KB 296ms
67ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Fri, 23 Jun 2023 15:34:05 GMT
last-modified: Thu, 11 May 2023 18:08:27 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9998D88962654A35BF41BCA34BD1F752 Ref B: MIAEDGE1711 Ref C: 2023-06-23T15:34:06Z
etag: "80df77953384d91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 12183

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 18 KB
7 KB 289ms
61ms Script
application/javascript 2001:4998:14:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e4164edd6af46ad5e9c02a482bdcd2a9c3e9eb199cee06bcd12cc751ce73de87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 15:33:35 GMT
x-amz-version-id: pM_8Podf2LG1oYqe3ugSKxJX2zCnEaDh
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: MJ7WKPZ6RRJRQ73Z
age: 32
x-amz-server-side-encryption: AES256
x-amz-id-2: awpdhrsVdSzeNE5+EKravQQdxM7WkI/2I+WV9IMRy3KOvhsOisfT9qNWOLKJ3HYcQHI5Fk8UB/A=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 12 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 07 Jun 2023 11:01:50 GMT
server: ATS
etag: "62d9fe1cc1697022ba0fe2a4d038b308-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H/1.1

200
OK

cse
pxl.connexity.net/c/
Redirect Chain

https://loadus.exelator.com/load/?p=204&g=92&j=0
https://loadus.exelator.com/load/?p=204&g=92&j=0&xl8blockcheck=1
https://pxl.connexity.net/c/cse?a=R&A=292&D=6a0d&V=9&I0k=ptnrid&I0v=78380866f9a0323d365ac0f0daced818&b=1687534446171

44 B
771 B

606ms
132ms

Image
image/gif

64.19.224.208
SHOPZILLA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pxl.connexity.net/c/cse?a=R&A=292&D=6a0d&V=9&I0k=ptnrid&I0v=78380866f9a0323d365ac0f0daced818&b=1687534446171
Requested by: Host: rd.bizrate.com
URL: https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913
Protocol: HTTP/1.1
Server: 64.19.224.208 , United States, ASN14332 (SHOPZILLA, US),
Reverse DNS
Software: nginx /
Resource Hash: 6d1743a4b9cd803083da5fd65626a4e92edebe73a40ee18f60276c96492b4afd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 15:34:06 GMT
Server: nginx
Transfer-Encoding: chunked
P3P: policyref="/w3c/p3p.xml", CP="CAO PSA OUR CURa DEVa PSDo PSAo BUS COR UNI COM",an.pp="http://www.connexity.com/privacy",an.oo="http://www.connexity.com/privacy",an.bt="N"
Content-Type: image/gif
Cache-Control: no-store, max-age=-1, post-check=0, pre-check=0
Content-Transfer-Encoding: binary
Connection: keep-alive
Expires: -1

Redirect headers

date: Fri, 23 Jun 2023 15:34:06 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://pxl.connexity.net/c/cse?a=R&A=292&D=6a0d&V=9&I0k=ptnrid&I0v=78380866f9a0323d365ac0f0daced818&b=1687534446171
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
content-length: 0

GET
H2 204 17135630.js Show response
bat.bing.com/p/action/ 0
116 B 71ms
71ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17135630.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Fri, 23 Jun 2023 15:34:05 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 682114AEC9364CA3A98F2CAA4D800541 Ref B: MIAEDGE1711 Ref C: 2023-06-23T15:34:06Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
230 B 93ms
92ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17135630&Ver=2&mid=73e0cabc-1c65-427a-bd16-7f4cc591aa4c&sid=6391226011db11ee8f20f139e3559b0b&vid=6391332011db11ee90753d2b531c45d4&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&p=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&r=&lt=1010&evt=pageLoad&sv=1&rn=537535

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 23 Jun 2023 15:34:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C812D0C941304BE8A2B5C25109553ECF Ref B: MIAEDGE1711 Ref C: 2023-06-23T15:34:06Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
359 B 90ms
90ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17135630&Ver=2&mid=73e0cabc-1c65-427a-bd16-7f4cc591aa4c&sid=6391226011db11ee8f20f139e3559b0b&vid=6391332011db11ee90753d2b531c45d4&vids=0&msclkid=N&pagetype=searchresults&p=https%3A%2F%2Frd.bizrate.com%2Frd2&sw=1600&sh=1200&sc=24&evt=custom&rn=339616

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 23 Jun 2023 15:34:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2CBC98B2B3C449739A2CC381D521E1EC Ref B: MIAEDGE1711 Ref C: 2023-06-23T15:34:06Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10135448.json Show response
s.yimg.com/wi/config/ 2 B
452 B 185ms
61ms XHR
application/json 2001:4998:14:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10135448.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 15:30:00 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: 1Q84ZDJSM6S5TM0P
age: 246
content-length: 2
x-amz-id-2: dio0mGJL4eQrvd+2y3Nk5yGV4UGWD52J9TkAxWY04gUa/P6mSwMr6J1lVGFMTjrGBqkLZP4+Z+U=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: public,max-age=3600

GET
H2 200 1593772137433234 Show response
connect.facebook.net/signals/config/ 301 KB
86 KB 80ms
74ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1593772137433234?v=2.9.108&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3ca7ae3bffe682d9058c94f7a817e67957e4f9e6eab1448c98f44a7d1958f241

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 23 Jun 2023 15:34:06 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 88277
x-xss-protection: 0
pragma: public
x-fb-debug: /l33SnxQszDyNIEmwYAQEObPD51ZRduDTpcEZ8aosa/D2YzqaKIP6pmoyuweRXOhF9/5cHg8pVdaNTkw+sXlxA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1070533785/ 3 KB
2 KB 325ms
92ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070533785/?random=1687534446261&cv=11&fst=1687534446261&bg=ffffff&guid=ON&async=1&gtm=45be36l0&u_w=1600&u_h=1200&url=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&hn=www.googleadservices.com&frm=0&auid=1230939469.1687534446&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1070533785

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca2537f66b3654c78b4e90215809bcfb85bccb3d0b039e6ee9ac2616510acfe1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 15:34:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1578
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1070533785/ 3 KB
2 KB 312ms
90ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070533785/?random=1687534446302&cv=11&fst=1687534446302&bg=ffffff&guid=ON&async=1&gtm=45be36l0&u_w=1600&u_h=1200&url=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&hn=www.googleadservices.com&frm=0&auid=1230939469.1687534446&uamb=0&uaw=0&data=event%3Dpage_view%3Becomm_pagetype%3Dproduct%3Becomm_prodid%3D&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1070533785

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03bb6a03dcfaf9b2b4ba688a94fadd8b3da192830c595627b65cc384b25a91fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 15:34:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1598
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
245 B 272ms
79ms Image
image/gif 76.13.32.146
YAHOO-BF1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2023%20Jun%202023%2015%3A34%3A06%20GMT&n=0&.yp=10135448&f=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&enc=UTF-8&yv=1.15.0&tagmgr=gtm

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.13.32.146 Lockport, United States, ASN26101 (YAHOO-BF1, US),

Reverse DNS

spdc.pbp.vip.bf1.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 15:34:06 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Fri, 23 Jun 2023 15:34:06 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
633 B 269ms
78ms Image
image/gif 76.13.32.146
YAHOO-BF1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&.yp=10135448&f=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&enc=UTF-8&yv=1.15.0&et=custom&ea=ViewProduct&product_id=&tagmgr=gtm

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.13.32.146 Lockport, United States, ASN26101 (YAHOO-BF1, US),

Reverse DNS

spdc.pbp.vip.bf1.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 15:34:06 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Fri, 23 Jun 2023 15:34:06 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 205ms
67ms Image
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1593772137433234&ev=PageView&dl=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&rl=&if=false&ts=1687534446418&sw=1600&sh=1200&v=2.9.108&r=stable&ec=0&o=30&fbp=fb.1.1687534446415.706289918&it=1687534446197&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 23 Jun 2023 15:34:06 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 205ms
68ms Image
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1593772137433234&ev=AddToCart&dl=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&rl=&if=false&ts=1687534446424&cd[content_type]=product&cd[content_ids]=%5B%22%22%5D&cd[contents]=%5B%7B%22id%22%3A%22%22%2C%22quantity%22%3A1%7D%5D&sw=1600&sh=1200&v=2.9.108&r=stable&ec=1&o=30&fbp=fb.1.1687534446415.706289918&it=1687534446197&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 23 Jun 2023 15:34:06 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 206ms
69ms Image
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1593772137433234&ev=ViewContent&dl=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&rl=&if=false&ts=1687534446426&cd[content_type]=product&cd[content_ids]=%5B%22%22%5D&cd[contents]=%5B%7B%22id%22%3A%22%22%2C%22mid%22%3A%22316282%22%2C%22atom%22%3A%22%22%7D%5D&sw=1600&sh=1200&v=2.9.108&r=stable&ec=2&o=30&fbp=fb.1.1687534446415.706289918&it=1687534446197&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 23 Jun 2023 15:34:06 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/1070533785/ 42 B
455 B 222ms
83ms Image
image/gif 2607:f8b0:4006:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1070533785/?random=1687534446302&cv=11&fst=1687532400000&bg=ffffff&guid=ON&async=1&gtm=45be36l0&u_w=1600&u_h=1200&url=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&frm=0&data=event%3Dpage_view%3Becomm_pagetype%3Dproduct%3Becomm_prodid%3D&fmt=3&is_vtc=1&random=448981287&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2004 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 15:34:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1070533785/ 42 B
108 B 222ms
85ms Image
image/gif 2607:f8b0:4006:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1070533785/?random=1687534446261&cv=11&fst=1687532400000&bg=ffffff&guid=ON&async=1&gtm=45be36l0&u_w=1600&u_h=1200&url=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&frm=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2200888985&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2004 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 15:34:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK interstitial-redirect-publisher-min-javascript-abtest-remarketing
rd.bizrate.com/em/ 43 B
467 B 146ms
145ms Ping
image/gif 192.138.218.207
SHOPZILLA

General

Check archive.org

Show headers Download Go to

Full URL: https://rd.bizrate.com/em/interstitial-redirect-publisher-min-javascript-abtest-remarketing
Requested by: Host: rd.bizrate.com
URL: https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.138.218.207 , United States, ASN14332 (SHOPZILLA, US),
Reverse DNS: rd.bizrate.com
Software: nginx/1.20.1 /
Resource Hash

Request headers

Referer: https://rd.bizrate.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 15:34:06 GMT
Server: nginx/1.20.1
P3P: CP="NON DSP ADM DEV PSD TAI OUR IND STP PRE NAV UNI"
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

Primary Request /
www.elfcosmetics.com/
Redirect Chain

https://rd.connexity.net/rd2?mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308...
https://www.elfcosmetics.com/?utm_source=Paid_Search&utm_medium=cpc&utm_campaign=connexity&cnxclid=16875344456998080343310090301008005&utm_term=16875344456998080343310090301008005

103 KB
0

1671ms
1489ms

Document
text/html

204.2.131.64

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/?utm_source=Paid_Search&utm_medium=cpc&utm_campaign=connexity&cnxclid=16875344456998080343310090301008005&utm_term=16875344456998080343310090301008005
Requested by: Host: rd.bizrate.com
URL: https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.2.131.64 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://rd.bizrate.com/rd2?t=https%3A%2F%2Fwww.elfcosmetics.com%2F%3Futm_source%3DPaid_Search%26utm_medium%3Dcpc%26utm_campaign%3Dconnexity%26cnxclid%3DSZ_REDIRECT_ID%26utm_term%3DSZ_REDIRECT_ID&mid=316282&dMid=316282&tokenId=18P&bId=314&bidType=11&a=b79e3374317fac778f936ee8c03726c1&af_id=725724&af_rid=90450488112&af_permalink_id=39a9f07405e997116e7281a26286308da686ac75&cobrand=1&af_placement_id=186631&afCampaignId=MF&rf_code=af1&af_assettype_id=14&af_creative_id=2913
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 0
content-encoding: gzip
content-length: 217115
content-type: text/html; charset=utf-8
date: Fri, 23 Jun 2023 15:34:08 GMT
etag: W/"b0444-BboFzbkj+x/9MrYy3+7IWNboFBk"
vary: Accept-Encoding
via: 1.1 4d5a0f70d1ac913d9a695c407458cff6.cloudfront.net (CloudFront)
x-amz-apigw-id: G-o5eHs1CYcFmtg=
x-amz-cf-id: U2WKqa-Da-_XB9lxygIwSMhafTW79_HiyPHG_m7oPpksrm0TvLgqOA==
x-amz-cf-pop: ORD52-C3
x-amzn-remapped-connection: close
x-amzn-remapped-content-length: 721988
x-amzn-remapped-date: Fri, 23 Jun 2023 15:34:08 GMT
x-amzn-requestid: 9fc4c177-c454-4e37-b84d-6f2049cd4562
x-amzn-trace-id: Root=1-6495bb6f-311ff2101824730508a9064b;Sampled=0;lineage=2b75b0e9:0
x-cache: Miss from cloudfront
x-yottaa-metrics: 2621cc02832e/[1174,1027,-] 26D1cc028340/[-,1306.903]
x-yottaa-optimizations: ob/1000000100001000 si/26D1cc028340-1687441174-7640135876 tts/1687452103935 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-yottaa-os: 200

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Fri, 23 Jun 2023 15:34:07 GMT
Location: https://www.elfcosmetics.com/?utm_source=Paid_Search&utm_medium=cpc&utm_campaign=connexity&cnxclid=16875344456998080343310090301008005&utm_term=16875344456998080343310090301008005
P3P: CP="This is not a P3P policy. Learn why here: http://connexity.com/privacy-policy/"
Referer: https://rd.bizrate.com/
Server: nginx/1.20.1
X-Application-Context: application:7500

GET
H2 200 /
www.facebook.com/tr/ 0
54 B 67ms
65ms Image
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1593772137433234&ev=Microdata&dl=https%3A%2F%2Frd.bizrate.com%2Frd2%3Ft%3Dhttps%253A%252F%252Fwww.elfcosmetics.com%252F%253Futm_source%253DPaid_Search%2526utm_medium%253Dcpc%2526utm_campaign%253Dconnexity%2526cnxclid%253DSZ_REDIRECT_ID%2526utm_term%253DSZ_REDIRECT_ID%26mid%3D316282%26dMid%3D316282%26tokenId%3D18P%26bId%3D314%26bidType%3D11%26a%3Db79e3374317fac778f936ee8c03726c1%26af_id%3D725724%26af_rid%3D90450488112%26af_permalink_id%3D39a9f07405e997116e7281a26286308da686ac75%26cobrand%3D1%26af_placement_id%3D186631%26afCampaignId%3DMF%26rf_code%3Daf1%26af_assettype_id%3D14%26af_creative_id%3D2913&rl=&if=false&ts=1687534447924&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.108&r=stable&ec=3&o=30&fbp=fb.1.1687534446415.706289918&it=1687534446197&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rd.bizrate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 23 Jun 2023 15:34:07 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST 0
bat.bing.com/actionp/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bat.bing.com
URL: https://bat.bing.com/actionp/0?ti=17135630&Ver=2&mid=73e0cabc-1c65-427a-bd16-7f4cc591aa4c&sid=6391226011db11ee8f20f139e3559b0b&vid=6391332011db11ee90753d2b531c45d4&vids=0&msclkid=N&evt=pageHide

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.myckdom.com/	1970-01-20 17:04:46	Name: rhid Value: 83366715352
.myckdom.com/	1970-01-20 12:45:38	Name: loi Value: ad_1194587_off_638358_aff_12590_cid_374591-ELFDOSMETICS.COM_ts_1687534444
241.trackingms.com/	1970-01-20 17:04:46	Name: rhid Value: 83366723799
.bizrate.com/	1970-01-20 12:47:00	Name: sessionid Value: 120131050411931645
.bizrate.com/	1970-01-20 22:21:34	Name: br Value: 16875344454062730138502010301003762
.bizrate.com/	1970-01-20 12:47:00	Name: _data Value: _time%3A%3Astart_time%3D1687534445%3Btimestamp%3D1687534445%7Ctracker%3A%3Ahtcnt%3D1%3Brf%3Dcldaf1%3Brf2%3D%3Bvsc%3Ddau%3Baf_id%3Baf_assettype_id%3Baf_creative_id%3Baf_placement_id%7Cdnt%3A%3Aon%3D0%3Bsrc%3D0
.bizrate.com/	1970-01-20 12:47:00	Name: rng Value: 9682768
.bizrate.com/	1970-01-20 13:28:46	Name: redirect_data Value: eyJvIjpbXSwibSI6WzMxNjI4Ml0sImMiOltdLCJiIjpbXX0=
.bizrate.com/	1970-01-20 13:28:46	Name: roi_cookie Value: 16875344456998080343310090301008005%7C316282
.bizrate.com/	1970-01-20 13:28:46	Name: roi_mid_attr Value: 316282%3A316282
.bizrate.com/	1970-01-20 12:47:00	Name: _uetsid Value: 6391226011db11ee8f20f139e3559b0b
.bizrate.com/	1970-01-20 22:07:10	Name: _uetvid Value: 6391332011db11ee90753d2b531c45d4
.exelator.com/	1970-01-20 15:38:22	Name: EE Value: "78380866f9a0323d365ac0f0daced818"
.exelator.com/	1970-01-20 15:38:22	Name: ud Value: "eJxrXxzq6XKLQcHcwtjCwMLMLM0y0cDYyDjF2Mw0MdkgzSAlMTk1xcLQYnFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDQZEl%252BUWb6otDgxUUpaQyLSopPBR8pKQIAivUqMA%253D%253D"
.bat.bing.com/	1970-01-20 12:55:39	Name: MR Value: 0
.bing.com/	1970-01-20 22:07:10	Name: MUID Value: 06ECB4BE05146C5A2C59A78704AA6D74
.bizrate.com/	1970-01-20 14:55:10	Name: _gcl_au Value: 1.1.1230939469.1687534446
.bizrate.com/	1970-01-20 14:55:10	Name: _fbp Value: fb.1.1687534446415.706289918
.yahoo.com/	1970-01-20 21:31:32	Name: A3 Value: d=AQABBG67lWQCEBraOpQDCjcHW7f2h5hn4UcFEgEBAQEMl2SfZNxH0iMA_eMAAA&S=AQAAAnts8p-UqOF_qTIv9Uhwg7Y
.doubleclick.net/	1970-01-20 12:45:35	Name: test_cookie Value: CheckForPermission
.connexity.net/	1970-01-20 22:21:34	Name: COu Value: e86d417d3572d7b4-075c5e4b2db8398a-20638c1676f7335c
.connexity.net/	1970-01-20 22:21:34	Name: br Value: 16875344454062730138502010301003762
.connexity.net/	1970-01-20 13:28:46	Name: rf Value: af1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

241.trackingms.com
bat.bing.com
clkdeals.com
connect.facebook.net
go.shopyourlikes.com
googleads.g.doubleclick.net
loadus.exelator.com
myckdom.com
p374591.myckdom.com
pxl.connexity.net
rd.bizrate.com
rd.connexity.net
s.yimg.com
s5.cnnx.io
sp.analytics.yahoo.com
www.elfcosmetics.com
www.elfdosmetics.com
www.facebook.com
www.google.com
www.googletagmanager.com
bat.bing.com
108.139.29.103
167.172.228.26
192.138.218.139
192.138.218.207
2001:4998:14:800::1000
204.2.131.64
2607:f8b0:4006:817::2008
2607:f8b0:4006:823::2002
2607:f8b0:4006:824::2004
2620:1ec:c11::200
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
50.16.197.56
52.116.53.146
52.116.53.151
52.117.247.211
64.19.224.208
76.13.32.146
03bb6a03dcfaf9b2b4ba688a94fadd8b3da192830c595627b65cc384b25a91fa
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
3ca7ae3bffe682d9058c94f7a817e67957e4f9e6eab1448c98f44a7d1958f241
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
6d1743a4b9cd803083da5fd65626a4e92edebe73a40ee18f60276c96492b4afd
704e1a0faf14742902dc882439df4eb1d40f1b88500999412e7045bb4da13723
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
a12af41bcd5b65ea43314443ec9d531768e5ad497f6e8c1c531adf980c7b9b3c
a3148adeb204b3a8581d4774b05c2c46a9dca4c18e1b183223603ebb53375799
b9d9c248d1c87f59c7f19b198c5ed7310a4bfd0f57759dd87d649b00ec9fdb5b
ca2537f66b3654c78b4e90215809bcfb85bccb3d0b039e6ee9ac2616510acfe1
d5e8c8a77ee331ce0472277e3adf0f703bb71569f17af73300292f6ca26280d4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4164edd6af46ad5e9c02a482bdcd2a9c3e9eb199cee06bcd12cc751ce73de87
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3307f4a100558839aa3be6600bbba289d19bf194cb85cb0e5cb674477009e87

www.elfcosmetics.com Open in urlscan Pro 204.2.131.64 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

29 Requests

93 %HTTPS

39 %IPv6

18 Domains

20 Subdomains

16 IPs

1 Countries

229 kBTransfer

782 kBSize

23 Cookies

0 Outgoing links

Page URL History

Redirected requests

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

www.elfcosmetics.com Open in urlscan Pro
204.2.131.64 Public Scan

Screenshot
Live screenshot

Full Image

29
Requests

93 %
HTTPS

39 %
IPv6

18
Domains

20
Subdomains

16
IPs

1
Countries

229 kB
Transfer

782 kB
Size

23
Cookies

29 HTTP transactions
0 data transactions