www.elfcosmetics.com Open in urlscan Pro
64.71.161.112 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cosmeticcrimal.ca/
Effective URL:
https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Submission: On May 11 via api (May 11th 2024, 8:40:06 am UTC) from US — Scanned from CA

Summary HTTP 213 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 66 IPs in 4 countries across 52 domains to perform 213 HTTP transactions. The main IP is 64.71.161.112, located in United States and belongs to YOTTAA-AS-1, US. The main domain is www.elfcosmetics.com. The Cisco Umbrella rank of the primary domain is 80089.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 25th 2023. Valid for: a year.

This is the only time www.elfcosmetics.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	204.2.133.238 204.2.133.238	393259 (YOTTAA-AS-1) (YOTTAA-AS-1)
1 14	64.71.161.112 64.71.161.112	393259 (YOTTAA-AS-1) (YOTTAA-AS-1)
2 8	2600:1408:c40... 2600:1408:c400:e::17cd:6a1a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2607:f8b0:400... 2607:f8b0:4004:c19::5b	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:600... 2a04:4e42:600::649	54113 (FASTLY) (FASTLY)
2	2600:1408:c40... 2600:1408:c400:e::17cd:6a10	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	151.101.66.133 151.101.66.133	54113 (FASTLY) (FASTLY)
5	35.190.10.96 35.190.10.96	15169 (GOOGLE) (GOOGLE)
5	2606:4700:440... 2606:4700:4400::ac40:965f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2606:4700::68... 2606:4700::6813:b134	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2607:f8b0:400... 2607:f8b0:4004:c19::61	15169 (GOOGLE) (GOOGLE)
3	2600:9000:21d... 2600:9000:21dd:a400:a:b89d:a6c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	104.26.13.205 104.26.13.205	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2607:f8b0:400... 2607:f8b0:4004:c07::66	15169 (GOOGLE) (GOOGLE)
1	2600:9000:24f... 2600:9000:24f1:da00:15:ad21:c740:93a1	16509 (AMAZON-02) (AMAZON-02)
2 3	2607:f8b0:400... 2607:f8b0:4004:c21::69	15169 (GOOGLE) (GOOGLE)
1 2	2607:f8b0:400... 2607:f8b0:4004:c07::9b	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2607:f8b0:400... 2607:f8b0:4004:c07::9a	15169 (GOOGLE) (GOOGLE)
2	44.194.41.150 44.194.41.150	14618 (AMAZON-AES) (AMAZON-AES)
7	108.139.47.127 108.139.47.127	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:23c... 2600:9000:23cb:3600:11:85b0:d600:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	54.86.47.208 54.86.47.208	14618 (AMAZON-AES) (AMAZON-AES)
1 2	54.164.102.168 54.164.102.168	14618 (AMAZON-AES) (AMAZON-AES)
3 4	68.67.179.164 68.67.179.164	29990 (ASN-APPNEX) (ASN-APPNEX)
4 4	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1 1	142.251.16.157 142.251.16.157	15169 (GOOGLE) (GOOGLE)
1 1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2607:f8b0:400... 2607:f8b0:4004:c1f::5e	15169 (GOOGLE) (GOOGLE)
1	140.174.14.148 140.174.14.148	393259 (YOTTAA-AS-1) (YOTTAA-AS-1)
1	34.102.147.248 34.102.147.248	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	151.101.193.21 151.101.193.21	54113 (FASTLY) (FASTLY)
1	23.47.22.7 23.47.22.7	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2606:4700:440... 2606:4700:4400::6812:2a49	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.164.116.94 18.164.116.94	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:23c... 2600:9000:23cb:f600:13:d6f4:3240:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2600:1408:c40... 2600:1408:c400:392::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f00... 2a03:2880:f003:c0e:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a04:4e42:200... 2a04:4e42:200::396	54113 (FASTLY) (FASTLY)
3	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
10	23.212.248.137 23.212.248.137	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2600:9000:251... 2600:9000:2514:9e00:a:7914:b00:93a1	16509 (AMAZON-02) (AMAZON-02)
2	34.120.253.250 34.120.253.250	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2607:f8b0:400... 2607:f8b0:4004:c17::65	15169 (GOOGLE) (GOOGLE)
5	34.49.124.132 34.49.124.132	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	151.101.65.21 151.101.65.21	54113 (FASTLY) (FASTLY)
2 4	142.251.163.148 142.251.163.148	15169 (GOOGLE) (GOOGLE)
2 4	142.251.163.149 142.251.163.149	15169 (GOOGLE) (GOOGLE)
2	151.101.193.140 151.101.193.140	54113 (FASTLY) (FASTLY)
2	54.237.62.243 54.237.62.243	14618 (AMAZON-AES) (AMAZON-AES)
4	3.220.193.24 3.220.193.24	14618 (AMAZON-AES) (AMAZON-AES)
2	34.98.67.3 34.98.67.3	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	151.101.193.35 151.101.193.35	54113 (FASTLY) (FASTLY)
1	54.77.225.35 54.77.225.35	16509 (AMAZON-02) (AMAZON-02)
2	108.138.106.40 108.138.106.40	16509 (AMAZON-02) (AMAZON-02)
2	192.229.210.155 192.229.210.155	15133 (EDGECAST) (EDGECAST)
1	3.232.206.92 3.232.206.92	14618 (AMAZON-AES) (AMAZON-AES)
13	34.98.72.95 34.98.72.95	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
8	23.220.128.196 23.220.128.196	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a03:2880:f10... 2a03:2880:f103:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
13	192.225.157.157 192.225.157.157	30286 (THM) (THM)
1	34.117.146.178 34.117.146.178	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.201.123.249 35.201.123.249	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.98.106.171 34.98.106.171	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	192.225.158.1 192.225.158.1	30286 (THM) (THM)
1	192.225.158.3 192.225.158.3	30286 (THM) (THM)
1	2600:1901:0:5... 2600:1901:0:56e0::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	142.250.31.156 142.250.31.156	15169 (GOOGLE) (GOOGLE)
2	34.149.130.207 34.149.130.207	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
8	34.111.8.32 34.111.8.32	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
213	66

1 204.2.133.238 (United States) 1 redirects

ASN393259 (YOTTAA-AS-1, US)

cosmeticcrimal.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 64.71.161.112 (United States) 1 redirects

ASN393259 (YOTTAA-AS-1, US)

www.elfcosmetics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:1408:c400:e::17cd:6a1a (Ashburn, United States) 2 redirects

ASN20940 (AKAMAI-ASN1, NL)

cdn.media.amplience.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c19::5b (Washington, United States)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1408:c400:e::17cd:6a10 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

cdn.static.amplience.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.66.133 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn-fsly.yottaa.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.190.10.96 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 96.10.190.35.bc.googleusercontent.com

collector-pxxt4gy2ig.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:4400::ac40:965f (United States)

ASN13335 (CLOUDFLARENET, US)

sdk.iad-05.braze.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6813:b134 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4004:c19::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:21dd:a400:a:b89d:a6c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.dynamicyield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.26.13.205 (None, )

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c07::66 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:24f1:da00:15:ad21:c740:93a1 (United States)

ASN16509 (AMAZON-02, US)

st.dynamicyield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c21::69 (Washington, United States) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c07::9b (Washington, United States) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c07::9a (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.194.41.150 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-194-41-150.compute-1.amazonaws.com

api.cquotient.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 108.139.47.127 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-47-127.jfk50.r.cloudfront.net

async-px.dynamicyield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:23cb:3600:11:85b0:d600:93a1 (United States)

ASN16509 (AMAZON-02, US)

js.cnnx.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.86.47.208 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-86-47-208.compute-1.amazonaws.com

pixel.pointmediatracker.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.164.102.168 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-164-102-168.compute-1.amazonaws.com

cnv.event.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.179.164 (North Bergen, United States) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.33.220.150 (Seattle, United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.16.157 (Farmingdale, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bl-in-f157.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.36.155 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c1f::5e (Washington, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 140.174.14.148 (Frankfurt am Main, Germany)

ASN393259 (YOTTAA-AS-1, US)

qoe-1.yottaa.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.147.248 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 248.147.102.34.bc.googleusercontent.com

tag.rmp.rakuten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.193.21 (San Francisco, United States)

ASN54113 (FASTLY, US)

www.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.47.22.7 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-47-22-7.deploy.static.akamaitechnologies.com

static.ordergroove.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:4400::6812:2a49 (United States)

ASN13335 (CLOUDFLARENET, US)

elfcosmetics.a.bigcontent.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.164.116.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-116-94.jfk50.r.cloudfront.net

t.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:23cb:f600:13:d6f4:3240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.usehero.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1408:c400:392::1931 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f003:c0e:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:200::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 23.212.248.137 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-212-248-137.deploy.static.akamaitechnologies.com

analytics.tiktok.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2514:9e00:a:7914:b00:93a1 (United States)

ASN16509 (AMAZON-02, US)

js.jebbit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.253.250 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 250.253.120.34.bc.googleusercontent.com

tag.wknd.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c17::65 (Washington, United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.49.124.132 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 132.124.49.34.bc.googleusercontent.com

sgtm.elfcosmetics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.21 (San Francisco, United States)

ASN54113 (FASTLY, US)

www.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.163.148 (Farmingdale, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: wv-in-f148.1e100.net

9231397.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.163.149 (Farmingdale, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: wv-in-f149.1e100.net

10742279.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.193.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.237.62.243 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-237-62-243.compute-1.amazonaws.com

api.usehero.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.220.193.24 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-193-24.compute-1.amazonaws.com

c.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.67.3 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 3.67.98.34.bc.googleusercontent.com

ut.rd.linksynergy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tags.rd.linksynergy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.193.35 (San Francisco, United States)

ASN54113 (FASTLY, US)

t.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.77.225.35 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-225-35.eu-west-1.compute.amazonaws.com

srm.ba.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.138.106.40 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-40.jfk50.r.cloudfront.net

cdn-scripts.signifyd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.229.210.155 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.232.206.92 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-206-92.compute-1.amazonaws.com

external-api.jebbit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 34.98.72.95 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 95.72.98.34.bc.googleusercontent.com

assets.bounceexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 23.220.128.196 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-220-128-196.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f103:83:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 192.225.157.157 (United States)

ASN30286 (THM, US)

imgs.signifyd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.146.178 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 178.146.117.34.bc.googleusercontent.com

data.cdnbasket.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.123.249 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 249.123.201.35.bc.googleusercontent.com

page.cdnbasket.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.106.171 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 171.106.98.34.bc.googleusercontent.com

view.cdnbasket.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.225.158.1 (United States)

ASN30286 (THM, US)

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.225.158.3 (United States)

ASN30286 (THM, US)

w2txo5aaqvyg3owu22twqjy4qvchbtt6d5e5yrrzb1ed5f0ffe8f7001sac.d.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:56e0:: (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

ids.cdnwidget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.31.156 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bj-in-f156.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.149.130.207 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 207.130.149.34.bc.googleusercontent.com

pd.cdnwidget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
idr.cdnwidget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.111.8.32 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 32.8.111.34.bc.googleusercontent.com

api.bounceexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
events.bouncex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	elfcosmetics.com 1 redirects www.elfcosmetics.com — Cisco Umbrella Rank: 80089 sgtm.elfcosmetics.com — Cisco Umbrella Rank: 175866	365 KB
15	signifyd.com cdn-scripts.signifyd.com — Cisco Umbrella Rank: 8143 imgs.signifyd.com — Cisco Umbrella Rank: 6962	69 KB
14	bounceexchange.com assets.bounceexchange.com — Cisco Umbrella Rank: 2384 api.bounceexchange.com — Cisco Umbrella Rank: 2673	302 KB
14	doubleclick.net 6 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 35 stats.g.doubleclick.net — Cisco Umbrella Rank: 89 cm.g.doubleclick.net — Cisco Umbrella Rank: 272 9231397.fls.doubleclick.net — Cisco Umbrella Rank: 303078 10742279.fls.doubleclick.net — Cisco Umbrella Rank: 265357	3 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 312	170 KB
11	dynamicyield.com cdn.dynamicyield.com — Cisco Umbrella Rank: 8814 st.dynamicyield.com — Cisco Umbrella Rank: 8494 async-px.dynamicyield.com — Cisco Umbrella Rank: 8693	246 KB
10	tiktok.com analytics.tiktok.com — Cisco Umbrella Rank: 712	270 KB
10	amplience.net 2 redirects cdn.media.amplience.net — Cisco Umbrella Rank: 14154 cdn.static.amplience.net — Cisco Umbrella Rank: 51671	6 MB
8	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 902	4 KB
7	bouncex.net events.bouncex.net — Cisco Umbrella Rank: 2244	754 B
7	paypal.com www.paypal.com — Cisco Umbrella Rank: 2954 t.paypal.com — Cisco Umbrella Rank: 3518	125 KB
6	contentsquare.net t.contentsquare.net — Cisco Umbrella Rank: 3447 c.contentsquare.net — Cisco Umbrella Rank: 4542 srm.ba.contentsquare.net — Cisco Umbrella Rank: 17473 k-aeu1.contentsquare.net Failed	72 KB
5	jebbit.com js.jebbit.com — Cisco Umbrella Rank: 37156 external-api.jebbit.com — Cisco Umbrella Rank: 37043	61 KB
5	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 2 analytics.google.com — Cisco Umbrella Rank: 154	423 B
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	491 KB
5	braze.com sdk.iad-05.braze.com — Cisco Umbrella Rank: 2594	1 KB
5	px-cloud.net collector-pxxt4gy2ig.px-cloud.net — Cisco Umbrella Rank: 212179	2 KB
4	google.ca www.google.ca — Cisco Umbrella Rank: 10035	253 B
4	adsrvr.org 4 redirects insight.adsrvr.org — Cisco Umbrella Rank: 691 match.adsrvr.org — Cisco Umbrella Rank: 358	2 KB
4	adnxs.com 3 redirects secure.adnxs.com — Cisco Umbrella Rank: 482 ib.adnxs.com — Cisco Umbrella Rank: 257	4 KB
4	youtube.com www.youtube.com — Cisco Umbrella Rank: 64	69 KB
4	yottaa.net cdn-fsly.yottaa.net — Cisco Umbrella Rank: 25251 Failed qoe-1.yottaa.net — Cisco Umbrella Rank: 10654	1 MB
3	cdnwidget.com ids.cdnwidget.com — Cisco Umbrella Rank: 3992 pd.cdnwidget.com — Cisco Umbrella Rank: 3940 idr.cdnwidget.com — Cisco Umbrella Rank: 8161	1 KB
3	cdnbasket.net data.cdnbasket.net — Cisco Umbrella Rank: 5153 page.cdnbasket.net — Cisco Umbrella Rank: 5166 view.cdnbasket.net — Cisco Umbrella Rank: 5161	1014 B
3	bing.com bat.bing.com — Cisco Umbrella Rank: 345	14 KB
3	usehero.com cdn.usehero.com — Cisco Umbrella Rank: 63708 api.usehero.com — Cisco Umbrella Rank: 59256	29 KB
3	bigcontent.io elfcosmetics.a.bigcontent.io — Cisco Umbrella Rank: 152476	8 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 32	21 KB
2	online-metrix.net h.online-metrix.net — Cisco Umbrella Rank: 2560 w2txo5aaqvyg3owu22twqjy4qvchbtt6d5e5yrrzb1ed5f0ffe8f7001sac.d.aa.online-metrix.net	438 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 101	400 B
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 456	837 B
2	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 2599	16 KB
2	linksynergy.com ut.rd.linksynergy.com — Cisco Umbrella Rank: 8843 tags.rd.linksynergy.com — Cisco Umbrella Rank: 5535	717 B
2	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1376	735 B
2	wknd.ai tag.wknd.ai — Cisco Umbrella Rank: 4545	6 KB
2	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1160	13 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 183	73 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 911	22 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 635	1 KB
2	bidr.io 1 redirects cnv.event.prod.bidr.io — Cisco Umbrella Rank: 11128	1 KB
2	cquotient.com api.cquotient.com — Cisco Umbrella Rank: 42720	516 B
2	ipify.org api.ipify.org — Cisco Umbrella Rank: 2924	253 B
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 126	23 B
1	ordergroove.com static.ordergroove.com — Cisco Umbrella Rank: 29952	43 KB
1	rakuten.com tag.rmp.rakuten.com — Cisco Umbrella Rank: 7849	15 KB
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 404	915 B
1	pointmediatracker.com 1 redirects pixel.pointmediatracker.com — Cisco Umbrella Rank: 4581	515 B
1	cnnx.link js.cnnx.link — Cisco Umbrella Rank: 9324	1 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 533	306 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 776	24 KB
1	cosmeticcrimal.ca 1 redirects cosmeticcrimal.ca	331 B
0	bidswitch.net Failed x.bidswitch.net Failed
213	52

	Domain	Requested by
14	www.elfcosmetics.com	1 redirects www.elfcosmetics.com cdn-fsly.yottaa.net
13	imgs.signifyd.com	www.elfcosmetics.com imgs.signifyd.com
13	assets.bounceexchange.com	www.elfcosmetics.com
12	cdn.cookielaw.org	cdn-fsly.yottaa.net cdn.cookielaw.org www.elfcosmetics.com
10	analytics.tiktok.com	www.elfcosmetics.com analytics.tiktok.com
8	ct.pinterest.com	s.pinimg.com analytics.tiktok.com www.elfcosmetics.com
8	cdn.media.amplience.net	2 redirects www.elfcosmetics.com
7	events.bouncex.net
7	async-px.dynamicyield.com	cdn.dynamicyield.com
5	sgtm.elfcosmetics.com	www.googletagmanager.com analytics.tiktok.com
5	www.paypal.com	www.elfcosmetics.com www.paypal.com analytics.tiktok.com
5	www.googletagmanager.com	www.elfcosmetics.com
5	sdk.iad-05.braze.com	cdn-fsly.yottaa.net
5	collector-pxxt4gy2ig.px-cloud.net	www.elfcosmetics.com analytics.tiktok.com
4	c.contentsquare.net	t.contentsquare.net
4	10742279.fls.doubleclick.net	2 redirects www.elfcosmetics.com
4	9231397.fls.doubleclick.net	2 redirects www.elfcosmetics.com
4	js.jebbit.com	www.elfcosmetics.com
4	www.google.ca
4	www.youtube.com	www.elfcosmetics.com
3	bat.bing.com	www.elfcosmetics.com
3	elfcosmetics.a.bigcontent.io
3	match.adsrvr.org	3 redirects
3	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
3	www.google.com	2 redirects
3	www.google-analytics.com	www.elfcosmetics.com www.google-analytics.com
3	cdn.dynamicyield.com	www.elfcosmetics.com
3	cdn-fsly.yottaa.net	www.elfcosmetics.com
2	www.facebook.com
2	idsync.rlcdn.com	2 redirects
2	www.paypalobjects.com	www.elfcosmetics.com
2	cdn-scripts.signifyd.com	www.elfcosmetics.com
2	t.paypal.com
2	api.usehero.com	cdn.usehero.com analytics.tiktok.com
2	alb.reddit.com
2	analytics.google.com	www.googletagmanager.com
2	tag.wknd.ai	www.elfcosmetics.com
2	www.redditstatic.com	www.elfcosmetics.com www.redditstatic.com
2	connect.facebook.net	www.elfcosmetics.com
2	s.pinimg.com	www.elfcosmetics.com
2	dsum-sec.casalemedia.com	1 redirects
2	ib.adnxs.com	2 redirects
2	secure.adnxs.com	1 redirects
2	cnv.event.prod.bidr.io	1 redirects
2	api.cquotient.com	cdn-fsly.yottaa.net
2	googleads.g.doubleclick.net	1 redirects www.elfcosmetics.com
2	api.ipify.org	cdn-fsly.yottaa.net
2	cdn.static.amplience.net	www.elfcosmetics.com
1	api.bounceexchange.com	www.elfcosmetics.com
1	idr.cdnwidget.com
1	pd.cdnwidget.com	analytics.tiktok.com
1	www.googleadservices.com	1 redirects
1	ids.cdnwidget.com	analytics.tiktok.com
1	w2txo5aaqvyg3owu22twqjy4qvchbtt6d5e5yrrzb1ed5f0ffe8f7001sac.d.aa.online-metrix.net
1	h.online-metrix.net	imgs.signifyd.com
1	view.cdnbasket.net	analytics.tiktok.com
1	page.cdnbasket.net	analytics.tiktok.com
1	data.cdnbasket.net	analytics.tiktok.com
1	tags.rd.linksynergy.com
1	external-api.jebbit.com	js.jebbit.com
1	srm.ba.contentsquare.net	t.contentsquare.net
1	ut.rd.linksynergy.com	www.elfcosmetics.com
1	cdn.usehero.com	www.elfcosmetics.com
1	t.contentsquare.net	www.elfcosmetics.com
1	static.ordergroove.com	www.elfcosmetics.com
1	tag.rmp.rakuten.com	www.elfcosmetics.com
1	qoe-1.yottaa.net	www.elfcosmetics.com
1	pixel.rubiconproject.com	1 redirects
1	cm.g.doubleclick.net	1 redirects
1	insight.adsrvr.org	1 redirects
1	pixel.pointmediatracker.com	1 redirects
1	js.cnnx.link	www.googletagmanager.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	st.dynamicyield.com	www.elfcosmetics.com
1	code.jquery.com	www.elfcosmetics.com
1	cosmeticcrimal.ca	1 redirects
0	x.bidswitch.net Failed
0	k-aeu1.contentsquare.net Failed	t.contentsquare.net
213	78

This site contains links to these domains. Also see Links.

Domain
cdn.dynamicyield.com
st.dynamicyield.com
rcom.dynamicyield.com
www.tiktok.com
www.instagram.com
www.pinterest.com
www.facebook.com
www.youtube.com
twitter.com
www.snapchat.com
www.linkedin.com
www.elfbeauty.com
preferences.elfcosmetics.com
www.onetrust.com

Subject Issuer	Validity	Valid
*.elfcosmetics.com Sectigo RSA Domain Validation Secure Server CA	`2023-09-25` - `2024-10-25`	a year	crt.sh
dm.amplience.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-20` - `2024-08-14`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
*.yottaa.net GlobalSign RSA OV SSL CA 2018	`2023-09-13` - `2024-10-14`	a year	crt.sh
*.px-cloud.net Sectigo RSA Domain Validation Secure Server CA	`2023-08-15` - `2024-09-13`	a year	crt.sh
sdk.iad-05.braze.com E1	`2024-04-19` - `2024-07-18`	3 months	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2024-03-01` - `2024-12-31`	10 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.dynamicyield.com Amazon RSA 2048 M02	`2023-09-03` - `2024-10-01`	a year	crt.sh
ipify.org GTS CA 1P5	`2024-03-21` - `2024-06-19`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.cquotient.com Amazon RSA 2048 M02	`2024-03-05` - `2025-04-02`	a year	crt.sh
js.cnnx.link Amazon RSA 2048 M02	`2023-07-11` - `2024-08-07`	a year	crt.sh
*.google.ca GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
tag.rmp.rakuten.com GTS CA 1D4	`2024-03-31` - `2024-06-29`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2024-02-08` - `2025-02-08`	a year	crt.sh
*.ordergroove.com Go Daddy Secure Certificate Authority - G2	`2023-08-04` - `2024-08-17`	a year	crt.sh
*.bigcontent.io GeoTrust TLS RSA CA G1	`2024-04-02` - `2025-05-03`	a year	crt.sh
t.contentsquare.net Amazon RSA 2048 M01	`2023-09-13` - `2024-10-11`	a year	crt.sh
*.usehero.com Amazon RSA 2048 M02	`2023-08-28` - `2024-09-24`	a year	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-07` - `2024-08-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-02-18` - `2024-05-18`	3 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-08` - `2024-07-06`	6 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-05-01` - `2024-06-27`	2 months	crt.sh
*.tiktok.com RapidSSL ECC CA 2018	`2023-07-14` - `2024-08-13`	a year	crt.sh
*.jebbit.com Amazon RSA 2048 M02	`2024-04-23` - `2025-05-21`	a year	crt.sh
tag.wknd.ai R3	`2024-03-19` - `2024-06-17`	3 months	crt.sh
sgtm.elfcosmetics.com GTS CA 1D4	`2024-03-17` - `2024-06-15`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-01-15` - `2024-07-13`	6 months	crt.sh
api.usehero.com Amazon RSA 2048 M03	`2024-01-06` - `2025-02-03`	a year	crt.sh
dep.bf.contentsquare.net Amazon RSA 2048 M03	`2024-02-18` - `2025-03-19`	a year	crt.sh
*.rd.linksynergy.com ZeroSSL RSA Domain Secure Site CA	`2024-01-23` - `2025-01-22`	a year	crt.sh
t.paypal.com DigiCert SHA2 Extended Validation Server CA	`2023-09-21` - `2024-10-21`	a year	crt.sh
srm.ba.contentsquare.net Amazon RSA 2048 M02	`2023-11-07` - `2024-12-06`	a year	crt.sh
cdn-scripts.signifyd.com Amazon RSA 2048 M01	`2023-07-03` - `2024-07-31`	a year	crt.sh
assets.bounceexchange.com GTS CA 1D4	`2024-03-19` - `2024-06-17`	3 months	crt.sh
imgs.signifyd.com Go Daddy Secure Certificate Authority - G2	`2023-10-20` - `2024-11-20`	a year	crt.sh
data.cdnbasket.net GTS CA 1D4	`2024-05-04` - `2024-08-02`	3 months	crt.sh
page.cdnbasket.net GTS CA 1D4	`2024-03-13` - `2024-06-11`	3 months	crt.sh
view.cdnbasket.net GTS CA 1D4	`2024-03-17` - `2024-06-15`	3 months	crt.sh
online-metrix.net Viking Cloud Organization Validation CA, Level 1	`2024-03-20` - `2024-10-21`	7 months	crt.sh
*.aa.online-metrix.net Viking Cloud Organization Validation CA, Level 1	`2024-03-20` - `2024-10-21`	7 months	crt.sh
ids.cdnwidget.com R3	`2024-03-12` - `2024-06-10`	3 months	crt.sh
pd.cdnwidget.com R3	`2024-05-11` - `2024-08-09`	3 months	crt.sh
idr.cdnwidget.com R3	`2024-05-11` - `2024-08-09`	3 months	crt.sh
*.wunderkind.co R3	`2024-04-04` - `2024-07-03`	3 months	crt.sh

This page contains 15 frames:

Primary Page: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Frame ID: 5544F1BBD7918304222571C60F5832E5
Requests: 188 HTTP requests in this frame

Frame: https://www.youtube.com/embed/bxGKZ6lfJ7A?enablejsapi=1
Frame ID: 1E07773FB4D9417626ADA17526F965EC
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/rZPCKoUReO0?enablejsapi=1
Frame ID: 06C6D46DF053E938B772F37A5611984B
Requests: 1 HTTP requests in this frame

Frame: https://www.paypal.com/credit-presentment/experiments/local?uid=uid_numhnacfzmymuvpacsidplhppphjzs&disableSetCookie=true&features=disable-set-cookie&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEtRVFGWUZkbUtOeHRaUkJvUmR2MmNodlFJLV9aUHZMMWpWTjlTRllDVHNlS1Q0T0hQS3JuVDJ5Smx4OGtXS25GSTdKWEVKTV9jVFNkYmYmaW50ZW50PWF1dGhvcml6ZSZjdXJyZW5jeT1DQUQmdmF1bHQ9dHJ1ZSZjb21wb25lbnRzPWJ1dHRvbnMsbWVzc2FnZXMiLCJhdHRycyI6eyJkYXRhLXNkay1pbnRlZ3JhdGlvbi1zb3VyY2UiOiJyZWFjdC1wYXlwYWwtanMiLCJkYXRhLXVpZCI6InVpZF9udW1obmFjZnpteW11dnBhY3NpZHBsaHBwcGhqenMifX0&env=production&scriptUID=uid_numhnacfzmymuvpacsidplhppphjzs&version=1.64.0&integrationType=SDK
Frame ID: 0788919C9EBBDD6BE1AC4E20A746ACCE
Requests: 1 HTTP requests in this frame

Frame: https://9231397.fls.doubleclick.net/activityi;dc_pre=CICf6MWZhYYDFcYTdgYdFSQPlg;src=9231397;type=retarget;cat=globa0;ord=3030601785353;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=false;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181619921z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals
Frame ID: 6B14D2C70CB3420D1AC17E0D7EC57335
Requests: 1 HTTP requests in this frame

Frame: https://10742279.fls.doubleclick.net/activityi;dc_pre=CJur6cWZhYYDFQ0PdgYdczIGlQ;src=10742279;type=elf8j0;cat=glo_flap;ord=8050526604900;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181663336z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals
Frame ID: 89C4DD374BA233572C67A194A5D4A031
Requests: 1 HTTP requests in this frame

Frame: https://ct.pinterest.com/ct.html
Frame ID: 432AD5AACE00157BAB03786DD5FDABAD
Requests: 1 HTTP requests in this frame

Frame: https://www.paypalobjects.com/muse/analytics/index.html
Frame ID: 9D2A9CA572868E0C8F767EEA052674DE
Requests: 1 HTTP requests in this frame

Frame: https://assets.bounceexchange.com/assets/bounce/local_storage_frame17.min.html
Frame ID: 0BFA6C37524A218ED29CEBAB9DF81F49
Requests: 1 HTTP requests in this frame

Frame: https://imgs.signifyd.com/-X8PVykUiJTFBxCK?25398944e1a3f768=QYC8DQ9pMQASyt634TlUPsJkdW5ya9pW_U-xRBTDtHtUm87Bm3JnHoOA4NIEVSt9julzCJ9hnl2NlBgpyUeDhQhMH65yk0-qLm89nB4VMyDFy_PEAt0H5VkQpvqJ2COP2KONN-DpOhAoCT1yFoOcGbPaPIRJTE2G5rNeewVPoCuZMfEODnPwM7t3FiXd8uhJqxMbKzUjDnPtExHZXXGvuIKogoc&jb=3d3b242662736577355d63666c677d7b2c607365355d616c6e657f7b2f3832313b26687b6875374b62706d656d2468736a3d496a7a65676d2d3a3a39383e
Frame ID: 4BE3E7D230F1ACCF93EC0C761E19C363
Requests: 11 HTTP requests in this frame

Frame: https://imgs.signifyd.com/niSEhLb2DwDQgHOR?a71ace3c16c42d88=G6Qz0no09KCqFU1MUIbMHlt3ae2y1XEFoLqUHsceJ5eE3IIclBnYb0BFFMfATISjk8grHYQG0OaEKgPh4H3iIKDSFW3aderYQYTTwSAm9tn5FqZhFfwBpbwISYBJ9EbpbebfizLRZ5JHAySxJ4g51R40dTKoUi5Vhn9j4Hixl5qnF7x6K1f0SRlnYGk1-1ZNwAXSFKNyYA9TDNzKYY-hYMdu4VRjIQ
Frame ID: AE29746CB676F5F1FBF629E37560EBE7
Requests: 1 HTTP requests in this frame

Frame: https://h.online-metrix.net/eAe_XCKZPNXKtOUS?909fa2c5a1543e9c=z1gLZptm6fIpRdzvpGBfm3yzGzqVLSGxudvDYaDcFKXOuIgPJ5Hf3h2PxzSdD3pdovcHuyUeRhBH2D_tO20Fr8Xk_MYhu87cxIBplt3Wn4lvWZbVuoCeAzXrpkcM8pBRwKiBIegqeildnuZQK32gqVF87OAP1VbQsItVUXJ2cQNKR1nJDh-j2BtdaMcAJs4wVbvSWZD-BRIWmqzt-xnO-6h5lGqpF8w
Frame ID: EEA3740930A2C2DE53164DC79A9BEFE8
Requests: 1 HTTP requests in this frame

Frame: https://imgs.signifyd.com/DE8oy331hjoltrPD?2e0e363fd439682b=Aoeq3fBcMEV3vfec99CPnRVg0cojm3_avi7_mKmyy9aOXSd2_7dDvHG-AF2JsNKIsszGXxhcoHnRQbe-vKEyXCdeaflHHRYsTpBlGeFNkVbJFp1IsHpRrihAD0sKbJsGFghxRH-e7jXAdiKtA5y2J8Jh398ah5fFlRtoEaXhThXSM81SPfVyhYTyhw5KcRf7uUcthuMzTIIpruKTRWwKj2CTg4l6lss
Frame ID: 62C3E92ACFC7954FE5DA66FF5D7177B3
Requests: 1 HTTP requests in this frame

Frame: https://9231397.fls.doubleclick.net/activityi;dc_pre=COjF8sqZhYYDFbI0dgYdhZgBHQ;src=9231397;type=retarget;cat=globa0;ord=9095524840991;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=false;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181619921z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals
Frame ID: F96363CD1339B90B3F6635F4AE9E2A6B
Requests: 1 HTTP requests in this frame

Frame: https://10742279.fls.doubleclick.net/activityi;dc_pre=CIfR8sqZhYYDFfYUdgYdM0wJIg;src=10742279;type=elf8j0;cat=glo_flap;ord=2419331686256;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181663336z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals
Frame ID: DE5FA04A5D16AFAEBFB2D3D8FE5037AC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Cosmetic Criminals | e.l.f. Cosmetics

Page URL History Show full URLs

https://cosmeticcrimal.ca/ HTTP 301
https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Page URL

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Dynamic Yield (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

cdn\.dynamicyield\.\w+/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

PerimeterX (Security) Expand

Overall confidence: 100%
Detected patterns

Rakuten (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

tag\.rmp\.rakuten\.com

basket.js (JavaScript Libraries) Expand

Overall confidence: 10%
Detected patterns

basket.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

213
Requests

93 %
HTTPS

36 %
IPv6

52
Domains

78
Subdomains

66
IPs

4
Countries

9948 kB
Transfer

19542 kB
Size

90
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://cdn.dynamicyield.com/

Search URL Search Domain Scan URL

URL: https://st.dynamicyield.com/

Search URL Search Domain Scan URL

URL: https://rcom.dynamicyield.com/

Search URL Search Domain Scan URL

URL: https://www.tiktok.com/@elfyeah/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/elfcosmetics/

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/elfcosmetics/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/elfcosmetics/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/eyeslipsfacedotcom

Search URL Search Domain Scan URL

URL: https://twitter.com/elfcosmetics

Search URL Search Domain Scan URL

URL: https://www.snapchat.com/add/elfcosmetics

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/e-l-f-beauty

Search URL Search Domain Scan URL

URL: https://www.elfbeauty.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.elfbeauty.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://preferences.elfcosmetics.com/privacy
Title: Privacy Rights Request Form

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cosmeticcrimal.ca/ HTTP 301
https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13

https://cdn.media.amplience.net/v/elfcosmetics/PWT_STORY_CRIMESCENE_VID/mp4_720p HTTP 302
https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_crimescene_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/8dfa5d11-77b7-4333-9d42-c08b194a927c.mp4

Request Chain 14

https://cdn.media.amplience.net/v/elfcosmetics/PWT_STORY_COSMETIC_CRIMINALS_VID/mp4_720p HTTP 302
https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_cosmetic_criminals_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/c5334fb2-6c51-41eb-8d3b-28107083bcd2.mp4

Request Chain 29

https://www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/authorize?redirect_uri=https%3A%2F%2Fwww.elfcosmetics.com%2Fcallback&response_type=code&client_id=f9f7052a-f742-4c38-bdf5-1da004e7fb3b&hint=guest&channel_id=elf-us&code_challenge=Ud2V1BZAxlFpiOfOBajQwpRlgH1uGtw-4946J1f_-d4 HTTP 303
https://www.elfcosmetics.com/callback?usid=c9274bd0-c4fd-4e61-8ac8-d238d69cc959&code=L1LMJnCBc4yN1F4Kkh0J2v_Nfup8H-eJFi6XEh-WZ5Y

Request Chain 33

https://www.google.com/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=1275937653.1715416793&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dma=0&npa=0&gtm=45He4580n81WL3STMXv896608294za200&auid=1776364679.1715416793 HTTP 302
https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=1275937653.1715416793&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dma=0&npa=0&gtm=45He4580n81WL3STMXv896608294za200&auid=1776364679.1715416793

Request Chain 59

https://pixel.pointmediatracker.com/kpi?c=elfcosmetics&kpi=visit&tag_id=244&fpc=becf4a1a-e525-43ef-bd14-8302ed4579c4&user_id=&utm_source=undefined&utm_medium=undefined&utm_campaign=undefined&new=undefined&gtmcb=2125782328 HTTP 302
https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=d2a52857-5659-4107-92a4-c839ca7a166c.&ord=7128298318220886170 HTTP 303
https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=d2a52857-5659-4107-92a4-c839ca7a166c.&ord=7128298318220886170&_bee_ppp=1

Request Chain 60

https://secure.adnxs.com/px?id=160890&%20seg=6104893&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D160890%26%2520seg%3D6104893%26t%3D2

Request Chain 61

https://insight.adsrvr.org/track/pxl/?adv=3ftfnh3&ct=0:8m23e30&fmt=3 HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=d5ed9a5a-e389-460c-b1ee-7b748657c7f0 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3Dd5ed9a5a-e389-460c-b1ee-7b748657c7f0 HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=3459814829854878186&ttd_tdid=d5ed9a5a-e389-460c-b1ee-7b748657c7f0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZDVlZDlhNWEtZTM4OS00NjBjLWIxZWUtN2I3NDg2NTdjN2Yw&gdpr=0&gdpr_consent=&ttd_tdid=d5ed9a5a-e389-460c-b1ee-7b748657c7f0 HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&google_gid=CAESELyXsJUtgk5dKxMCJJ94saA&google_cver=1 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&expiration=1718008795&gdpr=0&gdpr_consent= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&expiration=1718008795&gdpr=0&gdpr_consent=&C=1

Request Chain 108

https://9231397.fls.doubleclick.net/activityi;src=9231397;type=retarget;cat=globa0;ord=3030601785353;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=false;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181619921z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals HTTP 302
https://9231397.fls.doubleclick.net/activityi;dc_pre=CICf6MWZhYYDFcYTdgYdFSQPlg;src=9231397;type=retarget;cat=globa0;ord=3030601785353;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=false;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181619921z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals

Request Chain 112

https://10742279.fls.doubleclick.net/activityi;src=10742279;type=elf8j0;cat=glo_flap;ord=8050526604900;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181663336z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals HTTP 302
https://10742279.fls.doubleclick.net/activityi;dc_pre=CJur6cWZhYYDFQ0PdgYdczIGlQ;src=10742279;type=elf8j0;cat=glo_flap;ord=8050526604900;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181663336z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals

Request Chain 134

https://idsync.rlcdn.com/458359.gif?partner_uid=6dbe79cc-b314-42b0-8e6a-b91d21869909 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CPf8GxIwCiwIARCd5gEaJDZkYmU3OWNjLWIzMTQtNDJiMC04ZTZhLWI5MWQyMTg2OTkwORAAGg0I3d38sQYSBQjoBxAAQgBKAA HTTP 307
https://tags.rd.linksynergy.com/cs?ns=lr&uid3=df9797fbc93ef32359d61c2d2b594483c90d7bb5a6069cae8debe23f60e252a76ac34734d8e453ee

Request Chain 176

https://www.googleadservices.com/pagead/conversion/698270988/?random=1472750574&fst=1715416799530&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4570v9125640115z8896608294z99175401888za200&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1776364679.1715416793&bttype=purchase&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5&uip=199.48.243.0&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&s3p=1 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/698270988/?random=967453133&fst=1715416799530&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4570v9125640115z8896608294z99175401888za200&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1776364679.1715416793&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5&uip=199.48.243.0&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&s3p=1&ct_cookie_present=false&sscte=1&crd=CNm5sQIIscGxAgiwwbECCLnBsQIIl8GxAg&eitems=ChAI8K78sQYQ7ZSX_dSixoB7Eh0AFZfXVm6-oAMfN8e1k-TvAIE3nsMRHcmUIXj1rA&pscrd=IhMIkfmAyJmFhgMVuhBoCB3DSg6-MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6HWh0dHBzOi8vd3d3LmVsZmNvc21ldGljcy5jb20v HTTP 302
https://www.google.com/pagead/1p-conversion/698270988/?random=967453133&fst=1715416799530&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4570v9125640115z8896608294z99175401888za200&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1776364679.1715416793&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5&uip=199.48.243.0&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&s3p=1&ct_cookie_present=false&sscte=1&crd=CNm5sQIIscGxAgiwwbECCLnBsQIIl8GxAg&pscrd=IhMIkfmAyJmFhgMVuhBoCB3DSg6-MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6HWh0dHBzOi8vd3d3LmVsZmNvc21ldGljcy5jb20v&is_vtc=1&cid=CAQSKQB7FLtqmCY3LF6hdbaDf191p-ke_21sqjmG73BLGHUe0Uub9e088i1b&eitems=ChAI8K78sQYQ7ZSX_dSixoB7Eh0AFZfXVoaFwErWZPINuXYooXk50vM6ZL6gdtMCQg&random=419976735 HTTP 302
https://www.google.ca/pagead/1p-conversion/698270988/?random=967453133&fst=1715416799530&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4570v9125640115z8896608294z99175401888za200&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1776364679.1715416793&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5&uip=199.48.243.0&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&s3p=1&ct_cookie_present=false&sscte=1&crd=CNm5sQIIscGxAgiwwbECCLnBsQIIl8GxAg&pscrd=IhMIkfmAyJmFhgMVuhBoCB3DSg6-MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6HWh0dHBzOi8vd3d3LmVsZmNvc21ldGljcy5jb20v&is_vtc=1&cid=CAQSKQB7FLtqmCY3LF6hdbaDf191p-ke_21sqjmG73BLGHUe0Uub9e088i1b&eitems=ChAI8K78sQYQ7ZSX_dSixoB7Eh0AFZfXVoaFwErWZPINuXYooXk50vM6ZL6gdtMCQg&random=419976735&ipr=y

Request Chain 203

https://pixel.pointmediatracker.com/kpi?c=elfcosmetics&kpi=visit&tag_id=244&fpc=becf4a1a-e525-43ef-bd14-8302ed4579c4&user_id=&utm_source=undefined&utm_medium=undefined&utm_campaign=undefined&new=New&gtmcb=1131653493 HTTP 302
https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=6bac8c98-9355-4138-99b2-25f9970e0523.&ord=431674225549629506

Request Chain 207

https://insight.adsrvr.org/track/pxl/?adv=3ftfnh3&ct=0:8m23e30&fmt=3 HTTP 302
https://x.bidswitch.net/syncd?dsp_id=93&user_group=1&user_id=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch

Request Chain 211

https://9231397.fls.doubleclick.net/activityi;src=9231397;type=retarget;cat=globa0;ord=9095524840991;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=false;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181619921z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals HTTP 302
https://9231397.fls.doubleclick.net/activityi;dc_pre=COjF8sqZhYYDFbI0dgYdhZgBHQ;src=9231397;type=retarget;cat=globa0;ord=9095524840991;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=false;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181619921z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals

Request Chain 212

https://10742279.fls.doubleclick.net/activityi;src=10742279;type=elf8j0;cat=glo_flap;ord=2419331686256;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181663336z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals HTTP 302
https://10742279.fls.doubleclick.net/activityi;dc_pre=CIfR8sqZhYYDFfYUdgYdM0wJIg;src=10742279;type=elf8j0;cat=glo_flap;ord=2419331686256;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181663336z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals

213 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request elf-cosmetic-criminals Show response
www.elfcosmetics.com/en_CA/
Redirect Chain

https://cosmeticcrimal.ca/
https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

939 KB
239 KB

3118ms
2778ms

Document
text/html

64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

c0632e1970ec7ba15ad3a43afc0609446596e5ee8e7f6bab4e78f14d99f1b5af

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

age: 0
alt-svc: h3=":443"; ma=86400
cache-control: public, must-revalidate, s-maxage=900
content-encoding: gzip
content-length: 243185
content-type: text/html; charset=utf-8
date: Sat, 11 May 2024 08:39:49 GMT
etag: W/"cd8e2-Q1dvrI+4NAmDAg0wzS5BEWPXNJU"
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
via: 1.1 4f7671bb51952e26d4af9f468d98bc84.cloudfront.net (CloudFront)
x-amz-apigw-id: XmRBCHdTiYcEt5w=
x-amz-cf-id: 4HVym8PSbtVVP4WxmpNz1vJ-OV7UVXwaaHzRBiaZVVf4SNjjt9pcCg==
x-amz-cf-pop: PHL50-C1
x-amzn-remapped-connection: close
x-amzn-remapped-content-length: 841954
x-amzn-remapped-date: Sat, 11 May 2024 08:39:49 GMT
x-amzn-requestid: 44f8c2ef-c27e-4c41-837d-d50747b8e702
x-amzn-trace-id: Root=1-663f2ed3-4e60122f3000118f0238a92e;Parent=62ec9791f8aef237;Sampled=0;lineage=2b75b0e9:0
x-cache: Miss from cloudfront
x-yottaa-metrics: 23214047a164/[2474,2342,-] 23D14047a170/[-,2595.736]
x-yottaa-optimizations: ob/1000000100001000 si/23D14047a170-1715349443-8248796270 tts/1710864117465 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-yottaa-os: 200

Redirect headers

age: 0
content-length: 1197
content-type: text/html; charset=utf-8
date: Sat, 11 May 2024 08:39:46 GMT
location: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
vary: User-Agent
x-yottaa-fw: fb/100000 tid/658f1ccfd931403bb4ae2fbe rid/658f270fd931403bb4ae60d5 stid/5ad7b08e2bb0ac0c5ba3d38c
x-yottaa-metrics: 25D1cc0285ee/[-,0.176]
x-yottaa-optimizations: ob/0 si/25D1cc0285ee-1715349444-6948581096 tts/1715416786595 ti/0 ai/658f1ccfd931403bb4ae2fbe

GET
H2 200 init.js Show response
www.elfcosmetics.com/XT4Gy2ig/ 169 KB
75 KB 187ms
186ms Script
application/javascript 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: 16e39bf096710f2c65ca06172f5a70377defd3ff79d5f3f5bfde508eac55b611

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:49 GMT
content-encoding: gzip
etag: "2a230-6Pq8RT+cr6gFmTR8V292mWMKyUo"
active-cdn: Akamai
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
cache-control: max-age=600
x-yottaa-metrics: 23D14047a170/[-,84.963]
x-px-hash: ZmIzNmQ1ODQ2NjAwNzBkODUwZDdjNjBmZDAzNjg2MGVkNDMxMjcyNDFlNWY5ZDA1MWIxMDA3OTEzMDY3YWNiMA==
x-yottaa-optimizations: ob/0 si/23D14047a170-1715349443-8248796271 tts/1715416789969 ti/0 ai/5a0c9b7632f01c35d42101b2

GET /
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/en_CA/ 0
0

GET
H2 200 PWT_STORY_HEADER_DESKTOP_BG-min
cdn.media.amplience.net/i/elfcosmetics/ 630 KB
630 KB 696ms
266ms Image
image/jpeg 2600:1408:c400:e::17cd:6a1a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_HEADER_DESKTOP_BG-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:e::17cd:6a1a Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

4b89cd71669a53e8801ea9e9d4fb8a40bb5dbbb393a1b6c4a249349b42086da7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
x-content-type-options: nosniff
x-amp-srv: A
cache-tag: 6QGOL8iQ5,l4p5bDg2e,2orsu9Nt2,k4NPUWi7z
x-req-id: LP5bY-0NbN
content-length: 644728
x-xss-protection: 1; mode=block
x-amp-source-height: 1249
server: Unknown
x-frame-options: DENY
x-amp-source-width: 3199
access-control-allow-origin: *
content-type: image/jpeg
cache-control: max-age=633, s-maxage=86400
accept-ranges: bytes
x-amp-published: Wed, 20 Dec 2023 20:47:39 GMT

GET
H2 200 PWT_STORY_HEADER_DESKTOP_CC-min
cdn.media.amplience.net/i/elfcosmetics/ 205 KB
205 KB 578ms
149ms Image
image/png 2600:1408:c400:e::17cd:6a1a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_HEADER_DESKTOP_CC-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:e::17cd:6a1a Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

6ab1474b1928d39f768075dfef56e53b01fff6c85a44b07d150c4abf7299c3b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
x-content-type-options: nosniff
x-amp-srv: A
cache-tag: jV7FvZ5S2,l4p5bDg2e,HwG53bbZp,UyB2-aY-L
x-req-id: f1h5fn74u-
content-length: 209440
x-xss-protection: 1; mode=block
x-amp-source-height: 340
server: Unknown
x-frame-options: DENY
x-amp-source-width: 800
access-control-allow-origin: *
content-type: image/png
cache-control: max-age=644, s-maxage=86400
accept-ranges: bytes
x-amp-published: Wed, 20 Dec 2023 20:47:39 GMT

GET
H2 200 bxGKZ6lfJ7A
www.youtube.com/embed/ Frame 1E07 0
0 609ms
207ms Document
text/html 2607:f8b0:4004:c19::5b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/bxGKZ6lfJ7A?enablejsapi=1

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::5b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Sat, 11 May 2024 08:39:50 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 rZPCKoUReO0
www.youtube.com/embed/ Frame 06C6 0
0 674ms
274ms Document
text/html 2607:f8b0:4004:c19::5b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/rZPCKoUReO0?enablejsapi=1

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::5b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Sat, 11 May 2024 08:39:50 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 PWT_STORY_SOCIALLISTENING_DESKTOP_5-blurred-min
cdn.media.amplience.net/i/elfcosmetics/ 2 MB
2 MB 852ms
434ms Image
image/png 2600:1408:c400:e::17cd:6a1a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_SOCIALLISTENING_DESKTOP_5-blurred-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:e::17cd:6a1a Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

cdbeef0b146607f5137f8f5434eeab8625ee0801da2af33e045528d191e512d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
x-content-type-options: nosniff
x-amp-srv: A
cache-tag: 7Rff9IgA7,l4p5bDg2e,hUXp-ygcH,UyB2-aY-L
x-req-id: 27Kte03EkG
content-length: 2085695
x-xss-protection: 1; mode=block
x-amp-source-height: 1484
server: Unknown
x-frame-options: DENY
x-amp-source-width: 3080
access-control-allow-origin: *
content-type: image/png
cache-control: max-age=602, s-maxage=86400
accept-ranges: bytes
x-amp-published: Wed, 03 Jan 2024 21:02:28 GMT

GET
H2 200 PWT_STORY_DETECTIVES_DESKTOP_6-min
cdn.media.amplience.net/i/elfcosmetics/ 330 KB
331 KB 852ms
434ms Image
image/jpeg 2600:1408:c400:e::17cd:6a1a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_DETECTIVES_DESKTOP_6-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:e::17cd:6a1a Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

8cb2ac35adc7dee4b051d05a7ffc844c9f61eb67b3ce350a16a552f98ffc4172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
x-content-type-options: nosniff
x-amp-srv: A
cache-tag: h8yrLWf0O,l4p5bDg2e,q-jdDBY1E,k4NPUWi7z
x-req-id: vlCqFORosl
content-length: 338113
x-xss-protection: 1; mode=block
x-amp-source-height: 1062
server: Unknown
x-frame-options: DENY
x-amp-source-width: 2806
access-control-allow-origin: *
content-type: image/jpeg
cache-control: max-age=671, s-maxage=86400
accept-ranges: bytes
x-amp-published: Wed, 27 Dec 2023 17:21:33 GMT

GET
H2 200 PWT_STORY_ON_THE_CASE_DESKTOP_BTS-min
cdn.media.amplience.net/i/elfcosmetics/ 180 KB
180 KB 852ms
434ms Image
image/jpeg 2600:1408:c400:e::17cd:6a1a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_ON_THE_CASE_DESKTOP_BTS-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:e::17cd:6a1a Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

7a0204422805f76d793709204fd52e753cb059e5dd5099e41781499c8072e726

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
x-content-type-options: nosniff
x-amp-srv: A
cache-tag: 3sjYp_8xx,l4p5bDg2e,O8QiTHpoz,k4NPUWi7z
x-req-id: l-DXKKZvGg
content-length: 184181
x-xss-protection: 1; mode=block
x-amp-source-height: 1108
server: Unknown
x-frame-options: DENY
x-amp-source-width: 1952
access-control-allow-origin: *
content-type: image/jpeg
cache-control: max-age=658, s-maxage=86400
accept-ranges: bytes
x-amp-published: Fri, 29 Dec 2023 07:51:47 GMT

GET
H2 200 PWT_STORY_CRIME_TAPE_DESKTOP_7-min
cdn.media.amplience.net/i/elfcosmetics/ 614 KB
614 KB 852ms
435ms Image
image/png 2600:1408:c400:e::17cd:6a1a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_CRIME_TAPE_DESKTOP_7-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:e::17cd:6a1a Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

37d207a7297589d062c2af128ee513190a9297959cb24c68078f68d64b899c98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
x-content-type-options: nosniff
x-amp-srv: A
cache-tag: Oii4YgZuV,l4p5bDg2e,N2xhcEEJW,UyB2-aY-L
x-req-id: -bxwWalSrQ
content-length: 628288
x-xss-protection: 1; mode=block
x-amp-source-height: 525
server: Unknown
x-frame-options: DENY
x-amp-source-width: 3200
access-control-allow-origin: *
content-type: image/png
cache-control: max-age=595, s-maxage=86400
accept-ranges: bytes
x-amp-published: Thu, 28 Dec 2023 16:15:28 GMT

GET
H2 200 jquery-3.7.1.slim.min.js Show response
code.jquery.com/ 69 KB
24 KB 448ms
95ms Script
application/javascript 2a04:4e42:600::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.7.1.slim.min.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9261efb3407e3a9096e4654750d8eff6b3a663422f48845c7fbcc65034c340cf

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 6832663
x-cache: HIT, HIT
content-length: 24036
x-served-by: cache-lga21942-LGA, cache-yyz4568-YYZ
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1715416790.310193,VS0,VE0
etag: W/"28feccc0-11278"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 1313, 2876

GET
H2 200 player_api Show response
www.youtube.com/ 993 B
2 KB 604ms
156ms Script
text/javascript 2607:f8b0:4004:c19::5b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/player_api

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::5b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

866b0dff742f52c8ce72fb6793882fdc9cc16fa9dca416168e8ee33acac4199d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Sat, 11 May 2024 08:39:50 GMT

GET
H2

206

8dfa5d11-77b7-4333-9d42-c08b194a927c.mp4
cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_crimescene_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/
Redirect Chain

https://cdn.media.amplience.net/v/elfcosmetics/PWT_STORY_CRIMESCENE_VID/mp4_720p
https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_crimescene_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/8dfa5d11-77b7-4333-9d42-c08b194a927c.mp4

1 MB
1 MB

1274ms
284ms

Media
video/mp4

2600:1408:c400:e::17cd:6a10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_crimescene_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/8dfa5d11-77b7-4333-9d42-c08b194a927c.mp4
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Server: 2600:1408:c400:e::17cd:6a10 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b3efc48717edad187198d0a608a3b3a8195f0e5b6b6b41f27b78824796cbd61e

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Sat, 11 May 2024 08:39:52 GMT
last-modified: Fri, 22 Dec 2023 15:50:27 GMT
etag: "dd3676819bd88a250c875a11e38c307d"
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 0-1060947/1060948
x-amp-srv: A
accept-ranges: bytes
x-amp-route: ak-s1
Content-Length: 1060948

Redirect headers

date: Sat, 11 May 2024 08:39:50 GMT
x-content-type-options: nosniff
server: Unknown
x-frame-options: DENY
x-amp-srv: A
cache-tag: bCa5bgUvc,l4p5bDg2e,bgWw7nQ29
access-control-allow-origin: *
location: https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_crimescene_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/8dfa5d11-77b7-4333-9d42-c08b194a927c.mp4
content-type: text/html; charset=UTF-8
cache-control: max-age=1800, s-maxage=86400
accept-ranges: bytes
content-length: 0
x-xss-protection: 1; mode=block

GET
H2

206

c5334fb2-6c51-41eb-8d3b-28107083bcd2.mp4
cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_cosmetic_criminals_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/
Redirect Chain

https://cdn.media.amplience.net/v/elfcosmetics/PWT_STORY_COSMETIC_CRIMINALS_VID/mp4_720p
https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_cosmetic_criminals_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/c5334fb2-6c51-41eb-8d3b-28107083bcd2.mp4

1 MB
1 MB

1147ms
162ms

Media
video/mp4

2600:1408:c400:e::17cd:6a10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_cosmetic_criminals_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/c5334fb2-6c51-41eb-8d3b-28107083bcd2.mp4
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Server: 2600:1408:c400:e::17cd:6a10 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 4ae7d857dd8d096a5198b1e8280de9f929ca88d690e445731b6ffdffbf2b8383

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Sat, 11 May 2024 08:39:52 GMT
last-modified: Fri, 22 Dec 2023 17:43:50 GMT
etag: "91a2cbc7ca143aac79d0312d84bb77fb"
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 0-1262366/1262367
x-amp-srv: A
accept-ranges: bytes
x-amp-route: ak-s1
Content-Length: 1262367

Redirect headers

date: Sat, 11 May 2024 08:39:50 GMT
x-content-type-options: nosniff
server: Unknown
x-frame-options: DENY
x-amp-srv: A
cache-tag: _9zx3Bzxu,l4p5bDg2e,fH6Lo3_5e
access-control-allow-origin: *
location: https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_cosmetic_criminals_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/c5334fb2-6c51-41eb-8d3b-28107083bcd2.mp4
content-type: text/html; charset=UTF-8
cache-control: max-age=1800, s-maxage=86400
accept-ranges: bytes
content-length: 0
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 89ad311944927ce3cfae733238f317bf1a9a65c082e1c49a9d3c2ab590421e8d

Request headers

Referer
Origin: https://www.elfcosmetics.com
Accept-Language: en-CA,en;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: application/font-woff2;charset=utf-8

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93d3607ab3b6aacff8c4500a18bf501c85271bfc14950eb923f9a65ee456a7ac

Request headers

Referer
Origin: https://www.elfcosmetics.com
Accept-Language: en-CA,en;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: application/font-woff2;charset=utf-8

GET
H2 200 vendor.js Show response
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/ 2 MB
620 KB 450ms
196ms Script
application/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b2e0bde8a120edcd0e126c139ff4c62dc420e43a86bb9e22c92044fdda3fc3ef

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
via: 1.1 11ab138d0b995a9fa4daabbae7fc0b0c.cloudfront.net (CloudFront), 1.1 varnish
content-encoding: gzip
x-amz-cf-pop: EWR50-C1
age: 94992
x-yottaa-optimizations: ob/1000 si/3811cc023141-1712927895-738418657 tts/1710864117465 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-cache: Hit from cloudfront, HIT
x-amz-meta-deploy: 746186
content-length: 634413
x-amz-meta-bundle: 11187
x-served-by: cache-yyz4527-YYZ
x-yottaa-forcecache: true, true
server: AmazonS3
x-timer: S1715416790.268178,VS0,VE1
vary: Accept-Encoding
content-type: application/javascript; charset=utf8
cache-control: public, max-age=31104000
x-yottaa-metrics: 3821cc023178/[98,31,-] 3811cc023141/[-,396.367]
accept-ranges: bytes
x-amz-cf-id: 6PrS5FvdnvyfB6WSqokTxnuGNSblU3A6FEOHAfUc3PpARtJ298-rSA==
x-cache-hits: 1

GET
H2 200 main.js Show response
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/ 2 MB
485 KB 339ms
84ms Script
application/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/main.js?yocs=1u_1y_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 19cc36fffa37aa68e3eeb82532cb58611a1e1191cad33bf5edf5265f5930ff28

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
via: 1.1 173e86f2afd424b15a0a0681ea83781c.cloudfront.net (CloudFront), 1.1 varnish
content-encoding: gzip
x-amz-cf-pop: ORD56-P8
age: 819273
x-yottaa-optimizations: ob/1000 si/2611cc028373-1711982779-707011658 tts/1710864117465 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-cache: Hit from cloudfront, HIT
x-amz-meta-deploy: 742629
content-length: 495663
x-amz-meta-bundle: 11187
x-served-by: cache-yyz4527-YYZ
x-yottaa-forcecache: true, true
server: AmazonS3
x-timer: S1715416790.268135,VS0,VE1
vary: Accept-Encoding
content-type: application/javascript; charset=utf8
cache-control: public, max-age=31104000
x-yottaa-metrics: 2621cc02303b/[109,56,-] 2611cc028373/[-,418.645]
accept-ranges: bytes
x-amz-cf-id: Yhw4WnJ-UqbSVmhbe2lJXKzQLtNZrcnK5-sTbzb1MC9zc32XSDU3WA==
x-cache-hits: 1

GET
H2 200 pages-product-list-product-list-page.js Show response
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/ 42 KB
12 KB 328ms
74ms Script
application/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/pages-product-list-product-list-page.js?yocs=1u_1y_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f2461f7629a9751a8ce13d4fa6465bd4dade527356dedaa1e07be6712694ec4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
via: 1.1 d0bdb6771f06192a04a6e98c4188225c.cloudfront.net (CloudFront), 1.1 varnish
content-encoding: gzip
x-amz-cf-pop: ORD56-P8
age: 819273
x-yottaa-optimizations: ob/1000 si/2611cc8d5869-1711982775-2100080949 tts/1710864117465 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-cache: Hit from cloudfront, HIT
x-amz-meta-deploy: 742629
content-length: 11877
x-amz-meta-bundle: 11187
x-served-by: cache-yyz4527-YYZ
x-yottaa-forcecache: true, true
server: AmazonS3
x-timer: S1715416790.268167,VS0,VE0
vary: Accept-Encoding
content-type: application/javascript; charset=utf8
cache-control: public, max-age=31104000
x-yottaa-metrics: 2621cc023038/[18,16,-] 2611cc8d5869/[-,21.676]
accept-ranges: bytes
x-amz-cf-id: ToNZrsELjFeolcIu_EUe-0qujbMorE8uih8w0bKCCAsLkmOSB9RuiQ==
x-cache-hits: 461

POST
H2 200 collector Show response
collector-pxxt4gy2ig.px-cloud.net/api/v2/ 540 B
796 B 491ms
226ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxt4gy2ig.px-cloud.net/api/v2/collector
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 2d38f4f475cc275a90410a5da0b47d14d90b585185dc338105a740bb702e3f9a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 11 May 2024 08:39:50 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 540

OPTIONS
H2 200 /
sdk.iad-05.braze.com/api/v3/data/ Frame 0
0 604ms
224ms Preflight 2606:4700:4400::ac40:965f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:965f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-triggersrequest,x-requested-with
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-triggersrequest,x-requested-with
access-control-allow-methods: POST, GET
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
cf-cache-status: DYNAMIC
cf-ray: 8820dc66dcf8a234-YYZ
content-encoding: gzip
date: Sat, 11 May 2024 08:39:52 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 491ms
111ms Script
application/javascript 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/main.js?yocs=1u_1y_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a2f825beb3b540a044cdb0515177c34497aa2ce92e335bf1498fa42bb5baf88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Dw6K+rTuf8kOuPIEBw1QQA==
age: 63453
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6881
x-ms-lease-status: unlocked
last-modified: Wed, 08 May 2024 06:40:04 GMT
server: cloudflare
etag: 0x8DC6F29B1A99C59
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 0ca4e475-001e-0088-1962-a1f9b0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8820dc65fbf3ac27-YYZ

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 500 KB
135 KB 539ms
123ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WL3STMX

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9d2da5466cb139d5f69a5a2059e4650968c19781dd21a3be032d9c9160418350

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:52 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137410
x-xss-protection: 0
last-modified: Sat, 11 May 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 11 May 2024 08:39:52 GMT

GET
H2 200 api_dynamic.js Show response
cdn.dynamicyield.com/api/8772046/ 502 KB
56 KB 682ms
281ms Script
application/javascript 2600:9000:21dd:a400:a:b89d:a6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.dynamicyield.com/api/8772046/api_dynamic.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:a400:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: DYCDN /
Resource Hash: a5c9c61c23a93d1a05d6275ca1e1f939c2fae710f0f224a255428e7abe23602d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:47 GMT
content-encoding: gzip
via: 1.1 48d2977daea5b632b090c1400ef6bfcc.cloudfront.net (CloudFront)
last-modified: Wed, 08 May 2024 13:16:22 GMT
server: DYCDN
age: 6
x-amz-cf-pop: EWR53-C2
x-amz-server-side-encryption: AES256
etag: W/"098b85b9c37c7dc762ebb3dab42df057"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: max-age=30
link: <//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
x-amz-cf-id: 4LkQKfl8sJDLO-GQGHsepacN4NRz10pWM5BMizpUqC-1h3ipIBQf8g==

GET
H2 200 api_static.js Show response
cdn.dynamicyield.com/api/8772046/ 388 KB
114 KB 539ms
138ms Script
application/javascript 2600:9000:21dd:a400:a:b89d:a6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.dynamicyield.com/api/8772046/api_static.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:a400:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: DYCDN /
Resource Hash: 498ea43ee2b31ee61f58f43b798dfaec6eb59b63fefdfaa7c01bba897ba57a33

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 10 May 2024 13:16:39 GMT
content-encoding: gzip
via: 1.1 48d2977daea5b632b090c1400ef6bfcc.cloudfront.net (CloudFront)
last-modified: Wed, 08 May 2024 13:16:22 GMT
server: DYCDN
age: 69793
x-amz-cf-pop: EWR53-C2
x-amz-server-side-encryption: AES256
etag: W/"64e0187feba0c97d38f8aabb6e6d66cd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400
link: <//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
x-amz-cf-id: lxpICBWwo9DkkWM5TrHEkhKK1dSP60GqXof-2asdrDv1eq3V8L27Fg==

GET
H2 200 / Show response
api.ipify.org/ 22 B
155 B 410ms
141ms XHR
application/json 104.26.13.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41e5e5d78c15f2bed06cbf7cd62873c3287c1587bb7fd8f22620eb06c5cae895

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:51 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: application/json
access-control-allow-origin: *
cf-ray: 8820dc6569b7aae5-YYZ
content-length: 22

GET
H2 200 / Show response
api.ipify.org/ 22 B
98 B 500ms
90ms XHR
application/json 104.26.13.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41e5e5d78c15f2bed06cbf7cd62873c3287c1587bb7fd8f22620eb06c5cae895

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:52 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: application/json
access-control-allow-origin: *
cf-ray: 8820dc664a0aaae5-YYZ
content-length: 22

POST
H2 201 / Show response
sdk.iad-05.braze.com/api/v3/data/ 399 B
576 B 385ms
384ms XHR
application/json 2606:4700:4400::ac40:965f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/data/

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:965f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5747acdc028357d859f54da16a032df721c2d8fa84012660b395afd35d214a9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57
X-Braze-TriggersRequest: true
X-Braze-DataRequest: true
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-type: application/json
Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
X-Requested-With: XMLHttpRequest
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:52 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: f4d27130-dd44-4c7e-85b1-4aafade5555f
x-runtime: 0.178209
server: cloudflare
etag: W/"5747acdc028357d859f54da16a032df7"
vary: Origin,Accept-Encoding
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
x-ratelimit-reset: 1715416794
access-control-max-age: 7200
x-ratelimit-limit: 500.0
cf-ray: 8820dc684d66a234-YYZ
x-ratelimit-remaining: 497.0

GET
H2

200

callback
www.elfcosmetics.com/
Redirect Chain

https://www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/authorize?redirect_uri=https%3A%2F%2Fwww.elfcosmetics.com%2Fcallback&response_type=code&client_id=...
https://www.elfcosmetics.com/callback?usid=c9274bd0-c4fd-4e61-8ac8-d238d69cc959&code=L1LMJnCBc4yN1F4Kkh0J2v_Nfup8H-eJFi6XEh-WZ5Y

0
0

307ms
307ms

Fetch
application/json

64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/callback?usid=c9274bd0-c4fd-4e61-8ac8-d238d69cc959&code=L1LMJnCBc4yN1F4Kkh0J2v_Nfup8H-eJFi6XEh-WZ5Y

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Server

64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Sat, 11 May 2024 08:39:52 GMT
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 4f7671bb51952e26d4af9f468d98bc84.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 0
x-amz-cf-pop: PHL50-C1
age: 0
x-amzn-remapped-connection: close
x-amzn-requestid: dc96934f-1fa6-4c0d-b038-6a3acfc2e0de
x-yottaa-optimizations: ob/1000 si/23D14047a170-1715349443-8248796273 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-cache: Miss from cloudfront
x-amz-apigw-id: XmRB7ExCCYcEK9A=
content-length: 0
alt-svc: h3=":443"; ma=86400
x-yottaa-forcecache: true
x-amzn-trace-id: Root=1-663f2ed8-0461d1eb0a70e35123a44468;Parent=4fdb547239aadad6;Sampled=0;lineage=2b75b0e9:0
content-type: application/json
cache-control: public, max-age=604800
x-yottaa-os: 200
x-yottaa-metrics: 23214047a180/[203,197,-] 23D14047a170/[-,205.462]
x-amzn-remapped-date: Sat, 11 May 2024 08:39:52 GMT
x-amz-cf-id: qjWLZd7aAGajQX9izIJmxxQU0pyJVOOAUrC-d37nOyJM2zXU9rNMGw==

Redirect headers

date: Sat, 11 May 2024 08:39:52 GMT
x-correlation-id: 8820dc6988a157ee
via: 1.1 235099561ba63a2b7662a2b20d9ac036.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: PHL50-C1
age: 0
x-yottaa-optimizations: ob/0 si/23D14047a170-1715349443-8248796272 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 0
pragma: no-cache
x-ratelimit-1m-remaining: 23227, 1947471
x-ratelimit-1m-reset: 7418, 7417
x-ratelimit-1m-limit: 24000, 2000000
vary: Accept-Encoding
location: https://www.elfcosmetics.com/callback?usid=c9274bd0-c4fd-4e61-8ac8-d238d69cc959&code=L1LMJnCBc4yN1F4Kkh0J2v_Nfup8H-eJFi6XEh-WZ5Y
cache-control: no-store
x-yottaa-os: 303
x-proxy-request-url: https://6p9dgqhn.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/authorize?redirect_uri=https%3A%2F%2Fwww.elfcosmetics.com%2Fcallback&response_type=code&client_id=f9f7052a-f742-4c38-bdf5-1da004e7fb3b&hint=guest&channel_id=elf-us&code_challenge=Ud2V1BZAxlFpiOfOBajQwpRlgH1uGtw-4946J1f_-d4
x-yottaa-metrics: 23214047a17f/[75,71,-] 23D14047a170/[-,78.477]
cf-ray: 8820dc6988a157ee-IAD
x-amz-cf-id: K0xXTez2PhsGUu6gPAZdIHatKigMEAtzB_4IUQeIBIUWF9xMjSEprA==

GET
H2 200 6ee1574c-d59b-4e80-9930-2e1c3c7db4ff.json Show response
cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/ 6 KB
2 KB 472ms
113ms XHR
application/x-javascript 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

55baa715ccc8c2512bceb1c949c1d0927944ca327e7edd2d5fc312d2a41986e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 82228
content-md5: j7e7fSdncC8T3SCV/IpUig==
content-length: 1740
x-ms-lease-status: unlocked
last-modified: Mon, 08 Apr 2024 18:41:03 GMT
server: cloudflare
etag: 0x8DC57FB71838BE4
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c3fb1654-801e-0031-68e4-89d890000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8820dc691cb1aaad-YYZ
expires: Sun, 12 May 2024 08:39:52 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 517ms
117ms Script
text/javascript 2607:f8b0:4004:c07::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 11 May 2024 06:57:37 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 6135
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sat, 11 May 2024 08:57:37 GMT

GET
H2 200 st Show response
st.dynamicyield.com/ 118 KB
10 KB 649ms
150ms Script
text/javascript 2600:9000:24f1:da00:15:ad21:c740:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.dynamicyield.com/st?sec=8772046&inHead=true&id=0&jsession=h50e4hz4g3wr5uf4doqfz0u8zfvndwxv&ref=&scriptVersion=2.32.0&isSesNew=true&dyid_server=&ctx=%7B%22type%22%3A%22OTHER%22%2C%22lng%22%3A%22en-CA%22%2C%22data%22%3A%5B%5D%7D
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f1:da00:15:ad21:c740:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: ff97f5d3c81621b5d7aaaf5aa65ce6aa003df7751fd5dbf9a80a4a356fb815e3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:53 GMT
content-encoding: gzip
via: 1.1 d877346b368e974486e739220882b59e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
cache-control: no-cache
x-amz-cf-id: J5UR52jpqrGiPQUTdO9cuMsCEVlE29aiSekD5B5cKinM6RxC0h-TWA==
expires: Sat, 11 May 2024 08:39:52 GMT

GET
H3

200

landing
googleads.g.doubleclick.net/pagead/
Redirect Chain

https://www.google.com/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=1275937653.1715416793&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dma=0&npa=0&gtm=45He4580n81WL3STMXv89...
https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=1275937653.1715416793&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dma=0&npa=0&gtm=45He4580...

42 B
65 B

542ms
126ms

Ping
image/gif

2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=1275937653.1715416793&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dma=0&npa=0&gtm=45He4580n81WL3STMXv896608294za200&auid=1776364679.1715416793

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Server

2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:53 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:53 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=1275937653.1715416793&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dma=0&npa=0&gtm=45He4580n81WL3STMXv896608294za200&auid=1776364679.1715416793
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collector Show response
collector-pxxt4gy2ig.px-cloud.net/api/v2/ 600 B
664 B 198ms
196ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxt4gy2ig.px-cloud.net/api/v2/collector
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 13757862bb1b07255fb5cd6ede68eb0d486a16002a6fe600cdd259f01a089a45

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 11 May 2024 08:39:51 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 600

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
306 B 524ms
178ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a1309d2ccff026ab4dcf050977befc877505115e4777e240fa328b1781c63ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
accept: application/json
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 8820dc6bf88039c5-YYZ
access-control-allow-headers: Content-Type

POST
H2 201 sync Show response
sdk.iad-05.braze.com/api/v3/content_cards/ 85 B
252 B 229ms
229ms XHR
application/json 2606:4700:4400::ac40:965f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:965f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f216b50162bd5f4987b67548eaf5d98715fec939a7fd42ad1d8452c1529a558

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57
X-Braze-DataRequest: true
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-type: application/json
BRAZE-SYNC-RETRY-COUNT: 0
Referer: https://www.elfcosmetics.com/
X-Requested-With: XMLHttpRequest
Accept-Language: en-CA,en;q=0.9;q=0.9
X-Braze-ContentCardsRequest: true
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:53 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 146eacc6-c284-47f9-9ef8-c743263633bb
x-runtime: 0.058876
server: cloudflare
etag: W/"8f216b50162bd5f4987b67548eaf5d98"
vary: Origin,Accept-Encoding
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
x-ratelimit-reset: 1715416794
access-control-max-age: 7200
x-ratelimit-limit: 500.0
cf-ray: 8820dc6bbecaa234-YYZ
x-ratelimit-remaining: 493.0

OPTIONS
H2 200 sync
sdk.iad-05.braze.com/api/v3/content_cards/ Frame 0
0 164ms
163ms Preflight 2606:4700:4400::ac40:965f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:965f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: braze-sync-retry-count,content-type,x-braze-api-key,x-braze-contentcardsrequest,x-braze-datarequest,x-requested-with
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: braze-sync-retry-count,content-type,x-braze-api-key,x-braze-contentcardsrequest,x-braze-datarequest,x-requested-with
access-control-allow-methods: POST, GET
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
cf-cache-status: DYNAMIC
cf-ray: 8820dc6abe81a234-YYZ
content-encoding: gzip
date: Sat, 11 May 2024 08:39:52 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 132ms
131ms XHR
text/plain 2607:f8b0:4004:c07::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1714816308&t=pageview&_s=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dp=%2Fen_CA%2Felf-cosmetic-criminals&ul=en-ca&de=UTF-8&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACgAI~&jid=523226223&gjid=1378106454&cid=1017828244.1715416793&tid=UA-432816-1&_gid=1074227162.1715416793&_r=1&_slc=1&gtm=45He4580n81WL3STMXv896608294za200&gcs=G111&gcd=13t3t3t3t5&dma=0&z=1819876627

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 token Show response
www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/ 2 KB
2 KB 186ms
186ms Fetch
application/json 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/token

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

8366c029020891669a76e3026effc422022ee45b3c89345eef0bdaed3bfc2583

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
c_x-pwa-request: true
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:53 GMT
content-encoding: gzip
x-correlation-id: 8820dc6cd86b0600
cf-cache-status: DYNAMIC
via: 1.1 53e905605490f05641e5a7bb370e4b1a.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: PHL50-C1
age: 0
x-yottaa-optimizations: ob/1000 si/23D14047a170-1715349443-8248796274 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
pragma: no-cache
x-ratelimit-1m-remaining: 23220, 1947026
x-ratelimit-1m-reset: 6886, 6885
vary: Accept-Encoding, User-Agent
x-ratelimit-1m-limit: 24000, 2000000
content-type: application/json
cache-control: no-store
x-yottaa-os: 200
x-proxy-request-url: https://6p9dgqhn.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/token
x-yottaa-metrics: 23214047a189/[82,79,-] 23D14047a170/[-,84.780]
cf-ray: 8820dc6cd86b0600-IAD
x-amz-cf-id: tjgdnWjwh7Ny9m2OrEbNqXXUAjJx4itOm3SQfyxb2Bu2yY81CA5eGQ==

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202306.1.0/ 404 KB
98 KB 108ms
108ms Script
application/javascript 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def2a184135eba029f8f785b3ed69edc5f36b368226ce1fcfeda4f5aa301d1b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: XJk1ZZTljtwHFT3qcIJg+w==
age: 83929
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 99599
x-ms-lease-status: unlocked
last-modified: Wed, 12 Jul 2023 06:29:36 GMT
server: cloudflare
etag: 0x8DB82A15D413626
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: ab8cd6f5-901e-005f-7d08-7c8dbf000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8820dc6d1f1aac27-YYZ

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
352 B 571ms
195ms XHR
text/plain 2607:f8b0:4004:c07::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-432816-1&cid=1017828244.1715416793&jid=523226223&gjid=1378106454&_gid=1074227162.1715416793&_u=YEBAAEAAAAAAACgAI~&z=641456598

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 11 May 2024 08:39:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 sessions Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/ 0
1 KB 382ms
381ms XHR
text/plain 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/sessions
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiI4YzhjYTI4OC1mMWE2LTRmMDktYjI2OS0wNWQyZWViZmRmMDEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmM5Mjc0YmQwLWM0ZmQtNGU2MS04YWM4LWQyMzhkNjljYzk1OSIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MTU0MTY3NjMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmJld1hJV2xYcEd4Y2FSd1hwS3hiWVl4cndWOjpjaGlkOiAiLCJleHAiOjE3MTU0MTg1OTMsImlhdCI6MTcxNTQxNjc5MywianRpIjoiQzJDMTk1MTY2MTE4NjAtNDI0NjM3OTAzMjEwMjg3NDYxNTI4OTU2In0.ACsqn3PuT0YiG8Sb86_WGu2luvg_CT7Rvo2drKThIE3LZ2G3y70WQknnpt1H87LmMKwI4Aw0ogGH1PMyhno5rA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:53 GMT
via: 1.1 e1d636b234c38932eb25194cb146dbcc.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
x-amz-cf-pop: PHL50-C1
age: 0
x-yottaa-optimizations: ob/0 si/23D14047a170-1715349443-8248796275 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-dw-version-status: obsolete
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
pragma: no-cache
allow: OPTIONS,POST
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: etag,location,x-dw-version-status,x-dw-resource-state,authorization,x-dw-request-base-id
x-yottaa-metrics: 23214047a116/[274,271,-] 23D14047a170/[-,278.111]
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/sessions
accept-ranges: bytes
cf-ray: 8820dc6e1e018797-IAD
x-dw-request-base-id: HVqfttkuP2YBAAB_
x-amz-cf-id: dlgB5dIePCGWKX2J9CaeZuB8EIj3esTk487_a5RdHlyrUewOQNEWAw==
x-yottaa-os: 204
expires: Thu, 01 Dec 1994 16:00:00 GMT

POST
H2 200 shoppercontext Show response
www.elfcosmetics.com/api/v1/ 135 B
883 B 643ms
642ms XHR
application/json 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/api/v1/shoppercontext?siteId=elf-us

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

d7003226e2fea50e6765c46fe1bdacfe3a16adedd6c7a2530fef876c2356cf9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiI4YzhjYTI4OC1mMWE2LTRmMDktYjI2OS0wNWQyZWViZmRmMDEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmM5Mjc0YmQwLWM0ZmQtNGU2MS04YWM4LWQyMzhkNjljYzk1OSIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MTU0MTY3NjMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmJld1hJV2xYcEd4Y2FSd1hwS3hiWVl4cndWOjpjaGlkOiAiLCJleHAiOjE3MTU0MTg1OTMsImlhdCI6MTcxNTQxNjc5MywianRpIjoiQzJDMTk1MTY2MTE4NjAtNDI0NjM3OTAzMjEwMjg3NDYxNTI4OTU2In0.ACsqn3PuT0YiG8Sb86_WGu2luvg_CT7Rvo2drKThIE3LZ2G3y70WQknnpt1H87LmMKwI4Aw0ogGH1PMyhno5rA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: application/json
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 613a9db04d23967014b7c42269dc1c12.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 135
content-encoding: gzip
x-amz-cf-pop: PHL50-C1
age: 0
x-amzn-remapped-connection: close
x-amzn-requestid: b2879fad-e493-468a-bcb2-2c1fbc0e5882
x-yottaa-optimizations: ob/1000 si/23D14047a170-1715349443-8248796276 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-cache: Miss from cloudfront
x-amz-apigw-id: XmRCAFUHiYcEjrg=
content-length: 119
alt-svc: h3=":443"; ma=86400
etag: W/"87-WFt3zDSdrvttkMP6rAK367Qj/Rw"
x-amzn-trace-id: Root=1-663f2ed9-723ee4fc2e0467fc1df6116e;Parent=45254eef1e79dc32;Sampled=0;lineage=2b75b0e9:0
content-type: application/json; charset=utf-8
x-yottaa-os: 200
x-yottaa-metrics: 23214047a119/[513,509,-] 23D14047a170/[-,517.413]
x-amzn-remapped-date: Sat, 11 May 2024 08:39:53 GMT
x-amz-cf-id: ajzgSm-_294I-Pllw7eeTuYjTd2M9ILMlfH-cqEX_Yb-Io5RtGeV8Q==

POST
H2 201 sync Show response
sdk.iad-05.braze.com/api/v3/content_cards/ 85 B
200 B 225ms
225ms XHR
application/json 2606:4700:4400::ac40:965f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:965f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f216b50162bd5f4987b67548eaf5d98715fec939a7fd42ad1d8452c1529a558

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57
X-Braze-DataRequest: true
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-type: application/json
BRAZE-SYNC-RETRY-COUNT: 0
Referer: https://www.elfcosmetics.com/
X-Requested-With: XMLHttpRequest
Accept-Language: en-CA,en;q=0.9;q=0.9
X-Braze-ContentCardsRequest: true
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:53 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 2f4888ee-af2b-42ac-8aa7-7559141203a7
x-runtime: 0.060601
server: cloudflare
etag: W/"8f216b50162bd5f4987b67548eaf5d98"
vary: Origin,Accept-Encoding
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
x-ratelimit-reset: 1715416794
access-control-max-age: 7200
x-ratelimit-limit: 500.0
cf-ray: 8820dc6ddf7fa234-YYZ
x-ratelimit-remaining: 490.0

GET
H2 200 geo-ip Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/ 189 B
2 KB 294ms
293ms XHR
application/json 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=199.48.243.41

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

950200b1a632b0ee786b1af9bff50660cc7568ea90a68d0953ccdd7ca9927506

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: application/json
c_x-pwa-request: true
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:53 GMT
sfdc_customization: HOOK
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
via: 1.1 e5ff4a3d69612691bbce9d66888e6aa4.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
x-yottaa-optimizations: ob/1000 si/23D14047a170-1715349443-8248796277 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
content-security-policy-report-only: script-src 'none'; connect-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=1Bd4Ymh8Nbr2bBuruvuF5tfw75Eucz6O4sAlE2Af8pw-1715416793-1.0.1.1-EOQes8elLJZOltAd2w18ejBiOzjC6sx1vUElxt4_aqV4fPDmO5LaZBGyb1g3S9tSH.XzMtgUcIHOr0P6JvoFELjfy._KIhuFmTdpux68T27Cu6Kde6gSUjLYao9bHnL9UYFkKEyuwEBrtyFy.TQMiVq_UK0NB6FYbKvukNzA0sg; report-to cf-csp-endpoint
x-dw-version-status: obsolete
x-cache: Miss from cloudfront
age: 0
alt-svc: h3=":443"; ma=86400
allow: GET,HEAD,OPTIONS
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=1Bd4Ymh8Nbr2bBuruvuF5tfw75Eucz6O4sAlE2Af8pw-1715416793-1.0.1.1-EOQes8elLJZOltAd2w18ejBiOzjC6sx1vUElxt4_aqV4fPDmO5LaZBGyb1g3S9tSH.XzMtgUcIHOr0P6JvoFELjfy._KIhuFmTdpux68T27Cu6Kde6gSUjLYao9bHnL9UYFkKEyuwEBrtyFy.TQMiVq_UK0NB6FYbKvukNzA0sg"}],"group":"cf-csp-endpoint","max_age":86400}
content-type: application/json;charset=UTF-8
cache-control: max-age=0,no-cache,no-store,must-revalidate
x-yottaa-os: 200
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=199.48.243.41
x-yottaa-metrics: 23214047a14e/[180,177,-] 23D14047a170/[-,183.560]
cf-ray: 8820dc6f1fca5b17-IAD
x-dw-request-base-id: HVqkttkuP2YBAAB_
x-amz-cf-id: uLUBLQwRXwsdYZX4Q5OrlleRv8Y-EMsdGivO6aQ2oym7_hTHfUllnA==

GET
H2 200 geo-ip Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/ 189 B
909 B 824ms
529ms XHR
application/json 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=199.48.243.41

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

950200b1a632b0ee786b1af9bff50660cc7568ea90a68d0953ccdd7ca9927506

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: application/json
c_x-pwa-request: true
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
sfdc_customization: HOOK
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
via: 1.1 cf88880413082302757828626cf7b020.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
x-yottaa-optimizations: ob/1000 si/23D14047a170-1715349443-8248796279 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-dw-version-status: obsolete
x-cache: Miss from cloudfront
age: 0
alt-svc: h3=":443"; ma=86400
allow: GET,HEAD,OPTIONS
content-type: application/json;charset=UTF-8
cache-control: max-age=0,no-cache,no-store,must-revalidate
x-yottaa-os: 200
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=199.48.243.41
x-yottaa-metrics: 23214047a161/[397,394,-] 23D14047a170/[-,400.654]
cf-ray: 8820dc711e7a3b5f-IAD
x-dw-request-base-id: qbCWUdkuP2YBAAB_
x-amz-cf-id: Qp1I28WQeusSdJFujgc_MZiS74ICNN5GocpyKmLwtL2bhw0tiee6gA==

GET
H2 200 baskets Show response
www.elfcosmetics.com/mobify/proxy/api/customer/shopper-customers/v1/organizations/f_ecom_bbxc_prd/customers/bewXIWlXpGxcaRwXpKxbYYxrwV/ 11 B
879 B 313ms
313ms Fetch
application/json 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/api/customer/shopper-customers/v1/organizations/f_ecom_bbxc_prd/customers/bewXIWlXpGxcaRwXpKxbYYxrwV/baskets?siteId=elf-us

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

31f48ed33afe7e437efa2c30cbf97fbd62c2de5c0732504077377846fe64973f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiI4YzhjYTI4OC1mMWE2LTRmMDktYjI2OS0wNWQyZWViZmRmMDEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmM5Mjc0YmQwLWM0ZmQtNGU2MS04YWM4LWQyMzhkNjljYzk1OSIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MTU0MTY3NjMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmJld1hJV2xYcEd4Y2FSd1hwS3hiWVl4cndWOjpjaGlkOiAiLCJleHAiOjE3MTU0MTg1OTMsImlhdCI6MTcxNTQxNjc5MywianRpIjoiQzJDMTk1MTY2MTE4NjAtNDI0NjM3OTAzMjEwMjg3NDYxNTI4OTU2In0.ACsqn3PuT0YiG8Sb86_WGu2luvg_CT7Rvo2drKThIE3LZ2G3y70WQknnpt1H87LmMKwI4Aw0ogGH1PMyhno5rA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
c_x-pwa-request: true
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:53 GMT
sfdc_customization: HOOK
dnt: 0
cf-cache-status: DYNAMIC
x-correlation-id: 8820dc6f89cd059d
x-content-type-options: nosniff
via: 1.1 558a7274c3bf9c351a26dc5ddb8c820a.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
x-yottaa-optimizations: ob/1000 si/23D14047a170-1715349443-8248796278 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
content-encoding: gzip
x-cache: Miss from cloudfront
age: 0
alt-svc: h3=":443"; ma=86400
content-length: 37
allow: GET,HEAD,OPTIONS
x-ratelimit-remaining: 999
content-type: application/json;charset=UTF-8
vary: Accept-Encoding
sfdc_load: 1
cache-control: max-age=0,no-cache,no-store
x-yottaa-os: 200
x-proxy-request-url: https://6p9dgqhn.api.commercecloud.salesforce.com/customer/shopper-customers/v1/organizations/f_ecom_bbxc_prd/customers/bewXIWlXpGxcaRwXpKxbYYxrwV/baskets?siteId=elf-us
x-ratelimit-limit: 99999
accept-ranges: bytes
cf-ray: 8820dc6f89cd059d-IAD
x-amz-cf-id: 19xCURVxbQBgDAJZaHZTyZfC2rrDUiuklgZWBi_HLhpoN1cAHiAUIw==
x-yottaa-metrics: 23214047a15e/[142,139,-] 23D14047a170/[-,145.757]

POST
H2 200 viewPage Show response
api.cquotient.com/v3/activities/bbxc-elf-us/ 98 B
516 B 104ms
103ms Fetch
application/json 44.194.41.150
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cquotient.com/v3/activities/bbxc-elf-us/viewPage

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/main.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.194.41.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-194-41-150.compute-1.amazonaws.com

Software

envoy /

Resource Hash

93462eb3d917f68f309aaa025e778e52b1c574b6e07765738bf7ee1a3ab5084e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubdomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
x-cq-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.elfcosmetics.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:53 GMT
strict-transport-security: max-age=15552000; includeSubdomains
server: envoy
etag: W/"62-UpvxrtXpj5m0Wk3e/t97oinoKaI"
access-control-allow-methods: GET, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5
content-length: 98

OPTIONS
H2 200 viewPage
api.cquotient.com/v3/activities/bbxc-elf-us/ Frame 0
0 473ms
170ms Preflight 44.194.41.150
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cquotient.com/v3/activities/bbxc-elf-us/viewPage

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.194.41.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-194-41-150.compute-1.amazonaws.com

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-cq-client-id
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization, content-type, x-cq-tenant, x-cq-client-id
access-control-allow-methods: POST
access-control-allow-origin: https://www.elfcosmetics.com
content-length: 0
date: Sat, 11 May 2024 08:39:53 GMT
server: envoy
strict-transport-security: max-age=15552000; includeSubdomains
x-envoy-upstream-service-time: 1

GET
H2 200 dy-coll-min.js Show response
cdn.dynamicyield.com/scripts/2.32.0/ 196 KB
65 KB 111ms
111ms Script
text/javascript 2600:9000:21dd:a400:a:b89d:a6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.dynamicyield.com/scripts/2.32.0/dy-coll-min.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:a400:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: DYCDN /
Resource Hash: 42997132bd0142564014ac4a809356dc0ceb9b7a90eede2b5b48019f1700cc58

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 07 Apr 2024 06:09:06 GMT
content-encoding: gzip
via: 1.1 48d2977daea5b632b090c1400ef6bfcc.cloudfront.net (CloudFront)
last-modified: Tue, 02 Apr 2024 09:13:12 GMT
server: DYCDN
age: 2946648
x-amz-cf-pop: EWR53-C2
etag: W/"65b3e284856fb8d657d1f6a3423618c7"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=31536000
link: <//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
x-amz-cf-id: 86ygwcd4y1p3F-batEkIeGfgzivXVXQ8jg1M8FmW4lBIel0yVfdnqg==

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/018ebeca-ecda-7202-9bf3-a2ff4acebe55/ 158 KB
34 KB 112ms
112ms Fetch
application/x-javascript 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/018ebeca-ecda-7202-9bf3-a2ff4acebe55/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

009342098f06d5ae7b2186f1076fab177d05b5a481ffe1190535fe501c1cae68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 82228
content-md5: 5rS6k6LfUu8toMASIT8lMw==
content-length: 34672
x-ms-lease-status: unlocked
last-modified: Mon, 08 Apr 2024 18:41:17 GMT
server: cloudflare
etag: 0x8DC57FB7A1265A4
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: abd0a229-b01e-0083-53e4-8927e1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8820dc6f1ec4aaad-YYZ
expires: Sun, 12 May 2024 08:39:53 GMT

POST
H3 200 collector Show response
collector-pxxt4gy2ig.px-cloud.net/api/v2/ 32 B
49 B 116ms
116ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxt4gy2ig.px-cloud.net/api/v2/collector
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 7586f9164e6bc95d916e3828d687c85f77cf253b34a5908fffa5f6f17dfd0d72

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 11 May 2024 08:39:52 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32

POST
H2 200 uia Show response
async-px.dynamicyield.com/ 0
383 B 442ms
105ms XHR
text/plain 108.139.47.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/uia?cnst=1&_=1715416793654
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.32.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-127.jfk50.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 23a7db9b99ad0ff99aeef1ab5f27e734.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: D_uoZrkpoMHL_6THE83qetF_H78H0zDm_OxXOtWn4iQK3Xhm3im4nA==
expires: 0

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202306.1.0/assets/ 13 KB
3 KB 107ms
106ms Fetch
application/json 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202306.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 5mNZducabMgxSDzBo+ZI8w==
age: 67582
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3017
x-ms-lease-status: unlocked
last-modified: Wed, 12 Jul 2023 06:29:30 GMT
server: cloudflare
etag: 0x8DB82A159AF8EA6
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 0c718e4e-201e-0081-6f27-129959000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8820dc70ff85aaad-YYZ

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202306.1.0/assets/v2/ 61 KB
12 KB 120ms
120ms Fetch
application/json 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202306.1.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: sXFDxCJwbPEMIT/8f5Prwg==
age: 82228
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12544
x-ms-lease-status: unlocked
last-modified: Wed, 12 Jul 2023 06:29:33 GMT
server: cloudflare
etag: 0x8DB82A15AFF8646
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: f78e9e1f-701e-008c-7c4e-79518d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8820dc711f88aaad-YYZ

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/202306.1.0/assets/ 5 KB
2 KB 119ms
118ms Fetch
application/json 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202306.1.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

509f2e49500fbaeb5d7e1959071f2922b693d0135080e2871e124ec8bdd08bb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: v0pzgeeelPwcAOki15i3HA==
age: 82228
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1766
x-ms-lease-status: unlocked
last-modified: Wed, 12 Jul 2023 06:29:32 GMT
server: cloudflare
etag: 0x8DB82A15AB9FB83
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 3358d79e-b01e-003a-204e-7923fb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8820dc711f89aaad-YYZ

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202306.1.0/assets/ 21 KB
4 KB 131ms
131ms Fetch
text/css 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202306.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0c233d327541d2961f1cde9e53a6166279655f4d4041c1bc458ac1701827719

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: oWkBTLgDDXvrUsd93y/Zxg==
age: 82228
x-ms-lease-status: unlocked
last-modified: Wed, 12 Jul 2023 06:29:41 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 1ae336c1-301e-0056-1257-79c86c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8820dc711f8aaaad-YYZ

GET
H2 200 cnxtag-min.js Show response
js.cnnx.link/roi/ 2 KB
1 KB 635ms
202ms Script
text/javascript 2600:9000:23cb:3600:11:85b0:d600:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.cnnx.link/roi/cnxtag-min.js?id=316282
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL3STMX
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23cb:3600:11:85b0:d600:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: ff2fe181c12146189657e92f9ce0489f7f3b51345796f5a5ec9b089f9fb47616

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:31:47 GMT
via: 1.1 google, 1.1 5b4b6c6517b988a4ff2c794e5583ee02.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: JFK50-P1
age: 486
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
cache-control: max-age=600
x-amz-cf-id: aABPO5fZpZseC1eUVvJXegXs05maJ6QX6_T61Xj7sfu9PFwxGhrA5w==

GET
H/1.1

200
OK

cnv
cnv.event.prod.bidr.io/log/
Redirect Chain

https://pixel.pointmediatracker.com/kpi?c=elfcosmetics&kpi=visit&tag_id=244&fpc=becf4a1a-e525-43ef-bd14-8302ed4579c4&user_id=&utm_source=undefined&utm_medium=undefined&utm_campaign=undefined&new=un...
https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=d2a52857-5659-4107-92a4-c839ca7a166c.&ord=7128298318220886170
https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=d2a52857-5659-4107-92a4-c839ca7a166c.&ord=7128298318220886170&_bee_ppp=1

43 B
796 B

91ms
91ms

Image
image/gif

54.164.102.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=d2a52857-5659-4107-92a4-c839ca7a166c.&ord=7128298318220886170&_bee_ppp=1

Protocol

HTTP/1.1

Server

54.164.102.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-164-102-168.compute-1.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

pragma: no-cache
Date: Sat, 11 May 2024 08:39:55 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=d2a52857-5659-4107-92a4-c839ca7a166c.&ord=7128298318220886170&_bee_ppp=1
Date: Sat, 11 May 2024 08:39:55 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=160890&%20seg=6104893&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D160890%26%2520seg%3D6104893%26t%3D2

43 B
1 KB

159ms
159ms

Image
image/gif

68.67.179.164
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D160890%26%2520seg%3D6104893%26t%3D2

Protocol

Server

68.67.179.164 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
an-x-request-uuid: 6f4c7a44-75d6-4e7e-b7c0-57e04496a145
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 199.48.243.41; 199.48.243.41; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
an-x-request-uuid: 369dec3c-d075-412b-a385-3edf7ae81b86
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D160890%26%2520seg%3D6104893%26t%3D2
cache-control: no-store, no-cache, private
x-proxy-origin: 199.48.243.41; 199.48.243.41; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=3ftfnh3&ct=0:8m23e30&fmt=3
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=d5ed9a5a-e389-460c-b1ee-7b748657c7f0
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3Dd5ed9a5a-e389-460c-b1ee-7b748657c7f0
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=3459814829854878186&ttd_tdid=d5ed9a5a-e389-460c-b1ee-7b748657c7f0
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZDVlZDlhNWEtZTM4OS00NjBjLWIxZWUtN2I3NDg2NTdjN2Yw&gdpr=0&gdpr_consent=&ttd_tdid=d5ed9a5a-e389-460c-b1ee-7b748...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&google_gid=CAESELyXsJUtgk5dKxMCJJ94saA&google_cver=1
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&expiration=1718008795&gdpr=0&gdpr_consent=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&expiration=1718008795&gdpr=0&gdpr_consent=&C=1

43 B
338 B

99ms
97ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&expiration=1718008795&gdpr=0&gdpr_consent=&C=1
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:56 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aSnyEeXMfj8ZYTWrmH7O6sW6Uzfgy4TDkhU7BjMTFGEGUPwuReV5bci27b%2FmpwJE%2FREtXhpw3o1LtlKqbtOyUVF4dfEj%2BAk9xYEa4wOQ6MozClltFdTmXCeTCbKcF2KG0j3XMCjTyzSycA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8820dc805e14aaa4-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:56 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y3uVFuJMKaTmqpmM%2BK%2FL%2Fxhrvrt9TVhX4VKLBUBKnluH4Gm3QGxgLU%2BtQchWvmgxF%2FGnl7u4715GZ7zWAgI9OpXJazIgqgOxrXmAW8zfAPg3XUsrZUjEKYvXXwy7IUBnlS4uRBBZFSo8dw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=39&external_user_id=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&expiration=1718008795&gdpr=0&gdpr_consent=&C=1
cache-control: no-cache
cf-ray: 8820dc7f7dbaaaa4-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 128ms
127ms Image
image/gif 2607:f8b0:4004:c21::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-432816-1&cid=1017828244.1715416793&jid=523226223&_u=YEBAAEAAAAAAACgAI~&z=428975067

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::69 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 465ms
125ms Image
image/gif 2607:f8b0:4004:c1f::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-432816-1&cid=1017828244.1715416793&jid=523226223&_u=YEBAAEAAAAAAACgAI~&z=428975067

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 batch
async-px.dynamicyield.com/ 0
384 B 456ms
162ms Ping
text/plain 108.139.47.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/batch?cnst=1&_=1715416793767_935853
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.32.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-127.jfk50.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 3e7fb742ce78adbb687505d8440bf99c.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: JaIOfdJ8GmWY7VbDg94ycyx6t_bCXk9ayNVpdO0p9cF0GfMH3y_afw==
expires: 0

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 326ms
103ms Fetch 108.139.47.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=154912&uid=-3697455056132559143&sec=8772046&t=ri&e=1261284&p=1&ve=11209913&va=%5B27119924%5D&ses=28ccb96486a77be17ba48d06cdfc239a&expSes=34894&aud=884367.884385.884387.1167402.1324059.1846919.2324421.998337.1004416.1092373.1426804.1443347.1182144.799438.799440&expVisitId=-8540900237139395006&cgtgDecisionId=-8540900236503536637&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1715416793769&rri=9211684
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.32.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-127.jfk50.r.cloudfront.net
Software: /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 23a7db9b99ad0ff99aeef1ab5f27e734.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: URjiSrkKxU_RAkFOq7Ld0iFKE5dvaCCjLNvUpHZNKSxE2GQPR9Hh-w==
expires: 0

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 326ms
104ms Fetch 108.139.47.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=714536&uid=-3697455056132559143&sec=8772046&t=ri&e=1574966&p=1&ve=12698518&va=%5B28347247%5D&ses=28ccb96486a77be17ba48d06cdfc239a&expSes=34894&aud=884367.884385.884387.1167402.1324059.1846919.2324421.998337.1004416.1092373.1426804.1443347.1182144.799438.799440&expVisitId=-8540900238802446543&cgtgDecisionId=-8540900237361343738&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1715416793770&rri=2957545
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.32.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-127.jfk50.r.cloudfront.net
Software: /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 23a7db9b99ad0ff99aeef1ab5f27e734.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: J-eT9s_ZinVzbX9EMYUliZhiwUmPNCsGtorO41INkdZrxmfMpZ23dg==
expires: 0

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 325ms
104ms Fetch 108.139.47.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=253670&uid=-3697455056132559143&sec=8772046&t=ri&e=1609852&p=1&ve=12669413&va=%5B28321879%5D&ses=28ccb96486a77be17ba48d06cdfc239a&expSes=34894&aud=884367.884385.884387.1167402.1324059.1846919.2324421.998337.1004416.1092373.1426804.1443347.1182144.799438.799440&expVisitId=-8540900237110814463&cgtgDecisionId=-8540900236333473601&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1715416793771&rri=9613530
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.32.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-127.jfk50.r.cloudfront.net
Software: /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 23a7db9b99ad0ff99aeef1ab5f27e734.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: 3e28uuq3twdIXFFid1NOxE1wixB50nXGHZ67SnszCsNpFaZnH3aD-Q==
expires: 0

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 359ms
139ms Fetch 108.139.47.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=453799&uid=-3697455056132559143&sec=8772046&t=ri&e=1575901&p=1&ve=12991774&va=%5B28207096%5D&ses=28ccb96486a77be17ba48d06cdfc239a&expSes=34894&aud=884367.884385.884387.1167402.1324059.1846919.2324421.998337.1004416.1092373.1426804.1443347.1182144.799438.799440&expVisitId=-8540900235579938834&cgtgDecisionId=-8540900237051270586&mech=0&smech=2&eri=1&tsrc=Direct&reqts=1715416793772&rri=1863306
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.32.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-127.jfk50.r.cloudfront.net
Software: /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 23a7db9b99ad0ff99aeef1ab5f27e734.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: dpBGVbJk_LaialwDAdOAodyJAq0P43jVtIsY7WQYzm8suf-l9a331Q==
expires: 0

GET
H2 200 favicon.ico
www.elfcosmetics.com/ 34 KB
34 KB 144ms
143ms Other
image/x-icon 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/favicon.ico
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: 1331786f628c441b99665436eb8815381e066e17d5c3bb56f5ce2e045d8da17a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:53 GMT
via: 1.1 e1d636b234c38932eb25194cb146dbcc.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 34494
x-amz-cf-pop: PHL50-C1
age: 64, 64
x-amzn-remapped-connection: close
x-amzn-requestid: d2999de9-8dc0-4995-85ba-6f4d98eed19e
x-yottaa-optimizations: ob/100 si/23D14047a170-1715349443-8248796280 tts/1710864117465 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-cache: Hit from cloudfront
x-amz-apigw-id: XXHzeHi_iYcEs4A=
content-length: 34494
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 06 May 2024 18:22:06 GMT
x-amzn-trace-id: Root=1-66392015-109fa187159ffb236db8d477;Parent=0fb9baf3e0ac1a20;Sampled=0;lineage=2b75b0e9:0
etag: W/"86be-18f4f243cb0"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: max-age=600, s-maxage=600
x-yottaa-metrics: 23214047a162/[8,-,1715416773341] 23D14047a170/[-,13.215]
accept-ranges: bytes
x-amzn-remapped-date: Mon, 06 May 2024 18:23:18 GMT
x-amz-cf-id: k8qT6iSlc0VCYqmPKHGqE4Omsxfuzg-3DMdw2ykeS_ss57gdn8u0mw==

POST
H2 200 baskets Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/ 3 KB
2 KB 308ms
307ms XHR
application/json 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/baskets

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

8fd5b2be8986a642420a31377e016561b8e5191eecc86b866475caeece6531b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiI4YzhjYTI4OC1mMWE2LTRmMDktYjI2OS0wNWQyZWViZmRmMDEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmM5Mjc0YmQwLWM0ZmQtNGU2MS04YWM4LWQyMzhkNjljYzk1OSIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MTU0MTY3NjMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmJld1hJV2xYcEd4Y2FSd1hwS3hiWVl4cndWOjpjaGlkOiAiLCJleHAiOjE3MTU0MTg1OTMsImlhdCI6MTcxNTQxNjc5MywianRpIjoiQzJDMTk1MTY2MTE4NjAtNDI0NjM3OTAzMjEwMjg3NDYxNTI4OTU2In0.ACsqn3PuT0YiG8Sb86_WGu2luvg_CT7Rvo2drKThIE3LZ2G3y70WQknnpt1H87LmMKwI4Aw0ogGH1PMyhno5rA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: application/json
c_x-pwa-request: true
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
sfdc_customization: HOOK
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 39a169e5169cc741a7c793f95d144134.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 0
x-yottaa-optimizations: ob/1000 si/23D14047a170-1715349443-8248796281 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
content-encoding: gzip
x-dw-version-status: obsolete
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 1102
pragma: no-cache
etag: 50d7ea96b5a3cb89bca59413379821941cb8d86e96e8381ee62ee602b0ae624e
allow: OPTIONS,POST
content-type: application/json;charset=UTF-8
x-dw-resource-state: 50d7ea96b5a3cb89bca59413379821941cb8d86e96e8381ee62ee602b0ae624e
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: etag,location,x-dw-version-status,x-dw-resource-state,authorization,x-dw-request-base-id
x-yottaa-metrics: 23214047a163/[180,176,-] 23D14047a170/[-,183.692]
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/baskets
accept-ranges: bytes
cf-ray: 8820dc71ccc3823c-IAD
x-dw-request-base-id: DRDwkdkuP2YBAAB_
x-amz-cf-id: xOyz7JQcE3_eV0Yhn20ImwSWuZRDMtE7g2oDS87Z7m_1wgnIzblClA==
x-yottaa-os: 200
expires: Thu, 01 Dec 1994 16:00:00 GMT

POST
H2 200 event
qoe-1.yottaa.net/log-nt/ 3 B
191 B 705ms
253ms Ping
text/json 140.174.14.148
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://qoe-1.yottaa.net/log-nt/event
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 140.174.14.148 Frankfurt am Main, Germany, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 11 May 2024 08:39:54 GMT
access-control-expose-headers: X-Results-Data-Source
access-control-allow-credentials: true
cache-control: no-cache
timing-allow-origin: *
content-type: text/json

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/17fd9675/www-widgetapi.vflset/ 215 KB
67 KB 117ms
116ms Script
text/javascript 2607:f8b0:4004:c19::5b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/17fd9675/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::5b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07cd8a0ea2b5b9fa0845c4f3a17ba1c634b7404c92f8c18012a8d933f59f26a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:28:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 692
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68217
x-xss-protection: 0
last-modified: Wed, 08 May 2024 04:20:16 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 11 May 2025 08:28:21 GMT

POST
H2 200 batch
async-px.dynamicyield.com/ 0
383 B 197ms
162ms Ping
text/plain 108.139.47.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/batch?cnst=1&_=1715416793904_32018
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.32.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-127.jfk50.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 3e7fb742ce78adbb687505d8440bf99c.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: 97IcsqgDGFanLv_AI3M17S3WEn68L9TpJhisJeOnI6vtnWLGCnZA_g==
expires: 0

GET
H2 200 110221.ct.js Show response
tag.rmp.rakuten.com/ 47 KB
15 KB 363ms
106ms Script
text/javascript 34.102.147.248
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.rmp.rakuten.com/110221.ct.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.102.147.248 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

248.147.102.34.bc.googleusercontent.com

Software

Resource Hash

f65c65471955ca205caa4dde91ef65de82a40627acdaae83aa6710e7ef61d20f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=31536000
last-modified: Sat, 11 May 2024 08:39:54 GMT
x-cache: hit
x-samesite: secure
content-type: text/javascript
cache-control: max-age=86400
x-dyn: 0
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 js Show response
www.paypal.com/sdk/ 420 KB
118 KB 332ms
79ms Script
application/javascript 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/sdk/js?client-id=AQ-EQFYFdmKNxtZRBoRdv2chvQI-_ZPvL1jVN9SFYCTseKT4OHPKrnT2yJlx8kWKnFI7JXEJM_cTSdbf&intent=authorize&currency=CAD&vault=true&components=buttons,messages

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

975e0ad7b4aad355ee1853a42969a3f62b61e2edb7e6e950f1d8cc319e860e20

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; script-src 'nonce-NlK0cdnScUA5wGW9rC5H83ZN/8iruy0yZDR/plbKrlwqoyx9' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'nonce-NlK0cdnScUA5wGW9rC5H83ZN/8iruy0yZDR/plbKrlwqoyx9' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-NlK0cdnScUA5wGW9rC5H83ZN/8iruy0yZDR/plbKrlwqoyx9' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-NlK0cdnScUA5wGW9rC5H83ZN/8iruy0yZDR/plbKrlwqoyx9' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
content-encoding: gzip
x-content-type-options: nosniff
disable-set-cookie: true
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sat, 11 May 2024 08:39:54 GMT
age: 8141
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, HIT, MISS
p3p: true
paypal-debug-id: f875546d2d335
server-timing: "traceparent;desc="00-0000000000000000000f875546d2d335-01eb4b6ef91fc4cf-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
content-length: 118467
x-xss-protection: 1; mode=block
x-served-by: cache-bur-kbur8200163-BUR, cache-yyz4569-YYZ, cache-yyz4569-YYZ
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent: 00-0000000000000000000f875546d2d335-b3a5d6075aa95ae5-01
x-timer: S1715416794.202707,VS0,VE4
etag: W/"1cec3-c0fz3aAteJjAtTdd+rEY43HN+rs"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Server-Timing
cache-control: public, max-age=3600, s-maxage=10800
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
x-cache-hits: 0, 3, 0

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
600 B 108ms
107ms Image
image/svg+xml 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 58451
x-ms-lease-status: unlocked
last-modified: Thu, 09 May 2024 19:31:29 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 10677d90-301e-0003-6689-a2426e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8820dc724968ac27-YYZ

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
510 B 103ms
103ms Fetch
image/svg+xml 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
age: 67582
x-ms-lease-status: unlocked
last-modified: Thu, 09 May 2024 19:31:28 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 7d231aa5-701e-000f-3be1-a2ac9f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8820dc725802aaad-YYZ

GET
H2 200 ot_company_logo.png
cdn.cookielaw.org/logos/static/ 4 KB
4 KB 108ms
107ms Image
image/png 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_company_logo.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: E8+sk/ECzKgTUVtDLikiIA==
age: 63401
content-length: 4036
x-ms-lease-status: unlocked
last-modified: Thu, 09 May 2024 19:31:29 GMT
server: cloudflare
etag: 0x8DC705EA02A1D0A
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: c8dbce8a-401e-002e-2189-a2c1ae000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8820dc727981ac27-YYZ

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 120ms
120ms Image
image/svg+xml 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 11 May 2024 08:39:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 63598
x-ms-lease-status: unlocked
last-modified: Wed, 08 May 2024 06:40:07 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 8374a36e-501e-005c-237a-a1b090000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8820dc728989ac27-YYZ

GET
H/1.1 200
OK main.js Show response
static.ordergroove.com/1e72a9589c4f11e9a62ebc764e10b970/ 146 KB
43 KB 464ms
113ms Script
application/javascript 23.47.22.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.ordergroove.com/1e72a9589c4f11e9a62ebc764e10b970/main.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.47.22.7 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-47-22-7.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

2e8fd8d487b4259dbdc6c529f742806377fae205c8dc7d0f35ac8797bafe5b3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=15768000
Content-Encoding: gzip
Date: Sat, 11 May 2024 08:39:54 GMT
Server: nginx
X-Powered-By: Express
ETag: W/"f3bc9cdcf9c97d0ec2f18fd72203201caef8fea5-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: must-revalidate, max-age=900
Connection: keep-alive
Content-Length: 43396
Expires: Sat, 11 May 2024 08:54:54 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 327 KB
106 KB 143ms
142ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

88410dca3f8f80ede3afddab5e3a4fe04b1605143e0665f12ca0570ecea24f22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 108670
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 11 May 2024 08:39:54 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 307 KB
101 KB 132ms
131ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-5D80LRC85N&l=dataLayer&cx=c

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4ddabe1c1035e9369e2ae848e5126a02cf533f4eca547d7a5ee347c513d88029

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 103291
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 11 May 2024 08:39:54 GMT

GET
H3 200 NEW-beauty-squad-beauty-squad-loyalty-logo-staggered-paddedsquare
elfcosmetics.a.bigcontent.io/v1/static/ 5 KB
6 KB 469ms
103ms Image
image/png 2606:4700:4400::6812:2a49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://elfcosmetics.a.bigcontent.io/v1/static/NEW-beauty-squad-beauty-squad-loyalty-logo-staggered-paddedsquare?%24Desktop%24=&fmt=auto
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2a49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 210706c053295db0bfba03a98c0609a1f940c3f6b6c626f2f1084e089e959dc9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
x-amz-version-id: null
cf-cache-status: HIT
age: 76171
x-amz-server-side-encryption: AES256
x-amp-cf-worker: true
edge-control: max-age=86400
alt-svc: h3=":443"; ma=86400
content-length: 5378
last-modified: Fri, 10 May 2024 11:30:23 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=1800
accept-ranges: bytes
cf-ray: 8820dc7639d6543d-YYZ
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H3 200 icon-noun-gift-1165617
elfcosmetics.a.bigcontent.io/v1/static/ 2 KB
1 KB 473ms
108ms Image
image/svg+xml 2606:4700:4400::6812:2a49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://elfcosmetics.a.bigcontent.io/v1/static/icon-noun-gift-1165617?%24Desktop%24=&fmt=auto
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2a49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4aa855b8d34657ab4df5ca73fe7d7f67735ee1e39e8de83856ddc473d4713fbb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
age: 4199
x-amz-server-side-encryption: AES256
x-amp-cf-worker: true
edge-control: max-age=86400
alt-svc: h3=":443"; ma=86400
last-modified: Sat, 11 May 2024 07:29:55 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=1800
cf-ray: 8820dc7639d3543d-YYZ
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H3 200 icon-noun-hearts-257768v2
elfcosmetics.a.bigcontent.io/v1/static/ 2 KB
1 KB 474ms
108ms Image
image/svg+xml 2606:4700:4400::6812:2a49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://elfcosmetics.a.bigcontent.io/v1/static/icon-noun-hearts-257768v2?%24Desktop%24=&fmt=auto
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2a49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ddc89ba3c2a29bf8b6a376737d491efdb8f9bcebc7c635639cda62390f45a06

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
age: 4199
x-amz-server-side-encryption: AES256
x-amp-cf-worker: true
edge-control: max-age=86400
alt-svc: h3=":443"; ma=86400
last-modified: Sat, 11 May 2024 07:29:55 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=1800
cf-ray: 8820dc7639d7543d-YYZ
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 1a8bfa042c9c5.js Show response
t.contentsquare.net/uxa/ 295 KB
71 KB 410ms
115ms Script
application/javascript 18.164.116.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.contentsquare.net/uxa/1a8bfa042c9c5.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.116.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-116-94.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cc9ea760e99c7aeb29b3da195ff38ecb90d6699e6e437ba9fb6ba5c8a2912b01

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 14:13:30 GMT
content-encoding: br
via: 1.1 7edae070a6a25cc68c970c1111701a20.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P6
age: 0
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 72162
last-modified: Mon, 06 May 2024 14:12:04 GMT
server: AmazonS3
etag: "66d6e9575960179e8cacdf4ecc4b23e8"
vary: Accept-Encoding, Origin
content-type: application/javascript;charset=utf-8
cache-control: max-age=900
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 1YmN7O3MtOtFXcgoDmiV27EtI-O5cIM2HeKc_trtUTsloTi6MKRPjw==

GET
H2 200 loader.js Show response
cdn.usehero.com/ 98 KB
27 KB 602ms
137ms Script
application/javascript 2600:9000:23cb:f600:13:d6f4:3240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.usehero.com/loader.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23cb:f600:13:d6f4:3240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ab99a75a2070736b0282d041df3a7e272ad5d4d1929ae430089ac0335e05ad2c

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:11:53 GMT
content-encoding: br
via: 1.1 043cf9310ff19c0e58a0b6e76877f570.cloudfront.net (CloudFront)
last-modified: Tue, 19 Sep 2023 07:56:38 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P1
age: 1682
x-amz-server-side-encryption: AES256
etag: W/"fbf714a58cbac38c0deea519667d9044"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: SFbxQzWVAnarJYZlJvFHIXSIsAKMsLG6-ZEAas1LKZiuFyfbFCDGIA==

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 208 KB
75 KB 123ms
123ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-9231397&l=dataLayer&cx=c

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a4a87c74d93a3e9190c3cf5a0987d5be8e740d2c770febd4d52f9d8fe60ae4fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76370
x-xss-protection: 0
last-modified: Sat, 11 May 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 11 May 2024 08:39:54 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 208 KB
75 KB 151ms
151ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-10742279&l=dataLayer&cx=c

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cc142a9a1a0c5a1856092accbc2d7e975505f016b78bfe1b907fc2f52191d879

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76526
x-xss-protection: 0
last-modified: Sat, 11 May 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 11 May 2024 08:39:54 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ 5 KB
2 KB 619ms
155ms Script
application/javascript 2600:1408:c400:392::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:392::1931 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 0882be2bb685d64ae46b56574b330fb1afe5dfef39f940d12ca776475248eaa8

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-cdn: akamai
etag: "c292daff66d2a9db8fb67b7807bf3c7b"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=7200
accept-ranges: bytes
alt-svc: h3=":443"; ma=600
content-length: 1881

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
59 KB 530ms
135ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sat, 11 May 2024 08:39:54 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57845
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=21, rtx=0, c=15, mss=1392, tbw=2807, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: uwwopnhzsCuHbgujwvFfNSfa2972VoaPt9lU5JnjsaL7BqZHQhYia6kOh/a9WDwYh3Vivv2dJDwpJxL/3nM8+A==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 42 KB
12 KB 436ms
93ms Script
application/javascript 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 5ccd2a2d0cfc8f7b36c238c935a36c751eb306a4f23788a0c6c33eec1a5a2071

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Tue, 07 May 2024 17:43:30 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "337f63427080a8d6a60316b759dab390"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 12083

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 498ms
109ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Sat, 11 May 2024 08:39:54 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2431B0457CB146ADAE18D6C2CDBB70BC Ref B: YTO01EDGE0515 Ref C: 2024-05-11T08:39:54Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 sdk.js Show response
analytics.tiktok.com/i18n/pixel/ 8 KB
3 KB 506ms
173ms Script
application/javascript 23.212.248.137
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/sdk.js?sdkid=BRR4GA0I9JJBU29G8GF0
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.137 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-248-137.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 6ca208da05251bd9678d1d5b1e77b675d9bb1f9aceb2ba2769a256164d9c0bd3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-akamai-request-id: 18785a1
date: Sat, 11 May 2024 08:39:55 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-240511083955BCD0959C3E9929A122AE-2CE3377C51085690-00
x-cache: TCP_MISS from a23-220-104-137.deploy.akamaitechnologies.com (AkamaiGHost/11.5.0.1-56208139) (-)
server-timing: inner; dur=3, cdn-cache; desc=MISS, edge; dur=0, origin; dur=21
content-length: 2550
pragma: no-cache
server: nginx
x-tt-logid: 20240511083955BCD0959C3E9929A122AE
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 21,23.220.104.137
x-tt-trace-host: 014e4e28718c3c2e9a3ad553ffba555f92c058d95d2516a1102b8b37389245dfc3c9cc61f28bbd1a46d744917b8a5a31e249f5c7673e31a9bca112a1ac7bf7d8c6efaf3ac8cd66d9aedcc0b63d2acb83cd41c62387578675911d9de62806e9ffe1
expires: Sat, 11 May 2024 08:39:55 GMT

GET
H2 200 events.js Show response
analytics.tiktok.com/i18n/pixel/ 6 KB
3 KB 489ms
175ms Script
application/javascript 23.212.248.137
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1EFEJPT0U322RQPGHFG&lib=ttq
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.137 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-248-137.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: fcb0957e895444667ea2d03dbdf3e91b2c4cdc9c3af6b7a4275af7cd35bfcf2d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-akamai-request-id: 18785a2
date: Sat, 11 May 2024 08:39:55 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-24051108395508239E8156182E8ED844-0850161534C99957-00
x-cache: TCP_MISS from a23-220-104-137.deploy.akamaitechnologies.com (AkamaiGHost/11.5.0.1-56208139) (-)
server-timing: inner; dur=3, cdn-cache; desc=MISS, edge; dur=9, origin; dur=24
content-length: 2094
pragma: no-cache
server: nginx
x-tt-logid: 2024051108395508239E8156182E8ED844
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 24,23.220.104.137
x-tt-trace-host: 014e4e28718c3c2e9a3ad553ffba555f92c058d95d2516a1102b8b37389245dfc39628cd1fb16dc947dd064dc69b37e1e3003430dc3ec08be73c7c6b2dbf024cb84930b8dd60e4f7c207efaf44841360400938e06bcd454323bc4e6a0fd85dd063
expires: Sat, 11 May 2024 08:39:55 GMT

GET
H2 200 widget.js Show response
js.jebbit.com/companion/v1/ 44 KB
45 KB 560ms
123ms Script
text/javascript 2600:9000:2514:9e00:a:7914:b00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.jebbit.com/companion/v1/widget.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2514:9e00:a:7914:b00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cc9709489aeba0f23cc18fd3d1ff6f2087e1381ba6dbe92e98738228d520fd54

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: j3bLD5VAFZVsHy8WM9iuVjqRLf9F9664
date: Sat, 11 May 2024 07:06:52 GMT
via: 1.1 c456cd1dcda544d97e59ee05afbea4a2.cloudfront.net (CloudFront)
last-modified: Thu, 02 May 2024 15:04:41 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P8
age: 5584
x-amz-server-side-encryption: AES256
etag: "226557253164387c89ed4612b780f10f"
x-cache: Hit from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 45245
x-amz-cf-id: 2eKX-QcRiSUk5tmVN2VbbmTQ-L8yylTGql1HFaDoO-XCnlUut7UAfA==

GET
H2 200 i.js Show response
tag.wknd.ai/6664/ 17 KB
6 KB 367ms
78ms Script
text/plain 34.120.253.250
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.wknd.ai/6664/i.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.253.250 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 250.253.120.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: af91e8aa69da058225e20c567eb2dfe8c291ecfbd3903f0b72646e12c02842b2

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:37:20 GMT
content-encoding: gzip
via: 1.1 google
age: 155
x-envoy-upstream-service-time: 1
x-region: us-central1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5573
server: istio-envoy
etag: 296a9382d0b4dc
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=60
timing-allow-origin: *
link: <https://assets.bounceexchange.com>; rel=dns-prefetch, <https://events.bouncex.net>; rel=dns-prefetch, <https://data.cdnbasket.net>; rel=dns-prefetch, <https://page.cdnbasket.net>; rel=dns-prefetch, <https://view.cdnbasket.net>; rel=dns-prefetch, <https://ids.cdnwidget.com>; rel=dns-prefetch, <https://u.cdnwidget.com>; rel=dns-prefetch, <https://api.bounceexchange.com>; rel=preconnect, <https://pd.cdnwidget.com>; rel=preconnect

GET
H2 200 PWA-UpdateSession Show response
www.elfcosmetics.com/mobify/proxy/controllers/on/demandware.store/Sites-elf-us-Site/en_CA/ 56 B
1 KB 329ms
329ms XHR
application/json 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/mobify/proxy/controllers/on/demandware.store/Sites-elf-us-Site/en_CA/PWA-UpdateSession
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: 772f15316085ec36cb19f9af3a622cf12d847e0f187c3f907ee6daf975b7f7ce

Request headers

c_x-pwa-request: true
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
content-encoding: gzip
via: 1.1 9a4c760031a0dcc526cc9dcd0d0940ea.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
x-amz-cf-pop: PHL50-C1
age: 0
x-yottaa-optimizations: ob/1000 si/23D14047a170-1715349443-8248796282 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
pragma: no-cache
content-type: application/json
cache-control: no-cache, no-store, must-revalidate
x-yottaa-os: 200
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/on/demandware.store/Sites-elf-us-Site/en_CA/PWA-UpdateSession
x-yottaa-metrics: 23214047a181/[223,218,-] 23D14047a170/[-,226.469]
cf-ray: 8820dc74885f05c4-IAD
x-dw-request-base-id: DRABktouP2YBAAB_
x-amz-cf-id: JPxhWLMsBJo2dvN3DfS8vcQnJxqgIoLpRAoLSO5FayA2R9WZnUq8fw==
expires: Thu, 01 Dec 1994 16:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
102 B 122ms
121ms Ping
text/plain 2607:f8b0:4004:c17::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZLYXLXNDL8&gtm=45je4580v879088318z8896608294za200&_gaz=1&gcs=G111&gcd=13v3v3v3u5&npa=1&dma=0&cid=1017828244.1715416793&ul=en-ca&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1715416794&sct=1&seg=0&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&en=page_view&_fv=1&_ss=2&tfd=8232
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:57 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 118ms
118ms Ping
text/plain 2607:f8b0:4004:c07::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-ZLYXLXNDL8&cid=1017828244.1715416793&gtm=45je4580v879088318z8896608294za200&aip=1&dma=0&gcs=G111&gcd=13v3v3v3u5&npa=1&frm=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c07::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 134ms
133ms Image
image/gif 2607:f8b0:4004:c1f::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-ZLYXLXNDL8&cid=1017828244.1715416793&gtm=45je4580v879088318z8896608294za200&aip=1&dma=0&gcs=G111&gcd=13v3v3v3u5&npa=1&frm=0&z=1348433826

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect Show response
sgtm.elfcosmetics.com/g/ 739 B
1 KB 399ms
135ms XHR
text/plain 34.49.124.132
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.elfcosmetics.com/g/collect?v=2&tid=G-5D80LRC85N&gtm=45je4580v9125640115z8896608294za200&gcs=G111&gcd=13v3v3v3u5&npa=1&dma=0&cid=1017828244.1715416793&ecid=1852065918&ul=en-ca&sr=1600x1200&_fplc=0&ir=1&ur=CA-ON&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=EA&sst.rnd=1275937653.1715416793&sst.gse=1&sst.etld=google.ca&sst.gcd=13v3v3v3u5&sst.adr=1&sst.ude=0&_s=1&sid=1715416794&sct=1&seg=0&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&en=page_view&_fv=1&_ss=1&tfd=8300&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5D80LRC85N&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.49.124.132 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

132.124.49.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

76ec62b7ed46c908c3aa9f05ee34dda6231ca2b8fa120244db55f6cf2af10a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 google, 1.1 google
x-content-type-options: nosniff
server: Google Frontend
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-accel-buffering: no

GET
H2 200 collect Show response
sgtm.elfcosmetics.com/g/ 65 B
396 B 488ms
241ms XHR
text/plain 34.49.124.132
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.elfcosmetics.com/g/collect?v=2&tid=G-5D80LRC85N&gtm=45je4580v9125640115z8896608294za200&gcs=G111&gcd=13v3v3v3u5&npa=1&dma=0&cid=1017828244.1715416793&ecid=1852065918&ul=en-ca&sr=1600x1200&_fplc=0&ir=1&ur=CA-ON&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=EA&sst.rnd=1275937653.1715416793&sst.gse=1&sst.etld=google.ca&sst.gcd=13v3v3v3u5&sst.adr=1&sst.ude=0&_s=2&sid=1715416794&sct=1&seg=0&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&en=pageview&ep.vendor_id=pinterest&ep.email=&ep.event_id=1715417267545_17154171128253&_et=3&tfd=8317&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5D80LRC85N&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.49.124.132 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

132.124.49.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 google, 1.1 google
x-content-type-options: nosniff
server: Google Frontend
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-accel-buffering: no

GET
H2 200 collect Show response
sgtm.elfcosmetics.com/g/ 65 B
396 B 567ms
320ms XHR
text/plain 34.49.124.132
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.elfcosmetics.com/g/collect?v=2&tid=G-5D80LRC85N&gtm=45je4580v9125640115z8896608294za200&gcs=G111&gcd=13v3v3v3u5&npa=1&dma=0&cid=1017828244.1715416793&ecid=1852065918&ul=en-ca&sr=1600x1200&_fplc=0&ir=1&ur=CA-ON&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=EA&sst.rnd=1275937653.1715416793&sst.gse=1&sst.etld=google.ca&sst.gcd=13v3v3v3u5&sst.adr=1&sst.ude=0&_s=3&sid=1715416794&sct=1&seg=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&en=page_view&ep.vendor_id=facebook&ep.event_id=1715417267545_171541711282515&ep.email=&ep.phone=&_et=2&tfd=8317&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5D80LRC85N&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.49.124.132 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

132.124.49.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 google, 1.1 google
x-content-type-options: nosniff
server: Google Frontend
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-accel-buffering: no

POST
H3 200 collector Show response
collector-pxxt4gy2ig.px-cloud.net/api/v2/ 32 B
49 B 114ms
114ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxt4gy2ig.px-cloud.net/api/v2/collector
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 7586f9164e6bc95d916e3828d687c85f77cf253b34a5908fffa5f6f17dfd0d72

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 11 May 2024 08:39:54 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32

GET
H2 200 local
www.paypal.com/credit-presentment/experiments/ Frame 0788 0
0 337ms
82ms Document
text/html 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/credit-presentment/experiments/local?uid=uid_numhnacfzmymuvpacsidplhppphjzs&disableSetCookie=true&features=disable-set-cookie&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEtRVFGWUZkbUtOeHRaUkJvUmR2MmNodlFJLV9aUHZMMWpWTjlTRllDVHNlS1Q0T0hQS3JuVDJ5Smx4OGtXS25GSTdKWEVKTV9jVFNkYmYmaW50ZW50PWF1dGhvcml6ZSZjdXJyZW5jeT1DQUQmdmF1bHQ9dHJ1ZSZjb21wb25lbnRzPWJ1dHRvbnMsbWVzc2FnZXMiLCJhdHRycyI6eyJkYXRhLXNkay1pbnRlZ3JhdGlvbi1zb3VyY2UiOiJyZWFjdC1wYXlwYWwtanMiLCJkYXRhLXVpZCI6InVpZF9udW1obmFjZnpteW11dnBhY3NpZHBsaHBwcGhqenMifX0&env=production&scriptUID=uid_numhnacfzmymuvpacsidplhppphjzs&version=1.64.0&integrationType=SDK

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AQ-EQFYFdmKNxtZRBoRdv2chvQI-_ZPvL1jVN9SFYCTseKT4OHPKrnT2yJlx8kWKnFI7JXEJM_cTSdbf&intent=authorize&currency=CAD&vault=true&components=buttons,messages

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'sha256-RmYTC9iPUTyoPfOBR9rEZcPmA3A8NGQgxJOYYBUb740=' 'sha256-MkvCXwEdBhR/QU6eqGX5THWCtkqlaanwiNzVKNI9Vb8=' 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com https:; frame-src 'self' https://.paypalobjects.com https://.paypal.com https://.qualtrics.com; connect-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges: bytes
access-control-expose-headers: Server-Timing
age: 42032
cache-control: s-maxage=86400, max-age=0
content-encoding: gzip
content-length: 1526
content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'sha256-RmYTC9iPUTyoPfOBR9rEZcPmA3A8NGQgxJOYYBUb740=' 'sha256-MkvCXwEdBhR/QU6eqGX5THWCtkqlaanwiNzVKNI9Vb8=' 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com https:; frame-src 'self' https://*.paypalobjects.com https://*.paypal.com https://*.qualtrics.com; connect-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com
content-type: text/html; charset=utf-8
date: Sat, 11 May 2024 08:39:55 GMT
dc: ccg11-origin-www-1.paypal.com
edge-cache-tag: up-treatments-zoid
etag: W/"1479-kh6UBYIoGxq2oVlgyLcuhUJ6VJI"
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
paypal-debug-id: f144708c2689b
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
server-timing: "traceparent;desc="00-0000000000000000000f144708c2689b-9a65b2269d2f1e05-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
traceparent: 00-0000000000000000000f144708c2689b-d42894f6a6021332-01
vary: Accept-Encoding
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT, MISS
x-cache-hits: 226, 3308, 0
x-served-by: cache-bur-kbur8200138-BUR, cache-yyz4571-YYZ, cache-yyz4571-YYZ
x-timer: S1715416795.998897,VS0,VE5
x-xss-protection: 1; mode=block

GET
H2 200 pptm.js Show response
www.paypal.com/tagmanager/ 14 KB
6 KB 80ms
77ms Script
application/x-javascript 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/tagmanager/pptm.js?id=www.elfcosmetics.com&t=xo&v=5.0.437&source=payments_sdk&client_id=AQ-EQFYFdmKNxtZRBoRdv2chvQI-_ZPvL1jVN9SFYCTseKT4OHPKrnT2yJlx8kWKnFI7JXEJM_cTSdbf&comp=buttons,messages&disableSetCookie=true&vault=true

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5506280b7dc0dccff9587cbae7f5ba116267dada5e743b3e73fdcef498a4acd0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'nonce-Ow5BAHwLnxH71qr+ChdlaxW7qGaQSb8L536WCiu2Fggm3GDw' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; img-src * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://nexus.ensighten.com https://.google-analytics.com 'unsafe-inline' https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-Ow5BAHwLnxH71qr+ChdlaxW7qGaQSb8L536WCiu2Fggm3GDw' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; img-src * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com 'unsafe-inline' https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 11 May 2024 08:39:55 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
age: 41019
x-cache: HIT, HIT, MISS
paypal-debug-id: f16527211682a
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
content-length: 4796
x-xss-protection: 1; mode=block
x-served-by: cache-bur-kbur8200060-BUR, cache-yyz4569-YYZ, cache-yyz4569-YYZ
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent: 00-0000000000000000000f16527211682a-7171d96b30346ebd-01
x-timer: S1715416796.559249,VS0,VE4
etag: W/"3691-fk4lnuYKpnLqBSWqgOSMfEIwO6c"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=3600
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
x-cache-hits: 136, 56, 0

GET
H2

200

activityi;dc_pre=CICf6MWZhYYDFcYTdgYdFSQPlg;src=9231397;type=retarget;cat=globa0;ord=3030601785353;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefine...
9231397.fls.doubleclick.net/ Frame 6B14
Redirect Chain

https://9231397.fls.doubleclick.net/activityi;src=9231397;type=retarget;cat=globa0;ord=3030601785353;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefi...
https://9231397.fls.doubleclick.net/activityi;dc_pre=CICf6MWZhYYDFcYTdgYdFSQPlg;src=9231397;type=retarget;cat=globa0;ord=3030601785353;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-...

0
0

179ms
178ms

Document
text/html

142.251.163.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9231397.fls.doubleclick.net/activityi;dc_pre=CICf6MWZhYYDFcYTdgYdFSQPlg;src=9231397;type=retarget;cat=globa0;ord=3030601785353;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=false;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181619921z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f148.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 473
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 11 May 2024 08:39:55 GMT
expires: Sat, 11 May 2024 08:39:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 11 May 2024 08:39:55 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9231397.fls.doubleclick.net/activityi;dc_pre=CICf6MWZhYYDFcYTdgYdFSQPlg;src=9231397;type=retarget;cat=globa0;ord=3030601785353;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=false;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181619921z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 collect
analytics.google.com/g/s/ 0
210 B 620ms
202ms Image
text/plain 2607:f8b0:4004:c17::65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e4570v9125640115z8896608294z99175401888za200&_gsid=5D80LRC85NG6OAHbkmoEZxKqax6xTbdQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:56 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 131ms
131ms Image
image/gif 2607:f8b0:4004:c1f::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=0&tid=G-5D80LRC85N&cid=JI4RasqPXn9fV6eXTO53UGygJ6052lFl40lQ8Osrk2A%3D.1715416793&gtm=45j91e4570v9125640115z8896608294z99175401888za200&aip=1&z=1244836254

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 collect
stats.g.doubleclick.net/g/ 0
16 B 127ms
125ms Image
text/plain 2607:f8b0:4004:c07::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&dma=0&tid=G-5D80LRC85N&cid=JI4RasqPXn9fV6eXTO53UGygJ6052lFl40lQ8Osrk2A%3D.1715416793&gtm=45j91e4570v9125640115z8896608294z99175401888za200&aip=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c07::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:56 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

activityi;dc_pre=CJur6cWZhYYDFQ0PdgYdczIGlQ;src=10742279;type=elf8j0;cat=glo_flap;ord=8050526604900;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-c...
10742279.fls.doubleclick.net/ Frame 89C4
Redirect Chain

https://10742279.fls.doubleclick.net/activityi;src=10742279;type=elf8j0;cat=glo_flap;ord=8050526604900;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmeti...
https://10742279.fls.doubleclick.net/activityi;dc_pre=CJur6cWZhYYDFQ0PdgYdczIGlQ;src=10742279;type=elf8j0;cat=glo_flap;ord=8050526604900;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfc...

0
0

182ms
181ms

Document
text/html

142.251.163.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10742279.fls.doubleclick.net/activityi;dc_pre=CJur6cWZhYYDFQ0PdgYdczIGlQ;src=10742279;type=elf8j0;cat=glo_flap;ord=8050526604900;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181663336z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f149.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 409
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 11 May 2024 08:39:55 GMT
expires: Sat, 11 May 2024 08:39:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 11 May 2024 08:39:55 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10742279.fls.doubleclick.net/activityi;dc_pre=CJur6cWZhYYDFQ0PdgYdczIGlQ;src=10742279;type=elf8j0;cat=glo_flap;ord=8050526604900;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181663336z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

PATCH
H2 200 3e2cf67d330f9af7494a43bdab Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/baskets/ 3 KB
2 KB 244ms
243ms XHR
application/json 64.71.161.112
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/baskets/3e2cf67d330f9af7494a43bdab

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/mobify/bundle/11187/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.71.161.112 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

0b02eeb997b4d190e584dbb89c5dcea4d02572834f66f242faa21f9dc1dd3b05

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiI4YzhjYTI4OC1mMWE2LTRmMDktYjI2OS0wNWQyZWViZmRmMDEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmM5Mjc0YmQwLWM0ZmQtNGU2MS04YWM4LWQyMzhkNjljYzk1OSIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MTU0MTY3NjMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmJld1hJV2xYcEd4Y2FSd1hwS3hiWVl4cndWOjpjaGlkOiAiLCJleHAiOjE3MTU0MTg1OTMsImlhdCI6MTcxNTQxNjc5MywianRpIjoiQzJDMTk1MTY2MTE4NjAtNDI0NjM3OTAzMjEwMjg3NDYxNTI4OTU2In0.ACsqn3PuT0YiG8Sb86_WGu2luvg_CT7Rvo2drKThIE3LZ2G3y70WQknnpt1H87LmMKwI4Aw0ogGH1PMyhno5rA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: application/json
c_x-pwa-request: true
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
sec-ch-ua-platform: "Win32"

Response headers

x-yottaa-profileid: 5a0c9b7632f01c35d4210220
date: Sat, 11 May 2024 08:39:55 GMT
sfdc_customization: HOOK
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 4e2a7874b5959279490dd3b94b18a312.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 0
x-yottaa-optimizations: ob/1000 si/23D14047a170-1715349443-8248796283 tts/1710864117856 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
content-encoding: gzip
x-dw-version-status: obsolete
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 996
etag: 6d0b7c20d6dd1b6910042f01f2698c3061dd18d180422742bacf1bab5555b542
allow: DELETE,GET,HEAD,OPTIONS,PATCH
content-type: application/json;charset=UTF-8
x-dw-resource-state: 6d0b7c20d6dd1b6910042f01f2698c3061dd18d180422742bacf1bab5555b542
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: etag,location,x-dw-version-status,x-dw-resource-state,authorization,x-dw-request-base-id
x-yottaa-os: 200
access-control-allow-credentials: true
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/baskets/3e2cf67d330f9af7494a43bdab
accept-ranges: bytes
cf-ray: 8820dc791c1905c4-IAD
x-dw-request-base-id: DRAYktsuP2YBAAB_
x-amz-cf-id: 39O8UgqgOUB4cSB14yr3oW90JcPxvYWSfZVP13qUP90r6GWUF5j5mQ==
x-yottaa-metrics: 23214047a182/[111,107,-] 23D14047a170/[-,116.541]

GET
H2 200 t2_16331p_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
700 B 521ms
178ms XHR
application/json 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_16331p_telemetry
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:55 GMT
content-encoding: gzip
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
server: snooserv
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
content-length: 98

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 387ms
140ms Image
image/gif 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1715416794992&id=t2_16331p&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=697ea2e5-5ccb-4ec5-9df8-5e0827c43482&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_a8bbbcc6&dpm=&dpcc=&dprc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:56 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 display Show response
api.usehero.com/webplugin/ 189 B
1 KB 497ms
163ms XHR
application/json 54.237.62.243
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.usehero.com/webplugin/display?appId=efcf9631-4c6b-4874-9f76-51f71464249a&location=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&state=untouched&outboundFeature=

Requested by

Host: cdn.usehero.com
URL: https://cdn.usehero.com/loader.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.237.62.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-62-243.compute-1.amazonaws.com

Software

Resource Hash

0b6b20418b25a8020e4bc09d4c60f0da9fd2a553cc393d68be6328a64402d992

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains, max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-permitted-cross-domain-policies: none
surrogate-control: no-store
x-dns-prefetch-control: off
klarna-correlation-id: 48f32b5b-a582-4b6f-be4c-4b89e653732a
cross-origin-resource-policy: same-origin
x-geo-longitude: -79.36230
pragma: no-cache
referrer-policy: same-origin
etag: W/"bd-Dg6XpqyNMel86+l5hgGcWn2wlSQ"
x-frame-options: SAMEORIGIN
x-geo-zip: M5A
content-type: application/json; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?1
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-geo-latitude: 43.65470
x-accuracy: 20
expires: 0
date: Sat, 11 May 2024 08:39:55 GMT
strict-transport-security: max-age=15552000; includeSubDomains, max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
cross-origin-embedder-policy: require-corp
x-time-zone: America/Toronto
x-envoy-upstream-service-time: 15
content-length: 189
x-xss-protection: 0
x-request-id: 48f32b5b-a582-4b6f-be4c-4b89e653732a
cross-origin-opener-policy: same-origin
x-download-options: noopen
x-country: CA
x-geo-city: Toronto

GET
H2 204 pageview
c.contentsquare.net/ 0
320 B 516ms
164ms Image
text/plain 3.220.193.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/pageview?ex=&dt=502&pvt=n&cvars=%7B%223%22%3A%5B%22Page%20Type%22%2C%22content%22%5D%7D&cvarp=%7B%223%22%3A%5B%22Page%20Type%22%2C%22content%22%5D%7D&la=en-CA&uc=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dr=&dw=1600&dh=6759&ww=1600&wh=1200&sw=1600&sh=1200&uu=fb5b6c1e-e081-a8c1-b6c1-5f9d40b55289&sn=1&hd=1715416795&v=14.10.0&pid=1926&pn=1&r=927560
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.220.193.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-193-24.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:56 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
H2 200 jsp Show response
ut.rd.linksynergy.com/ 148 B
414 B 418ms
146ms Script
text/plain 34.98.67.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ut.rd.linksynergy.com/jsp?cn=rmuid&ro=0&cb=___rmuid

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.98.67.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

3.67.98.34.bc.googleusercontent.com

Software

Resource Hash

05791abffddcb67a92e9e2dfa25361ef8786512e296c288404357401db621f49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-type: text/plain; charset=utf-8
date: Sat, 11 May 2024 08:39:56 GMT
via: 1.1 google
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 148
x-samesite: secure

GET
H2 200 main.2bdc3040.js Show response
s.pinimg.com/ct/lib/ 69 KB
20 KB 128ms
126ms Script
application/javascript 2600:1408:c400:392::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.2bdc3040.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:392::1931 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 32d720cede6dadc60f848ff6670b767292e508c5ec392ef64ffd4fd46982e565

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-cdn: akamai
etag: "12a8f2d3ddbe2363a4a569b085d70d28"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 19942

GET
BLOB 200
OK 22610ed0-a578-476f-b7fc-c76d16b1860a
https://www.elfcosmetics.com/ 7 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.elfcosmetics.com/22610ed0-a578-476f-b7fc-c76d16b1860a
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b6bc1aaf438e1b7ca4df626c3ccbba4d73ac05b8ad1a31bb2b556da0bfaa0a7

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 7329
Content-Type: application/javascript

GET
H2 200 1638306756445368 Show response
connect.facebook.net/signals/config/ 68 KB
14 KB 116ms
116ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1638306756445368?v=2.9.156&r=stable&domain=www.elfcosmetics.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b336f926203c1280abc248e9659a8bfc81f33e5827bd8e5a90bd43cbe9958ef4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sat, 11 May 2024 08:39:56 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 14133
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=21, rtx=0, c=61, mss=1392, tbw=63325, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma: public
x-fb-debug: jfRhauZnzG6UCsvL/OpMW9b15rawvCIJN/jBJ0gv3pCJPOUVWx8PCmlWBvKZJPFa69Kx7mMj/iKOFGnhrKCd5g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 5013978.js Show response
bat.bing.com/p/action/ 0
118 B 109ms
107ms Script
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5013978.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Sat, 11 May 2024 08:39:56 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D4786A40C69448D69D7E3C5C5A19852D Ref B: YTO01EDGE0515 Ref C: 2024-05-11T08:39:56Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
361 B 202ms
201ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5013978&tm=gtm002&Ver=2&mid=bddb8f05-7dc3-4d36-9c35-c363d033a856&sid=0aa25a700f7211ef973dc7249545513e&vid=0aa29dd00f7211ef8aa4effdac61fb40&vids=1&msclkid=N&pi=918639831&lg=en-CA&sw=1600&sh=1200&sc=24&tl=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&p=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&r=&lt=7583&evt=pageLoad&sv=1&rn=807244

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 11 May 2024 08:39:56 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E62BA1744408460285255B1141AAAB45 Ref B: YTO01EDGE0515 Ref C: 2024-05-11T08:39:56Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 dvar
c.contentsquare.net/ 0
319 B 93ms
92ms Image
text/plain 3.220.193.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/dvar?v=14.10.0&pid=1926&pn=1&sn=1&uu=fb5b6c1e-e081-a8c1-b6c1-5f9d40b55289&dv=H4sIAAAAAAAAA6tWcnSKd4mMd8%2FJT0rMUXDOzyspys9RCEktLlGyUnKpzEvMzUxWiMxMzUlRcK0oSC3KTM1LTi1W0oHqQ4gpGAI1hCUWZSaWZObnAXkwJT755QqeeSWpeSATA%2FILSnOAikoqlWoB8S1cunwAAAA%3D&ct=2&r=395439
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.220.193.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-193-24.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:56 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
H2 200 main.MWNkMWZjOGNjMA.js Show response
analytics.tiktok.com/i18n/pixel/static/ 411 KB
109 KB 156ms
156ms Script
application/javascript 23.212.248.137
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.137 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-248-137.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 4dee7b7f5bd454fc7b52f623814a23be6e9bc6b191ffb1b14a8202ce10d6813f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-akamai-request-id: 1878dfd
date: Sat, 11 May 2024 08:39:56 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server: nginx
x-tt-logid: 20240509122136B8A93EFB888B9633C3FE
x-tt-trace-id: 00-240509122136B8A93EFB888B9633C3FE-6B220C80364BD591-00
vary: Accept-Encoding
x-cache: TCP_MEM_HIT from a23-220-104-137.deploy.akamaitechnologies.com (AkamaiGHost/11.5.0.1-56208139) (-)
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-tt-trace-host: 01d95672a5a61efd01ab307e9a6e9e938bff344acdd7fc12ac6a83f08cad727f2d0683759de4b2dde63a3e5f61b71a6ba2c16200ccd01bdf11c12b634b3955a312b78005ddfbbeeebf6bc6fba5294605b8073c9031441b25e5c4c188ab40047e35
server-timing: cdn-cache; desc=HIT, edge; dur=0, origin; dur=0, inner; dur=1
content-length: 111416

GET
H2 200 main.MWNkMWZjOGNjMQ.js Show response
analytics.tiktok.com/i18n/pixel/static/ 431 KB
114 KB 117ms
111ms Script
application/javascript 23.212.248.137
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMQ.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.137 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-248-137.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 25c8e105aed1fd7c0e7869d4e5cdc896fc4f74a2e6a24428711da23557cb98d3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-akamai-request-id: 18791d3
date: Sat, 11 May 2024 08:39:57 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server: nginx
x-tt-logid: 202405091304303DBA8CA429C591E1C63A
x-tt-trace-id: 00-2405091304303DBA8CA429C591E1C63A-43E6F3B6E0B8F4ED-00
vary: Accept-Encoding
x-cache: TCP_MEM_HIT from a23-220-104-137.deploy.akamaitechnologies.com (AkamaiGHost/11.5.0.1-56208139) (-)
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-tt-trace-host: 01d7aa588f05f9266f0c97550bef6f81254ed4802e01ae93a3097413d9d967cc5845410049250a1cc3dbb4ffab2ba69883bc33802b08937d5eb867cbe694f21c5f5e4c3dabb4048a8de55d261f00dd5c4aaef388a9b14527b73b3e93ed7df397ef
server-timing: cdn-cache; desc=HIT, edge; dur=1, origin; dur=0, inner; dur=2
content-length: 116349

GET
H2 200 ts
t.paypal.com/ 42 B
550 B 421ms
161ms Image
image/gif 151.101.193.35
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?pgrp=muse%3Athird-party%3Aanalytics-xo%3A%3A7PFGPLHGYKX72-1&page=muse%3Athird-party%3Aanalytics-xo%3A%3A7PFGPLHGYKX72-1%3A%3A%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=3a9b41b4-1a0b-4488-939e-bc9b13368cc5&fltp=analytics&mrid=7PFGPLHGYKX72&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&flag_consume=yes&pt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1715416795605&g=420&completeurl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&disableSetCookie=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.35 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 0, 0
date: Sat, 11 May 2024 08:39:57 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, MISS
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id: 0a91c9c039aa9
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
x-served-by: cache-bur-kbur8200173-BUR, cache-yyz4521-YYZ
pragma: no-cache
correlation-id: 0a91c9c039aa9
traceparent: 00-00000000000000000000a91c9c039aa9-cc92b86a96bdde8f-01
x-timer: S1715416798.615207,VS0,VE87
vary: Accept-Encoding
content-type: image/gif
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 May 2024 08:39:57 GMT

POST
H2 200 exist Show response
srm.ba.contentsquare.net/ 2 B
94 B 956ms
349ms Fetch
application/json 54.77.225.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://srm.ba.contentsquare.net/exist?v=14.10.0&pid=1926&pn=1&sn=1&uu=fb5b6c1e-e081-a8c1-b6c1-5f9d40b55289
Requested by: Host: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/1a8bfa042c9c5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.225.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-225-35.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 11 May 2024 08:39:56 GMT
content-length: 2
content-type: application/json

GET
H2 200 script-tag.js Show response
cdn-scripts.signifyd.com/api/ 10 KB
4 KB 407ms
90ms Script
application/javascript 108.138.106.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-scripts.signifyd.com/api/script-tag.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-40.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d7a363f752524fb545c3b2eb48a56d163cb659bc427d5215800ee7781d92c2ca

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:20:38 GMT
content-encoding: gzip
via: 1.1 87fe250b32fc87699b1f30c0c5ab6004.cloudfront.net (CloudFront)
last-modified: Tue, 23 Apr 2024 14:51:40 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P3
age: 1160
x-amz-server-side-encryption: AES256
etag: W/"73ca6f23f3e08738233832c7a7a0c30c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=1800
x-amz-cf-id: 1P-u_vmm-W8GTcI062h7Ch_BluY_8GTSsy8gZ_TPcEe5dc4JLOGdQg==

GET
H2 200 muse.js Show response
www.paypalobjects.com/muse/ 55 KB
16 KB 459ms
96ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/muse/muse.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (chf/1693) /

Resource Hash

20029e526c0674dd1f99d02142bbf324bd8ee217ca43705fa6fe1a64bd90ee0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: HIT
paypal-debug-id: 7d1320b30a415
dc: ccg11-origin-www-1.paypal.com
content-length: 16355
last-modified: Fri, 01 Sep 2023 21:10:59 GMT
server: ECAcc (chf/1693)
traceparent: 00-00000000000000000007d1320b30a415-017e7207d53f8af7-01
etag: "64f25363-daa8+gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
expires: Sat, 11 May 2024 09:39:57 GMT

GET
H2 200 widget.css
js.jebbit.com/companion/v1/ 15 KB
16 KB 167ms
166ms Stylesheet
text/css 2600:9000:2514:9e00:a:7914:b00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.jebbit.com/companion/v1/widget.css
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2514:9e00:a:7914:b00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 875ca118023e8741e684a320e73b7f9af4e8eba6c88f1f7e8457f7c0cdda6efb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 5TtP6A3FvksKClCFN7X6r1PsSCc1hWlP
date: Sat, 11 May 2024 07:06:52 GMT
via: 1.1 c456cd1dcda544d97e59ee05afbea4a2.cloudfront.net (CloudFront)
last-modified: Thu, 02 May 2024 15:04:41 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P8
age: 5585
x-amz-server-side-encryption: AES256
etag: "de1b72e797664b9b2c2139e5ccb24844"
x-cache: Hit from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 15521
x-amz-cf-id: nDAopwavdXaPaVBqLGRJ4p5t9XQd-Vg0XDlBQKngapUpBK77xSvPQg==

GET
H2 200 launcher_configs Show response
external-api.jebbit.com/moments/v2/ 2 B
448 B 516ms
163ms XHR
application/json 3.232.206.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://external-api.jebbit.com/moments/v2/launcher_configs?key=542695a9-9318-492b-9638-2018989f6dc4&url=aHR0cHMlM0ElMkYlMkZ3d3cuZWxmY29zbWV0aWNzLmNvbSUyRmVuX0NBJTJGZWxmLWNvc21ldGljLWNyaW1pbmFscw==&completedLightboxCampaigns=W10=&jebbitCookies=

Requested by

Host: js.jebbit.com
URL: https://js.jebbit.com/companion/v1/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.232.206.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-232-206-92.compute-1.amazonaws.com

Software

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
surrogate-control: no-store
x-dns-prefetch-control: off
content-length: 2
x-xss-protection: 1; mode=block
pragma: no-cache
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
x-download-options: noopen
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
expires: 0

GET
H2 200 runtime_6459738026535cda4232dc813c61447d.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 3 KB
2 KB 332ms
75ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/runtime_6459738026535cda4232dc813c61447d.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 59f1b7d93f47fcc926143154888aa471910eaf81c3c41270b61cfe012dda08df

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 26 Apr 2024 03:41:58 GMT
content-encoding: br
age: 1313879
x-guploader-uploadid: ABPtcPpwEnAdhBB_G6lc_i-iccU9eZuZ1tiGPNPUtpRuGheYdjLCfr0fu2wQD0OeJlkCfP00d1U
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1316
last-modified: Tue, 23 Apr 2024 14:37:31 GMT
server: UploadServer
etag: "09512239cb2a22728ca9f8608dfc2181"
x-goog-generation: 1713883050962681
x-goog-hash: crc32c=BS9gKg==, md5=CVEiOcsqInKMqfhgjfwhgQ==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 1316
accept-ranges: bytes
content-type: text/javascript

GET
H2

200

cs
tags.rd.linksynergy.com/
Redirect Chain

https://idsync.rlcdn.com/458359.gif?partner_uid=6dbe79cc-b314-42b0-8e6a-b91d21869909
https://idsync.rlcdn.com/1000.gif?memo=CPf8GxIwCiwIARCd5gEaJDZkYmU3OWNjLWIzMTQtNDJiMC04ZTZhLWI5MWQyMTg2OTkwORAAGg0I3d38sQYSBQjoBxAAQgBKAA
https://tags.rd.linksynergy.com/cs?ns=lr&uid3=df9797fbc93ef32359d61c2d2b594483c90d7bb5a6069cae8debe23f60e252a76ac34734d8e453ee

37 B
303 B

109ms
100ms

Image
image/gif

34.98.67.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tags.rd.linksynergy.com/cs?ns=lr&uid3=df9797fbc93ef32359d61c2d2b594483c90d7bb5a6069cae8debe23f60e252a76ac34734d8e453ee

Protocol

Server

34.98.67.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

3.67.98.34.bc.googleusercontent.com

Software

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

content-type: image/gif
date: Sat, 11 May 2024 08:39:57 GMT
via: 1.1 google
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
x-samesite: secure

Redirect headers

date: Sat, 11 May 2024 08:39:57 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://tags.rd.linksynergy.com/cs?ns=lr&uid3=df9797fbc93ef32359d61c2d2b594483c90d7bb5a6069cae8debe23f60e252a76ac34734d8e453ee
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 / Show response
ct.pinterest.com/user/ 321 B
728 B 582ms
241ms XHR
application/json 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2615235625530&pd=%7B%22np%22%3A%22gtm%22%7D&cb=1715416796727&dep=2%2CPAGE_LOAD

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.2bdc3040.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

27074e6240ca22f6d5a7cc51ee8cd8a0f091080ca80e6a1bea1c624e1cb40341

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:57 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.14dfda17.1715416797.39cacf5a
x-envoy-upstream-service-time: 0
alt-svc: h3=":443"; ma=600
content-length: 186
x-pinterest-rid: 4394661841393143
pin-unauth: dWlkPU5HSXpZamsyTTJNdFpURm1NaTAwWkRoaUxUaGpZemd0WkRCaVltSmlZak5tWlRBMg
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
pinterest-version: 9ab3886c06a794ff1d841687ae65f5a1cfdbcfc8
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ 321 B
706 B 613ms
274ms XHR
application/json 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22event_id%22%3A%223c13a414-3f1d-4e49-ac58-44e222159b0c%22%7D&tid=2615235625530&cb=1715416796730&dep=5%2CEVENT_TAGS_ABSENT

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.2bdc3040.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

27074e6240ca22f6d5a7cc51ee8cd8a0f091080ca80e6a1bea1c624e1cb40341

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:57 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.14dfda17.1715416797.39cacf5b
x-envoy-upstream-service-time: 0
content-length: 186
x-pinterest-rid: 1287768742237276
pin-unauth: dWlkPU5UQXdNVGc0TURNdFpXVmlaaTAwTmpnekxUbGhNemN0T1dRME9XVmtPR05rWW1KaQ
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
pinterest-version: 9ab3886c06a794ff1d841687ae65f5a1cfdbcfc8
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
0 577ms
242ms Fetch
image/gif 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/v3/?tid=2615235625530&pd=%7B%22np%22%3A%22gtm%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%222bdc3040%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22124%22%7D%2C%7B%22brand%22%3A%22Not%3AA-Brand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22124%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Win32%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22124.0.6367.201%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1715416796733

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.2bdc3040.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:57 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.14dfda17.1715416797.39cacf5c
content-type: image/gif
access-control-allow-origin: https://www.elfcosmetics.com
pinterest-version: 9ab3886c06a794ff1d841687ae65f5a1cfdbcfc8
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
content-length: 35
x-pinterest-rid: 1385875094540047
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 592ms
200ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1638306756445368&ev=PageView&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&rl=&if=false&ts=1715416796799&sw=1600&sh=1200&v=2.9.156&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1715416796790.254037398&ic=fbpixel&ler=empty&cdl=API_unavailable&it=1715416795075&coo=false&eid=1715417267545_171541711282515&tm=1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=20, rtx=0, c=10, mss=1392, tbw=2775, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 11 May 2024 08:39:57 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 identify_93546.js Show response
analytics.tiktok.com/i18n/pixel/static/ 139 KB
37 KB 122ms
122ms Script
application/javascript 23.212.248.137
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/identify_93546.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.137 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-248-137.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a869fe8cddaf23f1ee50724c35748cefb30c697095b2cf4a231033cb8f43b4ab

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-akamai-request-id: 18791fd
date: Sat, 11 May 2024 08:39:57 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server: nginx
x-tt-logid: 202405081635555477AB3B4CA12F6B454E
x-tt-trace-id: 00-2405081635555477AB3B4CA12F6B454E-54D93758FBE08EFA-00
vary: Accept-Encoding
x-cache: TCP_MEM_HIT from a23-220-104-137.deploy.akamaitechnologies.com (AkamaiGHost/11.5.0.1-56208139) (-)
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-tt-trace-host: 01020507c706a4db6c4d0c8391dc36c2c891a9a196cb6b989f99be4096195661376fa042cf50a34626e0285cdb75551ddc8c5a139bddbcc98c433d75b70fd1ef3ed237335756263d16473bc7b78fd70b9f8f43620840ec00fe71b92b6b64c75481
server-timing: cdn-cache; desc=HIT, edge; dur=1, origin; dur=0, inner; dur=2
content-length: 37256

POST
H2 200 performance_interaction
analytics.tiktok.com/api/v2/ 0
702 B 158ms
158ms Ping
text/plain 23.212.248.137
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/performance_interaction
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.137 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-248-137.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 1879366
date: Sat, 11 May 2024 08:39:57 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-24051108395734F042E3A876C2A35E0A-04F479260E404BD5-00
x-cache: TCP_MISS from a23-220-104-137.deploy.akamaitechnologies.com (AkamaiGHost/11.5.0.1-56208139) (-)
server-timing: inner; dur=10, cdn-cache; desc=MISS, edge; dur=9, origin; dur=14
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 2024051108395734F042E3A876C2A35E0A
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 14,23.220.104.137
x-tt-trace-host: 014e4e28718c3c2e9a3ad553ffba555f92c058d95d2516a1102b8b37389245dfc3b74e982136061738b87dbab3b13269331da594c3572d312a0a729207b0921cfc84efc05d50d59901967ea6099a0bf95a431b7b7f62d847c305a099299cecb979
access-control-allow-headers: Authorization,*
expires: Sat, 11 May 2024 08:39:57 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
701 B 205ms
205ms Ping
text/plain 23.212.248.137
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.137 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-248-137.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 187941e
date: Sat, 11 May 2024 08:39:57 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-24051108395708239E8156182E8ED8FB-40B17CD425AC5F60-00
x-cache: TCP_MISS from a23-220-104-137.deploy.akamaitechnologies.com (AkamaiGHost/11.5.0.1-56208139) (-)
server-timing: inner; dur=29, cdn-cache; desc=MISS, edge; dur=6, origin; dur=32
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 2024051108395708239E8156182E8ED8FB
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 32,23.220.104.137
x-tt-trace-host: 014e4e28718c3c2e9a3ad553ffba555f92c058d95d2516a1102b8b37389245dfc39628cd1fb16dc947dd064dc69b37e1e3f7fa52b1d9108af9bc107d41df3f029d71f16462c09fa7d6da0128ba92a0a15bd549d05098114c9232551e27992b8336
access-control-allow-headers: Authorization,*
expires: Sat, 11 May 2024 08:39:57 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
700 B 133ms
133ms Ping
text/plain 23.212.248.137
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.137 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-248-137.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 18794b1
date: Sat, 11 May 2024 08:39:57 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-2405110839574F03BDC013BEDDA91D72-4478646B28219BF7-00
x-cache: TCP_MISS from a23-220-104-137.deploy.akamaitechnologies.com (AkamaiGHost/11.5.0.1-56208139) (-)
server-timing: inner; dur=17, cdn-cache; desc=MISS, edge; dur=9, origin; dur=20
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202405110839574F03BDC013BEDDA91D72
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 21,23.220.104.137
x-tt-trace-host: 014e4e28718c3c2e9a3ad553ffba555f92c058d95d2516a1102b8b37389245dfc3ede31c07fbf7cbf93d8fb0c6c6279c16bac171a45a169c9b05ae586708ee09daa450bb154e57ad26254bcadeae8064cd210f169aac2bb11d504e7119ee5a4067
access-control-allow-headers: Authorization,*
expires: Sat, 11 May 2024 08:39:57 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
703 B 174ms
174ms Ping
text/plain 23.212.248.137
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.137 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-248-137.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 18794ec
date: Sat, 11 May 2024 08:39:57 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-240511083957D02FD61E0EDDAAB04C45-31908983375903F1-00
x-cache: TCP_MISS from a23-220-104-137.deploy.akamaitechnologies.com (AkamaiGHost/11.5.0.1-56208139) (-)
server-timing: inner; dur=29, cdn-cache; desc=MISS, edge; dur=8, origin; dur=32
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20240511083957D02FD61E0EDDAAB04C45
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 33,23.220.104.137
x-tt-trace-host: 014e4e28718c3c2e9a3ad553ffba555f92c058d95d2516a1102b8b37389245dfc34e1b513c65e8b7a52eea506588cadda888ee6654c0d3692961b4e0bda0a741fcca5f59593da1bdcb0343cbb9655d5d6be0b84b8465a7007298b01fe580b0201b
access-control-allow-headers: Authorization,*
expires: Sat, 11 May 2024 08:39:57 GMT

POST
H2 200 act
analytics.tiktok.com/api/v2/pixel/ 0
702 B 160ms
160ms Ping
text/plain 23.212.248.137
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel/act
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.137 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-248-137.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 18794fc
date: Sat, 11 May 2024 08:39:57 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-240511083957C297744D86BC5B9F62B0-0FF723860CA5C323-00
x-cache: TCP_MISS from a23-220-104-137.deploy.akamaitechnologies.com (AkamaiGHost/11.5.0.1-56208139) (-)
server-timing: inner; dur=22, cdn-cache; desc=MISS, edge; dur=7, origin; dur=26
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20240511083957C297744D86BC5B9F62B0
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 26,23.220.104.137
x-tt-trace-host: 014e4e28718c3c2e9a3ad553ffba555f92c058d95d2516a1102b8b37389245dfc3bdef4a3f732ee369d503ba9a5512d6d9b2f97298d9ca9fe2915afd8f80072f3a5b93ca9d06f70ebf93f011ca23db857ed5dbfefde7d54e79c18e946e3caaa158
access-control-allow-headers: Authorization,*
expires: Sat, 11 May 2024 08:39:57 GMT

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
0 138ms
137ms Fetch
image/gif 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22event_id%22%3A%223c13a414-3f1d-4e49-ac58-44e222159b0c%22%7D&tid=2615235625530&cb=1715416797349&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22pin_unauth%22%3A%22dWlkPU5HSXpZamsyTTJNdFpURm1NaTAwWkRoaUxUaGpZemd0WkRCaVltSmlZak5tWlRBMg%22%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%222bdc3040%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22124%22%7D%2C%7B%22brand%22%3A%22Not%3AA-Brand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22124%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Win32%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22124.0.6367.201%22%2C%22ecm_enabled%22%3Afalse%7D

Requested by

Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:39:57 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.14dfda17.1715416797.39cad166
content-type: image/gif
access-control-allow-origin: https://www.elfcosmetics.com
pinterest-version: 9ab3886c06a794ff1d841687ae65f5a1cfdbcfc8
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 35
x-pinterest-rid: 1583125698775965
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 main-v2_e6aef002e162dc3c3a947c6f327cd93d.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 493 KB
107 KB 74ms
74ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main-v2_e6aef002e162dc3c3a947c6f327cd93d.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 458e1efc488ce373471e141e0391fe435f3c2c821d18bb2bec307ffdf2f032e5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 19:44:32 GMT
content-encoding: br
age: 132925
x-guploader-uploadid: ABPtcPrv_iEtYJFOcVF_xhJZixq5iX3JNu_iicOzghzeIJKn31SIEpUN62FC_9Pz4sS_nDnDMCFYtbX5aQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109506
last-modified: Thu, 09 May 2024 19:44:23 GMT
server: UploadServer
etag: "06b730ab6ef8f2ac69e2233b833dfe8f"
x-goog-generation: 1715283863650384
x-goog-hash: crc32c=WUfv5A==, md5=Brcwq2748qxp4iM7gz3+jw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 109506
accept-ranges: bytes
content-type: text/javascript

GET
H2 200 cjs_min_3a843477d8e318f67237a66d0a58c542.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 49 KB
16 KB 147ms
146ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_3a843477d8e318f67237a66d0a58c542.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 6c58f061a49641f54723faab57ad0bdb49a95619e86c90dad9a3ed630ffb3780

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 23:07:58 GMT
content-encoding: gzip
age: 207119
x-guploader-uploadid: ABPtcPqJudAYhyjxFHtHh1bcKi-S02AZj75t3yeZaLg9ToDXS9RcA_XqEbt_Uhb7L5mPYyPQAVGqQbeNRQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15748
last-modified: Mon, 22 Apr 2024 20:59:52 GMT
server: UploadServer
etag: "1eb885454ea6bef1c9747800702959de"
x-goog-generation: 1713819592631797
x-goog-hash: crc32c=Joap5g==, md5=HriFRU6mvvHJdHgAcClZ3g==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000,no-transform
x-goog-stored-content-length: 15748
accept-ranges: bytes
content-type: text/javascript; charset=utf-8

GET
H2 200 company_toolkit.js Show response
cdn-scripts.signifyd.com/api/ 4 KB
2 KB 89ms
88ms Script
application/javascript 108.138.106.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-scripts.signifyd.com/api/company_toolkit.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-40.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6082597f3871c77c9b31aa1383577f8c0e54cb5ff09275dc817bc70d96e6217d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:20:38 GMT
content-encoding: gzip
via: 1.1 87fe250b32fc87699b1f30c0c5ab6004.cloudfront.net (CloudFront)
last-modified: Tue, 30 May 2023 10:18:44 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P3
age: 1160
x-amz-server-side-encryption: AES256
etag: W/"2c3950f122b3977df61b0e077aaa92c8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=1800
x-amz-cf-id: AbZVQpNEfiMBnIf6mXj0VfYbsGRXcSZRBWn_FW_Z8z4Qh1S7gbMyXQ==

GET
H3 200 token_create.js Show response
ct.pinterest.com/static/ct/ 4 KB
2 KB 102ms
101ms Script
application/javascript 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/static/ct/token_create.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

QUIC, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

cd56592299c1c670fb97ef28bcb50048508c01879ecb23b71364aecc0483e202

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:57 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.11dfda17.1715416797.46984967
etag: "19c94b308deaf8fbf050b4fca2fa21b7"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=7200
alt-svc: h3=":443"; ma=600
content-length: 2108
quic-version: 0x00000001

GET
H2 200 ct.html
ct.pinterest.com/ Frame 432A 0
0 572ms
226ms Document
text/html 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/ct.html

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

akamai-grn: 0.14dfda17.1715416798.39cada96
alt-svc: h3=":443"; ma=600
cache-control: max-age=86400
content-encoding: gzip
content-length: 323
content-type: text/html; charset=utf-8
date: Sat, 11 May 2024 08:39:58 GMT
pinterest-version: 9ab3886c06a794ff1d841687ae65f5a1cfdbcfc8
referrer-policy: origin
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
vary: Accept-Encoding
x-cdn: akamai
x-envoy-upstream-service-time: 0
x-pinterest-rid: 1277085090277276

GET
H2 200 index.html
www.paypalobjects.com/muse/analytics/ Frame 9D2A 0
0 471ms
101ms Document
text/html 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/muse/analytics/index.html

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (chf/16CA) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
cache-control: s-maxage=31536000, public,max-age=3600
content-encoding: gzip
content-length: 16754
content-type: text/html
date: Sat, 11 May 2024 08:39:58 GMT
dc: ccg11-origin-www-1.paypal.com
etag: "64f25363-dacc+gzip"
expires: Sat, 11 May 2024 09:39:58 GMT
last-modified: Fri, 01 Sep 2023 21:10:59 GMT
paypal-debug-id: 406a80b4c1d3e
server: ECAcc (chf/16CA)
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-0000000000000000000406a80b4c1d3e-e8aa75280a65d107-01
vary: Accept-Encoding
x-cache: HIT
x-content-type-options: nosniff

GET
H2 200 inbox-v2_02aca5df0e176b8810a86da97ac05424.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 17 KB
5 KB 74ms
73ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/inbox-v2_02aca5df0e176b8810a86da97ac05424.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 03dbf9dc05fa84370cbdfb363a10855e9fd035a833cd83b67e14cdb975882bed

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 01:09:18 GMT
content-encoding: br
age: 804639
x-guploader-uploadid: ABPtcPp46DlmpBRV113cw8Fe9pqq9QEcUhr8-d8RQ-y1yGJDnqpF4houQhjgwaQuHTta1zaAdbY
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5089
last-modified: Wed, 01 May 2024 17:27:47 GMT
server: UploadServer
etag: "2a4c802d3ec2dfc292cc9bb15ef5f45d"
x-goog-generation: 1714584467417610
x-goog-hash: crc32c=PRHjLA==, md5=KkyALT7C38KSzJuxXvX0XQ==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 5089
accept-ranges: bytes
content-type: text/javascript

GET
H2 200 onsite-v2_0e56ab6ba004ee080ce3deb3edae35e9.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 16 KB
5 KB 75ms
75ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/onsite-v2_0e56ab6ba004ee080ce3deb3edae35e9.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f10699f59e4285b87af5097e4ba9e470ee29b4f3487fa767f2818bdbbdd6bb14

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 26 Apr 2024 03:41:57 GMT
content-encoding: br
age: 1313880
x-guploader-uploadid: ABPtcPp1-pyK1jFmykrISpYdOEpFenwn-T8jc23pdBkDmSld74BrYwdRBDZPCr09nv8z3rOlU_SZzIWq3g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5003
last-modified: Tue, 23 Apr 2024 14:37:24 GMT
server: UploadServer
etag: "7ff99b6f1cea743cef749de91009e764"
x-goog-generation: 1713883044855037
x-goog-hash: crc32c=qFvE1Q==, md5=f/mbbxzqdDzvdJ3pEAnnZA==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 5003
accept-ranges: bytes
content-type: text/javascript

GET
H/1.1 200
OK blc1d8ozy8vr2jbi.js Show response
imgs.signifyd.com/ 96 KB
13 KB 678ms
209ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/blc1d8ozy8vr2jbi.js?ajj4ldbi89rqyd78=w2txo5aa&1xse2ao9podx6vnf=L2VuX0NBLzNlMmNmNjdkMzMwZjlhZjc0OTRhNDNiZGFi

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

28826bb97ed9575dcff04bfed41325c201f0f1d0c0c365e7b6f8c57ca29809d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sat, 11 May 2024 08:39:58 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: CP=IVAa PSAa
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK / Show response
data.cdnbasket.net/ 14 B
338 B 453ms
106ms XHR
application/json 34.117.146.178
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.cdnbasket.net/
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.146.178 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 178.146.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 01cbc02765f9732eccccd131ced67c20391426de5766a5ec9a63f40b448309ed

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Pragma: no-cache
Date: Sat, 11 May 2024 08:39:58 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
page.cdnbasket.net/ 14 B
338 B 439ms
104ms XHR
application/json 35.201.123.249
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://page.cdnbasket.net/
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.123.249 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 249.123.201.35.bc.googleusercontent.com
Software: /
Resource Hash: 6b76794387b8745d5b87f99bae1651cfd71babe2790d0a0a1ee1c43bfa8a6a0a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Pragma: no-cache
Date: Sat, 11 May 2024 08:39:58 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
view.cdnbasket.net/ 14 B
338 B 444ms
105ms XHR
application/json 34.98.106.171
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://view.cdnbasket.net/
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.106.171 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 171.106.98.34.bc.googleusercontent.com
Software: /
Resource Hash: f3ee233d8819e508bb5518fe58a3109712e1162aaec3a3470ca19e48e1a91db2

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Pragma: no-cache
Date: Sat, 11 May 2024 08:39:58 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H3 200 jquery-3.7.1.min.js Show response
assets.bounceexchange.com/assets/bounce/ 85 KB
30 KB 75ms
74ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/jquery-3.7.1.min.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 23:09:24 GMT
content-encoding: br
age: 207034
x-guploader-uploadid: ABPtcPp92gHmeersAAX6IdTwFi5U3mUDTMxR3gwwru6a4ZlUXdcLSKts1MG2aP2Gcqy56cRidJE
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31015
last-modified: Mon, 06 May 2024 20:34:30 GMT
server: UploadServer
etag: W/"2c872dbe60f4ba70fb85356113d8b35e"
vary: Accept-Encoding
x-goog-generation: 1715027670000061
x-goog-hash: crc32c=fsBEgw==, md5=LIctvmD0unD7hTVhE9izXg==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 87533
accept-ranges: none
content-type: text/javascript; charset=UTF-8

GET
H2 200 local_storage_frame17.min.html
assets.bounceexchange.com/assets/bounce/ Frame 0BFA 0
0 343ms
78ms Document
text/html 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/local_storage_frame17.min.html
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: none
access-control-allow-origin: *
access-control-expose-headers: etag Content-Type
age: 1313882
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=31536000
content-encoding: br
content-length: 938
content-type: text/html; charset=UTF-8
date: Fri, 26 Apr 2024 03:41:56 GMT
etag: W/"fc893948c3efc689b5b19d8a77958e23"
last-modified: Tue, 23 Apr 2024 14:37:03 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-generation: 1713883023838131
x-goog-hash: crc32c=kX4cqg== md5=/Ik5SMPvxom1sZ2Kd5WOIw==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 2408
x-guploader-uploadid: ABPtcPrpqVkWqfwzkxmSBsWl3SgTqT0o3qaT23OdAGUdX1m2HLbST92qY_wd6hWfkQnKxEf3Uys

GET
H2 200 ts
t.paypal.com/ 42 B
248 B 194ms
193ms Image
image/gif 151.101.193.35
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?pgrp=muse%3Aoffer%3A%3A%3A7PFGPLHGYKX72-1&page=muse%3Aoffer%3A%3A%3A7PFGPLHGYKX72-1%3A%3AvisitorInfoFlowStarted%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=3a9b41b4-1a0b-4488-939e-bc9b13368cc5&es=visitorInfoFlowStarted&mrid=7PFGPLHGYKX72&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&pt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1715416798362&g=420&completeurl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&disableSetCookie=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.35 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 0, 0
date: Sat, 11 May 2024 08:39:58 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, MISS
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id: 515b467b7b271
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
x-served-by: cache-bur-kbur8200087-BUR, cache-yyz4521-YYZ
pragma: no-cache
correlation-id: 515b467b7b271
traceparent: 00-0000000000000000000515b467b7b271-fad67897c66bd00c-01
x-timer: S1715416798.404581,VS0,VE120
vary: Accept-Encoding
content-type: image/gif
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 May 2024 08:39:58 GMT

GET
H/1.1 200
OK -X8PVykUiJTFBxCK Show response
imgs.signifyd.com/ Frame 4BE3 278 KB
47 KB 149ms
148ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/-X8PVykUiJTFBxCK?25398944e1a3f768=QYC8DQ9pMQASyt634TlUPsJkdW5ya9pW_U-xRBTDtHtUm87Bm3JnHoOA4NIEVSt9julzCJ9hnl2NlBgpyUeDhQhMH65yk0-qLm89nB4VMyDFy_PEAt0H5VkQpvqJ2COP2KONN-DpOhAoCT1yFoOcGbPaPIRJTE2G5rNeewVPoCuZMfEODnPwM7t3FiXd8uhJqxMbKzUjDnPtExHZXXGvuIKogoc&jb=3d3b242662736577355d63666c677d7b2c607365355d616c6e657f7b2f3832313b26687b6875374b62706d656d2468736a3d496a7a65676d2d3a3a39383e

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/blc1d8ozy8vr2jbi.js?ajj4ldbi89rqyd78=w2txo5aa&1xse2ao9podx6vnf=L2VuX0NBLzNlMmNmNjdkMzMwZjlhZjc0OTRhNDNiZGFi

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

b5ca26f75e39caf1ad08263c487bb2fc576b76c3981e0bbaa2ddacbdb27a4089

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sat, 11 May 2024 08:39:58 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
tmx-nonce: b1ed5f0ffe8f7001
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=2, max=99
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK DNED1GcIx1LuBBBw
imgs.signifyd.com/ Frame 4BE3 81 B
474 B 366ms
139ms Image
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/DNED1GcIx1LuBBBw?704ed3bfd7ca44f9=eq3FWSAHEJ1DBftPW-eD2sgMVqWuxgfOEBx0kf1voi0rEmXDcgJctVlJP13wIVVPpSQn9g0OJ92693-0v8lFDsQGuinbK4-Q02-ip95wnNZF3uyhXoME8VRoa69yXiM0MSFa0lCVpsfN6iJbBjQfAaAWoM4e0DehBLzL39V8kL6aMpEw8A

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Pragma: no-cache
Date: Sat, 11 May 2024 08:39:58 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK Ikyf8U4BxfHWQcxe
imgs.signifyd.com/ Frame 4BE3 81 B
474 B 503ms
138ms Image
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/Ikyf8U4BxfHWQcxe?19f3165c418f90fd=nHJTME05ReD7dSnF7YVpVKdd_MIkWXfmBskl5hr5KTFRRWvZrJHmVwxTMaRmdpbxQfE4wFMc_RrqxrQdhxaX3pclZDuIlchsng_JDYz-Y4lozLDP8BB6Mn4dSz4bGpcwOdROMQ-KfOdQIvUK5S6l9ibQKJbE--db7b0Tci0lIj7yFxn4xw

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Pragma: no-cache
Date: Sat, 11 May 2024 08:39:59 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png Show response
imgs.signifyd.com/fp/ Frame 4BE3 81 B
536 B 592ms
212ms XHR
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/-X8PVykUiJTFBxCK?25398944e1a3f768=QYC8DQ9pMQASyt634TlUPsJkdW5ya9pW_U-xRBTDtHtUm87Bm3JnHoOA4NIEVSt9julzCJ9hnl2NlBgpyUeDhQhMH65yk0-qLm89nB4VMyDFy_PEAt0H5VkQpvqJ2COP2KONN-DpOhAoCT1yFoOcGbPaPIRJTE2G5rNeewVPoCuZMfEODnPwM7t3FiXd8uhJqxMbKzUjDnPtExHZXXGvuIKogoc&jb=3d3b242662736577355d63666c677d7b2c607365355d616c6e657f7b2f3832313b26687b6875374b62706d656d2468736a3d496a7a65676d2d3a3a39383e

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: */*, w2txo5aa/b1ed5f0ffe8f7001l2vux0nblznlmmnmnjdkmzmwzjlhzjc0otrhndnizgfi
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sat, 11 May 2024 08:39:59 GMT
Strict-Transport-Security: max-age=31536000
Last-Modified: Sat, 11 May 2024 08:39:59 GMT
Server: Apache
Etag: 34459ecc866a45a0858771dc0045f793
Content-Type: image/png
Access-Control-Allow-Origin: https://www.elfcosmetics.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Thu, 10 May 2029 08:39:59 GMT

GET
H/1.1 200
OK niSEhLb2DwDQgHOR
imgs.signifyd.com/ Frame AE29 0
0 579ms
206ms Document
text/html 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/niSEhLb2DwDQgHOR?a71ace3c16c42d88=G6Qz0no09KCqFU1MUIbMHlt3ae2y1XEFoLqUHsceJ5eE3IIclBnYb0BFFMfATISjk8grHYQG0OaEKgPh4H3iIKDSFW3aderYQYTTwSAm9tn5FqZhFfwBpbwISYBJ9EbpbebfizLRZ5JHAySxJ4g51R40dTKoUi5Vhn9j4Hixl5qnF7x6K1f0SRlnYGk1-1ZNwAXSFKNyYA9TDNzKYY-hYMdu4VRjIQ

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 11 May 2024 08:39:59 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=100
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content VbruaIiIhsPLEErP Show response
imgs.signifyd.com/ Frame 4BE3 0
388 B 365ms
245ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Pragma: no-cache
Date: Sat, 11 May 2024 08:39:59 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK eAe_XCKZPNXKtOUS
h.online-metrix.net/ Frame EEA3 0
0 657ms
206ms Document
text/html 192.225.158.1
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/eAe_XCKZPNXKtOUS?909fa2c5a1543e9c=z1gLZptm6fIpRdzvpGBfm3yzGzqVLSGxudvDYaDcFKXOuIgPJ5Hf3h2PxzSdD3pdovcHuyUeRhBH2D_tO20Fr8Xk_MYhu87cxIBplt3Wn4lvWZbVuoCeAzXrpkcM8pBRwKiBIegqeildnuZQK32gqVF87OAP1VbQsItVUXJ2cQNKR1nJDh-j2BtdaMcAJs4wVbvSWZD-BRIWmqzt-xnO-6h5lGqpF8w

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.1 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 11 May 2024 08:39:59 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=100
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK DE8oy331hjoltrPD
imgs.signifyd.com/ Frame 62C3 0
0 589ms
208ms Document
text/html 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/DE8oy331hjoltrPD?2e0e363fd439682b=Aoeq3fBcMEV3vfec99CPnRVg0cojm3_avi7_mKmyy9aOXSd2_7dDvHG-AF2JsNKIsszGXxhcoHnRQbe-vKEyXCdeaflHHRYsTpBlGeFNkVbJFp1IsHpRrihAD0sKbJsGFghxRH-e7jXAdiKtA5y2J8Jh398ah5fFlRtoEaXhThXSM81SPfVyhYTyhw5KcRf7uUcthuMzTIIpruKTRWwKj2CTg4l6lss

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 11 May 2024 08:39:59 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=100
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
204 VbruaIiIhsPLEErP Show response
imgs.signifyd.com/ Frame 4BE3 0
219 B 312ms
207ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/VbruaIiIhsPLEErP?2bf5a44a89b36dc0=mbT7ioIn1R0xB0VnonchQaWK2Bdp5YAHnuALjrFNxEygyX65XlTWJUqCXN8wV1c2Iqr-n-BldwunMqAls-MaUyDGNSSmRDp40bQEDKci3ZFgjjDVBn6RUxxIeLe3-Y6LNluqDe_H7X-unAWEOQZd0RAvMz4kyP8sIS2HPA&ja=3a3236332e26693f253e32382e72373e3a2c6637393c3832723b3a383a2c6366373134383a783b3a3a32247b707b3f3138307233383a2c6c787a3739263b363a382639303a3a24393c3a322c3b32323826313c383a2e333a38322e313e303a2e39383a3824393a38263b303a2e677c3f383d6e3d3b6e31313e39673e686638383360343e6a6631383f623a636e39693c2e656435382c73696c373a362c666035627e7670792531492f324c2d3844757f7f2c676c6e636571656f7e616b7b246b656725384e6f665d494b2d3a4c6f6e6627636d7b67657e61692f617a616f6b6e696c79247866373d2e7862356f3230386c6c69373f3f3931396c366568653a3133336f6a3e633b313a3b32642e68623f6e3a323f3b3a693e3b6f303d6a6c3164693d383e683f37333b61336d3f61336d2c68716735556b6e6c6f7d712d383a39392e607b683743627a6565672f383839383e246a796f77355d69646c6575712e627160753543627067676f2e666069353e3226646c67353a2c64657c7a3732267e7a66354b6d6f7a6361632d3a445461666365777e6f782e65697e607837343a38396c3369386a6d693a30653c63613d3c303a30386366393d37363039666e363d3232393c396e3e6f6b61383c6e6b3b3e6b6e6a6e3d30333b3333313c612c6c783f6a7c7c7271253b412f304e2f384e7f7f7d266f666669677965677e636b7b24696d6d2f32446d645f49492f30446d64642f63677367677c6369256b7a6365636461667b2c783f7a667d6f63645d66666171602f354f6e6b6e716d29726e756f69645d7f63646c677f7957676f64636955786e6b736d7a2f3f47666b6c716d2b70667d6d6b6c5769666d626d5f6b617a6568697c2d3f4d6c6b6c796d2b786e7f6d6166557b7769696b766167652f3d4f6463647b67237064756d6b66557960676b617f6b7c652f3d4f6e6366796d297a667767636e5d7a6f61667866637b6d7a2737456e6166716d2b7a647d6f6366557c6c69577a6463736f7a2d3f4f6461667367297a6c7f6f636c5d6c6d74636c7e722f374d6c6b647b6d2b78667f676366557b746d557e616f7d67722f35476e6b6c796d2b726e7d6f6b6c5f62617c632d3f4f6e6964796d2c6d6c556b377f67686d645f6f68454c2f32323924302f3a3a2a4d786d6c454c2d323a475b2f38383a263a2d383a43627a65656b7f67215f6f68454c2f32324f4653462d3832475b2d30323126302f30382245786d664d442f38304f5b2f3a324d465b442f383245592530383b2e3a2d383241607a6d6f697d6d23556d6841617c5f6f6a4163742f3a3a5f67684d4449444d4e4555696c7b7e61646b6f665d697a7063797b2539402d383a4d505c556a666f6e6e5767616c676b702d394827323a455a5c556366617a5d61676676706f642539402d383a4d505c556b65666f7857687d646c6f7a57626b6e6655666e676b742f3b482730384d5a565f6c657a766055696469657a2d39482538384f5056556c64676b7e5d6266656c6c2f33482d383247505c5d6472696755666d7a7e602d3b482d383a45525c55786d66736f6764556d666c73677c556366696772273b4a2730304d585e5d7b626b6c6d7a557c6f72747f7a6f576e656e2d3b482f30304f5856577e65727c7f7067576b6d6f707a657971616564576a787e6b2f39422f3a3a4d5a5e557c6d727e77726f5f61676770786d79716b67665d70677c632f314a2f38384d505e577e6f787e7d786d5d6c63647c6f785d61646971677e7265786361273b4a2730304d585e5d7c6f727c7d7a6f576763727867785761666b6578557e6d5f6f64656d2f33482d383247505c5d71524f422f314a2f3838474d59576f6665676d647c5d63646c6d725577696474273b48253838454751576e606d5f7a6564666d785565617867697a2f33482d38384d4f59577b7e6b6c646b7266576e6578617c6376617e6771253b422f3038454f5b577c6f707e7f726f576c646d6b7e2d3b482f3030454551577e65727c7f7067576e6e6d617c5f666b666f6b7a2d3b482d383a4f4f5b557c67727e7d7a6f556a6166665d6e666f6b7c2f31402d3a324d455b5f7e67707e7f7a6d576269666c5f6c64656976556661666f6b70253942273a3a4f4f5b5574677a7c677a5f697278637155656a626d697c2f39422f3a3a5f47484d445769656e6f785f607d6c666f7a55646e67697627334a2538325f4f484f44576967677a726f7b796d66557e6d707e7f70655561717c6925394a2f30325f4d40454c5763656f78786f7b7b6d6e577e6f787e7d786d5d6f7e6b2d394827323a57474a4d4c556b656f727a6d7171656c5f7e67707e7f7a6d576f7c693b25394a2f3a325d4f4a4f4655616f6770706d79736f6c557667707c777065577339766b2f394a2d3a3a5f4f4847465769676f7a786d7b796f665f7e657a7c7f726f577931766b577170676a2539402d383a5f4d4a4d44556e65687d6d57706f646c6d786f705f636e64672f33482d3832554d4a454e5f6c6568776f557960696c6f7a792f33482d3838554f484f44556e67707e685d7c6f787e7d7867273b4a2730305f45484544556e7a697f556a7f6c666f7a792d31482f3a385d4f4047465f6e677965556b656c766d707627334a2538325f4f484f4457677d667e69556c7869752f394a2d383a554548474e577a6f66716d6d6c57656d666539362c6564556235303e6c3b6932346b303d39603e326d696e3236363361663c6b37683d693432306a3a63643d353b342e7d6d647e3543667e6f6c2f3a3a416c69242e7f6d66703d436e766d6625383843706b7b2d30324f78656445442f38384d666d61646f26696b6e3536&jb=393732266471374f6770636464692f3a4c3f2e3a2d38382a5d63666c657d712538304c5c2f323a393a2c322d3b4027323857636c3e3e2f3b4a2d3838723c34232d3838437a7a646d5d6f604b6374273a4c35393f2431342d3a322a4b4054474e2d38492d3a386661616f2538384d6d616165212d383a4168786f6f6d2f324c3938362c3826322c302d323a51696c6b7a612d384e3f3937243b3c

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sat, 11 May 2024 08:39:59 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK ANjfuRzBpQK5xeUJ
w2txo5aaqvyg3owu22twqjy4qvchbtt6d5e5yrrzb1ed5f0ffe8f7001sac.d.aa.online-metrix.net/ Frame 4BE3 81 B
438 B 773ms
198ms Image
image/png 192.225.158.3
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://w2txo5aaqvyg3owu22twqjy4qvchbtt6d5e5yrrzb1ed5f0ffe8f7001sac.d.aa.online-metrix.net/ANjfuRzBpQK5xeUJ?25bfe5f226d2c36e=WKyn5mk8YQTRn9WkF-cyg6wwfTO7AlzQZhi16toW1sDsRCrZez1CZepurbchhFwjk_PtUZPzAmR91wo8cbz4fL6UoisOQaeMOecQTTrlWWHfwPp9GjapND4GQ6KmiMpxqXs0dqZjk_QniI2rL74ySQttnBmrWkmgB18MVglDK9iDl90

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.3 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Pragma: no-cache
Date: Sat, 11 May 2024 08:39:59 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 c Show response
ids.cdnwidget.com/ 441 B
779 B 549ms
184ms XHR
application/json 2600:1901:0:56e0::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ids.cdnwidget.com/c?cookieID=&deviceID=&iv=&v=&GCH1=&SCH1=&GCS1=100238002&GCS2=MTcyLjE3LjAuOCwxMC4xMy4wLjIzLDI2MDQ6YWFhOmJiYjpjY2M6OjEwMTU=&pe=false&wsid=6664&varID=&varData=undefined&log=%7B%22config%22%3A%7B%22gmEN%22%3Atrue%2C%22pixEN%22%3Afalse%7D%2C%22apikey%22%3A%222%5EHIykD%22%2C%22cjsversion%22%3A%221.5.9%22%2C%22wsid%22%3A6664%2C%22loadID%22%3A%22fRGJIt1Mlq19vIk%22%2C%22timing%22%3A%7B%22sessionStorageLoad%22%3A11%2C%22IDStageStart%22%3A11%2C%22netComplete%22%3A135%2C%22obsReqpage%22%3A453%2C%22obsReqview%22%3A459%2C%22obsReqdata%22%3A467%2C%22IDStagePrefire%22%3A467%7D%2C%22matches%22%3A%7B%22cookie%22%3Afalse%2C%22LS%22%3Afalse%7D%2C%22info%22%3A%7B%22isSpoofed%22%3Afalse%2C%22PM%22%3Afalse%2C%22DNT%22%3Afalse%2C%22deviceTimezone%22%3A-7%2C%22extensionID%22%3Anull%2C%22externalID%22%3Anull%2C%22agent%22%3A%7B%22device%22%3Anull%7D%2C%22firstLoad%22%3Atrue%7D%2C%22deviceid%22%3A%22289032365152220840%22%2C%22visitid%22%3A%221715416798462047%22%7D
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:56e0:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software: /
Resource Hash: fdc7d594bb7e5c0b1893eedbc728dc4b482334c389dfe201b13531d730d0859f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:59 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441

GET
H/1.1 204
204 Qxk6FOjS7dHeLv44 Show response
imgs.signifyd.com/ Frame 4BE3 0
218 B 186ms
139ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/Qxk6FOjS7dHeLv44?8944863d9c3335fe=HPVCHjJtrJimVO75qVC-uCC-EdCiOrn7maudAidO5Sq4BX6CLcse680CwY4n37FaMO_pV0DaJFclIaNCvAHJpxLPQzrao3Ce77sllzHXQ5SOCQfc0W1mSqejC9ns7RTIoSwoDrIgVWMpKCKm8ZSmx1wHC5hAde_DMs-K5OgUjAv7yydS-uPSdzP8QXYPZoN9TCC6bcYDDdtlcqQxSfuCb9vX2PErjw&jac=1&je=3036242665656e6a3522392d3a4b3b2d3849332f3a496b356c3b6e6e6f3263313d37376a68326c3d6931616a6d3a3a38393139663e6f3d6a386b3a38393b65323d3c3e3b6b3f6a38693e35636b66343932666b3132352b

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sat, 11 May 2024 08:39:59 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=96
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 204
204 i9OlTKF3U2D7K8rA
imgs.signifyd.com/ Frame 4BE3 0
400 B 415ms
247ms Image
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/i9OlTKF3U2D7K8rA?4874fcc5ee045631=Jc18awkAEi3dKz1puncE735NY-2piZI7RDeX3hfxUcex9K3asvCNRKI9TUcqCF8LPXB5-igGFrMIhm_AjibU61yHMcv7POMr5JpOxYNnazw5kM3HeSYKdZIByC-5X2pdUpqLTuKneEU5l7oE_7h2p2jgoOFuq3LIUGrJIWaDhPi39AlojJ6QU85SnNSIpbK6PF4bxlGaxJGpNB2_zzw_H8FFhb5PYw&jf=3c3336267b696e5d7a646e357c6c7857494b557a52655a3b703241477d6b60352c736b6c55646b7c6f3f333f393736313e37333b2e79636c577c73786f37776f6a306d616e79692e7963665f61657b3539303f313932333b383432373a6132343c32696d3b6c3a3a3a3b303c38323a63323c3c30696f31643a3332393a373a3b3e303238383634613b646b333e3c6e6d6d303d6c6f33343b6a3d6b633f3f6b3c323a30656f35603d6f333d3c6f60326c6b34636569396b343d3b6c3a3b6b333f6f69386c6e3f693233696c3b683e34353f37313b6b62383d3d61636b38343a3031333c363f32686e3d3e38303b3c33383b3c6d3b333f6d3b6f3963623236333a3c30696b3331247b61665d7361673731383e3e383a3a3a3e6e3f346f6e683f646b3f3a303c3c64626f30316a3c663c3a3e3b613e6d66636369663c66386b3c3e396a683d6e3366323d3e6c3568386938383a61373c33613838323a3d6c33363c6936603238666930393d3d6d386a3f6d3b68643b6b393d346c3d313f6c6b30373237613d6b666e6e39333238693136326a323f376e3239693b3c382e79636678353a

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Pragma: no-cache
Date: Sat, 11 May 2024 08:39:59 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=95
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 collect Show response
sgtm.elfcosmetics.com/g/ 944 B
1 KB 167ms
165ms XHR
text/plain 34.49.124.132
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.elfcosmetics.com/g/collect?v=2&tid=G-5D80LRC85N&gtm=45je4580v9125640115z8896608294za200&gcs=G111&gcd=13v3v3v3u5&npa=1&dma=0&cid=1017828244.1715416793&ecid=1852065918&ul=en-ca&sr=1600x1200&_fplc=0&ir=1&ur=CA-ON&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=EA&sst.rnd=1275937653.1715416793&sst.gse=1&sst.etld=google.ca&sst.gcd=13v3v3v3u5&sst.adr=1&sst.ude=0&sid=1715416794&sct=1&seg=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&_s=4&tfd=13329&richsstsse

Requested by

Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.49.124.132 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

132.124.49.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

a57d22600251ee11596bd3ccd0432a382eddea215419292a915f24df956e994e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Sat, 11 May 2024 08:39:59 GMT
via: 1.1 google, 1.1 google
x-content-type-options: nosniff
server: Google Frontend
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-accel-buffering: no

GET
H/1.1 204
No Content VbruaIiIhsPLEErP Show response
imgs.signifyd.com/ Frame 4BE3 0
387 B 139ms
139ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Pragma: no-cache
Date: Sat, 11 May 2024 08:39:59 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

/
www.google.ca/pagead/1p-conversion/698270988/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/698270988/?random=1472750574&fst=1715416799530&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4570v912564011...
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/698270988/?random=967453133&fst=1715416799530&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4...
https://www.google.com/pagead/1p-conversion/698270988/?random=967453133&fst=1715416799530&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4570v9125640115z889660...
https://www.google.ca/pagead/1p-conversion/698270988/?random=967453133&fst=1715416799530&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4570v9125640115z8896608...

42 B
64 B

130ms
130ms

Image
image/gif

2607:f8b0:4004:c1f::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/698270988/?random=967453133&fst=1715416799530&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4570v9125640115z8896608294z99175401888za200&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1776364679.1715416793&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5&uip=199.48.243.0&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&s3p=1&ct_cookie_present=false&sscte=1&crd=CNm5sQIIscGxAgiwwbECCLnBsQIIl8GxAg&pscrd=IhMIkfmAyJmFhgMVuhBoCB3DSg6-MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6HWh0dHBzOi8vd3d3LmVsZmNvc21ldGljcy5jb20v&is_vtc=1&cid=CAQSKQB7FLtqmCY3LF6hdbaDf191p-ke_21sqjmG73BLGHUe0Uub9e088i1b&eitems=ChAI8K78sQYQ7ZSX_dSixoB7Eh0AFZfXVoaFwErWZPINuXYooXk50vM6ZL6gdtMCQg&random=419976735&ipr=y

Protocol

Server

2607:f8b0:4004:c1f::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:00 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:00 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/698270988/?random=967453133&fst=1715416799530&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4570v9125640115z8896608294z99175401888za200&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1776364679.1715416793&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5&uip=199.48.243.0&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&s3p=1&ct_cookie_present=false&sscte=1&crd=CNm5sQIIscGxAgiwwbECCLnBsQIIl8GxAg&pscrd=IhMIkfmAyJmFhgMVuhBoCB3DSg6-MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6HWh0dHBzOi8vd3d3LmVsZmNvc21ldGljcy5jb20v&is_vtc=1&cid=CAQSKQB7FLtqmCY3LF6hdbaDf191p-ke_21sqjmG73BLGHUe0Uub9e088i1b&eitems=ChAI8K78sQYQ7ZSX_dSixoB7Eh0AFZfXVoaFwErWZPINuXYooXk50vM6ZL6gdtMCQg&random=419976735&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lookup Show response
pd.cdnwidget.com/ 74 B
239 B 504ms
225ms XHR
application/json 34.149.130.207
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://pd.cdnwidget.com/lookup?deviceID=2gJXkqPwP9nnFjOQspbqBgjal1M&bxwid=6664&bxdid=289032365152220840&visitID=1715416798462047&enableUID2=false
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.130.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 207.130.149.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: f309b4b6297e8c886d8d6b1ff31decc2d09f6eecf7804e3325bf5a2d3a5eac55

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:40:00 GMT
via: 1.1 google
server: istio-envoy
content-type: application/json
access-control-allow-origin: *
x-envoy-upstream-service-time: 73
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74

GET
H/1.1 204
No Content VbruaIiIhsPLEErP Show response
imgs.signifyd.com/ Frame 4BE3 0
387 B 140ms
139ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Pragma: no-cache
Date: Sat, 11 May 2024 08:40:00 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 202 graph
idr.cdnwidget.com/ 0
135 B 418ms
146ms Image
text/plain 34.149.130.207
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idr.cdnwidget.com/graph?cookieID=2gJXkoMDVo7AMcFmOWcBBmifmlp&deviceID=2gJXkqPwP9nnFjOQspbqBgjal1M&bxdid=289032365152220840&bxvid=1715416798462047&bxwid=6664&gm=true&apikey=2^HIykD&loadID=fRGJIt1Mlq19vIk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.130.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 207.130.149.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Sat, 11 May 2024 08:40:00 GMT
via: 1.1 google
x-envoy-upstream-service-time: 0
server: istio-envoy
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 init1.js Show response
api.bounceexchange.com/bounce/ 108 KB
19 KB 426ms
137ms Script
text/javascript 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.bounceexchange.com/bounce/init1.js?wklzs=1099&wklz=C4ewVgigvAZgrgOwMbAJYgQMhQZygRgHZ8BWAFnwDYAOABlv1oGZNgAvEKMgJlswHcApgCMcqYIID6qACZRKCspgBOgnCAA2cNBgKV6AD3y8+qmIOWrlUbAEMNG1AgDmkuMo1QAFsGAAHHABSJgBBQO4AMXCI-liAOkENGCQQHABbQTQkHDiUtOjBBEkAYTDIxJgAWhT0zNQkauVUNKd7HEwAN1QxYEkUkABrVEEoQMIAIXDuDT8p4LLuH38g7hJQ8JJIjcjY-gSkmoysnLztiMKSss3zpOrUo-rG5taNFe5w4qnlOfXud7+xgARbAgQbDUYTKYyWQ-BbcagATmY3CYlBIpD+vGoZFoc24nz+XRksKIpAolEICOxlF4ZEIHymHVhY0mfw0IGczkEMmkCFhMDaggZf0EHQsknZnO5vP5guF3CQtmUvQAjsAAJ6w3H4qY4ODCFq+aUYHpCgGhAWvM0E6Ycrk8pzSGSFNAwYbE80hS04a1TRXK2VW+X+3odexwM3vC1ywiA+UyZwRVDKHDAAAyIFsHqjIWAygj8q8SpkAEk456ptxnAApAAaAxAAFlAQA1ECEEKNpARNIAeQA6khxuMWjA0jM8Tb1DBgGXmZia-WVQAFfjLhEIBARMC9iA4PzCFXjZxgez4RuTqHOZmQv7dZeqLogOA4Yov0AZb6e72+u84ADK+o4EgTTCBYgY+vK3QACqCAYwCAaIIGoGBX45j+wa2EgXhSMAbzzKS5BUHQDC0O8sZAp0So4AA2pK9q8gAurAgpUSmNGiuK9HSk4zE-mxtEhpIarqsxfBhuxeoGuIEg8ia4iCHxrESbR3EOkUsguqgbrckpVoCTRIZ6T6BlCWGWiKSx+kqTRfi2Fykgan4ln8R0zowHRdo8RpzoIK67rGYInTuYZSqhuGLmsf0Qy4aCEpKlyVkmcIfhQHwmSpTRABEIZZQANDltgSM4IDKOq+U5ThSANtoFVeCAGQVX4yggDIcAoBVPpKthWWMZgfh4TYeR+I4tjIFIMAaPZNgdEWNhFsoDpyFWdYNs2bYdl2PYDkOI7aeOfiYNOvSyFAK1Lqu66btuu77oex6nho55AA
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ed1a8723277464b3c707675f3a275e18114b964cb04d2e2116b8370a12d41e5d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:00 GMT
content-encoding: gzip
via: 1.1 google
last-modified: Sat, 11 May 2024 08:40:00 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 33
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 200 creatives-base-styles.a53944a2.min.css
assets.bounceexchange.com/tag/css/ 37 KB
6 KB 75ms
75ms Stylesheet
text/css 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/tag/css/creatives-base-styles.a53944a2.min.css
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 286a9eb90b3236f3c77e9cd147b524d542d53ba83973de175c45be3eb1147805

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 26 Apr 2024 03:41:45 GMT
content-encoding: gzip
age: 1313895
x-guploader-uploadid: ABPtcPo1nug7bgMvYPzpSZy5NN2YhLgeEBehCC9nvS0Wlbz2PscwDgKrZdKWRi2r2OkidNQBksnI8rqGAg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6053
last-modified: Tue, 13 Dec 2022 17:12:22 GMT
server: UploadServer
etag: "54f61bdcbfb6f81427c8a6803f48b02f"
vary: Accept-Encoding
x-goog-generation: 1670951542233151
x-goog-hash: crc32c=lLRhfg==, md5=VPYb3L+2+BQnyKaAP0iwLw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 6053
accept-ranges: bytes
content-type: text/css

GET
H2 200 visit
events.bouncex.net/track.gif/ 42 B
104 B 215ms
180ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/visit?wklz=G4SwziAuBcCuYFMBOBDA5ggdpAvAWQHsAvEAG1JQFIAmAMQFYA6ABhuYAoB1ETAEwIDuYNgDkAKmwCMzFpQDMAITbdMANgAs8pdWYAPDQEo2AQQAOp0gk4IARgGkoNBnIDsjOarbs7ACTF4AGRoAYTZSEABrBDYAcQQAYwiCIx1ggAskAgBbaLpJanUWItYdAGUUADMUJBAneld3VQAyUAgYJAQK5A6kHBbwKGgKPh40U3QEWCRSHDTISFNhanrjGno6NboBbcYEUgr4gjAcyBB4sEZDrM3aLAB9YNXluj2KgFpD44RT+I+arJ4KFIYH6bWgHTABFIsFOBEwuhwklUzGYoMGEKhMJAcIAnoidKjWoN4vBINlgNUQCgbJYwDhKC5tNRSAQ0BheHceDRqPIntQqsDcjzqKFqNQEMBkHcWWyEByuWLedyBYhuSFufFqpA7gBHSA4tVyPklYWi6hgWA2AHzOV3OFtIVKsUqx0i7ky9mczCc3hYU4VEByw18l1qt1izVISDB5VA1WK8PUSPainQx1G2OCsNm8YYO760zpkNxx0uAAiaJghwIEUD9MZ3N4IF4MbF1AAHABOZhyageeiSdZi5jt9Qm9Vi0AtxVGyQuQfqJHtlHqef1TSJ4AxhvlifUXhoWggJBgSABAgoac8o2QJCwXJmtLVXgASTLrbFaAAUgANJJ4MsADUCBcYw8HiWgsgAeU4eIFAUAEKiyUhTGzblIQqSA3w-ahvz-HUAAUBAIztMEwWgACsoIARTAUwbB1BQ0AooFJDwNCxQPbcmXAAiOlAAh4GCUlsmQYNQ0TcBSktMB4hqGwxJnYwJLNcAxAQXRIGkmxZPkxTr2Uks901eI0gQfMlgMucFyXFFpB5XdEwqYBoyU6z6EXVRlxKM0UAIYMfPdVClO5OYFiWFYbhubYBF2fZPhOM4LiuG57keVL9g+I5Et+OSQABTA4w46gUEs3lAsnUwtzcvcrydfdiqQD9iviFzg3czzvL3CA6qNN5JD3NA5ODVROz3a4lIq5k2rctdOpRYyUCycYQDQTAyozBs23UehVAKDcDIZJlgGqgyptIGarLm2zWEcs0Cj2vsXG47kToCvcLtcq6bK8ha7u5B6xTkdsXsnU7yo+y7eQ6m6GXfXdyyaeBkAmbBoBsTIhGQHB0kyHIkcQVAMDRyUT2xTB8UKGRqYJlHiZgCwUEgCoCCQLIcBUfghCkVFkaJv1oF9UB4m+HFCxwX0wAiMlTCaElT1EpBoCfWS4VJyA5RwVEMAIaBDlgbAkBxQ5fRx4wmh1vXBMN42CF9OQzZEC2EF1-WbcKnIcZQQreBQZ3dY6NByZwKCnctwPyY9hAQ+wSkCH9vWoDxMRWbhMkE9MI5ICBE3o7wehzctw5sB4P1c5wERzayO3o9RARbAdZscFUFv1ErJuYd+5hV0HOQ26Fs4ECbjtu17ftBzbEcxyaXMJUDAQO6aRAdXvTARab1F4nCP1ThyU8ltMRFrq7+gXDbrfA1j0wQFJiA4RwbO0DkJoB5FiWmkgNJjw5cYoxxO4Fb8zuE2MA1JLC8BwC6D+RACA4HUDoJegkkBv3rjYJoqNcB80QZhH0OBcK-giIRYipFyJUVovRRizFWJ4CaE+JA8oIH4L-AQACwFQLgUgjBOCCEQBIRQkAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:00 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 pageview
events.bouncex.net/track.gif/ 42 B
174 B 136ms
101ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/pageview?wklz=A4Qw5gpgbglhDuAuArgJwDYF4AWAXXwAzgKQDMAgsQEwBi1N8jAdBOgGYDGA9oQLYS4YHQk2696EAHYB9AMKVarNgFpufAUNWoYvGJJDpCAMlCRYCRB2SFcXXlBDaQAI3QRCmYgHYAQtSroXGCQACbSev5kClRsBoQQkVSy-tAQqNKBwRBhEVRUUf6xhgl51Ml5HI640gCOuACekRT+AAyJ5VSEyM66+NnSXJKEMLgl+c15RfHt-pmh4TIwIVKCbHAhTdFTY2X+lai4m4VxO0l7VdIO6Mg7EzEnM3mmENINwLdbD6VeACIm4NA4EhuFwANZwYYALwgmC8AEY4f8zEDLCBJIMhAYcPgiAVaPRGPAWOw1PxBMJRHYJDJ5BJ2KoeGTNBxtLp9IYkYCLCDwS9bFwMo5IJhtpzzMCuGC4K96u9MKRgBznuLLJLedIoTCAKx5RFiYCWXjATAtIz6xC4DhsE1muwG6zG03msDAR1GXhcZY2+AQZzDUZLTAANhDABYjLB-YG4fCtaG4UGABwtFqh2OkcPLWAcCCBqiJgCcLVIVFIQa1cJ1eRaidDpuVQOjRniNRukhzTY46DgknwOncuBARswMcr8aTKa1XkTZu7KxAwBgUDSw0GmEHYFIRizQhhISMuGwMFQYVAB3qGtsqAB0hCMEILjcIRFJwPkK4mFDVFNhC4aBzmA+s4RgAr2mDWGkzZcGw1R5mAABSAAaoI1AACvAqEFpIkg0AAVgA8gAioQwDODUPhgLhBhwgAskY2CODkz5UAhyFcDRPwAGpcF45A0RwNC8PhADqHA+D4uhsLw6DAEAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:00 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 id_sync
events.bouncex.net/track.gif/ 42 B
104 B 202ms
179ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/id_sync?id_sync:id_type=sid&id_sync:id_source=graph&soft_id=2gJXkqPwP9nnFjOQspbqBgjal1M&source=web&agent=cjs&deviceid=289032365152220840&visitid=1715416800471534&websiteid=6664&pageviewid=undefined&sequenceid=undefined
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:00 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H3 200 6aa18944a3ad2c224d37dafb46afa35f.jpg
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 92 KB
92 KB 89ms
88ms Image
image/jpeg 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/6aa18944a3ad2c224d37dafb46afa35f.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 41edca74f63e4546256206b316479052b81b5d8fe3b810424d302bd4bf70c9ed

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 26 Apr 2024 03:59:58 GMT
age: 1312802
x-guploader-uploadid: ABPtcPr1fuBaO12bi4KAOyRw2n47ZjK0unKFqtOKMgy9dbDo7VrBQq6dgxxBN3ZX3vcGdiIun_g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 93895
last-modified: Mon, 08 Apr 2024 16:27:35 GMT
server: UploadServer
etag: "6aa18944a3ad2c224d37dafb46afa35f"
x-goog-generation: 1712593655184176
x-goog-hash: crc32c=H/B1bQ==, md5=aqGJRKOtLCJNN9r7Rq+jXw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 93895
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 59a941c096f98029341d8c56b7b89113.png
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 18 KB
18 KB 103ms
102ms Image
image/png 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/59a941c096f98029341d8c56b7b89113.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 2f9c91dd6030ee0311497f63531e9e27cb31cb8468a74c0b8482075bdbaa80b5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 26 Apr 2024 03:59:58 GMT
age: 1312802
x-guploader-uploadid: ABPtcPq7k17sbJ3wSxDmwIj1vAJFKeVlMMgN4V-Ykwnj-7_Wj8RrMF76Q1pscz7543goVc6Uigvtwya6Yw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18352
last-modified: Tue, 25 Aug 2020 15:57:40 GMT
server: UploadServer
etag: "59a941c096f98029341d8c56b7b89113"
x-goog-generation: 1598371060392963
x-goog-hash: crc32c=8aFhaA==, md5=WalBwJb5gCk0HYxWt7iREw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 18352
accept-ranges: bytes
content-type: image/png

GET
H3 200 16f45df19355361dc1c101036c0035b0.png
assets.bounceexchange.com/assets/uploads/clients/3258/creatives/ 2 KB
2 KB 100ms
99ms Image
image/png 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/3258/creatives/16f45df19355361dc1c101036c0035b0.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 915046d9ebab575f9b2f8ba9a35e030b2be55b1439edce6e72f7a19b4a55bd45

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 23:04:29 GMT
age: 207331
x-guploader-uploadid: ABPtcPpGav8KRXbW5wEzd8VGm9lbhInTEqMLAZTEQLoubEjYrIdqjMo6-WIzubhRY1eGjiye0h_24iMyTA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2419
last-modified: Thu, 01 Apr 2021 03:01:32 GMT
server: UploadServer
etag: "16f45df19355361dc1c101036c0035b0"
x-goog-generation: 1617246092060079
x-goog-hash: crc32c=pklVBw==, md5=FvRd8ZNVNh3BwQEDbAA1sA==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 2419
accept-ranges: bytes
content-type: image/png

GET
H2 200 eligible
events.bouncex.net/track.gif/ 42 B
104 B 105ms
104ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/eligible?wklz=CYcwXAlgzgygrgIygYwE4QQU1QXgGYCGANlJgGSiRQAKqmAbhAPZxQDCrALkwLbb7FSFcMgLIAFpgAqMHAEYA7HICsAFjkA2ABwAGHXJ0AmMnACO8sqRB8AdpwD6EYFBxlRPAA4EIIG05yGqhqGhgDMCpYsqMiYOAgsNjEAHmQEIJh2OABWUGQ8TMCxOmQA7phIEJyY-hq1qmSMUJX+iirq2nqqSsqh9YWMMf6GWgCcOqFhGsoqIYY6WqrFXumMmCUtlpimcBmDwAFuRBAZnJwQfFCcBJ7y3e2681oah8d2BB4Q9NhNTDY4VyBQhQGBAYjhgGROOIIKhgPYvKhOABPeyXJioNKYezAaAEBBETD7QgkcicABeTBwqjmkTwDiGIAAUgANADWpmoJWoIxsNgAYlkAPIARSgHgQpgAQiAssQ5ABZMjiAiwxz7QxMtlMeUAEQAakwFABBeXIPk8QUAdWQkslPAgeB4RA8QA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:00 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 pop
events.bouncex.net/track.gif/ 42 B
104 B 178ms
177ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/pop?wklz=A4e2C4EMGMBcEsBukEgHYF4EFsCmAnAMgHNcRxoQBXNWfAT0oBNcMBhAQRLPH12PjoMAeQBy3cpVrw0uWs1aiuVAI4YAjIWiRswSPGJp4TDACYALADZTpgMwB2QgGdq+aKwBG1NO4AehSFJaDAArJ0JsEBYMAAZCAHdcDyd4WFxjDEss80JEeBSEE3V7dQBWc3VLAA4YmPMS0tscljz3DNMqgE4Y2ztLUrKbUxiq8zi9UjzceIzNJ1wVKjk2k1stABt4OVgcXCdYHWANBorq2q7NaE3tyGAkAhShA+I1lvh3DCZCWAALeHwmAB9PT4WD0QH7ED4QK4QFMfKQDzrXAmABmkHW82+AC8QBhzMNnCBUbBAe1iAApAAaAGsVAAFeL0zpoNAAMRCwgAik5gB4VAAhYghDHqACyhB+kABZJMpkptJAYoAIgA1ED2Dhi6Bs7DCADq0AFAuw8FR2HWwCAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:00 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 eligible
events.bouncex.net/track.gif/ 42 B
104 B 175ms
174ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/eligible?wklz=CYcwXAlgzgygrgIygYwE4QQU1QXgGYCGANlJgGSiRQAKqmAbhAPZxQDCrALkwLbb7FSFcMgLIAFpgAqMHAEYA7HICsAFjkA2ABwAGHXJ0AmMnACO8sqRB8AdpwD6EYFBxlRPAA4EIIG05yGqhqGhgDMWpYsqMiYOAgsNjEAHmQEIJh2OABWUGQ8TMCxOmQA7phIEJyY-hq1qmSMUJX+iirq2nqqSsqh9YWMMf6GWgCcOqFhGsoqIYY6WqrFXumMmCUtlpimcBmDwDj1yEQQGZycEHxQnASe8t3tujojmm7HpwQeEPTYTUw2ONcQKEKAwIDEcMAyJxxBBUMB7F5UJwAJ72K5MVBpTD2YDQAgIIiYfaEEjkTgALyYBzmkTwDiGIAAUgANADWpmoJWoIxsNgAYlkAPIARSgHgQpgAQiAssQ5ABZMjiAhwxz7QxMtlMeUAEQAakwFABBeXIPk8QUAdWQkslPAgeB4RA8QA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:00 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

POST
H3 200 collector Show response
collector-pxxt4gy2ig.px-cloud.net/api/v2/ 32 B
49 B 124ms
124ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxt4gy2ig.px-cloud.net/api/v2/collector
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 7586f9164e6bc95d916e3828d687c85f77cf253b34a5908fffa5f6f17dfd0d72

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 11 May 2024 08:40:00 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32

POST
H2 204 log Show response
www.paypal.com/credit-presentment/ 0
1 KB 213ms
213ms XHR
text/plain 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/credit-presentment/log?disableSetCookie=true&features=disable-set-cookie

Requested by

Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Sat, 11 May 2024 08:40:05 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, MISS, MISS
paypal-debug-id: f2925041b90ac
server-timing: "traceparent;desc="00-0000000000000000000f2925041b90ac-d1031f868457de82-01"";content-encoding;desc="",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-served-by: cache-bur-kbur8200070-BUR, cache-yyz4569-YYZ, cache-yyz4569-YYZ
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent: 00-0000000000000000000f2925041b90ac-994dd8237a9c4a7b-01
x-timer: S1715416805.185530,VS0,VE140
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
x-cache-hits: 0, 0, 0

OPTIONS
H2 204 log
www.paypal.com/credit-presentment/ Frame 0
0 450ms
199ms Preflight 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/credit-presentment/log?disableSetCookie=true&features=disable-set-cookie

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: Server-Timing
access-control-max-age: 86400
cache-control: max-age=0, no-cache, no-store, must-revalidate
date: Sat, 11 May 2024 08:40:05 GMT
dc: ccg11-origin-www-1.paypal.com
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
paypal-debug-id: f292504db202c
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
server-timing: "traceparent;desc="00-0000000000000000000f292504db202c-469cebd698abf3b9-01"";content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
traceparent: 00-0000000000000000000f292504db202c-1f577696821e6fce-01
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS, MISS
x-cache-hits: 0, 0, 0
x-served-by: cache-bur-kbur8200124-BUR, cache-yyz4520-YYZ, cache-yyz4520-YYZ
x-timer: S1715416805.987250,VS0,VE125

GET
H3 200 6aa18944a3ad2c224d37dafb46afa35f.jpg
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 92 KB
0 0ms
0ms Image
image/jpeg 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/6aa18944a3ad2c224d37dafb46afa35f.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 41edca74f63e4546256206b316479052b81b5d8fe3b810424d302bd4bf70c9ed

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 26 Apr 2024 03:59:58 GMT
age: 1312802
x-guploader-uploadid: ABPtcPr1fuBaO12bi4KAOyRw2n47ZjK0unKFqtOKMgy9dbDo7VrBQq6dgxxBN3ZX3vcGdiIun_g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 93895
last-modified: Mon, 08 Apr 2024 16:27:35 GMT
server: UploadServer
etag: "6aa18944a3ad2c224d37dafb46afa35f"
x-goog-generation: 1712593655184176
x-goog-hash: crc32c=H/B1bQ==, md5=aqGJRKOtLCJNN9r7Rq+jXw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 93895
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 59a941c096f98029341d8c56b7b89113.png
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 18 KB
0 0ms
0ms Image
image/png 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/59a941c096f98029341d8c56b7b89113.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 2f9c91dd6030ee0311497f63531e9e27cb31cb8468a74c0b8482075bdbaa80b5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 26 Apr 2024 03:59:58 GMT
age: 1312802
x-guploader-uploadid: ABPtcPq7k17sbJ3wSxDmwIj1vAJFKeVlMMgN4V-Ykwnj-7_Wj8RrMF76Q1pscz7543goVc6Uigvtwya6Yw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18352
last-modified: Tue, 25 Aug 2020 15:57:40 GMT
server: UploadServer
etag: "59a941c096f98029341d8c56b7b89113"
x-goog-generation: 1598371060392963
x-goog-hash: crc32c=8aFhaA==, md5=WalBwJb5gCk0HYxWt7iREw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 18352
accept-ranges: bytes
content-type: image/png

GET
H2 200 widget.js Show response
js.jebbit.com/companion/v1/ 44 KB
0 0ms
0ms Script
text/javascript 2600:9000:2514:9e00:a:7914:b00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.jebbit.com/companion/v1/widget.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2514:9e00:a:7914:b00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cc9709489aeba0f23cc18fd3d1ff6f2087e1381ba6dbe92e98738228d520fd54

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: j3bLD5VAFZVsHy8WM9iuVjqRLf9F9664
date: Sat, 11 May 2024 07:06:52 GMT
via: 1.1 c456cd1dcda544d97e59ee05afbea4a2.cloudfront.net (CloudFront)
last-modified: Thu, 02 May 2024 15:04:41 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P8
age: 5584
x-amz-server-side-encryption: AES256
etag: "226557253164387c89ed4612b780f10f"
x-cache: Hit from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 45245
x-amz-cf-id: 2eKX-QcRiSUk5tmVN2VbbmTQ-L8yylTGql1HFaDoO-XCnlUut7UAfA==

GET
H2 200 i.js Show response
tag.wknd.ai/6664/ 17 KB
43 B 78ms
77ms Script
text/plain 34.120.253.250
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.wknd.ai/6664/i.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.253.250 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 250.253.120.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: af91e8aa69da058225e20c567eb2dfe8c291ecfbd3903f0b72646e12c02842b2

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:39:55 GMT
content-encoding: gzip
via: 1.1 google
age: 10
x-envoy-upstream-service-time: 1
x-region: us-central1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5573
server: istio-envoy
etag: 296a9382d0b4dc
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=60
timing-allow-origin: *
link: <https://assets.bounceexchange.com>; rel=dns-prefetch, <https://events.bouncex.net>; rel=dns-prefetch, <https://data.cdnbasket.net>; rel=dns-prefetch, <https://page.cdnbasket.net>; rel=dns-prefetch, <https://view.cdnbasket.net>; rel=dns-prefetch, <https://ids.cdnwidget.com>; rel=dns-prefetch, <https://u.cdnwidget.com>; rel=dns-prefetch, <https://api.bounceexchange.com>; rel=preconnect, <https://pd.cdnwidget.com>; rel=preconnect

POST
H2 204 events
c.contentsquare.net/v2/ 0
319 B 93ms
92ms Ping
text/plain 3.220.193.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c.contentsquare.net/v2/events?uu=fb5b6c1e-e081-a8c1-b6c1-5f9d40b55289&sn=1&hd=1715416795&v=14.10.0&pid=1926&pn=1&str=2783&di=4831&dc=6656&fl=6671&sr=18&mdh=6759&hlm=true&ct=0
Requested by: Host: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/1a8bfa042c9c5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.220.193.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-193-24.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:05 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

POST recording
k-aeu1.contentsquare.net/v2/ 0
0

GET
H3 200 collect Show response
sgtm.elfcosmetics.com/g/ 65 B
85 B 259ms
258ms XHR
text/plain 34.49.124.132
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.elfcosmetics.com/g/collect?v=2&tid=G-5D80LRC85N&gtm=45je4580v9125640115z8896608294za200&gcs=G111&gcd=13v3v3v3u5&npa=1&dma=0&cid=1017828244.1715416793&ecid=1852065918&ul=en-ca&sr=1600x1200&ir=1&ur=CA-ON&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=EA&sst.rnd=1275937653.1715416793&sst.gse=1&sst.etld=google.ca&sst.gcd=13v3v3v3u5&sst.adr=1&sst.ude=0&_s=5&sid=1715416794&sct=1&seg=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&en=page_view&ep.vendor_id=facebook&ep.event_id=1715417267545_171541711282531&ep.email=&ep.phone=&_et=11328&tfd=19697&richsstsse

Requested by

Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.49.124.132 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

132.124.49.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:40:06 GMT
via: 1.1 google, 1.1 google
x-content-type-options: nosniff
server: Google Frontend
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-accel-buffering: no

GET
H3 200 eligible
events.bouncex.net/track.gif/ 42 B
60 B 96ms
96ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/eligible?wklz=CYcwXAlgzgygrgIygYwE4QQU1QXgGYCGANlJgGSiRQAKqmAbhAPZxQDCrALkwLbb7FSFcMgLIAFpgAqMHAEYA7HICsAFjkA2ABwAGHXJ0AmMnACO8sqRB8AdpwD6EYFBxlRPAA4EIIG05yGqsoagaqWLKjImDgILDZRAB5kBCCYdjgAVlBkPEzA0TpkAO6YSBCcmP4a1WGMUOX+iirq2nqqSsoAzGH5jFH+hloAnDqdhp0ayiqGMzpaqoVeqYyYRY2WmKZwaf3AOMpuRBBpnJwQfFCcBJ7yHS26wfOHx3YEHhD02PVMNjhXIJ0KAwIFEcMAyJxxBBUMB7F5UJwAJ72S5MVApTD2YDQAgIIiYPaEEjkTgALyYOFUhkKUCYeAcAxAACkABoAa1M1CK1CGNhsADEMgB5ACKUA8CFMACEQBliHIALJkcQEGGOPaGZnspgKgAiADUmAoAIIK5D8nhCgDqyClUp4EDwPCIHiAA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:05 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 118ms
118ms Image
image/gif 2607:f8b0:4004:c07::66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1714816308&t=pageview&_s=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dp=%2Fen_CA%2Felf-cosmetic-criminals&ul=en-ca&de=UTF-8&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAACgAIAC~&jid=&gjid=&cid=1017828244.1715416793&tid=UA-432816-1&_gid=1074227162.1715416793&gtm=45He4580n81WL3STMXv896608294za200&cd4=0&cd6=&cd7=&cd8=&cd9=0&cd14=content&cd19=&cd21=CA&gcs=G111&gcd=13v3v3v3u5&dma=0&npa=1&z=1046430764

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 01:14:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 26709
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET

cnv
cnv.event.prod.bidr.io/log/
Redirect Chain

https://pixel.pointmediatracker.com/kpi?c=elfcosmetics&kpi=visit&tag_id=244&fpc=becf4a1a-e525-43ef-bd14-8302ed4579c4&user_id=&utm_source=undefined&utm_medium=undefined&utm_campaign=undefined&new=Ne...
https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=6bac8c98-9355-4138-99b2-25f9970e0523.&ord=431674225549629506

0
0

GET
H2 200 /
www.facebook.com/tr/ 0
126 B 169ms
165ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1638306756445368&ev=PageView&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&rl=&if=false&ts=1715416805714&sw=1600&sh=1200&v=2.9.156&r=stable&a=tmSimo-GTM-WebTemplate&ec=1&o=4126&fbp=fb.1.1715416796790.254037398&ic=gtm&ler=empty&cdl=API_unavailable&it=1715416795075&coo=false&eid=1715417267545_171541711282531&tm=1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=25, rtx=0, c=10, mss=1392, tbw=3128, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 11 May 2024 08:40:05 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
98 B 76ms
73ms Image
image/gif 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1715416805718&id=t2_16331p&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=697ea2e5-5ccb-4ec5-9df8-5e0827c43482&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_a8bbbcc6&dpm=&dpcc=&dprc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 08:40:05 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET px
secure.adnxs.com/ 0
0

GET

syncd
x.bidswitch.net/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=3ftfnh3&ct=0:8m23e30&fmt=3
https://x.bidswitch.net/syncd?dsp_id=93&user_group=1&user_id=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch

0
0

GET
H2 204 pageview
c.contentsquare.net/ 0
319 B 94ms
92ms Image
text/plain 3.220.193.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/pageview?ex=&pvt=a&cvars=%7B%223%22%3A%5B%22Page%20Type%22%2C%22content%22%5D%7D&cvarp=%7B%223%22%3A%5B%22Page%20Type%22%2C%22content%22%5D%7D&la=en-CA&uc=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dr=&dw=1600&dh=6761&ww=1600&wh=1200&sw=1600&sh=1200&uu=fb5b6c1e-e081-a8c1-b6c1-5f9d40b55289&sn=1&hd=1715416805&v=14.10.0&pid=1926&pn=2&r=246810
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.220.193.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-193-24.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sat, 11 May 2024 08:40:05 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
H2 200 display Show response
api.usehero.com/webplugin/ 129 B
1 KB 234ms
233ms XHR
application/json 54.237.62.243
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.usehero.com/webplugin/display?appId=efcf9631-4c6b-4874-9f76-51f71464249a&location=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&state=untouched&outboundFeature=&visitorId=aeeb6b0f-a817-4e58-8cbd-81291779430e

Requested by

Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.237.62.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-62-243.compute-1.amazonaws.com

Software

Resource Hash

f728b2a3472bdb7b12fe2b3ad324f86306d5ebfd9a22970cdb9d75865437181f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains, max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-permitted-cross-domain-policies: none
surrogate-control: no-store
x-dns-prefetch-control: off
klarna-correlation-id: 603e8ca1-38cb-4a01-b1fa-b0f8b64f2aa8
cross-origin-resource-policy: same-origin
x-geo-longitude: -79.36230
pragma: no-cache
referrer-policy: same-origin
etag: W/"81-DUL/7m3RpQ4iaY5LE5GkpykgL0I"
x-frame-options: SAMEORIGIN
x-geo-zip: M5A
content-type: application/json; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?1
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-geo-latitude: 43.65470
x-accuracy: 20
expires: 0
date: Sat, 11 May 2024 08:40:06 GMT
strict-transport-security: max-age=15552000; includeSubDomains, max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
cross-origin-embedder-policy: require-corp
x-time-zone: America/Toronto
x-envoy-upstream-service-time: 16
content-length: 129
x-xss-protection: 0
x-request-id: 603e8ca1-38cb-4a01-b1fa-b0f8b64f2aa8
cross-origin-opener-policy: same-origin
x-download-options: noopen
x-country: CA
x-geo-city: Toronto

GET
H3 200 / Show response
ct.pinterest.com/user/ 35 B
64 B 108ms
107ms XHR
image/gif 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22event_id%22%3A%224c7c95a5-8015-4736-baff-d38786e98b6d%22%7D&tid=2615235625530&pd=%7B%22np%22%3A%22gtm%22%2C%22pin_unauth%22%3A%22dWlkPU5HSXpZamsyTTJNdFpURm1NaTAwWkRoaUxUaGpZemd0WkRCaVltSmlZak5tWlRBMg%22%7D&cb=1715416805858&dep=4%2CTAGS_RECEIVED&stc=true

Requested by

Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js

Protocol

Security

QUIC, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

quic-version: 0x00000001
date: Sat, 11 May 2024 08:40:05 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.11dfda17.1715416805.4698c7ee
x-envoy-upstream-service-time: 0
alt-svc: h3=":443"; ma=600
content-length: 35
x-pinterest-rid: 5969465358562235
pin-unauth: dWlkPU5HSXpZamsyTTJNdFpURm1NaTAwWkRoaUxUaGpZemd0WkRCaVltSmlZak5tWlRBMg
pragma: no-cache
referrer-policy: origin
content-type: image/gif
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
pinterest-version: 9ab3886c06a794ff1d841687ae65f5a1cfdbcfc8
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

activityi;dc_pre=COjF8sqZhYYDFbI0dgYdhZgBHQ;src=9231397;type=retarget;cat=globa0;ord=9095524840991;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefine...
9231397.fls.doubleclick.net/ Frame F963
Redirect Chain

https://9231397.fls.doubleclick.net/activityi;src=9231397;type=retarget;cat=globa0;ord=9095524840991;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefi...
https://9231397.fls.doubleclick.net/activityi;dc_pre=COjF8sqZhYYDFbI0dgYdhZgBHQ;src=9231397;type=retarget;cat=globa0;ord=9095524840991;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-...

0
0

157ms
156ms

Document
text/html

142.251.163.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9231397.fls.doubleclick.net/activityi;dc_pre=COjF8sqZhYYDFbI0dgYdhZgBHQ;src=9231397;type=retarget;cat=globa0;ord=9095524840991;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=false;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181619921z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f148.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 474
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 11 May 2024 08:40:06 GMT
expires: Sat, 11 May 2024 08:40:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 11 May 2024 08:40:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9231397.fls.doubleclick.net/activityi;dc_pre=COjF8sqZhYYDFbI0dgYdhZgBHQ;src=9231397;type=retarget;cat=globa0;ord=9095524840991;npa=1;auiddc=1776364679.1715416793;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=false;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181619921z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

activityi;dc_pre=CIfR8sqZhYYDFfYUdgYdM0wJIg;src=10742279;type=elf8j0;cat=glo_flap;ord=2419331686256;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-c...
10742279.fls.doubleclick.net/ Frame DE5F
Redirect Chain

https://10742279.fls.doubleclick.net/activityi;src=10742279;type=elf8j0;cat=glo_flap;ord=2419331686256;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmeti...
https://10742279.fls.doubleclick.net/activityi;dc_pre=CIfR8sqZhYYDFfYUdgYdM0wJIg;src=10742279;type=elf8j0;cat=glo_flap;ord=2419331686256;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfc...

0
0

162ms
162ms

Document
text/html

142.251.163.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10742279.fls.doubleclick.net/activityi;dc_pre=CIfR8sqZhYYDFfYUdgYdM0wJIg;src=10742279;type=elf8j0;cat=glo_flap;ord=2419331686256;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181663336z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f149.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 410
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 11 May 2024 08:40:06 GMT
expires: Sat, 11 May 2024 08:40:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 11 May 2024 08:40:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10742279.fls.doubleclick.net/activityi;dc_pre=CIfR8sqZhYYDFfYUdgYdM0wJIg;src=10742279;type=elf8j0;cat=glo_flap;ord=2419331686256;npa=1;auiddc=1776364679.1715416793;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4580v9181663336z8896608294za201;gcs=G111;gcd=13v3v3v3u5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 /
ct.pinterest.com/v3/ 35 B
0 114ms
114ms Fetch
image/gif 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22event_id%22%3A%224c7c95a5-8015-4736-baff-d38786e98b6d%22%7D&tid=2615235625530&pd=%7B%22np%22%3A%22gtm%22%2C%22pin_unauth%22%3A%22dWlkPU5HSXpZamsyTTJNdFpURm1NaTAwWkRoaUxUaGpZemd0WkRCaVltSmlZak5tWlRBMg%22%7D&cb=1715416805910&dep=4%2CTAGS_RECEIVED&stc=true&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%222bdc3040%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22124%22%7D%2C%7B%22brand%22%3A%22Not%3AA-Brand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22124%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Win32%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22124.0.6367.201%22%2C%22ecm_enabled%22%3Afalse%7D

Requested by

Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkMWZjOGNjMA.js

Protocol

Security

QUIC, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

quic-version: 0x00000001
date: Sat, 11 May 2024 08:40:05 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.11dfda17.1715416805.4698c8a2
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=600
content-length: 35
x-pinterest-rid: 3615660265931472
pragma: no-cache
referrer-policy: origin
content-type: image/gif
access-control-allow-origin: https://www.elfcosmetics.com
pinterest-version: 9ab3886c06a794ff1d841687ae65f5a1cfdbcfc8
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 widget.css
js.jebbit.com/companion/v1/ 15 KB
0 0ms
0ms Stylesheet
text/css 2600:9000:2514:9e00:a:7914:b00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.jebbit.com/companion/v1/widget.css
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2514:9e00:a:7914:b00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 875ca118023e8741e684a320e73b7f9af4e8eba6c88f1f7e8457f7c0cdda6efb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.elfcosmetics.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 5TtP6A3FvksKClCFN7X6r1PsSCc1hWlP
date: Sat, 11 May 2024 07:06:52 GMT
via: 1.1 c456cd1dcda544d97e59ee05afbea4a2.cloudfront.net (CloudFront)
last-modified: Thu, 02 May 2024 15:04:41 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P8
age: 5585
x-amz-server-side-encryption: AES256
etag: "de1b72e797664b9b2c2139e5ccb24844"
x-cache: Hit from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 15521
x-amz-cf-id: nDAopwavdXaPaVBqLGRJ4p5t9XQd-Vg0XDlBQKngapUpBK77xSvPQg==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/en_CA/

Domain: k-aeu1.contentsquare.net
URL: https://k-aeu1.contentsquare.net/v2/recording?rt=5&v=14.10.0&pid=1926&pn=1&sn=1&uu=fb5b6c1e-e081-a8c1-b6c1-5f9d40b55289&hlm=true&ct=0

Domain: cnv.event.prod.bidr.io
URL: https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=6bac8c98-9355-4138-99b2-25f9970e0523.&ord=431674225549629506

Domain: secure.adnxs.com
URL: https://secure.adnxs.com/px?id=160890&%20seg=6104893&t=2

Domain: x.bidswitch.net
URL: https://x.bidswitch.net/syncd?dsp_id=93&user_group=1&user_id=d5ed9a5a-e389-460c-b1ee-7b748657c7f0&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch

Verdicts & Comments Add Verdict or Comment

212 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

90 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: gPIwBcFp6sY
.youtube.com/	1970-01-21 00:49:28	Name: VISITOR_INFO1_LIVE Value: ilIA9jvGhW0
.youtube.com/	1970-01-21 00:49:28	Name: VISITOR_PRIVACY_METADATA Value: CgJDQRIEGgAgMw%3D%3D
.elfcosmetics.com/	1969-12-31 23:59:59	Name: pxcts Value: 07de51e0-0f72-11ef-bfdd-16168ad0aaf0
.elfcosmetics.com/	1970-01-21 05:15:52	Name: _pxvid Value: 07de3fd3-0f72-11ef-bfdc-50f87efdeba5
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: initAuthComplete Value: true
.elfcosmetics.com/	1970-01-21 06:06:16	Name: ab.storage.sessionId.609afcb2-1dc3-41ef-a771-0a9aaf10bf57 Value: %7B%22g%22%3A%223998ef06-95fe-bda3-5f13-75e67da7a96e%22%2C%22e%22%3A1715418591615%2C%22c%22%3A1715416791615%2C%22l%22%3A1715416791615%7D
.elfcosmetics.com/	1970-01-21 06:06:16	Name: ab.storage.deviceId.609afcb2-1dc3-41ef-a771-0a9aaf10bf57 Value: %7B%22g%22%3A%227339fea3-f4f6-3ff4-9abe-3a3ad5ba9177%22%2C%22c%22%3A1715416791617%2C%22l%22%3A1715416791617%7D
.elfcosmetics.com/	1970-01-20 21:13:28	Name: _dyjsession Value: h50e4hz4g3wr5uf4doqfz0u8zfvndwxv
.elfcosmetics.com/	1969-12-31 23:59:59	Name: dy_fs_page Value: www.elfcosmetics.com%2Fen_ca%2Felf-cosmetic-criminals
.elfcosmetics.com/	1970-01-20 21:13:28	Name: _dy_csc_ses Value: h50e4hz4g3wr5uf4doqfz0u8zfvndwxv
.elfcosmetics.com/	1970-01-20 21:13:28	Name: _dy_c_exps Value:
.elfcosmetics.com/	1970-01-20 22:39:52	Name: _gcl_au Value: 1.1.1776364679.1715416793
.elfcosmetics.com/	1970-01-20 20:30:17	Name: _px3 Value: 4983f29486e5c895e491150f84969339dd2608e5f368ec9d8aefce0e6b36841d:V9VTUKmo8gjDqm9fEQbSil9CsS0djajNo5glhGsIvk4sQ9+q4piHT5D+nGbE3l+kVwpvCRE1pV6WheeVwsjKNw==:1000:E0HtQjxPG3fj4h0xAjCvMdhnN9E+aZWDio/rUJFXqsMOkn6FCtf0oMYeqh0uTn78opolT68qYujmVSzofFM1ov6I/3qKkw9EDjhldz1vMbVuyiIsKWrH+94SgH4xQLjAtvaYQhvV3OYovzj4tiJrzWL8vSd/3e/m0n86wcG11F7/m3lgqD0W7s3lxW6GbvAfaxH4d3VPXEmMr/tvKgdtGbajkmqYF+m16oZQijyJxJY=
.elfcosmetics.com/	1970-01-20 20:31:43	Name: _gid Value: GA1.2.1074227162.1715416793
.elfcosmetics.com/	1970-01-20 20:30:16	Name: _gat_UA-432816-1 Value: 1
.dynamicyield.com/	1970-01-21 05:15:52	Name: DYID Value: -3697455056132559143
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: scapi Value: prd:c9274bd0-c4fd-4e61-8ac8-d238d69cc959:eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiI4YzhjYTI4OC1mMWE2LTRmMDktYjI2OS0wNWQyZWViZmRmMDEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmM5Mjc0YmQwLWM0ZmQtNGU2MS04YWM4LWQyMzhkNjljYzk1OSIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MTU0MTY3NjMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmJld1hJV2xYcEd4Y2FSd1hwS3hiWVl4cndWOjpjaGlkOiAiLCJleHAiOjE3MTU0MTg1OTMsImlhdCI6MTcxNTQxNjc5MywianRpIjoiQzJDMTk1MTY2MTE4NjAtNDI0NjM3OTAzMjEwMjg3NDYxNTI4OTU2In0.ACsqn3PuT0YiG8Sb86_WGu2luvg_CT7Rvo2drKThIE3LZ2G3y70WQknnpt1H87LmMKwI4Aw0ogGH1PMyhno5rA
.elfcosmetics.com/	1970-01-20 21:13:28	Name: _dycnst Value: dg
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: dwsid Value: 6ePEQjVeiMzzsqZd3FZyPioKBOpB-ydnv0HhQbc7zWGBwYWzE9hYYk-Sw1wxI7XyfYezPQ5KfdQCkdTDTDUqMw==
www.elfcosmetics.com/	1970-01-21 00:49:28	Name: dwanonymous_1a00c2845eeb01c699351ea28e20fd92 Value: bewXIWlXpGxcaRwXpKxbYYxrwV
.elfcosmetics.com/	1970-01-20 21:13:28	Name: _dyid Value: -3697455056132559143
.elfcosmetics.com/	1970-01-20 21:13:28	Name: _dycst Value: dk.w.c.ws.fst.
.elfcosmetics.com/	1970-01-20 21:13:28	Name: _dy_geo Value: CA.NA.CA_ON.CA_ON_Toronto
.elfcosmetics.com/	1970-01-20 21:13:28	Name: _dy_df_geo Value: Canada..Toronto
.elfcosmetics.com/	1970-01-20 21:13:28	Name: _dy_toffset Value: 0
.elfcosmetics.com/	1970-01-21 05:15:52	Name: _dy_soct Value: 647796.1248068.1715416793.h50e4hz4g3wr5uf4doqfz0u8zfvndwxv836603.1652212.1715416793837245.1654610.1715416793*861617.1750272.1715416793
www.elfcosmetics.com/	1970-01-20 20:40:21	Name: FPC Value: becf4a1a-e525-43ef-bd14-8302ed4579c4
.elfcosmetics.com/	1970-01-21 05:15:52	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Sat+May+11+2024+01%3A39%3A53+GMT-0700+(Pacific+Daylight+Saving+Time)&version=202306.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=c884339f-5315-4d91-b0d9-61674ebbbf99&interactionCount=0&landingPath=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1%2C5%3A1
.adsrvr.org/	1970-01-21 05:15:52	Name: TDID Value: d5ed9a5a-e389-460c-b1ee-7b748657c7f0
.adnxs.com/	1970-01-21 06:06:16	Name: receive-cookie-deprecation Value: 1
.elfcosmetics.com/	1970-01-21 06:06:16	Name: _ga_ZLYXLXNDL8 Value: GS1.1.1715416794.1.0.1715416794.60.0.0
.elfcosmetics.com/	1970-01-21 06:06:16	Name: _ga Value: GA1.1.1017828244.1715416793
.adnxs.com/	1970-01-20 22:39:52	Name: anj Value: dTM7k!M4/8CxrEQF']wIg2GTwu[uqF!]tbP6j2F-XstGt!@DyW%!rX6
.elfcosmetics.com/	1970-01-21 06:06:16	Name: _ga_5D80LRC85N Value: GS1.1.1715416794.1.1.1715416794.0.0.1852065918
.adnxs.com/	1970-01-20 22:39:52	Name: XANDR_PANID Value: -NTUv4pwrSACwYqAH5favxXlsriURsmoBBoW9F5VBL8sazZDBhdu2XkdUueg63SKpTc3aClLcFsf9rXOqufcOqpBnXXeOA1s3tGJ5YtnCYo.
.adnxs.com/	1970-01-20 22:39:52	Name: uuid2 Value: 3459814829854878186
.pointmediatracker.com/	1970-01-21 05:15:52	Name: c Value: be607e1c-2d5a-413d-8cce-f2fbe0277f03
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: esw.currency Value: CAD
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: sid Value: yo_mhd2gnkhymar8hn3j4QlmJi2pBTHjPmo
www.elfcosmetics.com/	1970-01-21 05:16:13	Name: _dyid_server Value: -3697455056132559143
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: esw.InternationalUser Value: true
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: esw.location Value: CA
www.elfcosmetics.com/	1970-01-20 20:31:43	Name: currentLocale Value: en_CA
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: esw.sessionid Value: bewXIWlXpGxcaRwXpKxbYYxrwV
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: esw.LanguageIsoCode Value: en_CA
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: __cq_dnt Value: 1
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: dw_dnt Value: 1
.elfcosmetics.com/	1970-01-20 21:13:28	Name: rmStore Value: dmid:9097
.elfcosmetics.com/	1970-01-21 06:06:16	Name: FPID Value: FPID2.2.JI4RasqPXn9fV6eXTO53UGygJ6052lFl40lQ8Osrk2A%3D.1715416793
.elfcosmetics.com/	1970-01-20 20:30:18	Name: FPGSID Value: 1.1715416794.1715416794.G-5D80LRC85N.G6OAHbkmoEZxKqax6xTbdQ
.elfcosmetics.com/	1970-01-20 22:39:52	Name: _rdt_uuid Value: 1715416794990.697ea2e5-5ccb-4ec5-9df8-5e0827c43482
.elfcosmetics.com/	1970-01-21 05:59:40	Name: _cs_c Value: 0
.elfcosmetics.com/	1970-01-21 05:59:40	Name: _cs_id Value: fb5b6c1e-e081-a8c1-b6c1-5f9d40b55289.1715416795.1.1715416795.1715416795.1558384338.1749580795045.1
.doubleclick.net/	1970-01-21 06:06:16	Name: IDE Value: AHWqTUl72Fv2jOZgJDWe8yjVQq-XhXybNP5lvR_h6omjWSy2HlTO-ICpVZRl0Y60HKI
.elfcosmetics.com/	1970-01-20 20:31:43	Name: _uetsid Value: 0aa25a700f7211ef973dc7249545513e
.elfcosmetics.com/	1970-01-21 05:51:52	Name: _uetvid Value: 0aa29dd00f7211ef8aa4effdac61fb40
.bidr.io/	1970-01-21 05:58:50	Name: bito Value: AAOYg07Mfl4AABSRI4qVcQ
.bidr.io/	1970-01-21 05:58:50	Name: bitoIsSecure Value: ok
.tiktok.com/	1970-01-21 05:51:52	Name: _ttp Value: 2gJXkL7CzQdohyYcJVSp4AUKf4m
.elfcosmetics.com/	1970-01-21 05:15:52	Name: hero-session-efcf9631-4c6b-4874-9f76-51f71464249a Value: author=client&expires=1746952795505&visitor=aeeb6b0f-a817-4e58-8cbd-81291779430e
.doubleclick.net/	1970-01-21 00:49:28	Name: receive-cookie-deprecation Value: 1
.rubiconproject.com/	1970-01-21 05:15:52	Name: khaos Value: LW1UVAPR-K-ATGQ
.rubiconproject.com/	1970-01-21 05:15:52	Name: audit Value: 1\|H3M7Or/YkCLoqoUuncligOSRTrMPTneuepkAn3uJ9pVatDGnh8ppCgiU/NS63r5TnswjVoXYaCyM1KxoLazIt9i2Wk5FrGos0XY24Ec+XLtVcGkK8fIhAaDrzKq++yPiDg7tByL5/yCZNu6nINdW1D+mHTV5nlyAmNl/1iGzYadbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.adsrvr.org/	1970-01-21 05:15:52	Name: TDCPM Value: CAESFwoIYXBwbmV4dXMSCwj6jPTs_uf4PBAFEhUKBmdvb2dsZRILCKjsyvL-5_g8EAUSFgoHcnViaWNvbhILCKqUy_L-5_g8EAUSFQoGY2FzYWxlEgsIoKKk-P7n-DwQBRgFIAMoATILCK6O1pWV6Pg8EAVCDyINCAESCQoFdGllcjIQAVoHM2Z0Zm5oM2ABcgZjYXNhbGU.
.elfcosmetics.com/	1970-01-20 20:30:18	Name: _cs_s Value: 1.5.0.1715418596082
.casalemedia.com/	1970-01-21 05:15:52	Name: CMID Value: Zj8u3NHM6lUAAFRiAEELOgAA
.casalemedia.com/	1970-01-20 22:39:52	Name: CMPS Value: 3723
.casalemedia.com/	1970-01-20 22:39:52	Name: CMPRO Value: 3723
.linksynergy.com/	1970-01-21 05:15:52	Name: rmuid Value: 6dbe79cc-b314-42b0-8e6a-b91d21869909
.undertone.com/	1970-01-21 05:15:52	Name: UTID Value: 25dbab878ca04bf785ca3bda00436fd1
.undertone.com/	1970-01-21 05:15:52	Name: UTID_ENC Value: 28opn30x9fnsu029jgh7wdpsh
.elfcosmetics.com/	1970-01-20 22:39:52	Name: _fbp Value: fb.1.1715416796790.254037398
.bing.com/	1970-01-21 05:51:52	Name: MUID Value: 2F1FF26F9DD361400C12E6139C79606C
.bat.bing.com/	1970-01-20 20:40:21	Name: MR Value: 0
.elfcosmetics.com/	1970-01-21 05:51:52	Name: _tt_enable_cookie Value: 1
.elfcosmetics.com/	1970-01-21 05:51:52	Name: _ttp Value: GVzIjTnBs8YNa17dDUtNkGKVvMz
.pinterest.com/	1970-01-21 05:15:52	Name: ar_debug Value: 1
.elfcosmetics.com/	1970-01-21 05:15:52	Name: _pin_unauth Value: dWlkPU5HSXpZamsyTTJNdFpURm1NaTAwWkRoaUxUaGpZemd0WkRCaVltSmlZak5tWlRBMg
.ct.pinterest.com/	1970-01-21 05:15:52	Name: _pinterest_ct_ua Value: "TWc9PSZVUVlJNUxKeTZxdnJRM2FSci96V25HTC9KZXY3QXVsQlIzYmpJNWJET0srazBJVUJBeFZPRDMxRGpBZkNwYmZSbVpmcm03bS9wWFZkd29FNFFDUVQrZGFsNVJGclpvVFNzYXRyUXVGS0ZIWT0mT0xZMC9XNDV3b3o2ZFJjQlhManRSQWJLVmIwPQ=="
.rlcdn.com/	1970-01-21 05:15:52	Name: rlas3 Value: 0u7YeGCSEI/BUGuk7ksXSPlf5NdWI5gDny43QPbAEzQ=
.rlcdn.com/	1970-01-20 21:56:40	Name: pxrc Value: CN3d/LEGEgUI6AcQABIGCOTrARAA
.linksynergy.com/	1970-01-21 05:15:52	Name: icts Value: 2024-05-11T08:39:57Z
imgs.signifyd.com/	1970-01-21 06:06:16	Name: thx_guid Value: 83576ac0cde77149a628eabf20390561
.elfcosmetics.com/	1970-01-20 20:31:28	Name: FPLC Value: K0e9SOEAlZ0WfncHjh82DjSVTL4z6Q4W7OSjYg4FtDN9%2FUgQwTYmJfmjeb6hJwusDvRGyOz%2B24OW6raH1kN4nzop990lEytnU0zqKgCyxh0MMMwbhfnVtwj%2Fmi6UyA%3D%3D
.elfcosmetics.com/	1970-01-21 06:06:16	Name: _scid Value: 49483183-bb2c-47e4-6c64-6350493370ae
.cdnwidget.com/	1970-01-21 06:00:31	Name: __3idcontext Value: {"cookieID":"2gJXkoMDVo7AMcFmOWcBBmifmlp","deviceID":"2gJXkqPwP9nnFjOQspbqBgjal1M","iv":"","v":""}
.elfcosmetics.com/	1970-01-21 05:59:04	Name: __idcontext Value: eyJjb29raWVJRCI6IjJnSlhrb01EVm83QU1jRm1PV2NCQm1pZm1scCIsImRldmljZUlEIjoiMmdKWGtxUHdQOW5uRmpPUXNwYnFCZ2phbDFNIiwiaXYiOiIiLCJ2IjoiIn0%3D
.bounceexchange.com/	1970-01-20 20:30:18	Name: bounceClientVisit6664c Value: %7B%22vid%22%3A1715416800471534%2C%22did%22%3A%22289032365152220840%22%7D
www.elfcosmetics.com/	1970-01-20 20:30:18	Name: bounceClientVisit6664v Value: N4IgNgDiBcIBYBcEQM4FIDMBBNAmAYnvgO6kB0ApmAGYDGA9igLYUICWtKZDTRFAdgH0AwjgJVqAWgbNWHaQCc2TNvwCGYFCAA0IBTBA6QbFIIDm9QSgooUbevxjUN13SfMQrNuw6cuKAL5AA

135 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Access to image at 'https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/en_CA/#elfcosmetics_a_00000055698485330971283280000018393236039574697104_?yocs=1u_' from origin 'https://www.elfcosmetics.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a5/en_CA/#elfcosmetics_a_00000055698485330971283280000018393236039574697104_?yocs=1u_ Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/1638306756445368?v=2.9.156&r=stable&domain=www.elfcosmetics.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105(Line 111) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10742279.fls.doubleclick.net
9231397.fls.doubleclick.net
alb.reddit.com
analytics.google.com
analytics.tiktok.com
api.bounceexchange.com
api.cquotient.com
api.ipify.org
api.usehero.com
assets.bounceexchange.com
async-px.dynamicyield.com
bat.bing.com
c.contentsquare.net
cdn-fsly.yottaa.net
cdn-scripts.signifyd.com
cdn.cookielaw.org
cdn.dynamicyield.com
cdn.media.amplience.net
cdn.static.amplience.net
cdn.usehero.com
cm.g.doubleclick.net
cnv.event.prod.bidr.io
code.jquery.com
collector-pxxt4gy2ig.px-cloud.net
connect.facebook.net
cosmeticcrimal.ca
ct.pinterest.com
data.cdnbasket.net
dsum-sec.casalemedia.com
elfcosmetics.a.bigcontent.io
events.bouncex.net
external-api.jebbit.com
geolocation.onetrust.com
googleads.g.doubleclick.net
h.online-metrix.net
ib.adnxs.com
idr.cdnwidget.com
ids.cdnwidget.com
idsync.rlcdn.com
imgs.signifyd.com
insight.adsrvr.org
js.cnnx.link
js.jebbit.com
k-aeu1.contentsquare.net
match.adsrvr.org
page.cdnbasket.net
pd.cdnwidget.com
pixel.pointmediatracker.com
pixel.rubiconproject.com
qoe-1.yottaa.net
s.pinimg.com
sdk.iad-05.braze.com
secure.adnxs.com
sgtm.elfcosmetics.com
srm.ba.contentsquare.net
st.dynamicyield.com
static.ordergroove.com
stats.g.doubleclick.net
t.contentsquare.net
t.paypal.com
tag.rmp.rakuten.com
tag.wknd.ai
tags.rd.linksynergy.com
ut.rd.linksynergy.com
view.cdnbasket.net
w2txo5aaqvyg3owu22twqjy4qvchbtt6d5e5yrrzb1ed5f0ffe8f7001sac.d.aa.online-metrix.net
www.elfcosmetics.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.paypal.com
www.paypalobjects.com
www.redditstatic.com
www.youtube.com
x.bidswitch.net
cdn-fsly.yottaa.net
cnv.event.prod.bidr.io
k-aeu1.contentsquare.net
secure.adnxs.com
x.bidswitch.net
104.18.36.155
104.26.13.205
108.138.106.40
108.139.47.127
140.174.14.148
142.250.31.156
142.251.16.157
142.251.163.148
142.251.163.149
151.101.193.140
151.101.193.21
151.101.193.35
151.101.65.21
151.101.66.133
18.164.116.94
192.225.157.157
192.225.158.1
192.225.158.3
192.229.210.155
204.2.133.238
23.212.248.137
23.220.128.196
23.47.22.7
2600:1408:c400:392::1931
2600:1408:c400:e::17cd:6a10
2600:1408:c400:e::17cd:6a1a
2600:1901:0:56e0::
2600:9000:21dd:a400:a:b89d:a6c0:93a1
2600:9000:23cb:3600:11:85b0:d600:93a1
2600:9000:23cb:f600:13:d6f4:3240:93a1
2600:9000:24f1:da00:15:ad21:c740:93a1
2600:9000:2514:9e00:a:7914:b00:93a1
2606:4700:4400::6812:2a49
2606:4700:4400::ac40:965f
2606:4700:4400::ac40:9b77
2606:4700::6813:b134
2607:f8b0:4004:c07::66
2607:f8b0:4004:c07::9a
2607:f8b0:4004:c07::9b
2607:f8b0:4004:c17::65
2607:f8b0:4004:c19::5b
2607:f8b0:4004:c19::61
2607:f8b0:4004:c1f::5e
2607:f8b0:4004:c21::69
2620:1ec:c11::237
2a03:2880:f003:c0e:face:b00c:0:3
2a03:2880:f103:83:face:b00c:0:25de
2a04:4e42:200::396
2a04:4e42:600::649
3.220.193.24
3.232.206.92
3.33.220.150
34.102.147.248
34.111.8.32
34.117.146.178
34.120.253.250
34.149.130.207
34.49.124.132
34.98.106.171
34.98.67.3
34.98.72.95
35.190.10.96
35.201.123.249
35.244.154.8
44.194.41.150
54.164.102.168
54.237.62.243
54.77.225.35
54.86.47.208
64.71.161.112
68.67.179.164
69.173.151.100
009342098f06d5ae7b2186f1076fab177d05b5a481ffe1190535fe501c1cae68
01cbc02765f9732eccccd131ced67c20391426de5766a5ec9a63f40b448309ed
03dbf9dc05fa84370cbdfb363a10855e9fd035a833cd83b67e14cdb975882bed
05791abffddcb67a92e9e2dfa25361ef8786512e296c288404357401db621f49
07cd8a0ea2b5b9fa0845c4f3a17ba1c634b7404c92f8c18012a8d933f59f26a2
0882be2bb685d64ae46b56574b330fb1afe5dfef39f940d12ca776475248eaa8
0a1309d2ccff026ab4dcf050977befc877505115e4777e240fa328b1781c63ae
0b02eeb997b4d190e584dbb89c5dcea4d02572834f66f242faa21f9dc1dd3b05
0b6b20418b25a8020e4bc09d4c60f0da9fd2a553cc393d68be6328a64402d992
1331786f628c441b99665436eb8815381e066e17d5c3bb56f5ce2e045d8da17a
13757862bb1b07255fb5cd6ede68eb0d486a16002a6fe600cdd259f01a089a45
16e39bf096710f2c65ca06172f5a70377defd3ff79d5f3f5bfde508eac55b611
19cc36fffa37aa68e3eeb82532cb58611a1e1191cad33bf5edf5265f5930ff28
1b6bc1aaf438e1b7ca4df626c3ccbba4d73ac05b8ad1a31bb2b556da0bfaa0a7
1ddc89ba3c2a29bf8b6a376737d491efdb8f9bcebc7c635639cda62390f45a06
20029e526c0674dd1f99d02142bbf324bd8ee217ca43705fa6fe1a64bd90ee0c
210706c053295db0bfba03a98c0609a1f940c3f6b6c626f2f1084e089e959dc9
25c8e105aed1fd7c0e7869d4e5cdc896fc4f74a2e6a24428711da23557cb98d3
27074e6240ca22f6d5a7cc51ee8cd8a0f091080ca80e6a1bea1c624e1cb40341
286a9eb90b3236f3c77e9cd147b524d542d53ba83973de175c45be3eb1147805
28826bb97ed9575dcff04bfed41325c201f0f1d0c0c365e7b6f8c57ca29809d6
2d38f4f475cc275a90410a5da0b47d14d90b585185dc338105a740bb702e3f9a
2e8fd8d487b4259dbdc6c529f742806377fae205c8dc7d0f35ac8797bafe5b3b
2f9c91dd6030ee0311497f63531e9e27cb31cb8468a74c0b8482075bdbaa80b5
31f48ed33afe7e437efa2c30cbf97fbd62c2de5c0732504077377846fe64973f
32d720cede6dadc60f848ff6670b767292e508c5ec392ef64ffd4fd46982e565
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
37d207a7297589d062c2af128ee513190a9297959cb24c68078f68d64b899c98
41e5e5d78c15f2bed06cbf7cd62873c3287c1587bb7fd8f22620eb06c5cae895
41edca74f63e4546256206b316479052b81b5d8fe3b810424d302bd4bf70c9ed
42997132bd0142564014ac4a809356dc0ceb9b7a90eede2b5b48019f1700cc58
458e1efc488ce373471e141e0391fe435f3c2c821d18bb2bec307ffdf2f032e5
498ea43ee2b31ee61f58f43b798dfaec6eb59b63fefdfaa7c01bba897ba57a33
4aa855b8d34657ab4df5ca73fe7d7f67735ee1e39e8de83856ddc473d4713fbb
4ae7d857dd8d096a5198b1e8280de9f929ca88d690e445731b6ffdffbf2b8383
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b89cd71669a53e8801ea9e9d4fb8a40bb5dbbb393a1b6c4a249349b42086da7
4ddabe1c1035e9369e2ae848e5126a02cf533f4eca547d7a5ee347c513d88029
4dee7b7f5bd454fc7b52f623814a23be6e9bc6b191ffb1b14a8202ce10d6813f
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
509f2e49500fbaeb5d7e1959071f2922b693d0135080e2871e124ec8bdd08bb2
5506280b7dc0dccff9587cbae7f5ba116267dada5e743b3e73fdcef498a4acd0
55baa715ccc8c2512bceb1c949c1d0927944ca327e7edd2d5fc312d2a41986e4
5747acdc028357d859f54da16a032df721c2d8fa84012660b395afd35d214a9d
59f1b7d93f47fcc926143154888aa471910eaf81c3c41270b61cfe012dda08df
5ccd2a2d0cfc8f7b36c238c935a36c751eb306a4f23788a0c6c33eec1a5a2071
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
6082597f3871c77c9b31aa1383577f8c0e54cb5ff09275dc817bc70d96e6217d
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6a2f825beb3b540a044cdb0515177c34497aa2ce92e335bf1498fa42bb5baf88
6ab1474b1928d39f768075dfef56e53b01fff6c85a44b07d150c4abf7299c3b7
6b76794387b8745d5b87f99bae1651cfd71babe2790d0a0a1ee1c43bfa8a6a0a
6c58f061a49641f54723faab57ad0bdb49a95619e86c90dad9a3ed630ffb3780
6ca208da05251bd9678d1d5b1e77b675d9bb1f9aceb2ba2769a256164d9c0bd3
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5
7586f9164e6bc95d916e3828d687c85f77cf253b34a5908fffa5f6f17dfd0d72
76ec62b7ed46c908c3aa9f05ee34dda6231ca2b8fa120244db55f6cf2af10a64
772f15316085ec36cb19f9af3a622cf12d847e0f187c3f907ee6daf975b7f7ce
7a0204422805f76d793709204fd52e753cb059e5dd5099e41781499c8072e726
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8366c029020891669a76e3026effc422022ee45b3c89345eef0bdaed3bfc2583
866b0dff742f52c8ce72fb6793882fdc9cc16fa9dca416168e8ee33acac4199d
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
875ca118023e8741e684a320e73b7f9af4e8eba6c88f1f7e8457f7c0cdda6efb
88410dca3f8f80ede3afddab5e3a4fe04b1605143e0665f12ca0570ecea24f22
89ad311944927ce3cfae733238f317bf1a9a65c082e1c49a9d3c2ab590421e8d
8cb2ac35adc7dee4b051d05a7ffc844c9f61eb67b3ce350a16a552f98ffc4172
8f216b50162bd5f4987b67548eaf5d98715fec939a7fd42ad1d8452c1529a558
8fd5b2be8986a642420a31377e016561b8e5191eecc86b866475caeece6531b6
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
915046d9ebab575f9b2f8ba9a35e030b2be55b1439edce6e72f7a19b4a55bd45
9261efb3407e3a9096e4654750d8eff6b3a663422f48845c7fbcc65034c340cf
93462eb3d917f68f309aaa025e778e52b1c574b6e07765738bf7ee1a3ab5084e
93d3607ab3b6aacff8c4500a18bf501c85271bfc14950eb923f9a65ee456a7ac
950200b1a632b0ee786b1af9bff50660cc7568ea90a68d0953ccdd7ca9927506
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
975e0ad7b4aad355ee1853a42969a3f62b61e2edb7e6e950f1d8cc319e860e20
9d2da5466cb139d5f69a5a2059e4650968c19781dd21a3be032d9c9160418350
9f2461f7629a9751a8ce13d4fa6465bd4dade527356dedaa1e07be6712694ec4
a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e
a4a87c74d93a3e9190c3cf5a0987d5be8e740d2c770febd4d52f9d8fe60ae4fc
a57d22600251ee11596bd3ccd0432a382eddea215419292a915f24df956e994e
a5c9c61c23a93d1a05d6275ca1e1f939c2fae710f0f224a255428e7abe23602d
a869fe8cddaf23f1ee50724c35748cefb30c697095b2cf4a231033cb8f43b4ab
ab99a75a2070736b0282d041df3a7e272ad5d4d1929ae430089ac0335e05ad2c
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af91e8aa69da058225e20c567eb2dfe8c291ecfbd3903f0b72646e12c02842b2
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2e0bde8a120edcd0e126c139ff4c62dc420e43a86bb9e22c92044fdda3fc3ef
b336f926203c1280abc248e9659a8bfc81f33e5827bd8e5a90bd43cbe9958ef4
b3efc48717edad187198d0a608a3b3a8195f0e5b6b6b41f27b78824796cbd61e
b5ca26f75e39caf1ad08263c487bb2fc576b76c3981e0bbaa2ddacbdb27a4089
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c0632e1970ec7ba15ad3a43afc0609446596e5ee8e7f6bab4e78f14d99f1b5af
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cc142a9a1a0c5a1856092accbc2d7e975505f016b78bfe1b907fc2f52191d879
cc9709489aeba0f23cc18fd3d1ff6f2087e1381ba6dbe92e98738228d520fd54
cc9ea760e99c7aeb29b3da195ff38ecb90d6699e6e437ba9fb6ba5c8a2912b01
cd56592299c1c670fb97ef28bcb50048508c01879ecb23b71364aecc0483e202
cdbeef0b146607f5137f8f5434eeab8625ee0801da2af33e045528d191e512d0
d0c233d327541d2961f1cde9e53a6166279655f4d4041c1bc458ac1701827719
d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e
d7003226e2fea50e6765c46fe1bdacfe3a16adedd6c7a2530fef876c2356cf9f
d7a363f752524fb545c3b2eb48a56d163cb659bc427d5215800ee7781d92c2ca
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
def2a184135eba029f8f785b3ed69edc5f36b368226ce1fcfeda4f5aa301d1b6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c
e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0
ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0
ed1a8723277464b3c707675f3a275e18114b964cb04d2e2116b8370a12d41e5d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10699f59e4285b87af5097e4ba9e470ee29b4f3487fa767f2818bdbbdd6bb14
f309b4b6297e8c886d8d6b1ff31decc2d09f6eecf7804e3325bf5a2d3a5eac55
f3ee233d8819e508bb5518fe58a3109712e1162aaec3a3470ca19e48e1a91db2
f65c65471955ca205caa4dde91ef65de82a40627acdaae83aa6710e7ef61d20f
f728b2a3472bdb7b12fe2b3ad324f86306d5ebfd9a22970cdb9d75865437181f
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
fcb0957e895444667ea2d03dbdf3e91b2c4cdc9c3af6b7a4275af7cd35bfcf2d
fdc7d594bb7e5c0b1893eedbc728dc4b482334c389dfe201b13531d730d0859f
ff2fe181c12146189657e92f9ce0489f7f3b51345796f5a5ec9b089f9fb47616
ff97f5d3c81621b5d7aaaf5aa65ce6aa003df7751fd5dbf9a80a4a356fb815e3

www.elfcosmetics.com Open in urlscan Pro 64.71.161.112 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

213 Requests

93 %HTTPS

36 %IPv6

52 Domains

78 Subdomains

66 IPs

4 Countries

9948 kBTransfer

19542 kBSize

90 Cookies

15 Outgoing links

Page URL History

Redirected requests

213 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.elfcosmetics.com Open in urlscan Pro
64.71.161.112 Public Scan

Screenshot
Live screenshot

Full Image

213
Requests

93 %
HTTPS

36 %
IPv6

52
Domains

78
Subdomains

66
IPs

4
Countries

9948 kB
Transfer

19542 kB
Size

90
Cookies

213 HTTP transactions
3 data transactions