page.firstleaf.club Open in urlscan Pro
2606:4700:10::ac43:1a84 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sailthru.perkspot.com/click/24831941.9083437/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xNDIwMjYyP21lc...
Effective URL:
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC...
Submission: On August 24 via api (August 24th 2021, 4:20:14 pm UTC) from US

Summary HTTP 208 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 74 IPs in 5 countries across 56 domains to perform 208 HTTP transactions. The main IP is 2606:4700:10::ac43:1a84, located in United States and belongs to CLOUDFLARENET, US. The main domain is page.firstleaf.club.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 13th 2021. Valid for: a year.

This is the only time page.firstleaf.club was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	3.226.166.212 3.226.166.212	14618 (AMAZON-AES) (AMAZON-AES)
2 18	23.96.203.178 23.96.203.178	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700::68... 2606:4700::6811:f349	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2620:1ec:48::45 2620:1ec:48::45	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.224.102.19 13.224.102.19	16509 (AMAZON-02) (AMAZON-02)
1	13.224.194.217 13.224.194.217	16509 (AMAZON-02) (AMAZON-02)
1 4	2a00:1450:400... 2a00:1450:400c:c08::9a	15169 (GOOGLE) (GOOGLE)
1	13.224.102.111 13.224.102.111	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
1	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
1 1	2a00:1450:400... 2a00:1450:4001:800::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1 31	104.18.72.113 104.18.72.113	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	52.202.102.177 52.202.102.177	14618 (AMAZON-AES) (AMAZON-AES)
3	104.18.70.113 104.18.70.113	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	13.69.106.212 13.69.106.212	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
7	104.16.51.111 104.16.51.111	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 3	89.207.16.72 89.207.16.72	41041 (VCLK-EU-SE) (VCLK-EU-SE)
8	2606:4700:10:... 2606:4700:10::ac43:1a84	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	35.244.137.202 35.244.137.202	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20e... 2600:9000:20eb:4200:b:dc44:3680:21	16509 (AMAZON-02) (AMAZON-02)
1 1	104.111.232.231 104.111.232.231	16625 (AKAMAI-AS) (AKAMAI-AS)
18	192.229.133.208 192.229.133.208	15133 (EDGECAST) (EDGECAST)
4	35.222.120.150 35.222.120.150	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:5e41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.120.27.38 34.120.27.38	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
2	151.101.13.140 151.101.13.140	54113 (FASTLY) (FASTLY)
1	13.224.196.60 13.224.196.60	16509 (AMAZON-02) (AMAZON-02)
1	13.224.102.6 13.224.102.6	16509 (AMAZON-02) (AMAZON-02)
1 2	52.206.179.19 52.206.179.19	14618 (AMAZON-AES) (AMAZON-AES)
1	13.224.102.20 13.224.102.20	16509 (AMAZON-02) (AMAZON-02)
1	151.101.13.44 151.101.13.44	54113 (FASTLY) (FASTLY)
5	159.203.152.67 159.203.152.67	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	3.12.200.117 3.12.200.117	16509 (AMAZON-02) (AMAZON-02)
1	216.239.36.21 216.239.36.21	15169 (GOOGLE) (GOOGLE)
1	13.225.87.11 13.225.87.11	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:21f... 2600:9000:21f3:2600:17:3f5c:f800:21	16509 (AMAZON-02) (AMAZON-02)
1	13.225.87.19 13.225.87.19	16509 (AMAZON-02) (AMAZON-02)
4	52.205.8.225 52.205.8.225	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:20e... 2600:9000:20eb:a00:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
3	35.201.112.186 35.201.112.186	15169 (GOOGLE) (GOOGLE)
1	104.111.239.203 104.111.239.203	16625 (AKAMAI-AS) (AKAMAI-AS)
1	167.172.228.26 167.172.228.26	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:219... 2600:9000:2190:1600:a:b27c:d040:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	34.120.253.250 34.120.253.250	15169 (GOOGLE) (GOOGLE)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	13.224.102.122 13.224.102.122	16509 (AMAZON-02) (AMAZON-02)
3	35.186.226.184 35.186.226.184	15169 (GOOGLE) (GOOGLE)
1	13.224.102.36 13.224.102.36	16509 (AMAZON-02) (AMAZON-02)
2 4	54.237.157.181 54.237.157.181	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2600:1f18:730... 2600:1f18:730:b110:c4cb:f288:bc78:c53b	14618 (AMAZON-AES) (AMAZON-AES)
1	34.206.124.188 34.206.124.188	14618 (AMAZON-AES) (AMAZON-AES)
4	2600:9000:21f... 2600:9000:21f3:6000:0:cc59:3900:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	34.98.72.95 34.98.72.95	15169 (GOOGLE) (GOOGLE)
1	13.224.89.92 13.224.89.92	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:20e... 2600:9000:20eb:1600:3:760:2800:21	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:21f... 2600:9000:21f3:3400:17:f683:1d40:21	16509 (AMAZON-02) (AMAZON-02)
3	35.186.194.58 35.186.194.58	15169 (GOOGLE) (GOOGLE)
3	3.213.211.223 3.213.211.223	14618 (AMAZON-AES) (AMAZON-AES)
1	35.227.203.40 35.227.203.40	15169 (GOOGLE) (GOOGLE)
1	35.227.224.109 35.227.224.109	15169 (GOOGLE) (GOOGLE)
1	35.186.223.76 35.186.223.76	15169 (GOOGLE) (GOOGLE)
1	130.211.47.17 130.211.47.17	15169 (GOOGLE) (GOOGLE)
1	35.176.195.187 35.176.195.187	16509 (AMAZON-02) (AMAZON-02)
1 1	54.237.151.241 54.237.151.241	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:1f18:444... 2600:1f18:444a:4680:5b76:7408:bdd4:1592	14618 (AMAZON-AES) (AMAZON-AES)
1	34.117.4.53 34.117.4.53	15169 (GOOGLE) (GOOGLE)
1	34.107.221.36 34.107.221.36	15169 (GOOGLE) (GOOGLE)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
208	74

1 3.226.166.212 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-226-166-212.compute-1.amazonaws.com

sailthru.perkspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 23.96.203.178 (Chicago, United States) 2 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

email.perkspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
jacobs.perkspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:f349 (United States)

ASN13335 (CLOUDFLARENET, US)

hello.myfonts.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:48::45 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

psprods3ep.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.102.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-102-19.zrh50.r.cloudfront.net

ak.sail-horizon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.194.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-217.fra2.r.cloudfront.net

cdn.rollbar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:400c:c08::9a (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.102.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-102-111.zrh50.r.cloudfront.net

cdn.heapanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 104.18.72.113 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

assets.zendesk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.zdassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.202.102.177 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-102-177.compute-1.amazonaws.com

heapanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.70.113 (United States)

ASN13335 (CLOUDFLARENET, US)

ekr.zdassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.69.106.212 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.16.51.111 (United States)

ASN13335 (CLOUDFLARENET, US)

perkspot.zendesk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
penrosehill.zendesk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 89.207.16.72 (United States) 3 redirects

ASN41041 (VCLK-EU-SE, US)

www.anrdoezrs.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cj.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.emjcd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700:10::ac43:1a84 (United States)

ASN13335 (CLOUDFLARENET, US)

page.firstleaf.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.firstleaf.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.firstleaf.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ct.firstleaf.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.244.137.202 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 202.137.244.35.bc.googleusercontent.com

g.fastcdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:4200:b:dc44:3680:21 (United States)

ASN16509 (AMAZON-02, US)

d1hdjv7b05hja2.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.232.231 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-232-231.deploy.static.akamaitechnologies.com

cloud.typography.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 192.229.133.208 (United States)

ASN15133 (EDGECAST, US)

v.fastcdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.222.120.150 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 150.120.222.35.bc.googleusercontent.com

heatmap-events-collector.instapage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
anthill.instapage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ec.instapagemetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5e41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.27.38 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 38.27.120.34.bc.googleusercontent.com

cdn.instapagemetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.13.140 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.196.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-196-60.fra2.r.cloudfront.net

init.blackcrow.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.102.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-102-6.zrh50.r.cloudfront.net

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.206.179.19 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-206-179-19.compute-1.amazonaws.com

trkn.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.102.20 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-102-20.zrh50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 159.203.152.67 (New York, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

rbv9j7km.firstleaf.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.12.200.117 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-12-200-117.us-east-2.compute.amazonaws.com

collector-7547.tvsquared.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.36.21 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: any-in-2415.1e100.net

jelly.mdhv.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.87.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-11.fra2.r.cloudfront.net

cdn.datasteam.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:21f3:2600:17:3f5c:f800:21 (United States)

ASN16509 (AMAZON-02, US)

d2hrivdxn8ekm8.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.87.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-19.fra2.r.cloudfront.net

cdn1-res.sundaysky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.205.8.225 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-8-225.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:a00:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.112.186 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 186.112.201.35.bc.googleusercontent.com

edge.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.239.203 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-239-203.deploy.static.akamaitechnologies.com

aa.trkn.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.172.228.26 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

stdomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:1600:a:b27c:d040:93a1 (United States)

ASN16509 (AMAZON-02, US)

ext.chtbl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.253.250 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 250.253.120.34.bc.googleusercontent.com

tag.wknd.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.102.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-102-122.zrh50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.186.226.184 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 184.226.186.35.bc.googleusercontent.com

tr.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.102.36 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-102-36.zrh50.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.237.157.181 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-237-157-181.compute-1.amazonaws.com

s-vop.sundaysky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b110:c4cb:f288:bc78:c53b (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.206.124.188 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-124-188.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:21f3:6000:0:cc59:3900:93a1 (United States)

ASN16509 (AMAZON-02, US)

web.chtbl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.72.95 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 95.72.98.34.bc.googleusercontent.com

assets.bounceexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.89.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-89-92.zrh50.r.cloudfront.net

dvqigh9b7wa32.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:1600:3:760:2800:21 (United States)

ASN16509 (AMAZON-02, US)

d330aiyvva2oww.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:3400:17:f683:1d40:21 (United States)

ASN16509 (AMAZON-02, US)

d1lu3pmaz2ilpx.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.186.194.58 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 58.194.186.35.bc.googleusercontent.com

rs.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.213.211.223 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-211-223.compute-1.amazonaws.com

api.datasteam.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.203.40 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 40.203.227.35.bc.googleusercontent.com

data.cdnbasket.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.224.109 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 109.224.227.35.bc.googleusercontent.com

page.cdnbasket.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.223.76 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 76.223.186.35.bc.googleusercontent.com

view.cdnbasket.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 130.211.47.17 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 17.47.211.130.bc.googleusercontent.com

ids.cdnwidget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.176.195.187 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-176-195-187.eu-west-2.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.237.151.241 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-237-151-241.compute-1.amazonaws.com

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:444a:4680:5b76:7408:bdd4:1592 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

i6.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.4.53 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 53.4.117.34.bc.googleusercontent.com

api.bounceexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.221.36 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 36.221.107.34.bc.googleusercontent.com

e.cdnwidget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	zdassets.com static.zdassets.com ekr.zdassets.com	1 MB
23	fastcdn.co g.fastcdn.co v.fastcdn.co	3 MB
19	perkspot.com 3 redirects sailthru.perkspot.com email.perkspot.com jacobs.perkspot.com	791 KB
13	firstleaf.club page.firstleaf.club www.firstleaf.club rbv9j7km.firstleaf.club images.firstleaf.club ct.firstleaf.club fbapi.firstleaf.club Failed	258 KB
9	google-analytics.com www.google-analytics.com	83 KB
8	zendesk.com 1 redirects assets.zendesk.com perkspot.zendesk.com penrosehill.zendesk.com	5 KB
6	fullstory.com edge.fullstory.com rs.fullstory.com	190 KB
6	cloudfront.net d1hdjv7b05hja2.cloudfront.net d2hrivdxn8ekm8.cloudfront.net dvqigh9b7wa32.cloudfront.net d330aiyvva2oww.cloudfront.net d1lu3pmaz2ilpx.cloudfront.net	13 KB
5	chtbl.com ext.chtbl.com web.chtbl.com	5 KB
5	liadm.com 2 redirects b-code.liadm.com rp.liadm.com rp4.liadm.com i.liadm.com i6.liadm.com	12 KB
5	sundaysky.com 2 redirects cdn1-res.sundaysky.com s-vop.sundaysky.com	6 KB
5	heapanalytics.com cdn.heapanalytics.com heapanalytics.com	44 KB
5	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net	18 KB
4	stackadapt.com tags.srv.stackadapt.com	6 KB
4	datasteam.io cdn.datasteam.io api.datasteam.io	25 KB
4	azureedge.net psprods3ep.azureedge.net	25 KB
3	cdnbasket.net data.cdnbasket.net page.cdnbasket.net view.cdnbasket.net	1 KB
3	bounceexchange.com assets.bounceexchange.com api.bounceexchange.com	145 KB
3	snapchat.com tr.snapchat.com	434 B
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	63 KB
3	trkn.us 1 redirects trkn.us aa.trkn.us	1 KB
3	bing.com bat.bing.com	9 KB
3	instapagemetrics.com cdn.instapagemetrics.com ec.instapagemetrics.com	23 KB
3	google.de www.google.de	278 B
3	google.com 1 redirects www.google.com	302 B
3	googletagmanager.com www.googletagmanager.com	164 KB
2	cdnwidget.com ids.cdnwidget.com e.cdnwidget.com	238 B
2	facebook.com www.facebook.com	238 B
2	facebook.net connect.facebook.net	99 KB
2	tvsquared.com collector-7547.tvsquared.com	9 KB
2	instapage.com heatmap-events-collector.instapage.com anthill.instapage.com	9 KB
2	visualstudio.com dc.services.visualstudio.com	213 B
1	twitter.com analytics.twitter.com	658 B
1	agkn.com aa.agkn.com	392 B
1	t.co t.co	455 B
1	reddit.com alb.reddit.com	125 B
1	wknd.ai tag.wknd.ai	5 KB
1	gstatic.com fonts.gstatic.com	19 KB
1	stdomi.com stdomi.com	202 B
1	mdhv.io jelly.mdhv.io	235 B
1	taboola.com cdn.taboola.com	25 KB
1	sc-static.net sc-static.net	6 KB
1	blackcrow.ai init.blackcrow.ai	385 B
1	redditstatic.com www.redditstatic.com	7 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	cloudflareinsights.com static.cloudflareinsights.com	5 KB
1	typography.com 1 redirects cloud.typography.com	438 B
1	googleapis.com fonts.googleapis.com	574 B
1	emjcd.com 1 redirects www.emjcd.com	1 KB
1	dotomi.com 1 redirects cj.dotomi.com	1 KB
1	anrdoezrs.net 1 redirects www.anrdoezrs.net	617 B
1	googleadservices.com www.googleadservices.com	14 KB
1	msecnd.net az416426.vo.msecnd.net	39 KB
1	rollbar.com cdn.rollbar.com	23 KB
1	sail-horizon.com ak.sail-horizon.com	43 KB
1	myfonts.net hello.myfonts.net	154 B
208	56

	Domain	Requested by
30	static.zdassets.com	jacobs.perkspot.com assets.zendesk.com static.zdassets.com www.googletagmanager.com page.firstleaf.club
18	v.fastcdn.co	page.firstleaf.club
17	jacobs.perkspot.com	1 redirects jacobs.perkspot.com
9	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com jacobs.perkspot.com page.firstleaf.club
5	rbv9j7km.firstleaf.club	jacobs.perkspot.com rbv9j7km.firstleaf.club page.firstleaf.club
5	g.fastcdn.co	page.firstleaf.club
4	penrosehill.zendesk.com	static.zdassets.com
4	web.chtbl.com	ext.chtbl.com
4	s-vop.sundaysky.com	2 redirects page.firstleaf.club
4	tags.srv.stackadapt.com	jacobs.perkspot.com tags.srv.stackadapt.com
4	page.firstleaf.club	jacobs.perkspot.com page.firstleaf.club static.cloudflareinsights.com
4	heapanalytics.com	jacobs.perkspot.com
4	stats.g.doubleclick.net	1 redirects jacobs.perkspot.com az416426.vo.msecnd.net www.google-analytics.com
4	psprods3ep.azureedge.net	jacobs.perkspot.com
3	api.datasteam.io	cdn.datasteam.io
3	rs.fullstory.com	edge.fullstory.com
3	tr.snapchat.com	page.firstleaf.club
3	edge.fullstory.com	jacobs.perkspot.com edge.fullstory.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com page.firstleaf.club
3	perkspot.zendesk.com	assets.zendesk.com static.zdassets.com
3	ekr.zdassets.com	assets.zendesk.com static.zdassets.com
3	www.google.de	jacobs.perkspot.com
3	www.google.com	1 redirects jacobs.perkspot.com
3	www.googletagmanager.com	jacobs.perkspot.com www.googletagmanager.com page.firstleaf.club
2	ec.instapagemetrics.com	cdn.instapagemetrics.com
2	assets.bounceexchange.com	tag.wknd.ai assets.bounceexchange.com
2	www.facebook.com	page.firstleaf.club
2	ct.firstleaf.club	images.firstleaf.club
2	connect.facebook.net	jacobs.perkspot.com connect.facebook.net
2	d2hrivdxn8ekm8.cloudfront.net	jacobs.perkspot.com d2hrivdxn8ekm8.cloudfront.net
2	collector-7547.tvsquared.com	jacobs.perkspot.com page.firstleaf.club
2	trkn.us	1 redirects page.firstleaf.club
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
1	analytics.twitter.com	static.ads-twitter.com
1	e.cdnwidget.com	page.firstleaf.club
1	api.bounceexchange.com	assets.bounceexchange.com
1	i6.liadm.com	page.firstleaf.club
1	i.liadm.com	1 redirects
1	aa.agkn.com	cdn.datasteam.io
1	ids.cdnwidget.com	assets.bounceexchange.com
1	view.cdnbasket.net	assets.bounceexchange.com
1	page.cdnbasket.net	assets.bounceexchange.com
1	data.cdnbasket.net	assets.bounceexchange.com
1	d1lu3pmaz2ilpx.cloudfront.net	d2hrivdxn8ekm8.cloudfront.net
1	d330aiyvva2oww.cloudfront.net	d2hrivdxn8ekm8.cloudfront.net
1	dvqigh9b7wa32.cloudfront.net	d2hrivdxn8ekm8.cloudfront.net
1	rp4.liadm.com	page.firstleaf.club
1	rp.liadm.com	1 redirects
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	t.co	page.firstleaf.club
1	alb.reddit.com	page.firstleaf.club
1	tag.wknd.ai	jacobs.perkspot.com
1	anthill.instapage.com	page.firstleaf.club
1	ext.chtbl.com	jacobs.perkspot.com
1	fonts.gstatic.com	fonts.googleapis.com
1	stdomi.com	page.firstleaf.club
1	aa.trkn.us	jacobs.perkspot.com
1	b-code.liadm.com	www.googletagmanager.com
1	cdn1-res.sundaysky.com	www.googletagmanager.com
1	images.firstleaf.club	jacobs.perkspot.com
1	cdn.datasteam.io	www.googletagmanager.com
1	jelly.mdhv.io	page.firstleaf.club
1	cdn.taboola.com	jacobs.perkspot.com
1	static.hotjar.com	jacobs.perkspot.com
1	sc-static.net	www.googletagmanager.com
1	init.blackcrow.ai	www.googletagmanager.com
1	www.redditstatic.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	cdn.instapagemetrics.com	page.firstleaf.club
1	static.cloudflareinsights.com	page.firstleaf.club
1	heatmap-events-collector.instapage.com	page.firstleaf.club
1	www.firstleaf.club	page.firstleaf.club
1	cloud.typography.com	1 redirects
1	d1hdjv7b05hja2.cloudfront.net	page.firstleaf.club
1	fonts.googleapis.com	page.firstleaf.club
1	www.emjcd.com	1 redirects
1	cj.dotomi.com	1 redirects
1	www.anrdoezrs.net	1 redirects
1	assets.zendesk.com	1 redirects
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	az416426.vo.msecnd.net	jacobs.perkspot.com
1	cdn.heapanalytics.com	jacobs.perkspot.com
1	cdn.rollbar.com	jacobs.perkspot.com
1	ak.sail-horizon.com	jacobs.perkspot.com
1	hello.myfonts.net	jacobs.perkspot.com
1	email.perkspot.com	1 redirects
1	sailthru.perkspot.com	1 redirects
0	fbapi.firstleaf.club Failed	connect.facebook.net
208	90

This site contains links to these domains. Also see Links.

Domain
www.firstleaf.club
firstleaf.club

Subject Issuer	Validity	Valid
*.perkspot.com Go Daddy Secure Certificate Authority - G2	`2021-07-22` - `2022-08-02`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-10` - `2022-07-09`	a year	crt.sh
*.azureedge.net Microsoft Azure TLS Issuing CA 02	`2021-08-21` - `2022-08-16`	a year	crt.sh
ak.sail-horizon.com Amazon	`2021-01-07` - `2022-02-04`	a year	crt.sh
cdn.rollbar.com Amazon	`2021-07-11` - `2022-08-09`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
cdn.heapanalytics.com Amazon	`2020-09-24` - `2021-10-26`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
sni1e6ffgl.wpc.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
www.google.de GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
ssl1036557.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2021-07-08` - `2022-07-07`	a year	crt.sh
heapanalytics.com Amazon	`2020-12-24` - `2022-01-22`	a year	crt.sh
in.applicationinsights.azure.com Microsoft RSA TLS CA 01	`2021-07-22` - `2022-07-22`	a year	crt.sh
perkspot.zendesk.com Cloudflare Inc ECC CA-3	`2021-06-16` - `2022-06-15`	a year	crt.sh
g.fastcdn.co GTS CA 1D4	`2021-06-29` - `2021-09-27`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
v.fastcdn.co DigiCert TLS RSA SHA256 2020 CA1	`2021-05-11` - `2022-05-16`	a year	crt.sh
heatmap-events-collector.instapage.com R3	`2021-06-26` - `2021-09-24`	3 months	crt.sh
cdn.instapagemetrics.com GTS CA 1D4	`2021-06-29` - `2021-09-27`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2021-07-06` - `2022-01-06`	6 months	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
www.redditstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2021-05-23` - `2021-11-18`	6 months	crt.sh
*.blackcrow.ai Amazon	`2021-01-20` - `2022-02-18`	a year	crt.sh
sc-static.net DigiCert TLS RSA SHA256 2020 CA1	`2021-02-11` - `2022-02-15`	a year	crt.sh
trkn.us Go Daddy Secure Certificate Authority - G2	`2021-01-19` - `2022-02-20`	a year	crt.sh
*.hotjar.com Amazon	`2020-12-25` - `2022-01-23`	a year	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-25` - `2021-12-26`	a year	crt.sh
rbv9j7km.firstleaf.club R3	`2021-07-24` - `2021-10-22`	3 months	crt.sh
*.tvsquared.com Amazon	`2020-10-16` - `2021-11-14`	a year	crt.sh
jelly.mdhv.io GTS CA 1D4	`2021-06-30` - `2021-09-28`	3 months	crt.sh
cdn.datasteam.io Amazon	`2020-11-19` - `2021-12-18`	a year	crt.sh
*.sundaysky.com DigiCert TLS RSA SHA256 2020 CA1	`2021-05-26` - `2022-06-26`	a year	crt.sh
*.srv.stackadapt.com Amazon	`2020-12-09` - `2022-01-07`	a year	crt.sh
*.liadm.com Amazon	`2021-03-02` - `2022-03-31`	a year	crt.sh
edge.fullstory.com GTS CA 1D4	`2021-08-22` - `2021-11-20`	3 months	crt.sh
cert1.a1.atm.aqfer.net R3	`2021-07-26` - `2021-10-24`	3 months	crt.sh
www.stdomi.com Sectigo RSA Domain Validation Secure Server CA	`2020-11-09` - `2021-11-14`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
ext.chtbl.com Amazon	`2021-01-25` - `2022-02-22`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-20` - `2021-10-18`	3 months	crt.sh
anthill.instapage.com R3	`2021-07-12` - `2021-10-10`	3 months	crt.sh
tag.wknd.ai R3	`2021-07-26` - `2021-10-24`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2021-05-23` - `2021-11-18`	6 months	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
tr.snapchat.com DigiCert TLS RSA SHA256 2020 CA1	`2021-01-19` - `2022-01-23`	a year	crt.sh
web.chtbl.com Amazon	`2021-02-28` - `2022-03-29`	a year	crt.sh
assets.bounceexchange.com GTS CA 1D4	`2021-06-30` - `2021-09-28`	3 months	crt.sh
*.fullstory.com R3	`2021-07-27` - `2021-10-25`	3 months	crt.sh
penrosehill.zendesk.com Cloudflare Inc ECC CA-3	`2021-06-16` - `2022-06-15`	a year	crt.sh
*.datasteam.io Amazon	`2021-07-31` - `2022-08-29`	a year	crt.sh
*.cdnbasket.net Go Daddy Secure Certificate Authority - G2	`2020-07-29` - `2021-09-27`	a year	crt.sh
ids.cdnwidget.com GTS CA 1D4	`2021-06-29` - `2021-09-27`	3 months	crt.sh
*.agkn.com RapidSSL RSA CA 2018	`2020-07-25` - `2022-09-18`	2 years	crt.sh
*.wunderkind.co R3	`2021-08-16` - `2021-11-14`	3 months	crt.sh
e.cdnwidget.com GTS CA 1D4	`2021-06-28` - `2021-09-26`	3 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
ec.instapagemetrics.com R3	`2021-08-17` - `2021-11-15`	3 months	crt.sh

This page contains 10 frames:

Primary Page: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Frame ID: 7E1BF1347C2CDD1D5BFA7E98076B4D4B
Requests: 172 HTTP requests in this frame

Frame: https://static.zdassets.com/ekr/asset_composer.js
Frame ID: 49EAC18BB0C1CF3F89040872EAF76437
Requests: 3 HTTP requests in this frame

Frame: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Frame ID: 80C3C64CDBE095B4B3B9BC65C34DCE08
Requests: 12 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=c20b9c7f-d0c3-4f4d-94a3-2a2c5fad8834
Frame ID: E7A4D6C2B5DBC9BCF697C9189887825E
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-25a418976ea02a6f393fbbe77cec94bb.html
Frame ID: E3B8C4A74D210472F3C36554BE0CB53A
Requests: 1 HTTP requests in this frame

Frame: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Frame ID: 460BC5A5D63EB5C0B3F3B1733B8A7566
Requests: 10 HTTP requests in this frame

Frame: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Frame ID: A732443FF5187B4B4168F54CB6F564F1
Requests: 10 HTTP requests in this frame

Frame: https://assets.bounceexchange.com/assets/bounce/local_storage_frame16.min.html
Frame ID: 8CD823AC154B7DADFDB2D3E49A7B3EE4
Requests: 1 HTTP requests in this frame

Frame: https://edge.fullstory.com/s/fs.js
Frame ID: C05949FFEC443B22A2247A60BDD5B38F
Requests: 1 HTTP requests in this frame

Frame: https://edge.fullstory.com/s/fs.js
Frame ID: 7A893039E07C1D2BE4E0600FF2CEDE58
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Buying Award-Winning Wine Is Simple With Firstleaf

Page URL History Show full URLs

https://sailthru.perkspot.com/click/24831941.9083437/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZ... HTTP 302
https://email.perkspot.com/e/v3/click/offer/1420262?merchantName=FirstleafWineClub&assetType=Small&cmpn... HTTP 302
https://jacobs.perkspot.com/auth/email?sid=fde50262-b02b-4d72-a5d2-4e00cb680328&auth=62159646368ee68e048... HTTP 302
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast Page URL
https://www.anrdoezrs.net/click-2097062-13552845?&sid=PEJ3Q6TIIVT5BHL32 HTTP 302
https://cj.dotomi.com/o2115dlutB/lsx/ACEEBHDE/B9IG9FB/9/9/9?t=mA0v%3DhWbLiOlaanlNTZdLK%3c%3czBB7A%... HTTP 302
https://www.emjcd.com/ro80tenm6/elq/35774A67/42B9284/2/6229264A688764949B:8LNeNVkpFyOM/4282378426h... HTTP 302
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=185077... Page URL

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Google Analytics Enhanced eCommerce (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

208
Requests

99 %
HTTPS

33 %
IPv6

56
Domains

90
Subdomains

74
IPs

5
Countries

6731 kB
Transfer

17689 kB
Size

1
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.firstleaf.club/quiz/1/
Title: Discount will be applied for $40 off your first order plus free shipping!

Search URL Search Domain Scan URL

URL: https://firstleaf.club/quiz/2?tests=atf-creative-control&utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512&color=100
Title: Red

Search URL Search Domain Scan URL

URL: https://firstleaf.club/quiz/1?tests=atf-creative-control&utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Title: A mix

Search URL Search Domain Scan URL

URL: https://www.firstleaf.club/
Title: Firstleaf

Search URL Search Domain Scan URL

URL: https://www.firstleaf.club/terms
Title: TERMS AND CONDITIONS

Search URL Search Domain Scan URL

URL: https://www.firstleaf.club/privacy
Title: PRIVACY POLICY

Search URL Search Domain Scan URL

URL: https://www.firstleaf.club/quiz/1/?tests=atf-creative-control&utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sailthru.perkspot.com/click/24831941.9083437/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xNDIwMjYyP21lcmNoYW50TmFtZT1GaXJzdGxlYWZXaW5lQ2x1YiZhc3NldFR5cGU9U21hbGwmY21wbmlkPTEyNiZwcD0xMSZwdD1zc3MmYXQ9cyZhcD0yJnBrPTExJmR0PXMmYW89MTQyMDI2MiYxPTEvJmVtYWlsPXNoYW5pc2Vfd2lsbGlhbXMlNDBqYWJpbC5jb20mZW1haWxCbGFzdElkPTI0ODMxOTQxJmVudGl0eUVtYWlsVHlwZUNvZGU9d2Vla2x5Ymxhc3QmdXNlcklkPTIzOTUzNDE1JmNvbW11bml0eWlkPTE5NiZhdXRoPTAyYzg0ZWUzOWQ3MTA2MjRhOWYxM2Q2YWM5YjUzODY1JmNvbW11bml0eW5hbWU9SmFjb2JzJnJlY29tbWlkPSZtc2dpZD0yNDgzMTk0MS45MDgzNDM3/61084837a319dd2d0a1f292dCe367e6a6 HTTP 302
https://email.perkspot.com/e/v3/click/offer/1420262?merchantName=FirstleafWineClub&assetType=Small&cmpnid=126&pp=11&pt=sss&at=s&ap=2&pk=11&dt=s&ao=1420262&1=1/&email=shanise_williams%40jabil.com&emailBlastId=24831941&entityEmailTypeCode=weeklyblast&userId=23953415&communityid=196&auth=02c84ee39d710624a9f13d6ac9b53865&communityname=Jacobs&recommid=&msgid=24831941.9083437 HTTP 302
https://jacobs.perkspot.com/auth/email?sid=fde50262-b02b-4d72-a5d2-4e00cb680328&auth=62159646368ee68e0481881e10689a3e&redirectUrl=%2foffer%2f1420262%2fnone%3futm_medium%3demail%26utm_id%3dweeklyblast&furtherRedirect= HTTP 302
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast Page URL
https://www.anrdoezrs.net/click-2097062-13552845?&sid=PEJ3Q6TIIVT5BHL32 HTTP 302
https://cj.dotomi.com/o2115dlutB/lsx/ACEEBHDE/B9IG9FB/9/9/9?t=mA0v%3DhWbLiOlaanlNTZdLK%3c%3czBB7A%3A%2F%2FEEE.s59v6wH9A.5wB%3AQI%2Fu30u2-KIRPIOK-JLNNKQMN%3c%3cY%3czBB7A%3A%2F%2F1su6tA.7w92A76B.u64%2F%3c%3cJ%3cJ%3cI%3cI%3c HTTP 302
https://www.emjcd.com/ro80tenm6/elq/35774A67/42B9284/2/6229264A688764949B:8LNeNVkpFyOM/4282378426h933geA5gh25Ae2c3A2734?s=a7xs%3DeTYIfLiXXkiKQWaIH%3cry3!CH4E-A9tsuys%3cw8847%3A%2F%2FBBB.p26s3tE67.2t8%3ANF%2Fr0xrz-HFOMFLH-GIKKHNJK%3c%3cV%3cw8847%3A%2F%2Fypr3q7.4t6z7438.r31%2F%3cGHGJrJFu-JJtu-JNMJ-pruH-tFNtOFLqIJNM%3cG%3cG%3cF%3cF%3c HTTP 302
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://sailthru.perkspot.com/click/24831941.9083437/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xNDIwMjYyP21lcmNoYW50TmFtZT1GaXJzdGxlYWZXaW5lQ2x1YiZhc3NldFR5cGU9U21hbGwmY21wbmlkPTEyNiZwcD0xMSZwdD1zc3MmYXQ9cyZhcD0yJnBrPTExJmR0PXMmYW89MTQyMDI2MiYxPTEvJmVtYWlsPXNoYW5pc2Vfd2lsbGlhbXMlNDBqYWJpbC5jb20mZW1haWxCbGFzdElkPTI0ODMxOTQxJmVudGl0eUVtYWlsVHlwZUNvZGU9d2Vla2x5Ymxhc3QmdXNlcklkPTIzOTUzNDE1JmNvbW11bml0eWlkPTE5NiZhdXRoPTAyYzg0ZWUzOWQ3MTA2MjRhOWYxM2Q2YWM5YjUzODY1JmNvbW11bml0eW5hbWU9SmFjb2JzJnJlY29tbWlkPSZtc2dpZD0yNDgzMTk0MS45MDgzNDM3/61084837a319dd2d0a1f292dCe367e6a6 HTTP 302
https://email.perkspot.com/e/v3/click/offer/1420262?merchantName=FirstleafWineClub&assetType=Small&cmpnid=126&pp=11&pt=sss&at=s&ap=2&pk=11&dt=s&ao=1420262&1=1/&email=shanise_williams%40jabil.com&emailBlastId=24831941&entityEmailTypeCode=weeklyblast&userId=23953415&communityid=196&auth=02c84ee39d710624a9f13d6ac9b53865&communityname=Jacobs&recommid=&msgid=24831941.9083437 HTTP 302
https://jacobs.perkspot.com/auth/email?sid=fde50262-b02b-4d72-a5d2-4e00cb680328&auth=62159646368ee68e0481881e10689a3e&redirectUrl=%2foffer%2f1420262%2fnone%3futm_medium%3demail%26utm_id%3dweeklyblast&furtherRedirect= HTTP 302
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Request Chain 25

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1585591459&utmhn=jacobs.perkspot.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&utmhid=674208957&utmr=-&utmp=%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&utmht=1629821995632&utmac=UA-652375-6&utmcc=__utma%3D64858676.931040915.1629821996.1629821996.1629821996.1%3B%2B__utmz%3D64858676.1629821996.1.1.utmcid%3Dweeklyblast%7Cutmccn%3D(not%2520set)%7Cutmcmd%3Demail%3B&utmjid=660956266&utmredir=3&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=931040915.1629821996&jid=660956266&_v=5.7.2dc&z=1585591459 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=931040915.1629821996&jid=660956266&_v=5.7.2dc&z=1585591459&slf_rd=1&random=3476021566

Request Chain 40

https://assets.zendesk.com/embeddable_framework/main.js HTTP 301
https://static.zdassets.com/ekr/asset_composer.js

Request Chain 70

https://cloud.typography.com/7410416/6307592/css/fonts.css HTTP 302
https://www.firstleaf.club/fonts/687751/007ADF49EA9D333D0.css

Request Chain 90

https://trkn.us/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=216706079 HTTP 302
https://trkn.us/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=216706079;ip=194.99.105.101;cuidchk=1

Request Chain 148

https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&cb=200227166&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&udt.segment=visitor HTTP 302
https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&cb=200227166&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&udt.segment=visitor&_cvt=t&timestamp=1629822002303&nonce=1ntein97kuj2qmjofe14sp6hg2&signature=0ace4c616a6ef80973b5067a39dd1f1c73d2d2e5

Request Chain 149

https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&cb=1383746124&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&udt.segment=visitor HTTP 302
https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&cb=1383746124&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&udt.segment=visitor&_cvt=t&timestamp=1629822002378&nonce=p67d9368jpu0ragmkol4rmgsi6&signature=53862a5435e085bc271b799bae1bd847aee3a53c

Request Chain 152

https://rp.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&refr=https%3A%2F%2Fjacobs.perkspot.com%2F&duid=a0b8fe163af0--01fdwfc8d16nemsap8sncqpvyw&se=e30&dtstmp=1629822001722 HTTP 302
https://rp4.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&refr=https%3A%2F%2Fjacobs.perkspot.com%2F&duid=a0b8fe163af0--01fdwfc8d16nemsap8sncqpvyw&se=e30&dtstmp=1629822001722&i6=MmEwMTo0Zjg6MTkyOjU0MTQ6OjI%3D&n3pc=true

Request Chain 202

https://i.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-588EEC63-3448-41AE-8985-AC4EBD18D2E1 HTTP 303
https://i6.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-588EEC63-3448-41AE-8985-AC4EBD18D2E1

208 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set none Show response
jacobs.perkspot.com/offer/1420262/
Redirect Chain

https://sailthru.perkspot.com/click/24831941.9083437/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xNDIwMjYyP21lcmNoYW50TmFtZT1GaXJzdGxlYWZXaW5lQ2x1YiZhc3NldFR5cGU9U21hbGwmY21wbmlkPTEy...
https://email.perkspot.com/e/v3/click/offer/1420262?merchantName=FirstleafWineClub&assetType=Small&cmpnid=126&pp=11&pt=sss&at=s&ap=2&pk=11&dt=s&ao=1420262&1=1/&email=shanise_williams%40jabil.com&em...
https://jacobs.perkspot.com/auth/email?sid=fde50262-b02b-4d72-a5d2-4e00cb680328&auth=62159646368ee68e0481881e10689a3e&redirectUrl=%2foffer%2f1420262%2fnone%3futm_medium%3demail%26utm_id%3dweeklybla...
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

59 KB
20 KB

680ms
680ms

Document
text/html

23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

d358bee9f01dc4b30c08363249d150e71b02738bff6b8258ba121c37b06313e3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Host: jacobs.perkspot.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: TiPMix=86.4834533941389; x-ms-routing-name=self; PerkSpot4=828595BB25DA6A38A34F6E3C60A4C9A04C9FED52CE868F6787D5A83F2D2D95C538681739264CD2B133B79F508786CE66AAD5064844808774DC7453D1B6FF5D7742640B11F695E21C3ACB94B9D74EA0936489FD9D301E15C1A86B776ECB9611B17367D68E52FFE1252574C3DEDA5B543AD17812DEAEC6E8E5F894A6D32182CAB6AE72D0FD4D1461BB07C0024D49E72F31B88497C53A7DB5109776B9C90B8892B87DF80E2D2CB6A981A065CE3FAEA85B712EEBBD05204C73A051387A912692FE30; SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; ARRAffinity=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1; ARRAffinitySameSite=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Cache-Control: private
Content-Length: 19232
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Set-Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; expires=Tue, 24-Aug-2021 16:39:54 GMT; path=/; secure; HttpOnly ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; expires=Tue, 24-Aug-2021 16:39:54 GMT; path=/; secure; HttpOnly SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; expires=Tue, 24-Aug-2021 16:39:54 GMT; path=/; secure; HttpOnly ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; expires=Tue, 24-Aug-2021 16:39:54 GMT; path=/; secure; HttpOnly
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
X-Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Security-Policy: frame-ancestors *.perkspot.com
Date: Tue, 24 Aug 2021 16:19:54 GMT

Redirect headers

Cache-Control: private
Content-Length: 203
Content-Type: text/html; charset=utf-8
Location: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Set-Cookie: TiPMix=86.4834533941389; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure PerkSpot4=828595BB25DA6A38A34F6E3C60A4C9A04C9FED52CE868F6787D5A83F2D2D95C538681739264CD2B133B79F508786CE66AAD5064844808774DC7453D1B6FF5D7742640B11F695E21C3ACB94B9D74EA0936489FD9D301E15C1A86B776ECB9611B17367D68E52FFE1252574C3DEDA5B543AD17812DEAEC6E8E5F894A6D32182CAB6AE72D0FD4D1461BB07C0024D49E72F31B88497C53A7DB5109776B9C90B8892B87DF80E2D2CB6A981A065CE3FAEA85B712EEBBD05204C73A051387A912692FE30; domain=.perkspot.com; path=/ SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; expires=Tue, 24-Aug-2021 16:39:53 GMT; path=/; secure; HttpOnly ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; expires=Tue, 24-Aug-2021 16:39:53 GMT; path=/; secure; HttpOnly ARRAffinity=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
X-Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Security-Policy: frame-ancestors *.perkspot.com
Date: Tue, 24 Aug 2021 16:19:53 GMT

GET
H2 200 2b1ecf
hello.myfonts.net/count/ 0
154 B 38ms
20ms Stylesheet
text/css 2606:4700::6811:f349
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hello.myfonts.net/count/2b1ecf
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:f349 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:54 GMT
server: cloudflare
age: 1
expect-ct: null
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 683de7ab5a9d1756-FRA
content-length: 0
expires: Wed, 24 Aug 2022 16:19:54 GMT

GET
H/1.1 200
OK core
jacobs.perkspot.com/Content/css/ 198 KB
54 KB 305ms
159ms Stylesheet
text/css 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/Content/css/core?v=21.8.28093.1

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

94c6483dadce933e499cc7f0a7cbd22d2565bbaf160f19086d55bd2e2df69f7b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Cookie: TiPMix=86.4834533941389; x-ms-routing-name=self; PerkSpot4=828595BB25DA6A38A34F6E3C60A4C9A04C9FED52CE868F6787D5A83F2D2D95C538681739264CD2B133B79F508786CE66AAD5064844808774DC7453D1B6FF5D7742640B11F695E21C3ACB94B9D74EA0936489FD9D301E15C1A86B776ECB9611B17367D68E52FFE1252574C3DEDA5B543AD17812DEAEC6E8E5F894A6D32182CAB6AE72D0FD4D1461BB07C0024D49E72F31B88497C53A7DB5109776B9C90B8892B87DF80E2D2CB6A981A065CE3FAEA85B712EEBBD05204C73A051387A912692FE30; SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; ARRAffinity=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1; ARRAffinitySameSite=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1
Connection: keep-alive
Referer: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 24 Aug 2021 16:19:54 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Expires: -1
Cache-Control: no-cache
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 55078
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK perxcss.css
jacobs.perkspot.com/Content/sass/ 481 KB
53 KB 598ms
152ms Stylesheet
text/css 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e14b6036972fd446c62212fe39351614667c28fa0de47e41e836b45d35ee6366

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Cookie: TiPMix=86.4834533941389; x-ms-routing-name=self; PerkSpot4=828595BB25DA6A38A34F6E3C60A4C9A04C9FED52CE868F6787D5A83F2D2D95C538681739264CD2B133B79F508786CE66AAD5064844808774DC7453D1B6FF5D7742640B11F695E21C3ACB94B9D74EA0936489FD9D301E15C1A86B776ECB9611B17367D68E52FFE1252574C3DEDA5B543AD17812DEAEC6E8E5F894A6D32182CAB6AE72D0FD4D1461BB07C0024D49E72F31B88497C53A7DB5109776B9C90B8892B87DF80E2D2CB6A981A065CE3FAEA85B712EEBBD05204C73A051387A912692FE30; SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; ARRAffinity=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1; ARRAffinitySameSite=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1
Connection: keep-alive
Referer: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Encoding: gzip
ETag: "8039e4e46598d71:0"
Last-Modified: Mon, 23 Aug 2021 21:29:03 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Date: Tue, 24 Aug 2021 16:19:55 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 54044
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK Cookie set community-css
jacobs.perkspot.com/ 49 KB
10 KB 655ms
201ms Stylesheet
text/css 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/community-css

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

c4a07a396ffa057bcc0ca3da5adb8ffc76619e7246b4d8d13b327427fa00709c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Cookie: TiPMix=86.4834533941389; x-ms-routing-name=self; PerkSpot4=828595BB25DA6A38A34F6E3C60A4C9A04C9FED52CE868F6787D5A83F2D2D95C538681739264CD2B133B79F508786CE66AAD5064844808774DC7453D1B6FF5D7742640B11F695E21C3ACB94B9D74EA0936489FD9D301E15C1A86B776ECB9611B17367D68E52FFE1252574C3DEDA5B543AD17812DEAEC6E8E5F894A6D32182CAB6AE72D0FD4D1461BB07C0024D49E72F31B88497C53A7DB5109776B9C90B8892B87DF80E2D2CB6A981A065CE3FAEA85B712EEBBD05204C73A051387A912692FE30; SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; ARRAffinity=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1; ARRAffinitySameSite=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1
Connection: keep-alive
Referer: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Encoding: gzip
Vary: Accept-Encoding
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: private
Date: Tue, 24 Aug 2021 16:19:55 GMT
Content-Disposition: attachment; filename=global.css
Set-Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; expires=Tue, 24-Aug-2021 16:39:55 GMT; path=/; secure; HttpOnly ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; expires=Tue, 24-Aug-2021 16:39:55 GMT; path=/; secure; HttpOnly
Content-Length: 9333
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK insights Show response
jacobs.perkspot.com/bundles/ 4 KB
3 KB 612ms
157ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/bundles/insights?v=BYC8KfJNNFadC6mBN8WA9SN_bH3bqkPFtSQg0hXgWI01

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

5efd1cdc9fe57d8ee4c5ee8839c2deb5a4c0a6f0eae362825bf0c94785c01632

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://jacobs.perkspot.com/
Cookie: TiPMix=86.4834533941389; x-ms-routing-name=self; PerkSpot4=828595BB25DA6A38A34F6E3C60A4C9A04C9FED52CE868F6787D5A83F2D2D95C538681739264CD2B133B79F508786CE66AAD5064844808774DC7453D1B6FF5D7742640B11F695E21C3ACB94B9D74EA0936489FD9D301E15C1A86B776ECB9611B17367D68E52FFE1252574C3DEDA5B543AD17812DEAEC6E8E5F894A6D32182CAB6AE72D0FD4D1461BB07C0024D49E72F31B88497C53A7DB5109776B9C90B8892B87DF80E2D2CB6A981A065CE3FAEA85B712EEBBD05204C73A051387A912692FE30; SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; ARRAffinity=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1; ARRAffinitySameSite=d74c4c142eaf3696a0fbe85514b26bd80fb28a344df8f49b6a6126abb83e23d1
Connection: keep-alive
Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:19:55 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 24 Aug 2021 16:19:55 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 24 Aug 2022 16:19:55 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 2610
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H2 200 logo_196.png
psprods3ep.azureedge.net/cdn.perkspot.com/images/communities/ 8 KB
9 KB 67ms
22ms Image
image/png 2620:1ec:48::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://psprods3ep.azureedge.net/cdn.perkspot.com/images/communities/logo_196.png
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:48::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8fd170635383b0c3166c17896a4b975f48d4d76d8f1a1d603d0481442f052d84

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-meta-createdby: not-implemented
date: Tue, 24 Aug 2021 16:19:55 GMT
x-amz-meta-uploader: S3StorageService
last-modified: Wed, 11 Nov 2020 00:55:59 GMT
server: AmazonS3
x-amz-request-id: 1HK7JMEQXTCT8AC2
etag: "9afdaf7aa9cb64c0e7084de27fff461c"
x-azure-ref: 0KxwlYQAAAADoOAi1WG82RLNQCKNiHVsZTE9OMjFFREdFMDIyMgA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
x-cache: TCP_HIT
content-type: image/png
cache-control: public, max-age=18000
accept-ranges: bytes
content-length: 8563
x-amz-id-2: ZmXVzh+vkR0+0xPeqbegLA1TCPwXy1PfPlFyAR578kicbaj/ypc/PxlCxyl+S2EA8xExx7/s8rw=

GET
H2 200 logo_44971.jpg
psprods3ep.azureedge.net/cdn.perkspot.com/images/merchants/ 16 KB
16 KB 67ms
23ms Image
image/jpeg 2620:1ec:48::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://psprods3ep.azureedge.net/cdn.perkspot.com/images/merchants/logo_44971.jpg
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:48::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7a58cec4842503db6949177b80ece47d5f5aba937676400675bfea596bc7492b

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-meta-createdby: not-implemented
date: Tue, 24 Aug 2021 16:19:55 GMT
x-amz-meta-uploader: api
last-modified: Thu, 16 Jul 2020 16:31:14 GMT
server: AmazonS3
x-amz-request-id: S3KMSPTKR8YY9A7B
etag: "eea31b3902773b178a36ba617964cafb"
x-azure-ref: 0KxwlYQAAAAAcJ37D78YQR52wqZqqbNk4TE9OMjFFREdFMDIyMgA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
x-cache: TCP_HIT
content-type: image/jpeg
cache-control: public, max-age=172800
accept-ranges: bytes
content-length: 16032
x-amz-id-2: z0dhUAVhII3pCJ3GPZtjc1k8fR+tLtrW6hipQxaGPebcLI1sL0XtRGCLVhwyrvEUqPfYuRt0pvg=

GET
H/1.1 200
OK Cookie set video.min.js Show response
jacobs.perkspot.com/Scripts/libraries/ 507 KB
141 KB 154ms
154ms Script
application/x-javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/Scripts/libraries/video.min.js

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

d9aeeae782fdde78411155839930b81c16fa4154002c1573462fa61806910409

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://jacobs.perkspot.com/
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262
Connection: keep-alive
Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Encoding: gzip
ETag: "0fdade66598d71:0"
Last-Modified: Mon, 23 Aug 2021 21:29:06 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: application/x-javascript
Date: Tue, 24 Aug 2021 16:19:55 GMT
Set-Cookie: TiPMix=38.2915108177306; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=22a7daa836b64a8ce56c907737553d08297ff2e76cd06a1f52c29956b9a85c17;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=22a7daa836b64a8ce56c907737553d08297ff2e76cd06a1f52c29956b9a85c17;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 143375
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK Cookie set video-js.min.css
jacobs.perkspot.com/Content/css/libraries/ 39 KB
11 KB 152ms
152ms Stylesheet
text/css 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/Content/css/libraries/video-js.min.css

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

fdf5dfab742b9d6c8c626174cd7e8899d2350d3ada34202ad6f3e87dadabb36c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://jacobs.perkspot.com/
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262
Connection: keep-alive
Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Encoding: gzip
ETag: "05710e96598d71:0"
Last-Modified: Mon, 23 Aug 2021 21:29:10 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Date: Tue, 24 Aug 2021 16:19:55 GMT
Set-Cookie: TiPMix=28.7839778833017; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=316e9038b96fd8455073cce422b826e7e338b02a5edae98480ec66624c5d9125;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=316e9038b96fd8455073cce422b826e7e338b02a5edae98480ec66624c5d9125;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 10275
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK Cookie set jquery Show response
jacobs.perkspot.com/bundles/ 823 KB
313 KB 181ms
179ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/bundles/jquery?v=3ipa0WhHW-L5DOvoOlXydtzjaB6j3dI5pZnH2Ri9bp01

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

8459ec0213bcf434156ac2e810c8ad3f800e2fadef7b41950c4399d0ed0c1e1e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://jacobs.perkspot.com/
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262
Connection: keep-alive
Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 24 Aug 2021 16:19:55 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 24 Aug 2022 16:19:55 GMT
Cache-Control: public
Transfer-Encoding: chunked
Set-Cookie: TiPMix=37.3974050103675; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=5c2f0a04eaf665015468e80170287bd43d0d86b3b30972eb2bd7c60c3fdca4a8;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=5c2f0a04eaf665015468e80170287bd43d0d86b3b30972eb2bd7c60c3fdca4a8;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Date: Tue, 24 Aug 2021 16:19:55 GMT
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK Cookie set jqueryval Show response
jacobs.perkspot.com/bundles/ 40 KB
16 KB 179ms
177ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/bundles/jqueryval?v=YzRBe6gfD164-CLYW2zoB8py-eOZPLHUgoPct44VgDo1

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

40f2d552c0db3ead874ec52bf624d9ec88007d8b659cd7189fecc3ff19d3d248

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://jacobs.perkspot.com/
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262
Connection: keep-alive
Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:19:55 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 24 Aug 2021 16:19:55 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 24 Aug 2022 16:19:55 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Set-Cookie: TiPMix=37.0616723490235; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=0f8925786185bc4eff5d40e1568b01cc989b4b01f30f956d7d05e5ca4919bec6;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=0f8925786185bc4eff5d40e1568b01cc989b4b01f30f956d7d05e5ca4919bec6;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Content-Length: 15663
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK Cookie set bootstrap Show response
jacobs.perkspot.com/bundles/ 41 KB
15 KB 180ms
177ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/bundles/bootstrap?v=7jtbseVPa_P_wxk-ANB0JbEiqz4vMc1fIXNwp0ieQEk1

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

60035f8d3292fc0b3155089baabc76fce2178f8d104ef606e4e31cbe0a2803b2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://jacobs.perkspot.com/
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262
Connection: keep-alive
Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:19:55 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 24 Aug 2021 16:19:55 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 24 Aug 2022 16:19:55 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Set-Cookie: TiPMix=77.0624584877223; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=bd0dfb948b4e67ff60a11cd6e169712e6848609ad034c4789ebdf993fcec41fb;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=bd0dfb948b4e67ff60a11cd6e169712e6848609ad034c4789ebdf993fcec41fb;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Content-Length: 14262
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK Cookie set modernizr Show response
jacobs.perkspot.com/bundles/ 11 KB
6 KB 439ms
152ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/bundles/modernizr?v=K-FFpFNtIXPUlQamnX3qHX_A5r7TM2xbAgcuEmpm3O41

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

9f0fab72c8a1fea1df1d6c5d128115031a8c44ccbc7f37e314acee6acb98779b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://jacobs.perkspot.com/
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262
Connection: keep-alive
Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:19:55 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 24 Aug 2021 16:19:55 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 24 Aug 2022 16:19:55 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Set-Cookie: TiPMix=14.1167164380274; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Content-Length: 5284
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK perkspot.interstitial Show response
jacobs.perkspot.com/bundles/ 285 B
754 B 213ms
156ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/bundles/perkspot.interstitial?v=t7AmW2sLYmtuXd_Ef0RYYqquwW8mSfQBRb6_PPlosA41

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

89c69b70386c8e4a1be1f0dfe4b485807c2ac88bfe195de3a254a855f36d8c0c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://jacobs.perkspot.com/
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; x-ms-routing-name=self; ai_user=giv8Uo+v2UlTbBLrIQ8UQF|2021-08-24T16:19:55.609Z; __utma=64858676.931040915.1629821996.1629821996.1629821996.1; __utmc=64858676; __utmz=64858676.1629821996.1.1.utmcid=weeklyblast|utmccn=(not%20set)|utmcmd=email; __utmt=1; __utmb=64858676.1.10.1629821996; _gcl_au=1.1.73561704.1629821996; _ga=GA1.3.931040915.1629821996; _gid=GA1.3.380474387.1629821996; _dc_gtm_UA-652375-6=1; _ga_8J161FED5Z=GS1.1.1629821995.1.0.1629821995.0; _ga=GA1.1.931040915.1629821996; ai_session=GPwC6yJbkh2FpIbNx5vfSk|1629821995746|1629821995746; sailthru_pageviews=1; TiPMix=34.457937830341; ARRAffinity=2bb9db0fc1f15806c34e6e3dcd35d19105172686523f20adf76a792565b6cb06; ARRAffinitySameSite=2bb9db0fc1f15806c34e6e3dcd35d19105172686523f20adf76a792565b6cb06
Connection: keep-alive
Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:19:55 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 24 Aug 2021 16:19:55 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 24 Aug 2022 16:19:55 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 296
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK addtohomescreen Show response
jacobs.perkspot.com/bundles/ 9 KB
4 KB 164ms
157ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/bundles/addtohomescreen?v=dQY7ReEN3P6AvpTV4mVTeWSR8WQitK0nH1fxax2VNoA1

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

65e4d18477e0e194ae2b3848fe053621a40508eeb817ab8c832b8005edd2c6af

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://jacobs.perkspot.com/
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262; x-ms-routing-name=self; ai_user=giv8Uo+v2UlTbBLrIQ8UQF|2021-08-24T16:19:55.609Z; __utma=64858676.931040915.1629821996.1629821996.1629821996.1; __utmc=64858676; __utmz=64858676.1629821996.1.1.utmcid=weeklyblast|utmccn=(not%20set)|utmcmd=email; __utmt=1; __utmb=64858676.1.10.1629821996; _gcl_au=1.1.73561704.1629821996; _ga=GA1.3.931040915.1629821996; _gid=GA1.3.380474387.1629821996; _dc_gtm_UA-652375-6=1; _ga_8J161FED5Z=GS1.1.1629821995.1.0.1629821995.0; _ga=GA1.1.931040915.1629821996; ai_session=GPwC6yJbkh2FpIbNx5vfSk|1629821995746|1629821995746; sailthru_pageviews=1; TiPMix=9.15533113719678; ARRAffinity=0f8925786185bc4eff5d40e1568b01cc989b4b01f30f956d7d05e5ca4919bec6; ARRAffinitySameSite=0f8925786185bc4eff5d40e1568b01cc989b4b01f30f956d7d05e5ca4919bec6
Connection: keep-alive
Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:19:55 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 24 Aug 2021 16:19:55 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 24 Aug 2022 16:19:55 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 3536
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H2 200 spm.v1.min.js Show response
ak.sail-horizon.com/spm/ 121 KB
43 KB 181ms
67ms Script
application/javascript 13.224.102.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-19.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d06ae5e97e495832fc4526c3e93d7e9440f1faf5f77669b41678c9d564a25faf

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:13:39 GMT
content-encoding: gzip
last-modified: Tue, 08 Jun 2021 04:22:34 GMT
server: AmazonS3
age: 377
etag: W/"b22b4f4738e8722be1636447be239da2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7245e91891539560c1f484b1e46159c9.cloudfront.net (CloudFront)
cache-control: max-age=600; must-revalidate
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: Ff6nKvHkQ4Y8LSAllI5JvE6_fGEQT-Ew60JrS8mWCkSUDl86iy4Jjw==

GET
H/1.1 200
OK rollbar.min.js Show response
cdn.rollbar.com/rollbarjs/refs/tags/v2.21.1/ 75 KB
23 KB 147ms
47ms Script
application/javascript 13.224.194.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.rollbar.com/rollbarjs/refs/tags/v2.21.1/rollbar.min.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.194.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-217.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: eee2bc6e4edf311a6a0337c339dbd85d0d8d4040b25e390ab18237e2fa84f1c9

Request headers

Origin: https://jacobs.perkspot.com
Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 15:35:42 GMT
Content-Encoding: gzip
Age: 2654
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Wed, 17 Mar 2021 15:55:23 GMT
Server: AmazonS3
ETag: W/"62dacaf8a5369242def33a2dcc503021"
Vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Via: 1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
Cache-Control: max-age=30672000,public
X-Amz-Cf-Pop: FRA2-C1
X-Amz-Cf-Id: rQ0M9HNyhicd4p3LgF-DGL_lKXl-m-S7utqh9z_vBP5G31ot7zGjZg==

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ 45 KB
17 KB 17ms
14ms Script
text/javascript 2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Jul 2021 18:24:06 GMT
server: Golfe2
age: 1598
date: Tue, 24 Aug 2021 15:53:17 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17093
expires: Tue, 24 Aug 2021 17:53:17 GMT

GET
H2 200 heap-1214792821.js Show response
cdn.heapanalytics.com/js/ 114 KB
43 KB 186ms
64ms Script
application/javascript 13.224.102.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.heapanalytics.com/js/heap-1214792821.js

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.102.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-102-111.zrh50.r.cloudfront.net

Software

nginx /

Resource Hash

ee12de8d2df7f136ccb75917bef79b12a373b8b7cef9322d119ce8e444f98255

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:12 GMT
content-encoding: gzip
server: nginx
age: 43
etag: W/"1c88d-0mo8X8M7eewE/DP84QC6UQ"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
via: 1.1 a70d280cd058ea89c08954ea0ad67199.cloudfront.net (CloudFront)
cache-control: public, max-age=120
x-amz-cf-pop: ZRH50-C1
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-id: z0gugBIqNB4R60F8HerYSfQcERiF-YtaLlNgpKA9zeHNBcs9uZuXYg==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 112 KB
42 KB 18ms
15ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-578DK6

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0e4968ab56283d1d1a44b663b9d471fa366a41d3d11dbb748618efe3df0a7cbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:55 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43061
x-xss-protection: 0
last-modified: Tue, 24 Aug 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 24 Aug 2021 16:19:55 GMT

GET
H/1.1 200
OK Cookie set 35A1AD_0_0.woff2
jacobs.perkspot.com/Content/fonts/ 28 KB
29 KB 274ms
151ms Font
font/woff2 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/Content/fonts/35A1AD_0_0.woff2

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

42ae1eb8cc55b4e2382e02323c96a40e80432d3e810bce85f10c75ddacbd2e2b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://jacobs.perkspot.com
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262
Connection: keep-alive
Origin: https://jacobs.perkspot.com
Referer: https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Last-Modified: Mon, 23 Aug 2021 21:29:01 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "94c88e46598d71:0"
X-Frame-Options: SAMEORIGIN
Content-Type: font/woff2
Date: Tue, 24 Aug 2021 16:19:55 GMT
Set-Cookie: TiPMix=34.457937830341; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=2bb9db0fc1f15806c34e6e3dcd35d19105172686523f20adf76a792565b6cb06;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=2bb9db0fc1f15806c34e6e3dcd35d19105172686523f20adf76a792565b6cb06;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Accept-Ranges: bytes
Content-Length: 28718
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK Cookie set fontawesome-webfont.woff2
jacobs.perkspot.com/Content/fonts/ 69 KB
70 KB 332ms
154ms Font
font/woff2 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/Content/fonts/fontawesome-webfont.woff2?v=4.6.1

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/Content/css/core?v=21.8.28093.1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://jacobs.perkspot.com
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://jacobs.perkspot.com/Content/css/core?v=21.8.28093.1
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262
Connection: keep-alive
Origin: https://jacobs.perkspot.com
Referer: https://jacobs.perkspot.com/Content/css/core?v=21.8.28093.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Last-Modified: Mon, 23 Aug 2021 21:29:01 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "b44141e46598d71:0"
X-Frame-Options: SAMEORIGIN
Content-Type: font/woff2
Date: Tue, 24 Aug 2021 16:19:55 GMT
Set-Cookie: TiPMix=7.05360281609632; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=2bb9db0fc1f15806c34e6e3dcd35d19105172686523f20adf76a792565b6cb06;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=2bb9db0fc1f15806c34e6e3dcd35d19105172686523f20adf76a792565b6cb06;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Accept-Ranges: bytes
Content-Length: 70728
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK Cookie set 35A1AD_3_0.woff2
jacobs.perkspot.com/Content/fonts/ 41 KB
42 KB 333ms
155ms Font
font/woff2 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://jacobs.perkspot.com/Content/fonts/35A1AD_3_0.woff2

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

255733aa26ecbe1a2608fc086d6b510fafce3647ad1ddf22392c390a1306e640

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://jacobs.perkspot.com
Accept-Encoding: gzip, deflate, br
Host: jacobs.perkspot.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
Cookie: SessionHolder=e7c0febf-dfb7-4c37-874c-031f81966262; ps_sid=e7c0febf-dfb7-4c37-874c-031f81966262
Connection: keep-alive
Origin: https://jacobs.perkspot.com
Referer: https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Last-Modified: Mon, 23 Aug 2021 21:29:01 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "d1d015e46598d71:0"
X-Frame-Options: SAMEORIGIN
Content-Type: font/woff2
Date: Tue, 24 Aug 2021 16:19:55 GMT
Set-Cookie: TiPMix=9.15533113719678; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=0f8925786185bc4eff5d40e1568b01cc989b4b01f30f956d7d05e5ca4919bec6;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=0f8925786185bc4eff5d40e1568b01cc989b4b01f30f956d7d05e5ca4919bec6;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Accept-Ranges: bytes
Content-Length: 42010
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H2 200 ai.2.min.js Show response
az416426.vo.msecnd.net/scripts/b/ 118 KB
39 KB 26ms
7ms Script
text/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/bundles/insights?v=BYC8KfJNNFadC6mBN8WA9SN_bH3bqkPFtSQg0hXgWI01
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F5B) /
Resource Hash: 9052548b73711c81589b805f3ef741747fca42bb7c6760bd1ded1bddd5c7823c

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 24 Aug 2021 16:19:55 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-07 00:07:47
content-md5: Er/k8oDkj+t0VHFKHxmzMw==
age: 1226
x-cache: HIT
x-ms-meta-aijssdksrc: [cdn]/scripts/b/ai.2.6.5.min.js
content-length: 39108
x-ms-lease-status: unlocked
last-modified: Mon, 09 Aug 2021 17:30:47 GMT
server: ECAcc (frc/8F5B)
x-ms-meta-aijssdkver: 2.6.5
etag: 0x8D95B5B6CA52C66
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 50f69621-d01e-0034-5301-99dbbd000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800, immutable, no-transform
x-ms-version: 2009-09-19
expires: Tue, 24 Aug 2021 16:49:55 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1585591459&utmhn=jacobs.perkspot.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt...
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=931040915.1629821996&jid=660956266&_v=5.7.2dc&z=1585591459
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=931040915.1629821996&jid=660956266&_v=5.7.2dc&z=1585591459&slf_rd=1&random=3476021566

42 B
107 B

32ms
32ms

Image
image/gif

2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=931040915.1629821996&jid=660956266&_v=5.7.2dc&z=1585591459&slf_rd=1&random=3476021566

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:55 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=931040915.1629821996&jid=660956266&_v=5.7.2dc&z=1585591459&slf_rd=1&random=3476021566
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 js Show response
www.googletagmanager.com/gtag/ 128 KB
50 KB 25ms
22ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-8J161FED5Z&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-578DK6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d4446ee603d5545233a34ace6d355c2e251fd2a1a02a23b976ef4adbbc8030de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:55 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51629
x-xss-protection: 0
expires: Tue, 24 Aug 2021 16:19:55 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 36 KB
14 KB 173ms
62ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-578DK6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

1c3bd00be556bf95f92a2ab1119b8b26544a1997ab0c09f86490bc32339ad32e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13981
x-xss-protection: 0
server: cafe
etag: 6132654052448080839
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 24 Aug 2021 16:19:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-578DK6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Jul 2021 18:24:06 GMT
server: Golfe2
age: 2603
date: Tue, 24 Aug 2021 15:36:32 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19672
expires: Tue, 24 Aug 2021 17:36:32 GMT

GET
H3-29 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
882 B 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 15:34:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 2747
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 24 Aug 2021 16:34:08 GMT

POST
H3-29 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-652375-6&cid=931040915.1629821996&jid=1617783541&uid=23953415&gjid=316228057&_gid=380474387.1629821996&_u=aSBCgAAjAAAAAE~&z=2073355025

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 24 Aug 2021 16:19:55 GMT
content-type: text/plain
access-control-allow-origin: https://jacobs.perkspot.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 6ms
6ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j92&a=674208957&t=pageview&_s=1&dl=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&ul=en-us&de=UTF-8&dt=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=64858676.931040915.1629821996.1629821996.1629821996.1&_utmz=64858676.1629821996.1.1.utmcid%3Dweeklyblast%7Cutmccn%3D(not%2520set)%7Cutmcmd%3Demail&_utmht=1629821995716&_u=aSBCgAAj~&jid=1617783541&gjid=316228057&cid=931040915.1629821996&uid=23953415&tid=UA-652375-6&_gid=380474387.1629821996&gtm=2wg8n0578DK6&z=544304775

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 00:04:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 58536
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 collect
www.google-analytics.com/g/ 0
17 B 13ms
12ms Ping
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-8J161FED5Z&gtm=2oe8n0&_p=674208957&sr=1600x1200&ul=en-us&cid=931040915.1629821996&_s=1&dl=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&dt=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&sid=1629821995&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8J161FED5Z&l=dataLayer&cx=c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:55 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://jacobs.perkspot.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ga-audiences
www.google.com/ads/ 42 B
64 B 33ms
32ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-652375-6&cid=931040915.1629821996&jid=1617783541&_u=aSBCgAAjAAAAAE~&z=2130239278

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 31ms
31ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-652375-6&cid=931040915.1629821996&jid=1617783541&_u=aSBCgAAjAAAAAE~&z=2130239278

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/978685899/ 2 KB
1 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/978685899/?random=1629821995871&cv=9&fst=1629821995871&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg8n0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&tiba=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43f628aef4c9eac54a0548718d071dc2e93af243dc2bb0c6bf900fd524691b96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1110
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK bd945d23-8646-466d-be45-cd48b1e070f0
https://jacobs.perkspot.com/ 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://jacobs.perkspot.com/bd945d23-8646-466d-be45-cd48b1e070f0
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H2 206 SD+540p%2C+PerkSpot+Welcome+Video.mp4
psprods3ep.azureedge.net/cdn.perkspot.com/video/ 3 MB
0 26ms
23ms Media
video/mp4 2620:1ec:48::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://psprods3ep.azureedge.net/cdn.perkspot.com/video/SD+540p%2C+PerkSpot+Welcome+Video.mp4
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:48::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://jacobs.perkspot.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 24 Aug 2021 16:19:55 GMT
etag: "6db36f0719fb6eec8d73c45a6d5a9580"
last-modified: Fri, 29 Jan 2021 15:21:43 GMT
server: AmazonS3
x-amz-request-id: JVFMKKAEHPM4STSG
x-amz-meta-cb-modifiedtime: Wed, 23 Dec 2020 12:28:12 GMT
x-azure-ref: 0KxwlYQAAAADi32sl6sMtQK1FjeIwsIi9TE9OMjFFREdFMDIyMgA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
x-cache: TCP_HIT
content-type: video/mp4
Content-Range: bytes 0-5324711/5324712
cache-control: public, max-age=172800
accept-ranges: bytes
Content-Length: 5324712
x-amz-id-2: xKdchZ2ShCH6ezD2SsentceFVZsscNCiIPq3iJUQ6VObVQTHDlm3yFfg26lQtFQAgcMyRrZ+zGk=

GET
H3-29 200 /
www.google.com/pagead/1p-user-list/978685899/ 42 B
65 B 20ms
19ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/978685899/?random=1629821995871&cv=9&fst=1629820800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg8n0&sendb=1&frm=0&url=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&tiba=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&async=1&fmt=3&is_vtc=1&random=799952104&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
www.google.de/pagead/1p-user-list/978685899/ 42 B
64 B 34ms
18ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/978685899/?random=1629821995871&cv=9&fst=1629820800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg8n0&sendb=1&frm=0&url=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&tiba=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&async=1&fmt=3&is_vtc=1&random=799952104&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

asset_composer.js Show response
static.zdassets.com/ekr/ Frame 49EA
Redirect Chain

https://assets.zendesk.com/embeddable_framework/main.js
https://static.zdassets.com/ekr/asset_composer.js

20 KB
6 KB

162ms
60ms

Script
application/javascript

104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/ekr/asset_composer.js

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

16cc547456ffa0052c3679e6c5ece2e14ad57c92b93562deb7bcb5829b7afcb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:56 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 31
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: VY26HSM6YSEZXBY5
x-amz-id-2: pwnUJJ9vS+VJLkJAIM/1QBVJ5FGdAzEWlm69LSz41CLquIaw4kgXJcSh/N73qd010d5JDfK4BF4=
last-modified: Wed, 09 Jun 2021 00:08:58 GMT
server: cloudflare
etag: W/"cc904f41324148b571599b3b02fdec0b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LfGLiz8GV5%2B7RBUtZRTnqZqBl9DgTjN7ICpSUTdkkaLm%2FNxf6RRzOFqxdsmlrUYXPRvBHYIN%2FJzc7rpY5UH8yfE3YTt1CmOr9twpSaMWKWjUBeGGRXVFIolIZ4EMf5EX6I1ZCkY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=60
x-amz-version-id: K3SnbkxF6hLvuoHLDwjJyrnNVVhjkbLm
cf-ray: 683de7b77d60fa78-AMS

Redirect headers

date: Tue, 24 Aug 2021 16:19:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q1KWvCzIb77as1Esoh0rfmeHgS2XrlM8drWpnWHIMpGEnUh8ZIahFAILKdEsL2W2kwITJSBzra6XXGwWKY2s4nBH2UnvkCMyehS5NGuvmKKLhyXj1dS8s7tRGkfAIvrkKpexSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
location: https://static.zdassets.com/ekr/asset_composer.js
cache-control: max-age=3600
strict-transport-security: max-age=0
cf-ray: 683de7b67bf4fa50-AMS
expires: Tue, 24 Aug 2021 17:19:56 GMT

GET
H2 200 telemetry
heapanalytics.com/api/ 37 B
258 B 401ms
131ms Image
image/gif 52.202.102.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heapanalytics.com/api/telemetry?a=1214792821&te=type&te=data&te=cm&te=eventPropertiesTelemetry%20-%20added%20new%20properties&te=val&te=2&st=1629821996409&hv=4.14.1

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.202.102.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-202-102-177.compute-1.amazonaws.com

Software

nginx /

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:56 GMT
server: nginx
etag: W/"25-PqzQEyMQ6kTK11azeKO8Bw"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 37

GET
H2 200 h
heapanalytics.com/ 37 B
258 B 331ms
132ms Image
image/gif 52.202.102.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heapanalytics.com/h?a=1214792821&u=4123321823197576&v=2492360745310324&s=6699107195278090&b=web&tv=4.0&z=0&h=%2Foffer%2F1420262%2Fnone&q=%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&d=jacobs.perkspot.com&t=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&um=email&k=CommunityId&k=196&k=StatusId&k=8&ts=1629821996478&st=1629821996480

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.202.102.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-202-102-177.compute-1.amazonaws.com

Software

nginx /

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:56 GMT
server: nginx
etag: W/"25-PqzQEyMQ6kTK11azeKO8Bw"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 37

GET
H2 200 identify_v3
heapanalytics.com/api/ 37 B
259 B 328ms
130ms Image
image/gif 52.202.102.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heapanalytics.com/api/identify_v3?a=1214792821&u=4123321823197576&v=2492360745310324&s=6699107195278090&i=23953415&b=web&tv=4.0&z=0&st=1629821996481

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.202.102.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-202-102-177.compute-1.amazonaws.com

Software

nginx /

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:56 GMT
server: nginx
etag: W/"25-PqzQEyMQ6kTK11azeKO8Bw"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 37

GET
H2 200 add_user_properties_v3
heapanalytics.com/api/ 37 B
258 B 330ms
132ms Image
image/gif 52.202.102.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heapanalytics.com/api/add_user_properties_v3?a=1214792821&u=4123321823197576&v=2492360745310324&s=6699107195278090&i=23953415&b=web&tv=4.0&_CommunityId=196&_StatusId=8&st=1629821996481

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.202.102.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-202-102-177.compute-1.amazonaws.com

Software

nginx /

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:19:56 GMT
server: nginx
etag: W/"25-PqzQEyMQ6kTK11azeKO8Bw"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 37

GET
H2 206 SD+540p%2C+PerkSpot+Welcome+Video.mp4
psprods3ep.azureedge.net/cdn.perkspot.com/video/ 64 KB
0 21ms
21ms Media
video/mp4 2620:1ec:48::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://psprods3ep.azureedge.net/cdn.perkspot.com/video/SD+540p%2C+PerkSpot+Welcome+Video.mp4
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:48::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://jacobs.perkspot.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 24 Aug 2021 16:19:56 GMT
etag: "6db36f0719fb6eec8d73c45a6d5a9580"
last-modified: Fri, 29 Jan 2021 15:21:43 GMT
server: AmazonS3
x-amz-request-id: JVFMKKAEHPM4STSG
x-amz-meta-cb-modifiedtime: Wed, 23 Dec 2020 12:28:12 GMT
x-azure-ref: 0LBwlYQAAAADcIqfxZwcKToS9ApfEMgO1TE9OMjFFREdFMDIyMgA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
x-cache: TCP_HIT
content-type: video/mp4
Content-Range: bytes 0-5324711/5324712
cache-control: public, max-age=172800
accept-ranges: bytes
Content-Length: 5324712
x-amz-id-2: xKdchZ2ShCH6ezD2SsentceFVZsscNCiIPq3iJUQ6VObVQTHDlm3yFfg26lQtFQAgcMyRrZ+zGk=

GET
H2 200 perkspot.zendesk.com Show response
ekr.zdassets.com/compose/web_widget/ Frame 49EA 718 B
1 KB 175ms
65ms XHR
application/json 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ekr.zdassets.com/compose/web_widget/perkspot.zendesk.com

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a825805da94e038e12f102f89e46f27ad9646d7ab7057753fb82786431ecc64e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:56 GMT
content-encoding: br
vary: Origin, Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 29
status: 200 OK
access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=0
x-request-id: 97efd24c-b6c5-4285-a087-bf5328b31652
x-runtime: 0.003613
server: cloudflare
etag: W/"a825805da94e038e12f102f89e46f27a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 7200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W%2FC7nDS5TbMd4XJEy6%2BaBYr0sU9euLBnpfhD9X6b7%2BnVBbQgd6DB%2F1Z3kwb%2ByZAB5TFiT%2BkeiR1nBehKDgX%2FSQamx3E3D%2F2vfVJcEqdLEFlSqqC5fbBr0hyeom8Q03vvLzE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=600, public, s-maxage=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray: 683de7b89c5a597d-AMS

OPTIONS
H2 200 track
dc.services.visualstudio.com/v2/ Frame 0
0 184ms
58ms Preflight 13.69.106.212
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Server

13.69.106.212 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,sdk-context
Origin: https://jacobs.perkspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-methods: POST
access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin: *
access-control-max-age: 3600
x-content-type-options: nosniff
date: Tue, 24 Aug 2021 16:19:56 GMT
content-length: 0

POST
H2 200 track Show response
dc.services.visualstudio.com/v2/ 96 B
213 B 826ms
826ms XHR
application/json 13.69.106.212
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.69.106.212 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

bbf7c43612543660ff95df57151eeca1a83e4dc59ff40df67fde5c3e20d7b71f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://jacobs.perkspot.com/
Sdk-Context: appId
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json

Response headers

x-ms-session-id: 1C7EE29F-0222-44EB-8FF3-9B3FB77B3077
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Tue, 24 Aug 2021 16:19:56 GMT
access-control-max-age: 3600
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
content-length: 96

GET
H2 200 web-widget-preload-d9d81488360f65d03f84.js Show response
static.zdassets.com/web_widget/latest/ Frame 80C3 88 KB
32 KB 70ms
69ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbb99457e56765ea4bea432267ab799598687f0a3cedf17ca67efb913ee9d9ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:56 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 399634
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 4Q3JEDADYY0YPQ6M
x-amz-id-2: 4GcTnFjmyHh3ukA5HgP+mpHvxmHRUMbz5oX9lww43RO2u0TOj9KzlUuDAKyWmqJUz14i4TmrZ4s=
last-modified: Thu, 19 Aug 2021 06:56:54 GMT
server: cloudflare
etag: W/"344f0fe59e0f077ebeeeef03607601ac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zFtyjBVVi9W7KB1Viyv0uGejh5bPTLYkz1i5eZUgcl%2FBSP3EOE7cgBDehRwmLZQAmLRleV44IoaWHZhurtYSDzPcY6ZU0MpjrV8Ga%2Fd0n7UJZmm8AcJwMycpfLMBZu31VxPLA4g%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 57Ip39pR3YbL9FqP79r8Y7su0sTb6uxl
cf-ray: 683de7b91ef6fa78-AMS
expires: Fri, 19 Aug 2022 06:56:53 GMT

GET
H2 200 web-widget-framework-97edc71e1362291b402d.js Show response
static.zdassets.com/web_widget/latest/ Frame 80C3 184 KB
59 KB 111ms
110ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eeaf2e313228f5fa957d5cf730e42df5cf45b7e2132a594d470576a88736a481

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:56 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 399634
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 4Q3VZ42PDHS8X1TT
x-amz-id-2: S2uEwZHGl+E6BzLxDC5n2Ea33S0aubhUaQxKIPVDmw2r+5eGV2GKZhSQ5p5RWMX17kKg+U4xJSU=
last-modified: Thu, 19 Aug 2021 06:56:54 GMT
server: cloudflare
etag: W/"e374a6019f706d78fc0110673a8149b4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V1powOTBbwPBGdNpXHldiinK10BJX8MAO0TTAk3zN99cL9FYp8G19MnB2uPYU2d79Iptxy6wPzkcF5dd%2B0uUyFemKGkMNsdYvZm68D3Kkurf3GhUz25sgTkjh6obfkhpHZHWWAw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: Wk53zNM1BfAU488Z5dqm0HEqnFW4uGAe
cf-ray: 683de7b91ef7fa78-AMS
expires: Fri, 19 Aug 2022 06:56:53 GMT

GET
H2 200 web-widget-chat-sdk-ad0bca0cd862985f164f.js Show response
static.zdassets.com/web_widget/latest/ Frame 80C3 203 KB
52 KB 111ms
110ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-chat-sdk-ad0bca0cd862985f164f.js

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a77ebced88a45b7146f3e8b0359f37d658f0f6e0eb481583ee9319cb601d893

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:56 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3080146
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 31A3BAY1ZH9GD1BV
x-amz-id-2: tfFkqroZKroq+pqLI+M3idv/nOENLrOjrlitzrzbLnFwRXLmuGoNzapA4k4INMPdjWyRcioA/K8=
last-modified: Mon, 19 Jul 2021 02:04:04 GMT
server: cloudflare
etag: W/"093f405bc41723c43486a657a0e1a173"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=knxEJxda0BzKaQ22YbV2B9GI7POJWwXQEOp3uAaK1Hqx2iEZwUXVAkdPo8oxkqteTFTwe89%2BNXAbBeZ2t3tlUUNfrlxDk8P%2BBjb5DEgtZNiWiC0wHod9pOS3waU3CJ8R%2Bw2DGa4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 6nLy1oZDiI0GDEsA2cGfRKjp8Mm1fRS8
cf-ray: 683de7b91ef8fa78-AMS
expires: Tue, 19 Jul 2022 02:04:03 GMT

GET
H2 200 web-widget-talk-sdk-5e847fafdc66ec0a9823.js Show response
static.zdassets.com/web_widget/latest/ Frame 80C3 69 KB
19 KB 62ms
61ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-talk-sdk-5e847fafdc66ec0a9823.js

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f16b41c0ac3d3c2b732a3c136d94a34ccaef99f0d8cce5f3ef244b78c03e036

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:56 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3080148
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: R064DQSZ403AP051
x-amz-id-2: R5ertjBhTM/j6o/rN9MgeARg9Gwrs6A+ju3/SuSEZgkScn8eOrrlbL/FtAhr5HM3IMnEYptAM6Q=
last-modified: Mon, 19 Jul 2021 02:04:04 GMT
server: cloudflare
etag: W/"d4b8963176acde642459d5c5c574e025"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pI1kPVxII6V0gs%2B0NUUS6HnFXQLN8LOAjf4OEadm50IS116wEwWYBGi1ifY2cHnijdS4GCPGOircwacUanX4vJ2p5uEj9TkejESQY6iFtZKQgMsojRlmQtJDBnvRGS7w%2B%2BG6pys%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: bUjsjS7lefrgeymz3edNwHG1NF59pyb1
cf-ray: 683de7b91ef9fa78-AMS
expires: Tue, 19 Jul 2022 02:04:03 GMT

GET
H2 200 config Show response
perkspot.zendesk.com/embeddable/ Frame 49EA 767 B
1 KB 218ms
87ms XHR
application/json 104.16.51.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://perkspot.zendesk.com/embeddable/config

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89d2b04a6542b3cfa82cce050c54aa0039de047b27072f7c1dc1b9b82ab2e5a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://jacobs.perkspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 30
x-zendesk-zorg: yes
x-zendesk-origin-server: embeddable-app-server-69746d8d9-dg7fn
access-control-allow-methods: GET
vary: Origin, Accept-Encoding
x-cached: STALE
x-request-id: 683de1b76f83caf0-SEA, 683de701ed9832c8-SEA
x-runtime: 0.001272
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rwV8zry4IZdIySm%2F5O9MimiPf%2B%2FqtIWp%2FNPIsdQq3jfoyzWrsig02avmRIgfV2HhPHnNa5Hoiz%2BWtlSut%2BoXs8DxPh6vLpxDrssbvt%2FmHBVTuPFd01FWbJKerCjv7O1PTr393Cnl"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: public, max-age=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray: 683de7bafa0b32be-CDG

GET
H2 200 en-us-json-c92f040571c86c5604a4.js Show response
static.zdassets.com/web_widget/latest/web-widget-locales/ Frame 80C3 33 KB
7 KB 61ms
61ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-locales/en-us-json-c92f040571c86c5604a4.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6eb4e5bf06118c495126b1cf6f5f370f94bc7651c6525d6c606877170afbf53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:57 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 740354
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 0TBV60A79Z96NHFA
x-amz-id-2: nmsb3c7vCzxhDfkxWWx0UqPrGt9Ibcee3mnut3akBqyyz7Vljdn5Esz75cUqy1/6V2OaALxHsZg=
last-modified: Fri, 13 Aug 2021 00:23:14 GMT
server: cloudflare
etag: W/"38e7cc9c495c12720eec3517509bd5e3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HPJbs6zrMajEWsGJ7fnjbw8Pm0vxvs0Egvg9J9eGm20TLe9UFwuG2wfJG5wNLlmv930tkHe0uVmmjtsQsj7KJDAKI2zrhC1hi7ZO9Z3Z8CLGUJcUiktdysW28UMQ3U4F7ipGWp8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: nxyhPh39LbwqesfRpjKXUZuzYoFcnoU5
cf-ray: 683de7bb89dafa78-AMS
expires: Sat, 13 Aug 2022 00:23:13 GMT

GET
H2 200 web-widget-218-a0e6bddf78f556c0ba98.js Show response
static.zdassets.com/web_widget/latest/ Frame 80C3 330 KB
100 KB 110ms
109ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-218-a0e6bddf78f556c0ba98.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9dcaeb939318effbb2db3a742e54dba4b1d31e84858207fb43b75a4b6a576dd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:57 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1293300
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: NMMVGY97EERBT9S0
x-amz-id-2: yEYoF4CZYjClgh5qy89ifZQokaoi3D/qINbwHHlxPlRqrHZsOv+e9iMxDa720RZb7GemgmHLX3Y=
last-modified: Mon, 09 Aug 2021 15:03:50 GMT
server: cloudflare
etag: W/"d270a189c9839f5d9d7f3e49bbeae2d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q8AXzLIXzNvL%2FFfVVFWgNLXFbdInIaF1DKBavH8H8O39B15yLTUYLyvI1ZGkMw4bLltHIcP119fiiBvefwk9aA3c9iqScWT%2Bsmz3IgabD18gK6SLPA263GxNaqZu7hCbY8QqDl8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 3sjv5e8lvY6f4Mm3flRDrq1MhhcZeVSU
cf-ray: 683de7bb89ddfa78-AMS
expires: Tue, 09 Aug 2022 15:03:49 GMT

GET
H2 200 web-widget-9829-5f3c12ec148288f64210.js Show response
static.zdassets.com/web_widget/latest/ Frame 80C3 91 KB
25 KB 110ms
110ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-9829-5f3c12ec148288f64210.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0987ab417187ff28db7f13e2ba5a66623e2b2cc83ba11308c8735df9a9db2792

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:57 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 740354
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 0TBS30EW49BDBRCH
x-amz-id-2: iDatlsCNBJN8nIaPicGQQ6pq0JwTtFoqW3HGYnfv7bIPfxwXqnL8iRXm7mr01+gjJVm43b5waSs=
last-modified: Fri, 13 Aug 2021 00:23:50 GMT
server: cloudflare
etag: W/"c416333951b19b5a604bb7f65785650e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f%2FP0TbFTpPMbc6yXtsDkPMQGaE%2FAHMJryJt8GwP9kTsusD3T3NgABhKMStwafgb6b2iDGGj%2BoDIL4%2B7dRo5f04sEOP%2Fgy3ehsxws2NG3hrzxizT7Uml8UQtK4jMT%2Buwz3zb8XUY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 49ot3h21npFAkxmz5L51VOsC2.m1cZtL
cf-ray: 683de7bb89defa78-AMS
expires: Sat, 13 Aug 2022 00:23:49 GMT

GET
H2 200 web_widget-0eb90e308aa2a8387460.js Show response
static.zdassets.com/web_widget/latest/web-widget-lazy/ Frame 80C3 417 KB
89 KB 72ms
72ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-lazy/web_widget-0eb90e308aa2a8387460.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eccbf3fae72a87817cd2d39cca489de2c2d9f73b130d223882a1c36b88919da0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:57 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 399635
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 4Q3PJANJ74DCJSP8
x-amz-id-2: rJAlNUnAKoWbvjG2rA8uHKnOF1igvPVlukSSDMgbr82cfxCprmheqMA5RqzaThCFfNLMpAmLHa4=
last-modified: Thu, 19 Aug 2021 06:55:13 GMT
server: cloudflare
etag: W/"9fb8b7e9cc7e6cea49362f07cb92834c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iFoBTRmBR09ZOziXlYsY6rM4e44nM%2BItjSloBHZixD%2B6ty8Ry8CLvVk02RXL%2Bx7FPCGl5csV%2BoMllyScrGLFjmO55y9dnMMo2IR6mkmaVmfn98vXT6cUztweA6M35XWmlb6vkIs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: ZZZrJnthwO1ZQ_GxukaRr7aoxAPsnxhT
cf-ray: 683de7bb89dffa78-AMS
expires: Fri, 19 Aug 2022 06:55:12 GMT

GET
H2 200 embeddable_blip Show response
perkspot.zendesk.com/ Frame 80C3 0
329 B 233ms
232ms XHR
text/plain 104.16.51.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://perkspot.zendesk.com/embeddable_blip?type=settings&data=eyJzZXR0aW5ncyI6eyJ3ZWJXaWRnZXQiOnsib2Zmc2V0Ijp7Imhvcml6b250YWwiOiI1cHgiLCJ2ZXJ0aWNhbCI6IjVweCIsIm1vYmlsZSI6eyJob3Jpem9udGFsIjoiNXB4IiwidmVydGljYWwiOiI1cHgifX0sInpJbmRleCI6MTk5OX19LCJidWlkIjoiYTQ3MzQ0YmM0ZTU1OGRlMTgwZmI4ZjQyNDg5ZWEwZTciLCJzdWlkIjoiMzdkMDkwMGQ2YzJlYWRkMTQxNDhjYzk1OTE1Y2I4NTQiLCJ2ZXJzaW9uIjoiMGJkNjBhYjZkIiwidGltZXN0YW1wIjoiMjAyMS0wOC0yNFQxNjoxOTo1Ny41NTRaIiwidXJsIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tIn0%3D

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:57 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-zendesk-zorg: yes
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pNn9bRsKjOGZ3M7ZIeSQlGUp3JWF%2FWY12BiJRzt%2FiWPNUIkrIcUqQDNGgv5f2yOVZDObRcGvtbVDxjb5EmwkNIW7q3DKSJraYLSkTh%2BVW49kxNZNLeljp3Gq5Wql3CKOR%2BsMMfRV"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://jacobs.perkspot.com
accept-ranges: bytes
cf-ray: 683de7bcec8832be-CDG
vary: Accept-Encoding
content-length: 0
x-request-id: 0b2a28c8a7fd0e6162fc3afdc778fe0b

GET
H2 200 embeddable_blip Show response
perkspot.zendesk.com/ Frame 80C3 0
280 B 229ms
229ms XHR
text/plain 104.16.51.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://perkspot.zendesk.com/embeddable_blip?type=pageView&data=eyJjaGFubmVsIjoid2ViX3dpZGdldCIsInBhZ2VWaWV3Ijp7InJlZmVycmVyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tIiwidGltZSI6MzYsImxvYWRUaW1lIjpudWxsLCJuYXZpZ2F0b3JMYW5ndWFnZSI6ImVuLVVTIiwicGFnZVRpdGxlIjoiWW91J3JlIG9uIHlvdXIgd2F5IHRvIHNhdmluZyBhdCBGaXJzdGxlYWYgV2luZSBDbHViIHwgSmFjb2JzIEVtcGxveWVlIERpc2NvdW50IFByb2dyYW0iLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjE1OSBTYWZhcmkvNTM3LjM2IiwiaXNNb2JpbGUiOmZhbHNlLCJpc1Jlc3BvbnNpdmUiOnRydWUsInZpZXdwb3J0TWV0YSI6IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xIiwiaGVscENlbnRlckRlZHVwIjpmYWxzZX0sImJ1aWQiOiIwOTBkZGMxZjUwYmIzZTY3ZDllNjBlZWVkMDIyY2M0NCIsInN1aWQiOiI4OTkzMjcxYmFiNzIxOWM2NmRkMzU3NTNhYmFkMjViZSIsInZlcnNpb24iOiIwYmQ2MGFiNmQiLCJ0aW1lc3RhbXAiOiIyMDIxLTA4LTI0VDE2OjE5OjU3LjU4MVoiLCJ1cmwiOiJodHRwczovL2phY29icy5wZXJrc3BvdC5jb20ifQ%3D%3D

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:57 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-zendesk-zorg: yes
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jQp87Ix3kcSg7KjL68jjsKrFNA%2BOG2fKRhpuCGoqYtq4scMJJN10LOxDX76VABaOuO2MP1s%2FwLT4aWqoEDOtJV6SW2M%2F8Xba%2FvON1UM6mm5VtUlRn1uTb0frODxc5WEmtGQHXDo0"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://jacobs.perkspot.com
accept-ranges: bytes
cf-ray: 683de7bd1cbe32be-CDG
vary: Accept-Encoding
content-length: 0
x-request-id: 61f7e935916687c2929deaea53e4194f

GET
H2 200 web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js Show response
static.zdassets.com/web_widget/latest/ Frame 80C3 337 B
931 B 58ms
57ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a3ab89bc8d4feb680748ba773ff13a07c2db610c1308ec9c12040aa9b65d46b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:58 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3080153
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: R0EMPM7SV24WKMWR
x-amz-id-2: aWz5ad5XM0iHyU++SxDxGYjYuW1Z0JSzwBoxQMyjMvXiyFhtmx5owXFlv1YsrrZfAiWHdGssAI4=
last-modified: Mon, 19 Jul 2021 02:04:04 GMT
server: cloudflare
etag: W/"200371227ff3b0fb85badb2d2faef3b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8pJy1hsAzwTNdHEaO617Gzrlcc%2Bgrn6pHlVq4k%2FYmkbyC6EjELm0EKx1TRAdemDaxSAHxl%2FOBzTwnKwKVp2s%2B2XKvb87dI59OiRKqLRZ%2Bgjjb%2BULlpttPBkrS8JBKnsWY4PfAhs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: ___O_wFiyDX4A56Xq4fDhtClHpW0qk0i
cf-ray: 683de7bf9e84fa78-AMS
expires: Tue, 19 Jul 2022 02:04:03 GMT

GET
H2 206 fda6cd35495c75f83508d9d2e77ee33d.mp3
static.zdassets.com/web_widget/latest/ Frame 80C3 19 KB
20 KB 97ms
97ms Media
audio/mpeg 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/fda6cd35495c75f83508d9d2e77ee33d.mp3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97e5b0b6cfc2ba9815028429c069631ba12b294aa7419d1ea130accd0adc2d46

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 24 Aug 2021 16:19:58 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: NBE21MG04831CSTW
x-amz-server-side-encryption: AES256
cf-ray: 683de7bffed7fa78-AMS
Content-Range: bytes 0-19697/19698
x-amz-replication-status: COMPLETED
Content-Length: 19698
x-amz-id-2: Qo5weh+OKI9a+ceZ8+kcvcFp7P3ljRl9MB+CysSzoQe03nhQJdH1jSjvVJ5f25WqrpF1av+d2vw=
last-modified: Mon, 23 Aug 2021 23:28:35 GMT
server: cloudflare
etag: "f11ce9e8f40a392830217253fe75d6de"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NRNPcE5T%2FWphDRHe1BoDpDxwYYHOuUIxeQLzbotKZ%2FhtFEfcGz1SlnbiZtt5z1ZiR9x0v1%2BMQfALEwg%2BMRWx4%2F7TjR%2BT3g%2BZ7xKs5nwFmRYF%2F0JipiJwDhpEwUU6Ap%2F6B%2B2%2Fn9s%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: O7Ps8bp437FYfPdbGZPcf1VBhcf9ZiJE
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: audio/mpeg; charset=utf-8
expires: Tue, 23 Aug 2022 23:28:34 GMT

GET
H2

200

Primary Request quiz Show response
page.firstleaf.club/
Redirect Chain

https://www.anrdoezrs.net/click-2097062-13552845?&sid=PEJ3Q6TIIVT5BHL32
https://cj.dotomi.com/o2115dlutB/lsx/ACEEBHDE/B9IG9FB/9/9/9?t=mA0v%3DhWbLiOlaanlNTZdLK%3c%3czBB7A%3A%2F%2FEEE.s59v6wH9A.5wB%3AQI%2Fu30u2-KIRPIOK-JLNNKQMN%3c%3cY%3czBB7A%3A%2F%2F1su6tA.7w92A76B.u64%...
https://www.emjcd.com/ro80tenm6/elq/35774A67/42B9284/2/6229264A688764949B:8LNeNVkpFyOM/4282378426h933geA5gh25Ae2c3A2734?s=a7xs%3DeTYIfLiXXkiKQWaIH%3cry3!CH4E-A9tsuys%3cw8847%3A%2F%2FBBB.p26s3tE67.2...
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shi...

146 KB
20 KB

210ms
183ms

Document
text/html

2606:4700:10::ac43:1a84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3185fb7f070716c9f9705f6eab9b4bbcb0d8c90c3b53eb9e894d315738e01dc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: page.firstleaf.club
:scheme: https
:path: /quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://jacobs.perkspot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Response headers

date: Tue, 24 Aug 2021 16:19:59 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 683de7c63aefc2ef-FRA
content-encoding: br

Redirect headers

Server: Server
Set-Cookie: S=400704284665427279:6JLcLTinDwMK; Max-Age=34041593; Domain=.emjcd.com; Path=/; Secure; SameSite=None LCLK=cjo!x2pz-vuedfjd; Max-Age=34041593; Domain=.emjcd.com; Path=/; Secure; SameSite=None CJSession=1214c40f-44ef-4874-acf2-e08e906b3487; Max-Age=-1; Domain=.emjcd.com; Path=/; Secure; SameSite=None S=400704284665427279:6JLcLTinDwMK; Max-Age=34041593; Domain=.emjcd.com; Path=/; Secure; SameSite=None
P3P: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
Cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Expires: Tue, 24 Aug 2021 16:19:59 GMT
Location: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Content-Type: text/html; charset=UTF-8
Connection: close
Transfer-Encoding: chunked
Date: Tue, 24 Aug 2021 16:19:58 GMT

POST collect
www.google-analytics.com/g/ 0
0

GET
H2 200 utils.4307b753f6f392018c32.js Show response
g.fastcdn.co/js/ 47 KB
16 KB 138ms
46ms Script
application/javascript 35.244.137.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://g.fastcdn.co/js/utils.4307b753f6f392018c32.js
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.137.202 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 202.137.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b96b4f9b3146047939f342700eb43b54b7ab687d070048efa199320fc250844e

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 00:14:07 GMT
content-encoding: gzip
age: 144352
x-guploader-uploadid: ADPycdvjo8cjKnw5zNS-jyVlfgm6_7vkW9vwu2ZQNH0D7sXKvIE8-x4bPpBn9l3nZ0IFWejYNHzXp8jD5fJUIA_36Iw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 16045
last-modified: Sun, 15 Aug 2021 09:35:28 GMT
server: UploadServer
etag: "3041b91068c7b521817389d49ee88aa6"
vary: Accept-Encoding
x-goog-hash: crc32c=DMZQJg==, md5=MEG5EGjHtSGBc4nUnuiKpg==
x-goog-generation: 1629020128855317
cache-control: public, max-age=31536000
x-goog-stored-content-length: 16045
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 23 Aug 2022 00:14:07 GMT

GET
H2 200 Cradle.4dac59f2328b0387640d.js Show response
g.fastcdn.co/js/ 20 KB
6 KB 133ms
41ms Script
application/javascript 35.244.137.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://g.fastcdn.co/js/Cradle.4dac59f2328b0387640d.js
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.137.202 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 202.137.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 871a395274807a496ca51c603b7320eca9fc11a7949c0df992be96f29dcb7211

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 00:12:53 GMT
content-encoding: gzip
age: 58026
x-guploader-uploadid: ADPycds_FIq_3mMMbWbuZQ6Lv-uEFQ7NpD3dP1Jm-SoNolI2AARGtEVBYzH3qhV66MH9uVpaXSEUa0NSo1dCM8kdaDE
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 5581
last-modified: Mon, 23 Aug 2021 15:13:03 GMT
server: UploadServer
etag: "e65424f8c2aaa7264ae3eaf852934882"
vary: Accept-Encoding
x-goog-hash: crc32c=MHgq+w==, md5=5lQk+MKqpyZK4+r4UpNIgg==
x-goog-generation: 1629731583106077
cache-control: public, max-age=31536000
x-goog-stored-content-length: 5581
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 00:12:53 GMT

GET
H2 200 LazyImage.b311ea858a228d7bc9b2.js Show response
g.fastcdn.co/js/ 3 KB
2 KB 228ms
137ms Script
application/javascript 35.244.137.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://g.fastcdn.co/js/LazyImage.b311ea858a228d7bc9b2.js
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.137.202 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 202.137.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 7e7c84efcf8e336f390d7a51a24cba3873782769b33470b31d2cef95b2f01cee

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 14:10:03 GMT
content-encoding: gzip
age: 7796
x-guploader-uploadid: ADPycds9lQ2REdWU-d4VFlp7Bd8rIV1c3sC-n8lTDlYF7utSGyZak6v9oR9Q4fguPR_XIe-aWu655wazALZCi0uEC_Pu5E1b5Q
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 1563
last-modified: Mon, 23 Aug 2021 15:13:03 GMT
server: UploadServer
etag: "4fada7192ed3976ed69f137f5aaeab12"
vary: Accept-Encoding
x-goog-hash: crc32c=FGzgaA==, md5=T62nGS7Tl27WnxN/Wq6rEg==
x-goog-generation: 1629731583687744
cache-control: public, max-age=31536000
x-goog-stored-content-length: 1563
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 14:10:03 GMT

GET
H3-29 200 css
fonts.googleapis.com/ 3 KB
574 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400,700

Requested by

Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

162a3eebb385684e99a8b624b77189f9b5c38cb51d1b814c1c3a84fc17c324a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 24 Aug 2021 14:37:59 GMT
server: ESF
date: Tue, 24 Aug 2021 16:19:59 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 24 Aug 2021 16:19:59 GMT

GET
H3-29 200 gtm.js Show response
www.googletagmanager.com/ 252 KB
72 KB 35ms
35ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

44bf4e4a70686f89b0205cf1ddac04c3f26368f6512380169cb3a996d8e4f236

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:59 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73289
x-xss-protection: 0
last-modified: Tue, 24 Aug 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 24 Aug 2021 16:19:59 GMT

GET
H2 200 LegacyVendors.d341954906ae69acee39.js Show response
g.fastcdn.co/js/ 95 KB
33 KB 227ms
137ms Script
application/javascript 35.244.137.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://g.fastcdn.co/js/LegacyVendors.d341954906ae69acee39.js
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.137.202 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 202.137.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 95bdb8a3cd90e91621c9e68d4b157dd7fedab021ee89e9e173d17f93f0f03305

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 21 Aug 2021 22:12:58 GMT
content-encoding: gzip
age: 238021
x-guploader-uploadid: ADPycdteBzXi_ufwpFbK4XrVn9wam-o9_3bid3YAkZc41v2IoyabuTnj2cI3KjrwsR5Adzxq4V5UEBGBUoAudGj23zc
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 33710
last-modified: Sun, 15 Aug 2021 09:35:27 GMT
server: UploadServer
etag: "fc551ad7e347bf019785e719fab1ba31"
vary: Accept-Encoding
x-goog-hash: crc32c=MgUolg==, md5=/FUa1+NHvwGXhecZ+rG6MQ==
x-goog-generation: 1629020127511133
cache-control: public, max-age=31536000
x-goog-stored-content-length: 33710
accept-ranges: bytes
content-type: application/javascript
expires: Sun, 21 Aug 2022 22:12:58 GMT

GET
H2 200 caslon.css
d1hdjv7b05hja2.cloudfront.net/fonts/ 2 KB
1 KB 49ms
16ms Stylesheet
text/css 2600:9000:20eb:4200:b:dc44:3680:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1hdjv7b05hja2.cloudfront.net/fonts/caslon.css
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4200:b:dc44:3680:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c77d5979a9eb0e45bd243053b0724ea63b2d3381a0b43a3ec80ad58df66cf781

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 09:22:40 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2017 18:11:11 GMT
server: AmazonS3
age: 457040
etag: W/"b57f1c931d356c98dde8a5d98c98605d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 59d92388a3a66e5f245f384a437fa025.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: EN4G3IiD8SvdcWOkWmOIhbYAhkTUjRR0nMJFifJNnVARXOjNWwV1Mw==

GET
H2

200

007ADF49EA9D333D0.css
www.firstleaf.club/fonts/687751/
Redirect Chain

https://cloud.typography.com/7410416/6307592/css/fonts.css
https://www.firstleaf.club/fonts/687751/007ADF49EA9D333D0.css

250 KB
186 KB

39ms
28ms

Stylesheet
text/css

2606:4700:10::ac43:1a84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.firstleaf.club/fonts/687751/007ADF49EA9D333D0.css
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7160bf300aedb0d16945e3ee5e15851ac0f21c571e2d4632e121eb6f1ab1d9aa

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:00 GMT
via: 1.1 debe291145dc27044f50d04bac101cd9.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 457382
cf-polished: origSize=257416
x-cache: Hit from cloudfront
content-encoding: br
last-modified: Mon, 28 Oct 2019 20:45:31 GMT
server: cloudflare
etag: W/"07e30349aeb157501123c221264ec810"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000, immutable
x-amz-cf-pop: FRA2-C2
cf-ray: 683de7d1fb75c2ef-FRA
x-amz-cf-id: _lCEIUFytqQfOFB124RPL8LzXf6VFeASasU-eYwrbkU6SkQXDurD9A==
cf-bgj: minify

Redirect headers

Date: Tue, 24 Aug 2021 16:20:00 GMT
Last-Modified: Fri, 21 Sep 2018 14:37:41 GMT
Server: AkamaiNetStorage
ETag: "a71d9ac9ba4b6206174d8d4e5688ba41:1537540658"
Content-Type: text/html
Location: https://www.firstleaf.club/fonts/687751/007ADF49EA9D333D0.css
Cache-Control: must-revalidate, private
Connection: keep-alive
X-HCo-pid: 16
Content-Length: 154
Expires: Tue, 24 August 2021 16:20:00 GMT

GET
H2 200 api.js Show response
page.firstleaf.club/cdn-cgi/bm/cv/669835187/ 35 KB
9 KB 12ms
12ms Script
text/javascript 2606:4700:10::ac43:1a84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://page.firstleaf.club/cdn-cgi/bm/cv/669835187/api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /cdn-cgi/bm/cv/669835187/api.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: page.firstleaf.club
referer: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=604800, public
cf-ray: 683de7c94f2ec2ef-FRA

GET
H2 200 54813432-0-arrow-white.png
v.fastcdn.co/u/814df80e/ 636 B
1 KB 215ms
54ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/54813432-0-arrow-white.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D42) /
Resource Hash: e4ebb4fc0904aae6b08aaa40be3f5d6d1bc00794ef5f3bb0d608b3e2428f4ec4

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:59 GMT
x-goog-stored-content-length: 636
age: 19437432
x-guploader-uploadid: ABg5-UzTfgY2mFT-ddq93PSVMMd55oV9BcW6VRyqe3blZ340nD0by5DhwoR4xn7S_lWeMzhC9UEzXFucfTTB3IockWfGjOuFXg
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Sun, 06 Feb 2022 06:12:49 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 636
last-modified: Wed, 16 Dec 2020 14:12:49 GMT
server: ECS (lcy/1D42)
etag: "9b3ce0934e7db12b851b49e29a3e07f5"
x-goog-hash: crc32c=/4dFFw==, md5=mzzgk059sSuFG0nimj4H9Q==
content-type: image/png
x-goog-generation: 1608127969121144
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:19:59 GMT

GET
H2 200 23347456-0-FL-Logotype-Purple.png
v.fastcdn.co/u/814df80e/ 17 KB
17 KB 110ms
53ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/23347456-0-FL-Logotype-Purple.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D6B) /
Resource Hash: 9fd678871d5c502175e5233f33bb7c2cb09eda96eebfa139f527b72683f8b92b

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:59 GMT
x-goog-stored-content-length: 17202
age: 3185631
x-guploader-uploadid: ADPycdu7JvcagYlv6uqgwBrVVE11mUL3aa5DoYmDB6ZJMVXexs35z_dr2OmjKE-n-cp9GuwOvzlfVOxNlLIS3uwrSC8
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Fri, 07 Dec 2018 11:23:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17202
last-modified: Mon, 16 Oct 2017 19:23:22 GMT
server: ECS (lcy/1D6B)
etag: "91be8ccb9b70cd700493193ba595a315"
x-goog-hash: crc32c=Gxw+uA==, md5=kb6My5twzXAEkxk7pZWjFQ==
content-type: image/png
x-goog-generation: 1508181802058066
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:19:59 GMT

GET
H2 200 57204196-0-business-insider.png
v.fastcdn.co/u/814df80e/ 28 KB
29 KB 53ms
53ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/57204196-0-business-insider.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D73) /
Resource Hash: c151d0f1c12c1ca6dc262f901b62a2e595d7da89411a6a43101d869f015d666e

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:19:59 GMT
x-goog-stored-content-length: 29171
age: 8790269
x-guploader-uploadid: ABg5-UzdW6ka2hxYrz1BfxfrRzBs_YAR2cVWn63_TFtNrUzIScWDPSx_lvTuPV01flVU2MvbPder2RN04F18XKOHuxPFb7Z5Og
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Tue, 05 Jul 2022 09:05:08 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29171
last-modified: Fri, 14 May 2021 17:05:09 GMT
server: ECS (lcy/1D73)
etag: "5216af290f0c54de89ea433971372a83"
x-goog-hash: crc32c=SmLmag==, md5=UhavKQ8MVN6J6kM5cTcqgw==
content-type: image/png
x-goog-generation: 1621011909303979
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:19:59 GMT

GET
H2 200 57204191-0-vogue.png
v.fastcdn.co/u/814df80e/ 17 KB
18 KB 54ms
54ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/57204191-0-vogue.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D1E) /
Resource Hash: 5f9fdb61e50cacfa4aeb8191d50c647ce1507ab13801d8848d4d00be1ad6bf1d

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:00 GMT
x-goog-stored-content-length: 17875
age: 8790270
x-guploader-uploadid: ABg5-Uy1EeViW5NdC6pkf2nAAHxHvhHUnaivPWwLRtx6JQDHjImLRIb2Bn5adzm9DxLLmY9lxItIKFWjKi0TDiWzCTublbP-bQ
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Tue, 05 Jul 2022 09:05:08 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17875
last-modified: Fri, 14 May 2021 17:05:09 GMT
server: ECS (lcy/1D1E)
etag: "3432492be420658e97b2ba4ceb1eea7c"
x-goog-hash: crc32c=u8wyRA==, md5=NDJJK+QgZY6XsrpM6x7qfA==
content-type: image/png
x-goog-generation: 1621011909066491
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:00 GMT

GET
H2 200 57204171-0-gq.png
v.fastcdn.co/u/814df80e/ 9 KB
9 KB 53ms
53ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/57204171-0-gq.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D6A) /
Resource Hash: bafaf035161ee03b515d06003c1c5559b047e4ab9f72302843850618740482a8

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:00 GMT
x-goog-stored-content-length: 9386
age: 8790269
x-guploader-uploadid: ABg5-UwAyJJhrZiHxK2hUPHplMx855_v_YEx3bFCSBghy0RIc2UtaQEnKNs_mTKJBTAAvJdYD_EP9WnLxP86kCDVYWY
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Tue, 05 Jul 2022 09:05:08 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9386
last-modified: Fri, 14 May 2021 17:05:09 GMT
server: ECS (lcy/1D6A)
etag: "7f99b37bf6bdc29c1a9ee3e816ceb3d5"
x-goog-hash: crc32c=t04dTA==, md5=f5mze/a9wpwanuPoFs6z1Q==
content-type: image/png
x-goog-generation: 1621011908989260
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:00 GMT

GET
H2 200 57204206-0-delish.png
v.fastcdn.co/u/814df80e/ 17 KB
17 KB 54ms
54ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/57204206-0-delish.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D4D) /
Resource Hash: db398ae2a6bcdac2506e0b532026b62c4058013a757d28b613a1188de22a066b

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:00 GMT
x-goog-stored-content-length: 16921
age: 8790269
x-guploader-uploadid: ABg5-Uw8NyETMbb3zz3irFfQOkUehYciyr1bA961ka4Vkp1rKlXyP8Ot9BUpCAyKJhqVJIQfG23ENA93tNk3ukAtt4I
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Tue, 05 Jul 2022 09:05:08 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16921
last-modified: Fri, 14 May 2021 17:05:09 GMT
server: ECS (lcy/1D4D)
etag: "1ce57fe4062960f2d21bdf90690e69d2"
x-goog-hash: crc32c=q9l9Rw==, md5=HOV/5AYpYPLSG9+QaQ5p0g==
content-type: image/png
x-goog-generation: 1621011909228430
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:00 GMT

GET
H2 200 57204176-0-et.png
v.fastcdn.co/u/814df80e/ 4 KB
5 KB 53ms
53ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/57204176-0-et.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D73) /
Resource Hash: 1a764c2e4e6cc6808b49bff5d27d1db28790d291c525f3849e12fc492fb62076

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:00 GMT
x-goog-stored-content-length: 4423
age: 5797534
x-guploader-uploadid: ABg5-UwRsbK0t0IsTngznZKfsDXWyYIw9Nxa9QMkV8NMXcM7954oxQryDxwZ6sjxFg0DAe9fnEkgkfllyt77fcdvV5Y
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Tue, 05 Jul 2022 09:05:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4423
last-modified: Fri, 14 May 2021 17:05:09 GMT
server: ECS (lcy/1D73)
etag: "bfc4ce6c42752f3d3616129a3b786dcf"
x-goog-hash: crc32c=cEXsAQ==, md5=v8TObEJ1Lz02FhKaO3htzw==
content-type: image/png
x-goog-generation: 1621011909008666
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:00 GMT

GET
H2 200 56646297-0-Small-D2-1.png
v.fastcdn.co/u/814df80e/ 63 KB
64 KB 54ms
53ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/56646297-0-Small-D2-1.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D27) /
Resource Hash: 55a72ceec0d570523aea5267ed47bbefe802949f7c3b7426554f277f96b1344f

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:00 GMT
x-goog-stored-content-length: 64658
age: 4746229
x-guploader-uploadid: ADPycdvkpxW9PrWqVeI2NWQ5QgssvRoS1X43Fyvkcakq4BWdjqQ-EJ9nD5Vi4eOEMnQrnc64qfJqB8E21afAR0iXYw
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Fri, 03 Jun 2022 06:23:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64658
last-modified: Mon, 12 Apr 2021 14:23:13 GMT
server: ECS (lcy/1D27)
etag: "0e0d30cbebfadb32c097023f27d28561"
x-goog-hash: crc32c=X+uUSA==, md5=Dg0wy+v62zLAlwI/J9KFYQ==
content-type: image/png
x-goog-generation: 1618237393811889
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:00 GMT

GET
H2 200 lib.js Show response
heatmap-events-collector.instapage.com/static/ 24 KB
9 KB 950ms
149ms Script
application/javascript 35.222.120.150
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://heatmap-events-collector.instapage.com/static/lib.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.222.120.150 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

150.120.222.35.bc.googleusercontent.com

Software

Resource Hash

9f4331078abd467835bcf0b2367872f497045d37ebfb32fe7d9f82cf6843d282

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=315360000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-dns-prefetch-control: off
strict-transport-security: max-age=315360000; includeSubDomains
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 18 Jun 2021 12:00:17 GMT
x-frame-options: SAMEORIGIN
date: Tue, 24 Aug 2021 16:20:01 GMT
expect-ct: max-age=0
vary: Accept-Encoding, Accept-Encoding
x-download-options: noopen
content-type: application/javascript; charset=UTF-8
cache-control: public, must-revalidate, public
access-control-allow-credentials: true
accept-ranges: bytes
expires: Tue, 24 Aug 2021 16:25:01 GMT

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 13 KB
5 KB 44ms
44ms Script
text/javascript 2606:4700::6810:5e41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e567066985125e7974f68b42914dcb134e3c38373a4a3d668bdb38a3e55f299

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
content-encoding: gzip
last-modified: Wed, 18 Aug 2021 21:41:27 GMT
server: cloudflare
etag: W/2021.5.3
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 683de7d23aa31f11-FRA

GET
H2 200 it.js Show response
cdn.instapagemetrics.com/t/js/3/ 70 KB
23 KB 156ms
43ms Script
application/javascript 34.120.27.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.instapagemetrics.com/t/js/3/it.js
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.27.38 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 38.27.120.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 6038138cc175775b42f31d117e20be6d12d56bc495b4ccac86f2db8ca6b1240b

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 12:06:55 GMT
content-encoding: gzip
age: 1224786
x-guploader-uploadid: ADPycdtE5RoNgEVJVVUSkL9o6KWGfiOwVLIE21ySUz6PAOWGM0t8ted4le84jY9Tx1TkVX6VMgMSvgn-3vjthS0clA0
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
x-goog-meta-tracker-version: 3
alt-svc: clear
content-length: 22752
last-modified: Tue, 10 Aug 2021 12:06:52 GMT
server: UploadServer
etag: "0a9dbbebc38c034f126f15aea8be1281"
x-goog-hash: crc32c=DGiIsw==, md5=Cp2768OMA08SbxWuqL4SgQ==
x-goog-generation: 1628597212109848
cache-control: no-transform
x-goog-stored-content-length: 22752
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 10 Aug 2022 12:06:55 GMT

GET
H2 200 sptw.3.js Show response
g.fastcdn.co/js/ 9 KB
3 KB 47ms
44ms Script
application/javascript 35.244.137.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://g.fastcdn.co/js/sptw.3.js
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.137.202 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 202.137.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: ee59049a77ecefd16b8b808229676b9f061ca97da27d3daf1271ef59dd5268e2

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 11:11:55 GMT
content-encoding: gzip
age: 1228086
x-guploader-uploadid: ADPycdsJndaELSJey0uzkyswSH5SupBbKOzQvKPIOXJRsCgN58stLI_1kOEz722Zd-BGe28SsMFoL2aLDiIlCtGiNJo
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 2984
last-modified: Tue, 10 Aug 2021 11:10:24 GMT
server: UploadServer
etag: "63285d34126a5466b0deebb6536b4545"
vary: Accept-Encoding
x-goog-hash: crc32c=++isQw==, md5=YyhdNBJqVGaw3uu2U2tFRQ==
x-goog-generation: 1628593824250788
cache-control: public, max-age=31536000
x-goog-stored-content-length: 2984
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 10 Aug 2022 11:11:55 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 30 KB
9 KB 32ms
28ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5c1282fb121104f5a505ecbfd7194e64c98db6b830684450dcfc478021d05257

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:00 GMT
content-encoding: gzip
last-modified: Wed, 28 Jul 2021 18:27:37 GMT
x-msedge-ref: Ref A: 7142AD05DD984AB7B109AA35FC0462DA Ref B: FRAEDGE1406 Ref C: 2021-08-24T16:20:01Z
etag: "80f2963dde83d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 9024

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 155ms
42ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
via: 1.1 varnish
last-modified: Mon, 12 Jul 2021 21:25:31 GMT
age: 47602
etag: "65cf0c0ceb852397f0d1e6732cd3c533+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1958
x-timer: S1629822001.136769,VS0,VE0
x-served-by: cache-fra19136-FRA

GET
H3-29 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Jul 2021 18:24:06 GMT
server: Golfe2
age: 2609
date: Tue, 24 Aug 2021 15:36:32 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19672
expires: Tue, 24 Aug 2021 17:36:32 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 22 KB
7 KB 154ms
42ms Script
application/javascript 151.101.13.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 7125a66456daa35dd3e3e8cca4b9523e05caf0b4fa5bd5874676e7c6db40f3aa

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
via: 1.1 varnish, 1.1 varnish
last-modified: Wed, 14 Jul 2021 17:50:00 GMT
server: snooserv
etag: "912f60c72fda50b2f21068c65115175d"
vary: Accept-Encoding,Origin
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-encoding: gzip
content-length: 7018

GET
H2 200 firstleaf.js Show response
init.blackcrow.ai/js/core/ 0
385 B 204ms
80ms Script
application/javascript 13.224.196.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://init.blackcrow.ai/js/core/firstleaf.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.196.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-196-60.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 15:50:15 GMT
via: 1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
last-modified: Tue, 24 Aug 2021 15:50:02 GMT
server: AmazonS3
age: 1787
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-cache: Error from cloudfront
x-amz-version-id: .K6q8NVDZd2tauXKks3wDVmXAcNVbpnJ
cache-control: max-age=600
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: application/javascript
content-length: 0
x-amz-cf-id: GqILmH6dHgs7K1s87KnkVUnjtmAUvRX0L6BoiHGWEZSNd_LyZq5NZQ==

GET
H2 200 scevent.min.js Show response
sc-static.net/ 15 KB
6 KB 227ms
116ms Script
application/javascript 13.224.102.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-6.zrh50.r.cloudfront.net
Software: CloudFront /
Resource Hash: a92b99b413aa8afe65e9a4943c148fdedab142e7b913dafc52a040d850a5b197

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
content-encoding: gzip
server: CloudFront
x-amz-cf-pop: ZRH50-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 5873
via: 1.1 6b0e09b8a7d995016df1513b4b11c17e.cloudfront.net (CloudFront)
x-amz-cf-id: z7Zb791r_EUelfZtYleiWglKaUQ63lhnUbcHJvDyvpUgcISp13GY7w==

GET
H/1.1

200
OK

ppt=8312;g=sitewide;gid=27870;ord=undefined
trkn.us/pixel/conv/
Redirect Chain

https://trkn.us/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=216706079
https://trkn.us/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=216706079;ip=194.99.105.101;cuidchk=1

42 B
780 B

594ms
593ms

Image
image/gif

52.206.179.19
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trkn.us/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=216706079;ip=194.99.105.101;cuidchk=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.179.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-179-19.compute-1.amazonaws.com

Software

Apache /

Resource Hash

b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 24 Aug 2021 16:20:01 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 9 Nov 1980 12:59:00 GMT
Server: Apache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Sun, 9 Nov 1980 12:58:00 GMT

Redirect headers

Date: Tue, 24 Aug 2021 16:20:01 GMT
X-Content-Type-Options: nosniff
Server: Apache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: /pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=216706079;ip=194.99.105.101;cuidchk=1
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 0

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bdeda331b720b33bf5b8bc88d52d16a1c40da840b41f4692e3ed70253fed9486

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 54990801-0-bottle-lite.jpg
v.fastcdn.co/u/814df80e/ 128 KB
129 KB 56ms
54ms Image
image/jpeg 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/54990801-0-bottle-lite.jpg
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D68) /
Resource Hash: d96709da01a87621fce7114b4f51beabccde158af5ddb2e4de80ef900f10bd59

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
x-goog-stored-content-length: 131274
age: 19429505
x-guploader-uploadid: ABg5-UxPgI7_0LBNTuA6qdngypckKXmjkjyFRMKATMPoWNMICPZihorF-B7E9wrJUDZO9eoAwHw9IZHLJnOWUrzTNTE
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Fri, 25 Feb 2022 06:41:15 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131274
last-modified: Mon, 04 Jan 2021 14:41:15 GMT
server: ECS (lcy/1D68)
etag: "99be48c2c3bac4ed61960bd9b8e222af"
x-goog-hash: crc32c=3LkmBw==, md5=mb5IwsO6xO1hlgvZuOIirw==
content-type: image/jpeg
x-goog-generation: 1609771275144629
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:01 GMT

GET
H2 200 57204186-0-paste.png
v.fastcdn.co/u/814df80e/ 31 KB
31 KB 107ms
106ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/57204186-0-paste.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D63) /
Resource Hash: 200d01f0cd516bfaff8f477ceb07b4eb083cf7e56ac403153175071990d53380

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
x-goog-stored-content-length: 31603
age: 8790270
x-guploader-uploadid: ABg5-Uyl80oc0M1SnmqAKEUUeECBC5F2Mk-ai0pe_6nQM0k8cq1_DUY48IC_MGXJBZueUEsSmQbAQYLm2EL5-cLGmntzNqyvhg
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Tue, 05 Jul 2022 09:05:08 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31603
last-modified: Fri, 14 May 2021 17:05:09 GMT
server: ECS (lcy/1D63)
etag: "9278f8b4a78cd46142d945adcefff7a0"
x-goog-hash: crc32c=f60Q6g==, md5=knj4tKeM1GFC2UWtzv/3oA==
content-type: image/png
x-goog-generation: 1621011909001396
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:01 GMT

GET
H2 200 57204201-0-refinery29.png
v.fastcdn.co/u/814df80e/ 40 KB
41 KB 108ms
107ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/57204201-0-refinery29.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D3D) /
Resource Hash: 437a1672bb11b8d01e8867a7cbe9f16fb1b6217b3849f15f4247ab19cb5d6a34

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
x-goog-stored-content-length: 41331
age: 8790266
x-guploader-uploadid: ABg5-Uwj0nIpus0a3x8oxSULlDloB3taOxBAzob7ILIoKht5paZxI2HyfEfTJY8A5RLhYSP_7lhFeu5Nsr5n0X4CUhnuKKHRCA
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Tue, 05 Jul 2022 09:05:08 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41331
last-modified: Fri, 14 May 2021 17:05:09 GMT
server: ECS (lcy/1D3D)
etag: "c8e016856d74d6259c41be0e86645823"
x-goog-hash: crc32c=yjX0Uw==, md5=yOAWhW101iWcQb4OhmRYIw==
content-type: image/png
x-goog-generation: 1621011909071940
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:01 GMT

GET
H2 200 57204181-0-foodandwine.png
v.fastcdn.co/u/814df80e/ 35 KB
36 KB 109ms
108ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/57204181-0-foodandwine.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D23) /
Resource Hash: 364571a2f5be79b1b7cd8ed5e011ac1d62d3c05326b879582018d4bed97cac49

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
x-goog-stored-content-length: 36135
age: 8790271
x-guploader-uploadid: ABg5-UwPwhHbIek3IQ1-YvZwvHBv8mJ6cxhIK24cqHTQYk1wqrgL_1NYnig5T75s6MBUNzAz-6DoIVdVLrLCuqy1Z4w
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Tue, 05 Jul 2022 09:05:08 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36135
last-modified: Fri, 14 May 2021 17:05:09 GMT
server: ECS (lcy/1D23)
etag: "8c1f2a774ccff73bdbf2e04246b92a9b"
x-goog-hash: crc32c=fS7Rqw==, md5=jB8qd0zP9zvb8uBCRrkqmw==
content-type: image/png
x-goog-generation: 1621011908988696
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:01 GMT

GET
H2 200 56049276-0-BI-LOGO.png
v.fastcdn.co/u/814df80e/ 12 KB
12 KB 109ms
108ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/56049276-0-BI-LOGO.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D35) /
Resource Hash: c3060cd252f0a0a5f81a15fbef41b596d2db68cefe3de3e0a8c16fdc7177da0f

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
x-goog-stored-content-length: 11913
age: 14234146
x-guploader-uploadid: ABg5-Uzd4lKHLhfXha9jZ6C9KFoFfTmpN-2DvZP7rKnFe0g0ypqAYifYKEsqgvOnOllFjrEDeCaK9nZ932t2O4RN6dvln2uelw
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Fri, 29 Apr 2022 08:16:26 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11913
last-modified: Mon, 08 Mar 2021 16:16:26 GMT
server: ECS (lcy/1D35)
etag: "39667f4eb045b98dfec8064b4bdb4304"
x-goog-hash: crc32c=FNkYpw==, md5=OWZ/TrBFuY3+yAZLS9tDBA==
content-type: image/png
x-goog-generation: 1615220186183268
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:01 GMT

GET
H2 200 52332085-0-bottle-bg-1.jpg
v.fastcdn.co/u/814df80e/ 66 KB
67 KB 108ms
108ms Image
image/jpeg 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/52332085-0-bottle-bg-1.jpg
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D4E) /
Resource Hash: e62bc837007999cb7c58bb6aab499ba2d02bd49c40149db8bc60936e982564e4

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
x-goog-stored-content-length: 67756
age: 8533044
x-guploader-uploadid: ABg5-UyuFZRXIO6ijNwVCUinamsr6aw3pqb6GJOSZgQbYVvq_7NFNRNyetWxBi2t9wESqATImizBP52CvCGU3Owk-rK01_FRvA
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Tue, 14 Sep 2021 11:15:19 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67756
last-modified: Fri, 24 Jul 2020 19:15:19 GMT
server: ECS (lcy/1D4E)
etag: "18a3af3f9355df6af36b15c272b650b5"
x-goog-hash: crc32c=hNIVng==, md5=GKOvP5NV32rzaxXCcrZQtQ==
content-type: image/jpeg
x-goog-generation: 1595618119206778
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:01 GMT

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a899a0398bbfbb8343c67e83098446254c1609aae412962cff6929087135a51c

Request headers

Origin: https://page.firstleaf.club
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393

Request headers

Origin: https://page.firstleaf.club
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 16 KB
16 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01af466f48d14857d97a67cd7025ce67c8a0b9ca83ddb6d3f313c7369c432868

Request headers

Origin: https://page.firstleaf.club
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c

Request headers

Origin: https://page.firstleaf.club
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 1508181802-23347456-150x150-FL-Logotype-Purple.png
v.fastcdn.co/t/thumbnail/20171016/ 47 KB
47 KB 54ms
54ms Image
image/png 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/t/thumbnail/20171016/1508181802-23347456-150x150-FL-Logotype-Purple.png
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D29) /
Resource Hash: f201df44d5c747fcb0e34380d77409cd02be1f6e8810138d75394674b057a929

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
x-goog-stored-content-length: 48123
age: 19438377
x-guploader-uploadid: ABg5-Uylf316tgbmdqZTgq40fT-A8UHiFpOGu3dFPPT8KZMP0AuJskecyouGe5Uwk-sgrDN13HOSrTL9eB24xhmdv-c
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Fri, 07 Dec 2018 11:23:26 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48123
last-modified: Mon, 16 Oct 2017 19:23:26 GMT
server: ECS (lcy/1D29)
etag: "ce787594c24907600a864463e0a96b8e"
x-goog-hash: crc32c=M5S3hg==, md5=znh1lMJJB2AKhkRj4Klrjg==
content-type: image/png
x-goog-generation: 1508181806504663
cache-control: max-age=315360000, public
x-goog-meta-content-length: 48123
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:01 GMT

GET
H2 200 snippet.js Show response
static.zdassets.com/ekr/ 20 KB
6 KB 98ms
98ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

16cc547456ffa0052c3679e6c5ece2e14ad57c92b93562deb7bcb5829b7afcb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: NRDNPYMMZ4S18PZE
x-amz-id-2: dVvIcGiItj+FCXRbr8R9Cjzga2b7f4HYvsNabDq92dxyCx7E6N2w1OADyK2ZNSFGQkVQ2iO2uKo=
last-modified: Wed, 09 Jun 2021 00:08:59 GMT
server: cloudflare
etag: W/"cc904f41324148b571599b3b02fdec0b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=41vJQsEedbBBpmiBG9ksViTsIbyHni1J1fEJS2gKARJfmvwMxF%2F0QEd%2FtlE%2FyvsQWJuezRDtNiR9TjiQmbGHvnJBnfV5VVvy9agvTB6heCdUlqVnjPGJ5HtmI5EiJhn%2BVmt7o6k%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=60
x-amz-version-id: VFukQxfz8SFs4LT0u8yzm_CAm2zq09sT
cf-ray: 683de7d31bb2fa78-AMS

GET
H2 200 hotjar-465352.js Show response
static.hotjar.com/c/ 5 KB
2 KB 197ms
94ms Script
application/javascript 13.224.102.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-465352.js?sv=7

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.102.20 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-102-20.zrh50.r.cloudfront.net

Software

Resource Hash

9109f62db3dea9641df567a892e97d9338cd63248fb97f6c4903eb33a4dfbb60

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
x-amz-cf-pop: ZRH50-C1
etag: W/c38e3c83513696c50763dec7776f8165
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
x-amz-cf-id: ftXJhIXJR4avM-9Wr6RGSUGFJ9VzKvqMZAmwsvJIAUh89BtfwqqznA==
via: 1.1 4ee178becf6bd81a5ce90c64ae0621b5.cloudfront.net (CloudFront)

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1046601/ 74 KB
25 KB 296ms
293ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1046601/tfa.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2066a5c2ea3def6ac7eb16471ef8c07c031e70970d70275185fbe53d0ae85bac

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: 7gesz5nXiQgTjQ7ODNoxBwVIlEYePgPi
content-encoding: gzip
etag: "cbe162c1677acea51cbda01d4b18b8ba"
age: 0
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 24762
x-amz-id-2: 1TT6Ccm/O+ZYOxyZtd6BAhOPLfZbyJdVLmmI0Zn5DPDCg8FAnoJMniBF+SQU7WM+XEN93dtljkQ=
x-served-by: cache-fra19167-FRA
last-modified: Mon, 09 Aug 2021 10:25:28 GMT
server: AmazonS3
x-timer: S1629822001.136817,VS0,VE212
date: Tue, 24 Aug 2021 16:20:01 GMT
vary: Accept-Encoding
x-amz-request-id: T47NNEZ0SKPFTZ7Z
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 62
x-cache-hits: 1

GET
H/1.1 200
OK wxyz.js Show response
rbv9j7km.firstleaf.club/assets/ 43 KB
10 KB 658ms
146ms Script
application/javascript 159.203.152.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://rbv9j7km.firstleaf.club/assets/wxyz.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.203.152.67 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: openresty /
Resource Hash: 779ea318ca1aa1b8d459103115b7ed6ce64ccc1e411a816ca7806b09e3f03bc5

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:01 GMT
Content-Encoding: gzip
Server: openresty
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/javascript

GET
H/1.1 200
OK tv2track.js Show response
collector-7547.tvsquared.com/ 20 KB
9 KB 760ms
141ms Script
application/javascript 3.12.200.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-7547.tvsquared.com/tv2track.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.12.200.117 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-12-200-117.us-east-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:01 GMT
Content-Encoding: gzip
Last-Modified: Fri, 02 Jul 2021 14:21:37 GMT
Server: nginx
ETag: "60df20f1-2133"
Content-Type: application/javascript
Cache-Control: max-age=600
Connection: keep-alive
X-Robots-Tag: noindex
Content-Length: 8499
Expires: Tue, 24 Aug 2021 16:30:01 GMT

GET
H2 200 star.gif
jelly.mdhv.io/v1/ 43 B
235 B 349ms
190ms Image
image/gif 216.239.36.21
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jelly.mdhv.io/v1/star.gif?pid=S1QWtdGepedvdhZ2jCn2PVKP4IsF&src=mh&evt=hi&url=/quiz&ifa=[device_id]&uid=undefined&ord=undefined&rev=undefined
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.36.21 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: any-in-2415.1e100.net
Software: Google Frontend /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:20:01 GMT
server: Google Frontend
content-type: image/gif
x-cloud-trace-context: 79b1653239fcc7bb05fdea2a18f66fac
cache-control: no-store,no-cache,must-revalidate,max-age=0,post-check=0,pre-check=0
content-length: 43
expires: -1

GET
H2 200 D22CCB709CDC50.js Show response
cdn.datasteam.io/js/ 70 KB
23 KB 198ms
93ms Script
application/x-javascript 13.225.87.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.datasteam.io/js/D22CCB709CDC50.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-11.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 97f5ecdc5516a2af7d1d027d72a74f42e41755e0039f330331cd66bd330e7b39

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 22:52:43 GMT
content-encoding: gzip
last-modified: Mon, 05 Apr 2021 20:11:28 GMT
server: AmazonS3
age: 62839
etag: W/"013875b925c46b5f1a7965baf37eee42"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 32e3b86ae254a231182567c0124af893.cloudfront.net (CloudFront)
cache-control: max-age=600,s-maxage=86400
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: FqXhG5IWCBund8HSE5alESvVXWcXlFEcODvzUIcesRn20ge8qFK84Q==

GET
H2 200 sp-at-v2-14-0.js Show response
images.firstleaf.club/js/ 97 KB
30 KB 65ms
52ms Script
application/javascript 2606:4700:10::ac43:1a84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://images.firstleaf.club/js/sp-at-v2-14-0.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffb92ab9eefa3b6e3f6313d9a4194715887b0b8442d7be6cd1a472db7e810e5a

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
via: 1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-cf-pop: FRA2-C1
cf-polished: origSize=100349
x-cache: Hit from cloudfront
content-encoding: br
last-modified: Mon, 27 Jul 2020 04:28:00 GMT
server: cloudflare
etag: W/"8dba669b94e3865c9205ef8fd15ee4d1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=5356800
cf-ray: 683de7d3adc1c2ef-FRA
x-amz-cf-id: nhHLRYaiQjJk16lz7XN16Hco-9sNmxX3JLlQ9alz1uq_3x1KPPCVPg==
cf-bgj: minify

GET
H2 200 c8fdefca-b38f-49ff-a307-bcb109f7aefb-latest.js Show response
d2hrivdxn8ekm8.cloudfront.net/tag-manager/ 275 B
651 B 34ms
8ms Script
application/javascript 2600:9000:21f3:2600:17:3f5c:f800:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2hrivdxn8ekm8.cloudfront.net/tag-manager/c8fdefca-b38f-49ff-a307-bcb109f7aefb-latest.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:2600:17:3f5c:f800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3b5ec8ee05daecb254a5b42fd0742c2d9b0dfa20223156fa43a29f96de97d2d0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: mHjDJSVK2u.BPMgdGzMgKwBZFArdO6eR
via: 1.1 06d36e78e8dfd9468327f09115761a9e.cloudfront.net (CloudFront)
last-modified: Fri, 13 Nov 2020 20:22:38 GMT
server: AmazonS3
age: 51241
etag: "b988df2daf770c7753535798447d3067"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Tue, 24 Aug 2021 02:06:01 GMT
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 275
x-amz-cf-id: CVqMleKyM6uhr60286FI2fFnjF734xW6P-O6X8jtVH4x9iETT3VUlw==

GET
H/1.1 200
OK t.js Show response
cdn1-res.sundaysky.com/vop/v2/ 3 KB
2 KB 193ms
45ms Script
application/javascript 13.225.87.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn1-res.sundaysky.com/vop/v2/t.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.225.87.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-87-19.fra2.r.cloudfront.net

Software

Resource Hash

f7c20d02ef54341b1562afe8db32d1bc701bb7974db2ffc0a560097e3875c1be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 03:50:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 44957
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
X-XSS-Protection: 1; mode=block
Last-Modified: Mon, 02 Aug 2021 11:33:50 GMT
X-Frame-Options: DENY
ETag: W/"2603-1627904030000"
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
Cache-Control: public, max-age=604800
X-Amz-Cf-Pop: FRA2-C2
X-Amz-Cf-Id: -oXphycQYMzWYlEiFJmutFVAv_u3x-wMahGwXQYO-O0MqkzNkD5xkw==

GET
H/1.1 200
OK events.js Show response
tags.srv.stackadapt.com/ 13 KB
5 KB 612ms
131ms Script
text/javascript 52.205.8.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.8.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-8-225.compute-1.amazonaws.com
Software: /
Resource Hash: d08f06cab5fa2985cb68919ae3f4b53ae0ed16f3d1079aeb2bd339402a3ff345

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 24 Aug 2021 16:20:01 GMT
Content-Encoding: gzip
Cache-Control: max-age=30
Content-Length: 4435
Connection: keep-alive
Content-Type: text/javascript

GET
H2 200 a-069s.min.js Show response
b-code.liadm.com/ 25 KB
10 KB 99ms
58ms Script
application/javascript 2600:9000:20eb:a00:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-069s.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:a00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ZIO-Http /
Resource Hash: 724bbf6dc23c60a8ebfc0a3c99c7499c17c90182f148efb0057c9a5f2fc2a1ae

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 13:57:09 GMT
via: 1.1 c7f7b4cf7fd5efe64bac95586db3f62b.cloudfront.net (CloudFront)
server: ZIO-Http
age: 8572
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C1
content-encoding: gzip
x-amz-cf-id: QuSb2qnoXqyt9q-LZtklOYnpbphx_1SxZs44Bex9hvTG4CMz6xE-yQ==

GET
H2 200 fs.js Show response
edge.fullstory.com/s/ 209 KB
63 KB 272ms
47ms Script
application/javascript 35.201.112.186
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/fs.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 082a814158a4221fc2e1da585435b8d31fa704f221169ebe12b9b4d3573016a2

Request headers

Origin: https://page.firstleaf.club
Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 15:28:28 GMT
content-encoding: gzip
age: 3093
x-guploader-uploadid: ADPycdvQon_JgoLvz_By6WvG7N-u_N1ciVIJpw1k30k7Yf7_yheogKy3tsOCtnTyYypTtcq3_7YXDkL_GrafPP9AKbZA4JHnTw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 64115
last-modified: Thu, 05 Aug 2021 19:32:56 GMT
server: UploadServer
etag: "22b58691e95646727daf16321cfe2ed1"
x-goog-hash: crc32c=z4hkXw==, md5=IrWGkelWRnJ9rxYyHP4u0Q==
x-goog-generation: 1628191976428607
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=3600,no-transform
x-goog-stored-content-length: 64115
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 24 Aug 2021 16:28:28 GMT

GET
H/1.1 204
No Content cs.js Show response
aa.trkn.us/1/e/ 0
192 B 354ms
130ms Script
text/plain 104.111.239.203
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://aa.trkn.us/1/e/cs.js?cid=c013&evid=5713e69f-ed70-4bb9-9079-619171b397f7&suu=1&dmn=page.firstleaf.club
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.239.203 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-239-203.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 24 Aug 2021 16:20:01 GMT
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Expires: Tue, 24 Aug 2021 16:20:01 GMT

GET
H2 200 /
stdomi.com/ 49 B
202 B 485ms
213ms Image
image/gif 167.172.228.26
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stdomi.com/?prdid={provided_by_intango}&subid={pass_back_intango_click_id_here}
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.172.228.26 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:20:01 GMT
server: nginx/1.16.1
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
content-length: 49
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dddf04d190be2e7006f807221d5f5852bf45a97c2aad4c66b1f0a1661efa7dda

Request headers

Origin: https://page.firstleaf.club
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c

Request headers

Origin: https://page.firstleaf.club
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 51b06909334339bd5f4027e70f4d2fd30a2a3977ee44cce7385b908ec8f51903

Request headers

Origin: https://page.firstleaf.club
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70

Request headers

Origin: https://page.firstleaf.club
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
H3-29 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ 19 KB
19 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://page.firstleaf.club
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 00:32:15 GMT
x-content-type-options: nosniff
age: 56866
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19844
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:10 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 00:32:15 GMT

GET
H2 200 trackable.js Show response
ext.chtbl.com/ 4 KB
4 KB 197ms
13ms Script
application/javascript 2600:9000:2190:1600:a:b27c:d040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ext.chtbl.com/trackable.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:1600:a:b27c:d040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27dc4f62298834987d3d8e5608c1af94c82ee3d18ee31858d39e0202697b5308

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:12:36 GMT
via: 1.1 0c476b4e93e7b13a5f68b185a8e9753c.cloudfront.net (CloudFront)
last-modified: Fri, 12 Feb 2021 20:28:32 GMT
server: AmazonS3
age: 445
etag: "4a494dbb82444463b6fd8bff0e5593d6"
x-cache: Hit from cloudfront
content-type: application/javascript;charset=UTF-8
cache-control: max-age=3600
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 4092
x-amz-cf-id: 2jqLIUa827B6C3xIEWaLLzy6md9Ve3758oY0VjqVccgLnpFYevOfMw==

GET
H3-29 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
25 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

525f091870c1282bb4823f9e64192983f1652a3bbc84c97ca5e6c4f063ca6e82

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25940
x-xss-protection: 0
pragma: public
x-fb-debug: 7ZUcSKzZ8TuNUuVLNjqRJR2aj0MmDI4zdRWGihD/1y+H+bZ8yk5NZNWplLdbQPBXhhwfOs3syPf4tzv5gRRphQ==
x-frame-options: DENY
date: Tue, 24 Aug 2021 16:20:01 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 visit
anthill.instapage.com/projects/56c2f3d796773d0a7e96a536/events/ 35 B
293 B 469ms
152ms Image
application/octet-stream 35.222.120.150
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://anthill.instapage.com/projects/56c2f3d796773d0a7e96a536/events/visit?api_key=0590a2f300016ea4bfe7b5be27c9ed365ce7254655c3d614a5db901832236dd5aa547b10a69217ef02aff9bc31a92f7c1d046bc384b56a063a863ef5a9c1f8404a071447760b5f74033146d507556651880689ca394bc7f242da578fae8b4be3f8fb238e7dbc25fa8896ac7e36848215ccf0461624606ff57da1b675f07396929954bba10bd619275ab83a82ac3e027b&data=eyJwYWdlX3VybCI6Imh0dHBzOi8vcGFnZS5maXJzdGxlYWYuY2x1Yi9xdWl6P3V0bV9zb3VyY2U9Y2pfYWZmaWxpYXRlJmZyaWVuZHM9dHJ1ZSZ1dG1fbWVkaXVtPWNwYSZ1dG1fY2FtcGFpZ249MTg1MDc3MV8xMitJbnRlcmFjdGl2ZStMTENfMjA5NzA2MiZ1dG1fdGVybT0mdXRtX2NvbnRlbnQ9MTM1NTI4NDVfNitCb3R0bGVzK2ZvcislMjQ0MCtQbHVzK0ZyZWUrU2hpcHBpbmcrZm9yK2ErWWVhciZ1dG1fc3ViY2FtcGFpZ249MjA5NzA2MiZjamV2ZW50PTIwNjAxNTYyMDRmNzExZWM4M2VmMDM4YzBhMTgwNTEyIiwib3duZXJfaWQiOjE5NzM0NzYsImN1c3RvbWVyX2lkIjoyMzQ0MDkxLCJwYWdlX2lkIjoyMTQyNzUzNiwicHVibGlzaGVkX3ZlcnNpb24iOjI1OSwidmFyaWF0aW9uX25hbWUiOiJFRiIsInZhcmlhdGlvbl9pZCI6MjczLCJsaW5rZWRfdmFyaWF0aW9uX2lkIjoyNzQsInZhcmlhdGlvbiI6IkVGIiwicXVhbnRpdHkiOjEsImluaXRpYWxfcmVzcG9uc2l2ZV9tb2RlIjpudWxsLCJzdGF0aWNfcGFnZSI6ZmFsc2UsImphdmFzY3JpcHQiOnRydWUsInZpZXdwb3J0X2hlaWdodCI6MTIwMCwidmlld3BvcnRfd2lkdGgiOjE2MDAsImNhbXBhaWduX2lkIjpmYWxzZSwiYWRfaWQiOmZhbHNlLCJjYW1wYWlnbl9zb3VyY2UiOmZhbHNlLCJ2aXNpdGVkIjowLCJyZXNwb25zaXZlX21vZGUiOm51bGwsInJlZiI6Imh0dHBzOi8vamFjb2JzLnBlcmtzcG90LmNvbS8ifQ==&t=1629822001225

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.222.120.150 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

150.120.222.35.bc.googleusercontent.com

Software

/ Express

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
referrer-policy: same-origin
x-powered-by: Express
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=315360000; includeSubDomains
vary: Accept-Encoding, Origin
content-length: 35
etag: W/"23-X71HIiL+uKIs9biqXcW44Tr4jis"

GET
H2 200 i.js Show response
tag.wknd.ai/4263/ 17 KB
5 KB 174ms
47ms Script
text/plain 34.120.253.250
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.wknd.ai/4263/i.js
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.253.250 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 250.253.120.34.bc.googleusercontent.com
Software: fasthttp /
Resource Hash: 747fd9fef704d10db66417d93d5b8a4076a25a01f3b36f4da5b0bf8d62a7b6df

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 15:46:07 GMT
content-encoding: deflate
server: fasthttp
age: 2034
etag: 32a4edd525ad55
content-type: text/plain; charset=utf-8
via: 1.1 google
cache-control: public,max-age=60
x-region: us-central1
timing-allow-origin: *
alt-svc: clear
content-length: 4747

GET
H2 204 5565374.js Show response
bat.bing.com/p/action/ 0
109 B 358ms
357ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/5565374.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 24 Aug 2021 16:20:01 GMT
cache-control: private,max-age=86400
x-msedge-ref: Ref A: 3C5CFBF3F6134AB0AB0ACDFF385340E4 Ref B: FRAEDGE1406 Ref C: 2021-08-24T16:20:01Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
255 B 31ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5565374&tm=gtm001&Ver=2&mid=d834e2bb-216e-4e67-b461-9d4c493ecb04&sid=21d025a004f711ec93912f3466ce0098&vid=21d0533004f711ec85a3090d5213b26e&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf&kw=wine,%20wine%20club&p=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&r=https%3A%2F%2Fjacobs.perkspot.com%2F&lt=2815&evt=pageLoad&msclkid=N&sv=1&rn=76142
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Tue, 24 Aug 2021 16:20:01 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: B9E695C82A27442BADF54827490EBEF7 Ref B: FRAEDGE1406 Ref C: 2021-08-24T16:20:01Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 15:59:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 1254
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1306
x-xss-protection: 0
expires: Tue, 24 Aug 2021 16:59:07 GMT

GET
H3-29 200 js Show response
www.google-analytics.com/gtm/ 113 KB
43 KB 36ms
36ms Script
application/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=OPT-WRCDBFX&t=gtm6&cid=874306131.1629822001

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

93e5fd37ff6841584c06ada6f8a127be04fd8427ab0d817b4d301a58a5272dc3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43618
x-xss-protection: 0
expires: Tue, 24 Aug 2021 16:20:01 GMT

GET
H2 200 54280096-0-FIRSTLEAF-4-20-18-SH.jpg
v.fastcdn.co/u/814df80e/ 636 KB
636 KB 162ms
159ms Image
image/jpeg 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/54280096-0-FIRSTLEAF-4-20-18-SH.jpg
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D6F) /
Resource Hash: 7084ebbefbe4e68b8d66c66b4f05795676a2c51bd8e7fffc47a7c2e015aa0544

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
x-goog-stored-content-length: 650889
age: 14234141
x-guploader-uploadid: ABg5-UxbFP8R6YPuhexrI6b426Nhfia7uzHY7rPcaXeb2TPCGo39aOntsNEOf8AoqLlh0f-W6IlQnPEfGmYcSZx-18wUGiKNsg
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Fri, 07 Jan 2022 08:53:50 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 650889
last-modified: Mon, 16 Nov 2020 16:53:51 GMT
server: ECS (lcy/1D6F)
etag: "5126564702f93f64c73860dab71c20a1"
x-goog-hash: crc32c=m4NYAw==, md5=USZWRwL5P2THOGDatxwgoQ==
content-type: image/jpeg
x-goog-generation: 1605545631140587
cache-control: max-age=315360000, public
x-goog-meta-content-length: 650889
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:01 GMT

GET
H2 200 54280086-0-FIRSTLEAF-4-20-18-SH.jpg
v.fastcdn.co/u/814df80e/ 1 MB
1 MB 99ms
97ms Image
image/jpeg 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/54280086-0-FIRSTLEAF-4-20-18-SH.jpg
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D69) /
Resource Hash: d88d643839a4133a341acdbb486111679804cbce0b2d9af9cf7423a3bc62450d

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
x-goog-stored-content-length: 1270572
age: 14234141
x-guploader-uploadid: ABg5-UyAlhxh1Rm01j7NCDhpM91vl6GM1Mx5msRWBF9GbmMBz_3BWi3WxSA_0DmxV0YXUsbC-5aVxyrWfs7nBo58DXA
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Fri, 07 Jan 2022 08:53:39 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1270572
last-modified: Mon, 16 Nov 2020 16:53:39 GMT
server: ECS (lcy/1D69)
etag: "dcafc1dd8bd8c7cf4e28646fff779dea"
x-goog-hash: crc32c=/HvrnQ==, md5=3K/B3YvYx89OKGRv/3ed6g==
content-type: image/jpeg
x-goog-generation: 1605545619410205
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:01 GMT

GET
H2 200 54280111-0-firstleaf-weareyou-4.jpg
v.fastcdn.co/u/814df80e/ 826 KB
826 KB 101ms
100ms Image
image/jpeg 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v.fastcdn.co/u/814df80e/54280111-0-firstleaf-weareyou-4.jpg
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D61) /
Resource Hash: 449319f85e3e51826d1452e7dfe201765992eeb42366d5b862c497af03721d4b

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
x-goog-stored-content-length: 845370
age: 14234141
x-guploader-uploadid: ABg5-UyYQyQTTXgM2t8FNVSRkiXb0weSLL41bKqi2wGsskj9_meHZDkCH2AZ0STI4H__sE_HTDGOIPndfHstpEPwzezwJwEiXA
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Fri, 07 Jan 2022 08:54:06 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 845370
last-modified: Mon, 16 Nov 2020 16:54:06 GMT
server: ECS (lcy/1D61)
etag: "8c284c026ab433627f62598f9fec01db"
x-goog-hash: crc32c=hQRsSg==, md5=jChMAmq0M2J/YlmPn+wB2w==
content-type: image/jpeg
x-goog-generation: 1605545646916845
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
expires: Wed, 24 Aug 2022 16:20:01 GMT

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
125 B 249ms
150ms Image
image/gif 151.101.13.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1629822001352&id=t2_154evxdq&event=PageVisit&m.itemCount=&m.value=&m.currency=&m.transactionId=&m.customEventName=&uuid=5930a579-5edb-43b0-98a5-80787a781da2&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_a797b96e
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
via: 1.1 varnish
server: Varnish
accept-ranges: bytes
content-length: 42
retry-after: 0
content-type: image/gif

GET
H2 200 adsct
t.co/i/ 43 B
455 B 252ms
155ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=nzfyd&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Tue, 24 Aug 2021 16:20:01 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: a0c435dedf9984fbffa4a46168257019a24f574344106f726b6b3129aa1cab8a
x-transaction: 84a731818ed0f0b0
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H2 204 result Show response
page.firstleaf.club/cdn-cgi/bm/cv/ 0
281 B 10ms
10ms XHR
text/plain 2606:4700:10::ac43:1a84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://page.firstleaf.club/cdn-cgi/bm/cv/result?req_id=683de7c63aefc2ef
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/cdn-cgi/bm/cv/669835187/api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-fetch-mode: cors
origin: https://page.firstleaf.club
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
cookie: _gcl_au=1.1.141097883.1629822000; query=?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512; CJEVENT=2060156204f711ec83ef038c0a180512; FL_Referrer=2; _uetsid=21d025a004f711ec93912f3466ce0098; _uetvid=21d0533004f711ec85a3090d5213b26e; _ga=GA1.2.874306131.1629822001; _gid=GA1.2.1131056354.1629822001; _rdt_uuid=1629822001351.5930a579-5edb-43b0-98a5-80787a781da2
content-length: 745
:path: /cdn-cgi/bm/cv/result?req_id=683de7c63aefc2ef
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: page.firstleaf.club
referer: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
server: cloudflare
set-cookie: __cf_bm=04ce16b6479833178c516466d6840511da13faef-1629822001-1800-Ab58jmZ31XfNMepYMuYEmt7wIyisiL2/po4JAh+Dl3YBq484QEtVY6Ly8g9zH9nQ05sO+45s+jMQ1o6vdsJw8WhOmPWetFwW1SzzhBM2hjtKyRVrmf2NjOrELg1ZICSXozJLK6w+SLrEL+s5+Ag2T/s=; path=/; expires=Tue, 24-Aug-21 16:50:01 GMT; domain=.firstleaf.club; HttpOnly; Secure; SameSite=None
cf-ray: 683de7d4ef6ec2ef-FRA
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding

GET
H3-29 200 1669030446688031 Show response
connect.facebook.net/signals/config/ 264 KB
74 KB 101ms
101ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1669030446688031?v=2.9.44&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0255458c627efd907d6313000cabccc2af24fbebd5c14cc112d3eaf6d1649f11

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: y3KgwlaP7v3LHcymC2SYqjr5Lna2gvpE58CoLV3gWE9jjHspwl42RfvystzFTfds6jOu44yIuGwMzL1LoogIkQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 24 Aug 2021 16:20:01 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 tracker-latest.min.js Show response
d2hrivdxn8ekm8.cloudfront.net/ 10 KB
10 KB 7ms
6ms Script
application/javascript 2600:9000:21f3:2600:17:3f5c:f800:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2hrivdxn8ekm8.cloudfront.net/tracker-latest.min.js
Requested by: Host: d2hrivdxn8ekm8.cloudfront.net
URL: https://d2hrivdxn8ekm8.cloudfront.net/tag-manager/c8fdefca-b38f-49ff-a307-bcb109f7aefb-latest.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:2600:17:3f5c:f800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8dd95d85ec6c727b643ee77877b0f0f871e5e0c23c4a4f8b2717c8e2992113ea

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: TMoLD_DiUBmYAiSnr6YprAKLygQ3P9GG
via: 1.1 06d36e78e8dfd9468327f09115761a9e.cloudfront.net (CloudFront)
last-modified: Thu, 25 Mar 2021 23:09:46 GMT
server: AmazonS3
age: 22336
etag: "0e1055fa94f517c775220f50e87ea05b"
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
date: Tue, 24 Aug 2021 10:07:46 GMT
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 9967
x-amz-cf-id: yUFXrlpxDj5NIDqZ_LIILdF-5TuUCt6Yf0QE-4dfuMh9d1OIJf3SUg==

POST
H2 200 pipeline Show response
ct.firstleaf.club/prh/ 2 B
312 B 438ms
437ms XHR
text/plain 2606:4700:10::ac43:1a84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.firstleaf.club/prh/pipeline
Requested by: Host: images.firstleaf.club
URL: https://images.firstleaf.club/js/sp-at-v2-14-0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 683de7d90d5fc2ef-FRA
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
access-control-allow-origin: https://page.firstleaf.club
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
content-length: 2

GET
H2 200 b253b5fa-0522-4fcb-b2f3-9056b25ec9b1 Show response
ekr.zdassets.com/compose/ 635 B
685 B 214ms
214ms XHR
application/json 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ekr.zdassets.com/compose/b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf4731e62066a0dd232bda3ae64cb3293df6488f92969b61457622cab819cf8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
content-encoding: br
vary: Origin, Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
status: 200 OK
access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=0
x-request-id: 90325290-dd82-4782-bf54-d884f470cf49
x-runtime: 0.016814
server: cloudflare
etag: W/"cf4731e62066a0dd232bda3ae64cb329"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 7200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J%2B5rpMfT1XkgzTU3hkbsmbg62TgSaGzzo310BDmbx%2F6J69KyPW2hzRDOh%2FsUVjr%2FTOLWxzisAbZJmpKBaYvgyUaGem9kjBQShWO3GQ9odpkUkiikaYAuLxMMElTGyJq2x1g%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=600, public, s-maxage=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray: 683de7d54871597d-AMS

GET
H2 200 modules.e763089bec9f2503d752.js Show response
script.hotjar.com/ 221 KB
59 KB 163ms
55ms Script
application/javascript 13.224.102.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.e763089bec9f2503d752.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-465352.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.102.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-102-122.zrh50.r.cloudfront.net

Software

Resource Hash

b8e39dad2211fe2aafd3c487471c94934a5230aeb00608f59b80c880ce777440

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:32:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 539276
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 59555
access-control-allow-origin: *
last-modified: Wed, 18 Aug 2021 10:31:58 GMT
etag: "59b0bd2bf71a6ea4a84151c51b91fba8"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad3.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: kNPpSneyzqZnj_7uC6HSCFYgo7ySFP0hX8RdnOJqHuTRsqHR2uN0-g==

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
30 B 13ms
13ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j92&a=197022713&t=pageview&_s=1&dl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&dr=https%3A%2F%2Fjacobs.perkspot.com%2F&ul=en-us&de=UTF-8&dt=Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAEALQAAAAC~&jid=1839987830&gjid=660311562&cid=874306131.1629822001&tid=UA-68049103-4&_gid=1131056354.1629822001&_r=1&gtm=2wg8n0TKCVNW&z=1984027948

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:20:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://page.firstleaf.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
60 B 6ms
6ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j92&a=197022713&t=event&ni=1&_s=1&dl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&dr=https%3A%2F%2Fjacobs.perkspot.com%2F&ul=en-us&de=UTF-8&dt=Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page&ea=atf-creative-control&el=%2Fquiz&_u=aGDACEALRAAAAC~&jid=&gjid=&cid=874306131.1629822001&tid=UA-68049103-4&_gid=1131056354.1629822001&gtm=2wg8n0TKCVNW&z=542208731

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 00:04:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 58542
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 i Show response
tr.snapchat.com/cm/ Frame E7A4 0
262 B 157ms
59ms Document
text/html 35.186.226.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/i?pid=c20b9c7f-d0c3-4f4d-94a3-2a2c5fad8834

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

184.226.186.35.bc.googleusercontent.com

Software

nginx/1.17.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

:method: GET
:authority: tr.snapchat.com
:scheme: https
:path: /cm/i?pid=c20b9c7f-d0c3-4f4d-94a3-2a2c5fad8834
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://page.firstleaf.club/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://page.firstleaf.club/

Response headers

server: nginx/1.17.3
date: Tue, 24 Aug 2021 16:20:01 GMT
content-type: text/html
content-length: 0
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 p
tr.snapchat.com/ 68 B
86 B 116ms
66ms Image
image/png 35.186.226.184
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.snapchat.com/p?pid=c20b9c7f-d0c3-4f4d-94a3-2a2c5fad8834&ev=PAGE_VIEW&pl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&ts=1629822001553&rf=https%3A%2F%2Fjacobs.perkspot.com%2F&v=1.5&if=false&bt=__LIVE__&intg=gtm&u_c1=e10bd8bb-e52e-4d33-b2e4-9946a3d2cf5a&m_sl=3024&m_rd=3142&m_pi=2700&m_ic=0

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

184.226.186.35.bc.googleusercontent.com

Software

nginx/1.17.3 /

Resource Hash

2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
via: 1.1 google
server: nginx/1.17.3
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, no-transform
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 68

GET
H3-29 200 p
tr.snapchat.com/ 68 B
86 B 114ms
64ms Image
image/png 35.186.226.184
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.snapchat.com/p?pid=c20b9c7f-d0c3-4f4d-94a3-2a2c5fad8834&ev=PAGE_VIEW&pl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&ts=1629822001554&rf=https%3A%2F%2Fjacobs.perkspot.com%2F&v=1.5&if=false&bt=__LIVE__&intg=gtm&u_c1=e10bd8bb-e52e-4d33-b2e4-9946a3d2cf5a&m_sl=3024&m_rd=3143&m_pi=2700&m_ic=0

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

184.226.186.35.bc.googleusercontent.com

Software

nginx/1.17.3 /

Resource Hash

2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
via: 1.1 google
server: nginx/1.17.3
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, no-transform
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 68

GET
H2 200 box-25a418976ea02a6f393fbbe77cec94bb.html Show response
vars.hotjar.com/ Frame E3B8 2 KB
1 KB 152ms
49ms Document
text/html 13.224.102.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-25a418976ea02a6f393fbbe77cec94bb.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-465352.js?sv=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-36.zrh50.r.cloudfront.net
Software: /
Resource Hash: 7a44e0685d8929b5d4d50476273c9957c8c76f03afc424c665a4066e5bc1beb9

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-25a418976ea02a6f393fbbe77cec94bb.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://page.firstleaf.club/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://page.firstleaf.club/

Response headers

content-type: text/html
content-length: 1044
date: Sun, 18 Jul 2021 00:16:30 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "76922233be8bdb14c053af468d29404a"
last-modified: Thu, 15 Jul 2021 14:16:09 GMT
x-amz-server-side-encryption: AES256
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 d7147e532e5cf73689fcb39fa760bcf3.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: I6BCsd2szr1Civ8FIaJihzjg2Eo1QvCwSBn_fz_BjblDw34tR9a5fA==
age: 3254611

GET
H/1.1

200

j
s-vop.sundaysky.com/t/v1/
Redirect Chain

https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_1...
https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_1...

645 B
645 B

135ms
133ms

Image
application/javascript

54.237.157.181
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&cb=200227166&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&udt.segment=visitor&_cvt=t&timestamp=1629822002303&nonce=1ntein97kuj2qmjofe14sp6hg2&signature=0ace4c616a6ef80973b5067a39dd1f1c73d2d2e5

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.237.157.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-157-181.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 24 Aug 2021 16:20:02 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI PUR COM NAV INT DEM STA PRE"
Cache-control: private, no-cache, no-cache=Set-Cookie, must-revalidate, proxy-revalidate, max-age=0
Connection: keep-alive
Content-Type: application/javascript;charset=UTF-8
Content-Length: 645
X-XSS-Protection: 1; mode=block
Expires: Sat, 1 Apr 2000 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 24 Aug 2021 16:20:01 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI PUR COM NAV INT DEM STA PRE"
Location: https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&cb=200227166&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&udt.segment=visitor&_cvt=t&timestamp=1629822002303&nonce=1ntein97kuj2qmjofe14sp6hg2&signature=0ace4c616a6ef80973b5067a39dd1f1c73d2d2e5
Cache-control: private, no-cache, no-cache=Set-Cookie, must-revalidate, proxy-revalidate, max-age=0
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Sat, 1 Apr 2000 00:00:00 GMT

GET
H/1.1

200

j
s-vop.sundaysky.com/t/v1/
Redirect Chain

https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_1...
https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_1...

600 B
600 B

198ms
197ms

Image
application/javascript

54.237.157.181
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&cb=1383746124&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&udt.segment=visitor&_cvt=t&timestamp=1629822002378&nonce=p67d9368jpu0ragmkol4rmgsi6&signature=53862a5435e085bc271b799bae1bd847aee3a53c

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.237.157.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-157-181.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 24 Aug 2021 16:20:01 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI PUR COM NAV INT DEM STA PRE"
Cache-control: private, no-cache, no-cache=Set-Cookie, must-revalidate, proxy-revalidate, max-age=0
Connection: keep-alive
Content-Type: application/javascript;charset=UTF-8
Content-Length: 600
X-XSS-Protection: 1; mode=block
Expires: Sat, 1 Apr 2000 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 24 Aug 2021 16:20:01 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI PUR COM NAV INT DEM STA PRE"
Location: https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&cb=1383746124&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&udt.segment=visitor&_cvt=t&timestamp=1629822002378&nonce=p67d9368jpu0ragmkol4rmgsi6&signature=53862a5435e085bc271b799bae1bd847aee3a53c
Cache-control: private, no-cache, no-cache=Set-Cookie, must-revalidate, proxy-revalidate, max-age=0
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Sat, 1 Apr 2000 00:00:00 GMT

GET
H2 200 b253b5fa-0522-4fcb-b2f3-9056b25ec9b1 Show response
ekr.zdassets.com/compose/ 635 B
582 B 229ms
228ms XHR
application/json 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ekr.zdassets.com/compose/b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf4731e62066a0dd232bda3ae64cb3293df6488f92969b61457622cab819cf8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
content-encoding: br
vary: Origin, Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
status: 200 OK
access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=0
x-request-id: 90325290-dd82-4782-bf54-d884f470cf49
x-runtime: 0.016814
server: cloudflare
etag: W/"cf4731e62066a0dd232bda3ae64cb329"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 7200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tArV7X25Jp%2BgECDAKhXuDTyURhVAvZk0KeG3hlxZpakgtrU0cLLipTggjcmukwqDsSP8lDiCgvHdvDdD28QgzHSGgoh9s4Usf7x9Y%2FfW5oALyc9iNuHWH2hPjxXvwhKgcxc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=600, public, s-maxage=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray: 683de7d609b7597d-AMS

OPTIONS
H2 200 pipeline
ct.firstleaf.club/prh/ Frame 0
0 630ms
452ms Preflight 2606:4700:10::ac43:1a84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.firstleaf.club/prh/pipeline
Protocol: H2
Server: 2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://page.firstleaf.club
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-length: 0
access-control-allow-origin: https://page.firstleaf.club
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-max-age: 5
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 683de7d63c36dfbf-FRA

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2B...
https://rp4.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2...

13 B
569 B

419ms
132ms

XHR
application/json

34.206.124.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&refr=https%3A%2F%2Fjacobs.perkspot.com%2F&duid=a0b8fe163af0--01fdwfc8d16nemsap8sncqpvyw&se=e30&dtstmp=1629822001722&i6=MmEwMTo0Zjg6MTkyOjU0MTQ6OjI%3D&n3pc=true

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.206.124.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-206-124-188.compute-1.amazonaws.com

Software

nginx/1.18.0 /

Resource Hash

efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
x-pixel-event-id: 63755a18-572d-4bef-ad52-1b889e4f2fee
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
request-time: 1
vary: Origin
content-length: 13
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: nginx/1.18.0
x-frame-options: DENY
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json
access-control-allow-origin: null
access-control-allow-credentials: true
trace-id: 9e0374a963f36528

Redirect headers

date: Tue, 24 Aug 2021 16:20:01 GMT
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: nginx/1.18.0
vary: Origin
location: https://rp4.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&refr=https%3A%2F%2Fjacobs.perkspot.com%2F&duid=a0b8fe163af0--01fdwfc8d16nemsap8sncqpvyw&se=e30&dtstmp=1629822001722&i6=MmEwMTo0Zjg6MTkyOjU0MTQ6OjI%3D&n3pc=true
x-frame-options: DENY
access-control-allow-origin: https://page.firstleaf.club
x-xss-protection: 1; mode=block
x-permitted-cross-domain-policies: master-only
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
trace-id: 6489a3418a26af81
request-time: 0
content-length: 0
x-content-type-options: nosniff

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
87 B 15ms
14ms XHR
text/plain 2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-68049103-4&cid=874306131.1629822001&jid=1839987830&gjid=660311562&_gid=1131056354.1629822001&_u=aGDAAEAKQAAAAC~&z=597066707

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 24 Aug 2021 16:20:01 GMT
content-type: text/plain
access-control-allow-origin: https://page.firstleaf.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track Show response
web.chtbl.com/ 49 B
380 B 205ms
204ms XHR
application/json 2600:9000:21f3:6000:0:cc59:3900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web.chtbl.com/track
Requested by: Host: ext.chtbl.com
URL: https://ext.chtbl.com/trackable.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:6000:0:cc59:3900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: uvicorn /
Resource Hash: bb30148d9df7671c14f2cd5be91e6b7a1488932efb740a80b66f39052744c168

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json;charset=UTF-8

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
server: uvicorn
x-amz-cf-pop: FRA2-C2
vary: Origin
access-control-allow-methods: OPTIONS,POST
content-type: application/json
access-control-allow-origin: *
x-cache: Miss from cloudfront
access-control-allow-headers: *
content-length: 49
x-amz-cf-id: N7CObHwCVgzma57sP3GWZCxGbrJnNkDqlyaNqquAvM58wqkHh-ve9Q==

OPTIONS
H2 200 track
web.chtbl.com/ Frame 0
0 227ms
191ms Preflight
application/json 2600:9000:21f3:6000:0:cc59:3900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web.chtbl.com/track
Protocol: H2
Server: 2600:9000:21f3:6000:0:cc59:3900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: uvicorn /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://page.firstleaf.club
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-type: application/json
content-length: 49
date: Tue, 24 Aug 2021 16:20:01 GMT
server: uvicorn
access-control-allow-methods: OPTIONS,POST
access-control-allow-headers: *
access-control-allow-origin: *
vary: Origin
x-cache: Miss from cloudfront
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: -qE6Pz0WdcloyhsUvDQPgyf10pPFmywbFqGXxjSC7pKWw5_zBhxv0A==

GET config
fbapi.firstleaf.club/.open-bridge/ 0
0

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1669030446688031&ev=PageView&dl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&rl=https%3A%2F%2Fjacobs.perkspot.com%2F&if=false&ts=1629822001755&sw=1600&sh=1200&v=2.9.44&r=stable&ec=0&o=30&fbp=fb.1.1629822001753.774473020&eid=ob2_plugin-set_ad944680027034190db0abc60eeda15d587e6ef3ebaab3f22876f6103d1bd91b&it=1629822001433&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:01 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 24 Aug 2021 16:20:01 GMT

GET
H2 200 ijs_all_modules_cjs_min_bf9d1b39f31e38750440567b75e6eeb7.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 575 KB
143 KB 154ms
44ms Script
text/javascript 34.98.72.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bf9d1b39f31e38750440567b75e6eeb7.js
Requested by: Host: tag.wknd.ai
URL: https://tag.wknd.ai/4263/i.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 97893424c202706d78df96de52159bc3c84e300d73ec2b4c2f4e81453933f47d

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 13:37:22 GMT
content-encoding: gzip
age: 9760
x-guploader-uploadid: ADPycduSY2Im6joDqeZZ9YNUuBg3kc4-LQKGwu_Sbf9BiTfpqxaoEjSmxx5HgvdsTBRyGQW7CvAlKpIoKJU9iEmxkrg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 145717
last-modified: Tue, 24 Aug 2021 13:37:14 GMT
server: UploadServer
etag: "a69be6fe97ff902e2b015dc2094ddb9b"
vary: Accept-Encoding
x-goog-hash: crc32c=9J3DSw==, md5=ppvm/pf/kC4rAV3CCU3bmw==
x-goog-generation: 1629812234744975
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 145717
accept-ranges: bytes
content-type: text/javascript
expires: Wed, 24 Aug 2022 13:37:22 GMT

GET
H2 200 5a28e627 Show response
dvqigh9b7wa32.cloudfront.net/ 43 B
493 B 197ms
52ms XHR
image/gif 13.224.89.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dvqigh9b7wa32.cloudfront.net/5a28e627?data=dmVyc2lvbj0xLjIuMTImdG9rZW49YzhmZGVmY2EtYjM4Zi00OWZmLWEzMDctYmNiMTA5ZjdhZWZiJnNlc3Npb25JZD1mNjk5YWUzYy0zYzJkLTAwYmYtM2Q1ZS1mMjYxYzFlYWY1NTU%3D&date=1629822001765
Requested by: Host: d2hrivdxn8ekm8.cloudfront.net
URL: https://d2hrivdxn8ekm8.cloudfront.net/tracker-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.89.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-92.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 09:17:40 GMT
via: 1.1 a4f3f56409fe4e0b42683dc15dd52ef8.cloudfront.net (CloudFront)
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 25341
x-cache: Hit from cloudfront
content-length: 43
last-modified: Wed, 08 Mar 2017 06:19:28 GMT
server: AmazonS3
etag: "fb02f374b8f73825415db1bccd4bd76d"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
x-amz-cf-id: No6dbb7HvWhCMuiXO2EATmKb3BVMn3I3aW43RuQQtLEVUD4p_WLYTg==

GET
H2 200 5a28e627 Show response
d330aiyvva2oww.cloudfront.net/ 43 B
491 B 104ms
46ms XHR
image/gif 2600:9000:20eb:1600:3:760:2800:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d330aiyvva2oww.cloudfront.net/5a28e627?data=aXB2Nj10cnVlJnZlcnNpb249MS4yLjEyJnRva2VuPWM4ZmRlZmNhLWIzOGYtNDlmZi1hMzA3LWJjYjEwOWY3YWVmYiZzZXNzaW9uSWQ9ZjY5OWFlM2MtM2MyZC0wMGJmLTNkNWUtZjI2MWMxZWFmNTU1&date=1629822001766
Requested by: Host: d2hrivdxn8ekm8.cloudfront.net
URL: https://d2hrivdxn8ekm8.cloudfront.net/tracker-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:1600:3:760:2800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 22:53:55 GMT
via: 1.1 dde0b4b1e223fa23670e93078a04c116.cloudfront.net (CloudFront)
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 62767
x-cache: Hit from cloudfront
content-length: 43
last-modified: Wed, 08 Mar 2017 06:19:28 GMT
server: AmazonS3
etag: "fb02f374b8f73825415db1bccd4bd76d"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: PoshVtxF4KvhfUSO0KWpuJ4s_VCjyQBfCmeMuj23oZ0mIvBPEs4Wpg==

GET
H2 200 5a28e627 Show response
d1lu3pmaz2ilpx.cloudfront.net/ 43 B
448 B 73ms
21ms XHR
image/gif 2600:9000:21f3:3400:17:f683:1d40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1lu3pmaz2ilpx.cloudfront.net/5a28e627?data=dmVyc2lvbj0xLjIuMTImdG9rZW49YzhmZGVmY2EtYjM4Zi00OWZmLWEzMDctYmNiMTA5ZjdhZWZiJnNlc3Npb25JZD1mNjk5YWUzYy0zYzJkLTAwYmYtM2Q1ZS1mMjYxYzFlYWY1NTUmY29va2llU3VwcG9ydD1QRVJTSVNUJmV2ZW50PXBhZ2V2aWV3JiUyNG9zPVdpbmRvd3MmJTI0cmVmZXJyZXI9aHR0cHMlM0ElMkYlMkZqYWNvYnMucGVya3Nwb3QuY29tJTJGJiUyNGN1cnJlbnRVcmw9aHR0cHMlM0ElMkYlMkZwYWdlLmZpcnN0bGVhZi5jbHViJTJGcXVpeiUzRnV0bV9zb3VyY2UlM0Rjal9hZmZpbGlhdGUlMjZmcmllbmRzJTNEdHJ1ZSUyNnV0bV9tZWRpdW0lM0RjcGElMjZ1dG1fY2FtcGFpZ24lM0QxODUwNzcxXzEyJTJCSW50ZXJhY3RpdmUlMkJMTENfMjA5NzA2MiUyNnV0bV90ZXJtJTNEJTI2dXRtX2NvbnRlbnQlM0QxMzU1Mjg0NV82JTJCQm90dGxlcyUyQmZvciUyQiUyNTI0NDAlMkJQbHVzJTJCRnJlZSUyQlNoaXBwaW5nJTJCZm9yJTJCYSUyQlllYXIlMjZ1dG1fc3ViY2FtcGFpZ24lM0QyMDk3MDYyJTI2Y2pldmVudCUzRDIwNjAxNTYyMDRmNzExZWM4M2VmMDM4YzBhMTgwNTEy&date=1629822001774
Requested by: Host: d2hrivdxn8ekm8.cloudfront.net
URL: https://d2hrivdxn8ekm8.cloudfront.net/tracker-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3400:17:f683:1d40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 13:52:27 GMT
via: 1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront)
vary: Origin
age: 8855
x-cache: Hit from cloudfront
content-length: 43
last-modified: Wed, 08 Mar 2017 06:19:28 GMT
server: AmazonS3
etag: "fb02f374b8f73825415db1bccd4bd76d"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: xvropHc4Eoio_bTkbiKY6-vu2klhp1iqwY3lSvZFywWzVnE6zQDpQQ==

GET
H/1.1 200
OK jpuid Show response
rbv9j7km.firstleaf.club/ 67 B
409 B 126ms
125ms Script
text/javascript 159.203.152.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://rbv9j7km.firstleaf.club/jpuid?jsonp=RB.jsonPUID
Requested by: Host: rbv9j7km.firstleaf.club
URL: https://rbv9j7km.firstleaf.club/assets/wxyz.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.203.152.67 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: openresty /
Resource Hash: 95c3e9694940734aa400f378ae328969cde4fb39e4bc343c68ecf9245b1bc9ad

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:01 GMT
Content-Encoding: gzip
Server: openresty
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/javascript

GET
H/1.1 200
OK integrations Show response
rbv9j7km.firstleaf.club/ 42 B
246 B 241ms
125ms Script
text/javascript 159.203.152.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://rbv9j7km.firstleaf.club/integrations?source=firstleaf
Requested by: Host: rbv9j7km.firstleaf.club
URL: https://rbv9j7km.firstleaf.club/assets/wxyz.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.203.152.67 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: openresty /
Resource Hash: a6e9e1722cffa254dc5061e3d89fc40a4faec0cd7d44819923657d498e8df822

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:02 GMT
Content-Encoding: gzip
Server: openresty
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/javascript

GET
H2 200 web-widget-preload-d9d81488360f65d03f84.js Show response
static.zdassets.com/web_widget/latest/ Frame 460B 88 KB
32 KB 68ms
68ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbb99457e56765ea4bea432267ab799598687f0a3cedf17ca67efb913ee9d9ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 399640
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 4Q3JEDADYY0YPQ6M
x-amz-id-2: 4GcTnFjmyHh3ukA5HgP+mpHvxmHRUMbz5oX9lww43RO2u0TOj9KzlUuDAKyWmqJUz14i4TmrZ4s=
last-modified: Thu, 19 Aug 2021 06:56:54 GMT
server: cloudflare
etag: W/"344f0fe59e0f077ebeeeef03607601ac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ac68461YyEpxpmZY9CTB9hCpvF93%2Bm6lhCx3MwbXr%2FIqT2HmwCFWq7p7IX0TZjJSxl0YEFSHB1kTzPPE5MecTDJKZxshXDDeOawX3FwWYCjlSCsvQX8%2FhrK5PRJ1XmVZ6zUNN2U%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 57Ip39pR3YbL9FqP79r8Y7su0sTb6uxl
cf-ray: 683de7d87887fa78-AMS
expires: Fri, 19 Aug 2022 06:56:53 GMT

GET
H2 200 web-widget-framework-97edc71e1362291b402d.js Show response
static.zdassets.com/web_widget/latest/ Frame 460B 184 KB
60 KB 65ms
64ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eeaf2e313228f5fa957d5cf730e42df5cf45b7e2132a594d470576a88736a481

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 399640
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 4Q3VZ42PDHS8X1TT
x-amz-id-2: S2uEwZHGl+E6BzLxDC5n2Ea33S0aubhUaQxKIPVDmw2r+5eGV2GKZhSQ5p5RWMX17kKg+U4xJSU=
last-modified: Thu, 19 Aug 2021 06:56:54 GMT
server: cloudflare
etag: W/"e374a6019f706d78fc0110673a8149b4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ez24TGTZg%2FYK2yMkrnANAmUPICnhhYtUKyyWhqV%2FKJmMh9yhGjr%2FLpXmgBsd4ljhqQadlVhWICDl%2Bk7BJY8a2DarUefkH9xGDHSUB%2BiRqkBXMm9cGRY%2BGMnqBobOYTRg3bxYEwc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: Wk53zNM1BfAU488Z5dqm0HEqnFW4uGAe
cf-ray: 683de7d898a1fa78-AMS
expires: Fri, 19 Aug 2022 06:56:53 GMT

GET
H2 200 web-widget-chat-sdk-ad0bca0cd862985f164f.js Show response
static.zdassets.com/web_widget/latest/ Frame 460B 203 KB
52 KB 64ms
63ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-chat-sdk-ad0bca0cd862985f164f.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a77ebced88a45b7146f3e8b0359f37d658f0f6e0eb481583ee9319cb601d893

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3080152
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 31A3BAY1ZH9GD1BV
x-amz-id-2: tfFkqroZKroq+pqLI+M3idv/nOENLrOjrlitzrzbLnFwRXLmuGoNzapA4k4INMPdjWyRcioA/K8=
last-modified: Mon, 19 Jul 2021 02:04:04 GMT
server: cloudflare
etag: W/"093f405bc41723c43486a657a0e1a173"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ObUWuHbE5ZZO6QwkeKjjJ1uaAK5JRii8iTO87ZFBBLHKv%2B9rnB5RDXfvKhN70P%2Fbr%2FsKzG0kzihOTYKIldtZYOzMqNqA37DxwLr%2FSzu8WJ4j2meqszm7ILjQIYpE9YrO2n6mDkw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 6nLy1oZDiI0GDEsA2cGfRKjp8Mm1fRS8
cf-ray: 683de7d8b8ccfa78-AMS
expires: Tue, 19 Jul 2022 02:04:03 GMT

POST
H2 200 page Show response
rs.fullstory.com/rec/ 2 KB
1 KB 447ms
341ms XHR
application/json 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/page
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 8426b2d0a63cc9d3f8122abdd2864b0b956b0ebd6bd93e62e57fb42cf7415ed2

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: gzip
content-type: application/json; charset=utf-8
access-control-allow-origin: https://page.firstleaf.club
access-control-allow-credentials: true
alt-svc: clear
content-length: 1017
via: 1.1 google

GET
H/1.1 200
OK sa.css
tags.srv.stackadapt.com/ 83 B
310 B 132ms
130ms Stylesheet
text/css 52.205.8.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.8.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-8-225.compute-1.amazonaws.com
Software: /
Resource Hash: 32b56ae665e6fa2c28e14760615cb0f5ad99a1f5da920d1d073481cf9d4e3046

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 24 Aug 2021 16:20:02 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 83
Content-Type: text/css

GET
H/1.1 200
OK sa.jpeg Show response
tags.srv.stackadapt.com/ 0
881 B 515ms
129ms Fetch
image/jpeg 52.205.8.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.8.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-8-225.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 24 Aug 2021 16:20:02 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 651
Content-Type: image/jpeg

GET
H/1.1 200
OK tv2track.php
collector-7547.tvsquared.com/ 42 B
276 B 143ms
142ms Image
image/gif 3.12.200.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://collector-7547.tvsquared.com/tv2track.php?action_name=Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf&idsite=TV-27455427-1&rec=1&r=744615&h=18&m=20&s=1&url=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&urlref=https%3A%2F%2Fjacobs.perkspot.com%2F&_id=f4009bfb22e510e3&_idts=1629822002&_idvc=0&_idn=1&_viewts=&cookie=1&res=1600x1200&gt_ms=187
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.12.200.117 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-12-200-117.us-east-2.compute.amazonaws.com
Software: nginx /
Resource Hash: f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:02 GMT
Server: nginx
Connection: keep-alive
Request-Id: e1156862-9382-4217-88ef-b3718dcec2d1
P3p: CP='OTI DSP COR NID STP UNI OTPa OUR'
Content-Length: 42
Content-Type: image/gif

GET
H2 200 web-widget-preload-d9d81488360f65d03f84.js Show response
static.zdassets.com/web_widget/latest/ Frame A732 88 KB
32 KB 72ms
72ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbb99457e56765ea4bea432267ab799598687f0a3cedf17ca67efb913ee9d9ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 399640
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 4Q3JEDADYY0YPQ6M
x-amz-id-2: 4GcTnFjmyHh3ukA5HgP+mpHvxmHRUMbz5oX9lww43RO2u0TOj9KzlUuDAKyWmqJUz14i4TmrZ4s=
last-modified: Thu, 19 Aug 2021 06:56:54 GMT
server: cloudflare
etag: W/"344f0fe59e0f077ebeeeef03607601ac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vPI0oia7jQ%2FoI1LizhcbrJJxn7EQqpyJYgoG5O8VhYWk3HiU8xnRUPoC2BR0frYQMTJCXm21peSybkTe8P5ff%2B%2F6Xm7O0iyT%2BGSn%2B8KHIwpGnH11A6JZn61tKuIpOJE4d7TZw30%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 57Ip39pR3YbL9FqP79r8Y7su0sTb6uxl
cf-ray: 683de7d8e8f0fa78-AMS
expires: Fri, 19 Aug 2022 06:56:53 GMT

GET
H2 200 web-widget-framework-97edc71e1362291b402d.js Show response
static.zdassets.com/web_widget/latest/ Frame A732 184 KB
59 KB 69ms
68ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eeaf2e313228f5fa957d5cf730e42df5cf45b7e2132a594d470576a88736a481

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 399640
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 4Q3VZ42PDHS8X1TT
x-amz-id-2: S2uEwZHGl+E6BzLxDC5n2Ea33S0aubhUaQxKIPVDmw2r+5eGV2GKZhSQ5p5RWMX17kKg+U4xJSU=
last-modified: Thu, 19 Aug 2021 06:56:54 GMT
server: cloudflare
etag: W/"e374a6019f706d78fc0110673a8149b4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m7tUCTYIjvbOHP7%2FZxP%2FjhiGS7ZbYza4NX0vwBwXf2XCJ81seeAflTgKkiSCMtsTEkDxNSW%2F247oqj3GOcmsNfHbYZ96CxOOsCCgcjG%2Fxu1W7rEyYBVl37ArZT6cuu7MpquSbns%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: Wk53zNM1BfAU488Z5dqm0HEqnFW4uGAe
cf-ray: 683de7d8f8fdfa78-AMS
expires: Fri, 19 Aug 2022 06:56:53 GMT

GET
H2 200 web-widget-chat-sdk-ad0bca0cd862985f164f.js Show response
static.zdassets.com/web_widget/latest/ Frame A732 203 KB
52 KB 73ms
73ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-chat-sdk-ad0bca0cd862985f164f.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a77ebced88a45b7146f3e8b0359f37d658f0f6e0eb481583ee9319cb601d893

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3080152
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 31A3BAY1ZH9GD1BV
x-amz-id-2: tfFkqroZKroq+pqLI+M3idv/nOENLrOjrlitzrzbLnFwRXLmuGoNzapA4k4INMPdjWyRcioA/K8=
last-modified: Mon, 19 Jul 2021 02:04:04 GMT
server: cloudflare
etag: W/"093f405bc41723c43486a657a0e1a173"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BXr%2FO25tb8HWs4NR7T5bP2QiYwJq74i11qBXt6y0kge7iAz4ydCvw8MoBIrZvy0VJtgQsTN6V08rmwwzB1PjSas3Tz99OGMix%2Bipc91y6vdA6IBzleR6fOldahNZlZnqK9gghMc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 6nLy1oZDiI0GDEsA2cGfRKjp8Mm1fRS8
cf-ray: 683de7d90918fa78-AMS
expires: Tue, 19 Jul 2022 02:04:03 GMT

GET
H2 200 config Show response
penrosehill.zendesk.com/embeddable/ 1 KB
1 KB 248ms
103ms XHR
application/json 104.16.51.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://penrosehill.zendesk.com/embeddable/config

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1847eaa967fa68572b15907b46b8c40d76095549e9af076ac613e21d8de52eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: UPDATING
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 162
x-zendesk-zorg: yes
x-zendesk-origin-server: embeddable-app-server-757d8758c7-s4dlv
access-control-allow-methods: GET
vary: Origin, Accept-Encoding
x-cached: STALE
x-request-id: 683de1d51c6d5992-IAD, 683de3e43eeb3b8b-IAD
x-runtime: 0.001538
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F3pagoLdmDExHHJz6gnMfvCP1BMjRfN0BQ2g09trAv8OiYcDKn5%2BKO39rn6Rds1wNMQdM4Izm%2F9lHRpwqyNQ2WTEcDg%2FJNEfyFEzs%2FDM0zp7URILPm8yQ8CyIsZpwRroKPEUmgX9rKi6"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: public, max-age=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray: 683de7d9df75ee23-CDG

OPTIONS
H2 200 track
web.chtbl.com/ Frame 0
0 140ms
140ms Preflight
application/json 2600:9000:21f3:6000:0:cc59:3900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web.chtbl.com/track
Protocol: H2
Server: 2600:9000:21f3:6000:0:cc59:3900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: uvicorn /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://page.firstleaf.club
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-type: application/json
content-length: 49
date: Tue, 24 Aug 2021 16:20:02 GMT
server: uvicorn
access-control-allow-methods: OPTIONS,POST
access-control-allow-headers: *
access-control-allow-origin: *
vary: Origin
x-cache: Miss from cloudfront
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 8SBCgUOfyRKrZA3cP51k17VzaqOzNusWsG6exOclAePj6rarHEnAmA==

POST
H2 200 track Show response
web.chtbl.com/ 49 B
379 B 223ms
221ms XHR
application/json 2600:9000:21f3:6000:0:cc59:3900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web.chtbl.com/track
Requested by: Host: ext.chtbl.com
URL: https://ext.chtbl.com/trackable.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:6000:0:cc59:3900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: uvicorn /
Resource Hash: bb30148d9df7671c14f2cd5be91e6b7a1488932efb740a80b66f39052744c168

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json;charset=UTF-8

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
server: uvicorn
x-amz-cf-pop: FRA2-C2
vary: Origin
access-control-allow-methods: OPTIONS,POST
content-type: application/json
access-control-allow-origin: *
x-cache: Miss from cloudfront
access-control-allow-headers: *
content-length: 49
x-amz-cf-id: k8pnLn-PibyhXKKAMh92Qb5XYu0FW61gzLcc3VVKmUdXgZlpPis8CA==

GET
H/1.1 200
OK rb
rbv9j7km.firstleaf.club/v2/ 44 B
338 B 218ms
125ms Image
image/gif 159.203.152.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rbv9j7km.firstleaf.club/v2/rb?pageReferrer=https%3A%2F%2Fjacobs.perkspot.com%2F&url=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&action=view&source=firstleaf&rb_source=firstleaf&script_version=wxyz.js&sessionId=44f09618-7072-4a8c-944d-75e8e2731396&uid=rbos-c9c9a178-2ead-4906-9155-c1889ab2d6db
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.203.152.67 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: openresty /
Resource Hash: 039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:02 GMT
Server: openresty
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: image/gif

GET
H/1.1 200
OK rb
rbv9j7km.firstleaf.club/v2/ 44 B
338 B 194ms
130ms Image
image/gif 159.203.152.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rbv9j7km.firstleaf.club/v2/rb?pageReferrer=https%3A%2F%2Fjacobs.perkspot.com%2F&url=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&action=identify&source=firstleaf&rb_source=firstleaf&tatari_session_id=f699ae3c-3c2d-00bf-3d5e-f261c1eaf555&chartable_user_id=7362f18e-1219-4dec-af8f-c2e1371af5f2&script_version=wxyz.js&sessionId=44f09618-7072-4a8c-944d-75e8e2731396&uid=rbos-c9c9a178-2ead-4906-9155-c1889ab2d6db
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.203.152.67 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: openresty /
Resource Hash: 039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:02 GMT
Server: openresty
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: image/gif

GET
H/1.1 200
OK 2CCB709CDC50 Show response
api.datasteam.io/v1/C/RawData/ 208 B
795 B 561ms
135ms Script
text/plain 3.213.211.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.datasteam.io/v1/C/RawData/2CCB709CDC50?v=588eec63-3448-41ae-8985-ac4ebd18d2e1&se=817b32d3-398c-4644-8d18-5e41fc57fcd3&d=eyJ2IjoiNTg4ZWVjNjMtMzQ0OC00MWFlLTg5ODUtYWM0ZWJkMThkMmUxIiwibSI6ImYxMzY1YzUyLTE2ODktNDZlMi1iMmYzLTZjNzk2ZGI2MjQyZiIsImNzaSI6IiIsInNlIjoiODE3YjMyZDMtMzk4Yy00NjQ0LThkMTgtNWU0MWZjNTdmY2QzIiwibiI6MSwicCI6IjA5Njg0ZGFmLTVjMmItNGE0Yy05YmFmLTIwYjc3MTQ0ZjhiZiIsInUiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpej91dG1fc291cmNlPWNqX2FmZmlsaWF0ZSZmcmllbmRzPXRydWUmdXRtX21lZGl1bT1jcGEmdXRtX2NhbXBhaWduPTE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjImdXRtX3Rlcm09JnV0bV9jb250ZW50PTEzNTUyODQ1XzYrQm90dGxlcytmb3IrJTI0NDArUGx1cytGcmVlK1NoaXBwaW5nK2ZvcithK1llYXImdXRtX3N1YmNhbXBhaWduPTIwOTcwNjImY2pldmVudD0yMDYwMTU2MjA0ZjcxMWVjODNlZjAzOGMwYTE4MDUxMiIsInBuIjoiL3F1aXoiLCJyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tLyIsInQiOiJCdXlpbmcgQXdhcmQtV2lubmluZyBXaW5lIElzIFNpbXBsZSBXaXRoIEZpcnN0bGVhZiIsImMiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpeiIsInByIjoiOUNEQzUwIiwidXRtX3MiOiJjal9hZmZpbGlhdGUiLCJ1dG1fbSI6ImNwYSIsInV0bV9jIjoiMTg1MDc3MV8xMitJbnRlcmFjdGl2ZStMTENfMjA5NzA2MiIsInMiOjEsInZzIjoxLCJsIjoiUGFnZUxvYWQifQ%3D%3D&callback=cb71ad054d4c2ab
Requested by: Host: cdn.datasteam.io
URL: https://cdn.datasteam.io/js/D22CCB709CDC50.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.211.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-211-223.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: cb5dd16308166e2fa952b70971f4911960c584ab7da699608bec15fce74cc8ca

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:02 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 208

GET
H2 200 config Show response
penrosehill.zendesk.com/embeddable/ 1 KB
857 B 261ms
194ms XHR
application/json 104.16.51.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://penrosehill.zendesk.com/embeddable/config

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1847eaa967fa68572b15907b46b8c40d76095549e9af076ac613e21d8de52eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-zendesk-zorg: yes
x-zendesk-origin-server: embeddable-app-server-757d8758c7-s4dlv
access-control-allow-methods: GET
vary: Origin, Accept-Encoding
x-cached: STALE
x-request-id: 683dba942fd440ef-LHR, 683de7d9ef76ee23-IAD
x-runtime: 0.001172
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FqbnMhtfNC%2B2MtGbQv6xW3pTZP76jemaUiq40NuMM72OxqTFz1nQU2LOHnM4sUOBkVHTVm6N4RCYyRtxKwDNFt5m%2BtYd1OUmokfOI%2Fsx7cRAPWIVrPRLJSSPX2Z4dwCuTFmtg7qwsNpC"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: public, max-age=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray: 683de7d9ef76ee23-CDG

GET
H/1.1 200
OK / Show response
data.cdnbasket.net/ 57 B
406 B 475ms
159ms XHR
application/json 35.227.203.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://data.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bf9d1b39f31e38750440567b75e6eeb7.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.227.203.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.203.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 26ae7b7f0278c3b81b2ee4901d669167f1a6a20d3c22d3a2e1922ca6a263549f

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 24 Aug 2021 16:20:02 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
page.cdnbasket.net/ 57 B
406 B 476ms
155ms XHR
application/json 35.227.224.109
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://page.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bf9d1b39f31e38750440567b75e6eeb7.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.227.224.109 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 109.224.227.35.bc.googleusercontent.com
Software: /
Resource Hash: d9a4a375ae347d1c5512808a99d0eac792fb416af21bd90fc9993df6ff1692ff

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 24 Aug 2021 16:20:02 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
view.cdnbasket.net/ 57 B
406 B 475ms
149ms XHR
application/json 35.186.223.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://view.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bf9d1b39f31e38750440567b75e6eeb7.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.186.223.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.223.186.35.bc.googleusercontent.com
Software: /
Resource Hash: ee8f1e346db3e2c4537ca018738ee6cbb15ed36930c126beb8384a97dc8de5bd

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 24 Aug 2021 16:20:02 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H2 200 local_storage_frame16.min.html Show response
assets.bounceexchange.com/assets/bounce/ Frame 8CD8 2 KB
1 KB 49ms
49ms Document
text/html 34.98.72.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/local_storage_frame16.min.html
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bf9d1b39f31e38750440567b75e6eeb7.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f2f11e4d45030f1f21ec7d3ae67a65b83c4c67016fe861fbebdff04ca0c8cd60

Request headers

:method: GET
:authority: assets.bounceexchange.com
:scheme: https
:path: /assets/bounce/local_storage_frame16.min.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://page.firstleaf.club/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://page.firstleaf.club/

Response headers

x-guploader-uploadid: ADPycduL0_zA1jGMb2xVwJbefMOZVA0m7zmxBfOOWAwNlZYBAlAR0Zvs9N8XmPahS8AdO_jlE__kFnM_y_tIEPa2erQ
date: Wed, 18 Aug 2021 06:17:59 GMT
expires: Thu, 18 Aug 2022 06:17:59 GMT
last-modified: Tue, 17 Aug 2021 15:17:06 GMT
etag: "eeea1ec7c5299d2e4e146ad9f24be9df"
x-goog-generation: 1629213426835489
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 1055
content-type: text/html; charset=UTF-8
content-encoding: gzip
x-goog-hash: crc32c=a9cGIA== md5=7uoex8UpnS5OFGrZ8kvp3w==
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
vary: Accept-Encoding
content-length: 1055
access-control-allow-origin: *
access-control-expose-headers: etag Content-Type
server: UploadServer
cache-control: public,max-age=31536000
age: 554523
alt-svc: clear

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
91 B 9ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1669030446688031&ev=Microdata&dl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&rl=https%3A%2F%2Fjacobs.perkspot.com%2F&if=false&ts=1629822002277&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf%22%2C%22meta%3Adescription%22%3A%22Firstleaf%20brings%20you%20the%20best%20wines%20that%20fit%20your%20individual%20taste%20when%20you%20become%20a%20member%20of%20our%20award-winning%20wine%20club%22%2C%22meta%3Akeywords%22%3A%22wine%2C%20wine%20club%22%7D&cd[OpenGraph]=%7B%22og%3Alocale%22%3A%22en_US%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22Discover%20Award-Winning%20Wines%20From%20Around%20The%20World%20That%20Are%20Personalized%20To%20Your%20Individual%20Taste%22%2C%22og%3Adescription%22%3A%22Our%20world-class%20winemakers%20will%20send%20you%20the%20best%20wines%2C%20specific%20to%20your%20individual%20palate%2C%20at%20a%20value%20that%20can%27t%20be%20beat.%22%2C%22og%3Asite_name%22%3A%22Discover%20Award-Winning%20Wines%20From%20Around%20The%20World%20That%20Are%20Personalized%20To%20Your%20Individual%20Taste%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fpage.firstleaf.club%2Fquiz%22%2C%22og%3Aimage%22%3A%22%2F%2Fv.fastcdn.co%2Fu%2F814df80e%2F34504091-0-Unboxing03-132-1.jpg%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fv.fastcdn.co%2Fu%2F814df80e%2F34504091-0-Unboxing03-132-1.jpg%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.44&r=stable&ec=1&o=30&fbp=fb.1.1629822001753.774473020&eid=ob2_plugin-set_8423b3cc96a99420417d8e7802649724974ee891d7c721dc35031f79e9cf06b0&it=1629822001433&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Tue, 24 Aug 2021 16:20:02 GMT

GET
H2 200 en-us-json-c92f040571c86c5604a4.js Show response
static.zdassets.com/web_widget/latest/web-widget-locales/ Frame 460B 33 KB
7 KB 67ms
66ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-locales/en-us-json-c92f040571c86c5604a4.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6eb4e5bf06118c495126b1cf6f5f370f94bc7651c6525d6c606877170afbf53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 740359
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 0TBV60A79Z96NHFA
x-amz-id-2: nmsb3c7vCzxhDfkxWWx0UqPrGt9Ibcee3mnut3akBqyyz7Vljdn5Esz75cUqy1/6V2OaALxHsZg=
last-modified: Fri, 13 Aug 2021 00:23:14 GMT
server: cloudflare
etag: W/"38e7cc9c495c12720eec3517509bd5e3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OAtuhjSxkckASMwEcdeAj4i2c%2BlLxRwMIzwoQOTfpmmUJjF8mh4qL2RXIB8%2FDBCyZOf0GUA%2BTESW3FnkYCly0Rcq6Qk1vu0Kodfv9IdoILvkYqs4K92g094HhFCDUVCDT%2BGeO1w%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: nxyhPh39LbwqesfRpjKXUZuzYoFcnoU5
cf-ray: 683de7da8abafa78-AMS
expires: Sat, 13 Aug 2022 00:23:13 GMT

GET
H2 200 web-widget-218-a0e6bddf78f556c0ba98.js Show response
static.zdassets.com/web_widget/latest/ Frame 460B 330 KB
100 KB 109ms
107ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-218-a0e6bddf78f556c0ba98.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9dcaeb939318effbb2db3a742e54dba4b1d31e84858207fb43b75a4b6a576dd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1293305
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: NMMVGY97EERBT9S0
x-amz-id-2: yEYoF4CZYjClgh5qy89ifZQokaoi3D/qINbwHHlxPlRqrHZsOv+e9iMxDa720RZb7GemgmHLX3Y=
last-modified: Mon, 09 Aug 2021 15:03:50 GMT
server: cloudflare
etag: W/"d270a189c9839f5d9d7f3e49bbeae2d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3ZlvtYm2dJVbU2gQI0SViWUUOsl8XvEAyYsvS31eh4ATW0IkntoYsYoF8bfkh%2FcRmhao1%2FPIojoOQTOFuzEFxDGvCLGlWdnf8yRpVxvi8yAS4nLUl%2BhyhLIgMwk9lZUxtr8SK6o%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 3sjv5e8lvY6f4Mm3flRDrq1MhhcZeVSU
cf-ray: 683de7da9aeffa78-AMS
expires: Tue, 09 Aug 2022 15:03:49 GMT

GET
H2 200 web-widget-9829-5f3c12ec148288f64210.js Show response
static.zdassets.com/web_widget/latest/ Frame 460B 91 KB
25 KB 98ms
97ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-9829-5f3c12ec148288f64210.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0987ab417187ff28db7f13e2ba5a66623e2b2cc83ba11308c8735df9a9db2792

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 740359
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 0TBS30EW49BDBRCH
x-amz-id-2: iDatlsCNBJN8nIaPicGQQ6pq0JwTtFoqW3HGYnfv7bIPfxwXqnL8iRXm7mr01+gjJVm43b5waSs=
last-modified: Fri, 13 Aug 2021 00:23:50 GMT
server: cloudflare
etag: W/"c416333951b19b5a604bb7f65785650e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X88A8%2FOagPsr8%2Bry8kcNg7axz7aocgURGuDsnwiSSpa8b1KhSiEBGhBlLcyPp1Mlwfdlv9I4g41%2Ft9fal%2FDB9T1pHS2xYBuIsNihNvxu9bqJbtDDQmlb8%2BLxRbZ3WtKhGDz%2Fig8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 49ot3h21npFAkxmz5L51VOsC2.m1cZtL
cf-ray: 683de7da9af0fa78-AMS
expires: Sat, 13 Aug 2022 00:23:49 GMT

GET
H2 200 web_widget-0eb90e308aa2a8387460.js Show response
static.zdassets.com/web_widget/latest/web-widget-lazy/ Frame 460B 417 KB
89 KB 99ms
98ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-lazy/web_widget-0eb90e308aa2a8387460.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eccbf3fae72a87817cd2d39cca489de2c2d9f73b130d223882a1c36b88919da0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 399640
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 4Q3PJANJ74DCJSP8
x-amz-id-2: rJAlNUnAKoWbvjG2rA8uHKnOF1igvPVlukSSDMgbr82cfxCprmheqMA5RqzaThCFfNLMpAmLHa4=
last-modified: Thu, 19 Aug 2021 06:55:13 GMT
server: cloudflare
etag: W/"9fb8b7e9cc7e6cea49362f07cb92834c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O14lrK9aa7Zxpf1XnWMnvQ8VoBNFLl3kkuCZBfFmpdA%2FSww5BOiP3LyIr2VCHmqpleI42yg0sKHfm%2FuA3g4ENIi3OcdNFGlVt0ES%2BW84RnRsBKnytn6RPjd3hscw%2FHIE1KE2RZw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: ZZZrJnthwO1ZQ_GxukaRr7aoxAPsnxhT
cf-ray: 683de7da9af1fa78-AMS
expires: Fri, 19 Aug 2022 06:55:12 GMT

POST
H2 200 bundle Show response
rs.fullstory.com/rec/ 29 B
91 B 383ms
284ms XHR
application/json 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/bundle?OrgId=134SPF&UserId=4645873318666240&SessionId=4791531866464256&PageId=4731174154182656&Seq=1&PageStart=1629822002096&PrevBundleTime=0&LastActivity=514&IsNewSession=true
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 2e02c4c060db17b5b8fbeb44c56540ba2af433fd6f428f4176c46651514782a1

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://page.firstleaf.club
date: Tue, 24 Aug 2021 16:20:02 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: clear
content-length: 29
content-type: application/json; charset=utf-8

GET
H2 200 en-us-json-c92f040571c86c5604a4.js Show response
static.zdassets.com/web_widget/latest/web-widget-locales/ Frame A732 33 KB
7 KB 79ms
79ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-locales/en-us-json-c92f040571c86c5604a4.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6eb4e5bf06118c495126b1cf6f5f370f94bc7651c6525d6c606877170afbf53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 740359
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 0TBV60A79Z96NHFA
x-amz-id-2: nmsb3c7vCzxhDfkxWWx0UqPrGt9Ibcee3mnut3akBqyyz7Vljdn5Esz75cUqy1/6V2OaALxHsZg=
last-modified: Fri, 13 Aug 2021 00:23:14 GMT
server: cloudflare
etag: W/"38e7cc9c495c12720eec3517509bd5e3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pv%2BnjkXQyzKFlsIHRd4nobiIDgbEWu2QY7ByxacOj%2BKjg9BHVuRFYfCvDCb40xKvN2A%2BcvJCYKplgZ4ktMiebd3cMeS4fJ1IWsKfzoY%2Feq8W5XwFrSf3eo5Cb9xDTTbGfCD%2B4Bg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: nxyhPh39LbwqesfRpjKXUZuzYoFcnoU5
cf-ray: 683de7db5bb4fa78-AMS
expires: Sat, 13 Aug 2022 00:23:13 GMT

GET
H2 200 web-widget-218-a0e6bddf78f556c0ba98.js Show response
static.zdassets.com/web_widget/latest/ Frame A732 330 KB
100 KB 80ms
78ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-218-a0e6bddf78f556c0ba98.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9dcaeb939318effbb2db3a742e54dba4b1d31e84858207fb43b75a4b6a576dd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1293305
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: NMMVGY97EERBT9S0
x-amz-id-2: yEYoF4CZYjClgh5qy89ifZQokaoi3D/qINbwHHlxPlRqrHZsOv+e9iMxDa720RZb7GemgmHLX3Y=
last-modified: Mon, 09 Aug 2021 15:03:50 GMT
server: cloudflare
etag: W/"d270a189c9839f5d9d7f3e49bbeae2d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tgzAtcOs0rHyzZ%2BAKZM8gam%2FZNuArQu7kcSjXBNVgaFgqs3yMujLRfvM1wkDj86w4%2BaI5BKIXJqM6x0%2Bf%2B8AsEZode6%2B90OGv4RPA5FgKm2KteMCB4hYLpxGeUlT0L8z7mvJ%2B9A%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 3sjv5e8lvY6f4Mm3flRDrq1MhhcZeVSU
cf-ray: 683de7db5bbdfa78-AMS
expires: Tue, 09 Aug 2022 15:03:49 GMT

GET
H2 200 web-widget-9829-5f3c12ec148288f64210.js Show response
static.zdassets.com/web_widget/latest/ Frame A732 91 KB
25 KB 76ms
75ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-9829-5f3c12ec148288f64210.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0987ab417187ff28db7f13e2ba5a66623e2b2cc83ba11308c8735df9a9db2792

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 740359
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 0TBS30EW49BDBRCH
x-amz-id-2: iDatlsCNBJN8nIaPicGQQ6pq0JwTtFoqW3HGYnfv7bIPfxwXqnL8iRXm7mr01+gjJVm43b5waSs=
last-modified: Fri, 13 Aug 2021 00:23:50 GMT
server: cloudflare
etag: W/"c416333951b19b5a604bb7f65785650e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sH1tcA%2FAi2TpwVyWHBHVuAqiyXxx%2B9%2BCYn56L13sG4eERnrBBDfDvFAJkw7nU1OpFZph2JULkXbVMcz%2F1mim3sLGZ85UoZuOrkVW0dVJgh7aGWr4jCPaGD5yrADcoH5kb4I6hdI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 49ot3h21npFAkxmz5L51VOsC2.m1cZtL
cf-ray: 683de7db5bbffa78-AMS
expires: Sat, 13 Aug 2022 00:23:49 GMT

GET
H2 200 web_widget-0eb90e308aa2a8387460.js Show response
static.zdassets.com/web_widget/latest/web-widget-lazy/ Frame A732 417 KB
89 KB 76ms
76ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-lazy/web_widget-0eb90e308aa2a8387460.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eccbf3fae72a87817cd2d39cca489de2c2d9f73b130d223882a1c36b88919da0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 399640
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: 4Q3PJANJ74DCJSP8
x-amz-id-2: rJAlNUnAKoWbvjG2rA8uHKnOF1igvPVlukSSDMgbr82cfxCprmheqMA5RqzaThCFfNLMpAmLHa4=
last-modified: Thu, 19 Aug 2021 06:55:13 GMT
server: cloudflare
etag: W/"9fb8b7e9cc7e6cea49362f07cb92834c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E%2F3zNYi9eLk4haQ%2FEJAvzu%2BH7Fw1ZqEnlw6nfqsdmXqTXneKu8UM%2FHvISPmCFsDMIqiwwRq75Lr%2BBSdxOE3wsESYrM0%2F3M2TvYcBK%2BQCXH9bY%2BbgalYxRDOI5KNiWhTf3O%2Frl9I%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: ZZZrJnthwO1ZQ_GxukaRr7aoxAPsnxhT
cf-ray: 683de7db5bc0fa78-AMS
expires: Fri, 19 Aug 2022 06:55:12 GMT

GET
H2 200 embeddable_blip Show response
penrosehill.zendesk.com/ Frame 460B 0
327 B 170ms
169ms XHR
text/plain 104.16.51.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://penrosehill.zendesk.com/embeddable_blip?type=pageView&data=eyJjaGFubmVsIjoid2ViX3dpZGdldCIsInBhZ2VWaWV3Ijp7InJlZmVycmVyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tLyIsInRpbWUiOjAsImxvYWRUaW1lIjoxOTIuOTAwMDAxNTI1ODc4OSwibmF2aWdhdG9yTGFuZ3VhZ2UiOiJlbi1VUyIsInBhZ2VUaXRsZSI6IkJ1eWluZyBBd2FyZC1XaW5uaW5nIFdpbmUgSXMgU2ltcGxlIFdpdGggRmlyc3RsZWFmIiwidXNlckFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzkyLjAuNDUxNS4xNTkgU2FmYXJpLzUzNy4zNiIsImlzTW9iaWxlIjpmYWxzZSwiaXNSZXNwb25zaXZlIjp0cnVlLCJ2aWV3cG9ydE1ldGEiOiJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIiwiaGVscENlbnRlckRlZHVwIjpmYWxzZX0sImJ1aWQiOiJjYjRlNjMxOGM5Yjc3ZTNmMzg5MzkwYzMyM2NjNTdmMyIsInN1aWQiOiJiODA3OTM3YTBhYTU4NjU2MjhiMmU3NjEyOTdiMTBiMCIsInZlcnNpb24iOiIwYmQ2MGFiNmQiLCJ0aW1lc3RhbXAiOiIyMDIxLTA4LTI0VDE2OjIwOjAyLjU1MloiLCJ1cmwiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpej91dG1fc291cmNlPWNqX2FmZmlsaWF0ZSZmcmllbmRzPXRydWUmdXRtX21lZGl1bT1jcGEmdXRtX2NhbXBhaWduPTE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjImdXRtX3Rlcm09JnV0bV9jb250ZW50PTEzNTUyODQ1XzYrQm90dGxlcytmb3IrJTI0NDArUGx1cytGcmVlK1NoaXBwaW5nK2ZvcithK1llYXImdXRtX3N1YmNhbXBhaWduPTIwOTcwNjImY2pldmVudD0yMDYwMTU2MjA0ZjcxMWVjODNlZjAzOGMwYTE4MDUxMiJ9

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-zendesk-zorg: yes
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=leskF09mShtNK5eHbXQiiqLzCVB56HZmi4%2BwYAi8ZlotDDTQczKyXQnnETc%2BP%2BrcQGWlQJQmewLhRP6oYZO877AUi5bmMmuj1Jzplo5G01UM2nRJr1cMrd2tGWP3%2FYuzm3toKnEO95XC"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://page.firstleaf.club
accept-ranges: bytes
cf-ray: 683de7dc2975ee23-CDG
vary: Accept-Encoding
content-length: 0
x-request-id: 2a3e7a6083aab16fb2913106d62ef7d6

GET
H/1.1 200
OK saq_pxl Show response
tags.srv.stackadapt.com/ 116 B
424 B 133ms
133ms XHR
text/plain 52.205.8.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=IOSBs3FjUaqbjgRgvgMP0A&is_js=true&landing_url=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512&t=Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf&host=https://page.firstleaf.club
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.8.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-8-225.compute-1.amazonaws.com
Software: /
Resource Hash: bce81f2aefa4042dd1af80d01b7f9c874e95aadb151fa05cfaae23e64e8f3e86

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:02 GMT
Access-Control-Allow-Methods: GET
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://page.firstleaf.club
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 116

GET
H2 200 embeddable_blip Show response
penrosehill.zendesk.com/ Frame A732 0
404 B 443ms
442ms XHR
text/plain 104.16.51.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://penrosehill.zendesk.com/embeddable_blip?type=pageView&data=eyJjaGFubmVsIjoid2ViX3dpZGdldCIsInBhZ2VWaWV3Ijp7InJlZmVycmVyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tLyIsInRpbWUiOjAsImxvYWRUaW1lIjoxMjEuNjk5OTk2OTQ4MjQyMTksIm5hdmlnYXRvckxhbmd1YWdlIjoiZW4tVVMiLCJwYWdlVGl0bGUiOiJCdXlpbmcgQXdhcmQtV2lubmluZyBXaW5lIElzIFNpbXBsZSBXaXRoIEZpcnN0bGVhZiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Mi4wLjQ1MTUuMTU5IFNhZmFyaS81MzcuMzYiLCJpc01vYmlsZSI6ZmFsc2UsImlzUmVzcG9uc2l2ZSI6dHJ1ZSwidmlld3BvcnRNZXRhIjoid2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCIsImhlbHBDZW50ZXJEZWR1cCI6ZmFsc2V9LCJidWlkIjoiY2QwYTY2N2Q2ODVmOTJhNGMyMmM0NWM4YjQxMTIwYzciLCJzdWlkIjoiZjAwNGFkMzMxZDZhOGE5MWIzNTlhYmQyZDdiNzkwMGUiLCJ2ZXJzaW9uIjoiMGJkNjBhYjZkIiwidGltZXN0YW1wIjoiMjAyMS0wOC0yNFQxNjoyMDowMi42ODdaIiwidXJsIjoiaHR0cHM6Ly9wYWdlLmZpcnN0bGVhZi5jbHViL3F1aXo%2FdXRtX3NvdXJjZT1jal9hZmZpbGlhdGUmZnJpZW5kcz10cnVlJnV0bV9tZWRpdW09Y3BhJnV0bV9jYW1wYWlnbj0xODUwNzcxXzEyK0ludGVyYWN0aXZlK0xMQ18yMDk3MDYyJnV0bV90ZXJtPSZ1dG1fY29udGVudD0xMzU1Mjg0NV82K0JvdHRsZXMrZm9yKyUyNDQwK1BsdXMrRnJlZStTaGlwcGluZytmb3IrYStZZWFyJnV0bV9zdWJjYW1wYWlnbj0yMDk3MDYyJmNqZXZlbnQ9MjA2MDE1NjIwNGY3MTFlYzgzZWYwMzhjMGExODA1MTIifQ%3D%3D

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:03 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-zendesk-zorg: yes
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ctib1Ek3tE7c15fQ6ATejpjyJtxYu5FkCqglVPm59iV2A%2BILYXc8YimOrAiU9qRdyKXtLnMP2TBxgR%2FVE9wtfzD4Mc6lV4mRkO8z7yd0%2BWKxj0Gz5uip3bqs4r95y4j9j%2Fgi5OttbiHv"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://page.firstleaf.club
accept-ranges: bytes
cf-ray: 683de7dd1a93ee23-CDG
vary: Accept-Encoding
content-length: 0
x-request-id: 66b9cb853d40f6575ecd63b046d5d2f8

GET
H2 200 c Show response
ids.cdnwidget.com/ 31 B
170 B 246ms
146ms XHR
application/json 130.211.47.17
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ids.cdnwidget.com/c?cookieID=&deviceID=&iv=&v=&GCH1=ec1d68233f62831f4621395416806c48&SCH1=&GCS1=058087013&GCS2=OTkyYWUzYzItZTZhYy00N2Q2LWEzYzMtNGY1YTU4MGQ3Yzc4LmxvY2FsLDM4Mzg4ZTk0LTVhN2MtNDg5Mi04YTdhLTU1ODYzNTM1Yjg2OC5sb2NhbA==&pe=false&wsid=4263&log=%7B%22config%22%3A%7B%22gmEN%22%3Atrue%2C%22pixEN%22%3Afalse%7D%2C%22apikey%22%3A%222%5EHIykD%22%2C%22cjsversion%22%3A%221.5.9%22%2C%22wsid%22%3A4263%2C%22loadID%22%3A%22fHGQ6oDhQZCwuRI%22%2C%22timing%22%3A%7B%22sessionStorageLoad%22%3A11%2C%22IDStageStart%22%3A11%2C%22netComplete%22%3A212%2C%22obsReqdata%22%3A531%2C%22obsReqpage%22%3A532%2C%22obsReqview%22%3A532%2C%22IDStagePrefire%22%3A533%7D%2C%22matches%22%3A%7B%22cookie%22%3Afalse%2C%22LS%22%3Afalse%7D%2C%22info%22%3A%7B%22isSpoofed%22%3Atrue%2C%22PM%22%3Afalse%2C%22DNT%22%3Afalse%2C%22deviceTimezone%22%3A2%2C%22extensionID%22%3Anull%2C%22externalID%22%3Anull%2C%22agent%22%3A%7B%22device%22%3Anull%7D%2C%22firstLoad%22%3Atrue%7D%7D
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bf9d1b39f31e38750440567b75e6eeb7.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.47.17 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 17.47.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 6627c5ab36fa407f18fc9b6987e359eccef005ae6d35b370d2142b7daa770324

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: https://page.firstleaf.club
date: Tue, 24 Aug 2021 16:20:02 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: clear
content-type: application/json

GET
H2 200 fs.js Show response
edge.fullstory.com/s/ Frame C059 209 KB
63 KB 45ms
44ms Script
application/javascript 35.201.112.186
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/fs.js
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 082a814158a4221fc2e1da585435b8d31fa704f221169ebe12b9b4d3573016a2

Request headers

Origin: https://page.firstleaf.club
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 15:28:28 GMT
content-encoding: gzip
age: 3094
x-guploader-uploadid: ADPycdvQon_JgoLvz_By6WvG7N-u_N1ciVIJpw1k30k7Yf7_yheogKy3tsOCtnTyYypTtcq3_7YXDkL_GrafPP9AKbZA4JHnTw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 64115
last-modified: Thu, 05 Aug 2021 19:32:56 GMT
server: UploadServer
etag: "22b58691e95646727daf16321cfe2ed1"
x-goog-hash: crc32c=z4hkXw==, md5=IrWGkelWRnJ9rxYyHP4u0Q==
x-goog-generation: 1628191976428607
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=3600,no-transform
x-goog-stored-content-length: 64115
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 24 Aug 2021 16:28:28 GMT

GET
H2 200 fs.js Show response
edge.fullstory.com/s/ Frame 7A89 209 KB
63 KB 93ms
93ms Script
application/javascript 35.201.112.186
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/fs.js
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 082a814158a4221fc2e1da585435b8d31fa704f221169ebe12b9b4d3573016a2

Request headers

Origin: https://page.firstleaf.club
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 15:28:28 GMT
content-encoding: gzip
age: 3094
x-guploader-uploadid: ADPycdvQon_JgoLvz_By6WvG7N-u_N1ciVIJpw1k30k7Yf7_yheogKy3tsOCtnTyYypTtcq3_7YXDkL_GrafPP9AKbZA4JHnTw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 64115
last-modified: Thu, 05 Aug 2021 19:32:56 GMT
server: UploadServer
etag: "22b58691e95646727daf16321cfe2ed1"
x-goog-hash: crc32c=z4hkXw==, md5=IrWGkelWRnJ9rxYyHP4u0Q==
x-goog-generation: 1628191976428607
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=3600,no-transform
x-goog-stored-content-length: 64115
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 24 Aug 2021 16:28:28 GMT

GET
H2 200 g.jsonp Show response
aa.agkn.com/adscores/ 82 B
392 B 177ms
57ms Script
application/json 35.176.195.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aa.agkn.com/adscores/g.jsonp?sid=9202274878&userid=9CDC50-588EEC63-3448-41AE-8985-AC4EBD18D2E1
Requested by: Host: cdn.datasteam.io
URL: https://cdn.datasteam.io/js/D22CCB709CDC50.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.195.187 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-176-195-187.eu-west-2.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: 9e446e75dc20b6dc693b247aaf7704112e55ef434588368aa0761fc76b3a29a5

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 24 Aug 2021 16:20:02 GMT
server: AAWebServer
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
cache-control: no-cache, no-store, must-revalidate
content-type: application/json
content-length: 82
expires: 0

GET
H/1.1

200
OK

63537
i6.liadm.com/s/
Redirect Chain

https://i.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-588EEC63-3448-41AE-8985-AC4EBD18D2E1
https://i6.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-588EEC63-3448-41AE-8985-AC4EBD18D2E1

43 B
447 B

289ms
94ms

Image
image/gif

2600:1f18:444a:4680:5b76:7408:bdd4:1592
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-588EEC63-3448-41AE-8985-AC4EBD18D2E1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:444a:4680:5b76:7408:bdd4:1592 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:03 GMT
Cache-Control: no-store
Connection: keep-alive
trace-id: 29f9f853d4fcc416
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-588EEC63-3448-41AE-8985-AC4EBD18D2E1
Date: Tue, 24 Aug 2021 16:20:03 GMT
Connection: keep-alive
trace-id: 84260ec38927165e
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK 2CCB709CDC50 Show response
api.datasteam.io/v1/C/RawData/ 208 B
795 B 136ms
135ms Script
text/plain 3.213.211.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.datasteam.io/v1/C/RawData/2CCB709CDC50?v=588eec63-3448-41ae-8985-ac4ebd18d2e1&se=817b32d3-398c-4644-8d18-5e41fc57fcd3&d=eyJ2IjoiNTg4ZWVjNjMtMzQ0OC00MWFlLTg5ODUtYWM0ZWJkMThkMmUxIiwibSI6IjA3Nzk4MzgzLThjYWItNDY3OS1hZDM1LTgxOWE1ZDM4YmFiZiIsImNzaSI6IiIsInNlIjoiODE3YjMyZDMtMzk4Yy00NjQ0LThkMTgtNWU0MWZjNTdmY2QzIiwicCI6IjA5Njg0ZGFmLTVjMmItNGE0Yy05YmFmLTIwYjc3MTQ0ZjhiZiIsInUiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpej91dG1fc291cmNlPWNqX2FmZmlsaWF0ZSZmcmllbmRzPXRydWUmdXRtX21lZGl1bT1jcGEmdXRtX2NhbXBhaWduPTE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjImdXRtX3Rlcm09JnV0bV9jb250ZW50PTEzNTUyODQ1XzYrQm90dGxlcytmb3IrJTI0NDArUGx1cytGcmVlK1NoaXBwaW5nK2ZvcithK1llYXImdXRtX3N1YmNhbXBhaWduPTIwOTcwNjImY2pldmVudD0yMDYwMTU2MjA0ZjcxMWVjODNlZjAzOGMwYTE4MDUxMiIsInBuIjoiL3F1aXoiLCJyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tLyIsInQiOiJCdXlpbmcgQXdhcmQtV2lubmluZyBXaW5lIElzIFNpbXBsZSBXaXRoIEZpcnN0bGVhZiIsImMiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpeiIsInByIjoiOUNEQzUwIiwiZWlkIjoibnNfc2VnXzAwMCIsInV0bV9zIjoiY2pfYWZmaWxpYXRlIiwidXRtX20iOiJjcGEiLCJ1dG1fYyI6IjE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjIiLCJzIjoyLCJ2cyI6MSwibCI6IkFjdGlvbiIsInYwMSI6IkVpZCIsInYwMiI6Im5zX3NlZ18wMDAifQ%3D%3D&callback=cb3605eced31542
Requested by: Host: cdn.datasteam.io
URL: https://cdn.datasteam.io/js/D22CCB709CDC50.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.211.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-211-223.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: 878514ad86b3587bf26342fa8dd5da06fac5ea3992312a65b6bb7547e398ff95

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:02 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 208

GET
H2 200 init1.js Show response
api.bounceexchange.com/bounce/ 36 B
320 B 161ms
75ms Script
text/html 34.117.4.53
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.bounceexchange.com/bounce/init1.js?wklz=C4ewVgigvAZgrgOwMbAJYgQMhQZygRgDYAmATgA5jiAGagZmv2s2AC8QoBafGzAdwCmAIxypgAgPqoAJlAAsxQnUwAnAThAAbOGgwFCtAB49aqgTAEq1KqGACGSECIB0AB0sBrHK5DBnjgFtsO01NVAQAcwk4FU0oAAtgYFccAFI6AEFU4gAxbJzXOwiBZxhUFRxgTQE7GH9tIXyARzhUVnScnQCJDRikAXSAESQwCVqysLtxbMIYFVQBBGk0ukHgFTgBxS6JAIFpVDgAoaRCmZ2kOwDC1AiEIfxyAFZqAHZX-AkebIAhAEkEOIVA40AA3LY-AAykIAwhIaKRXtQSOdgN0gcdVqjuo5AYtgA86E8nsRyHInhJCL8fr4qupfjAQCpftkSXI5NRfgAFbRpYg-HJqCEAZXiqFcrnCEQZTN+dl+AE0asztmienAhJdrnZbvdVgikSjFCMBODAUMaAZ8E8SNQ5DAPvgBEhyHRzPRyEhqHZHtQnjxMKDUKJgBJHCAPAsoKlXj9ssRNK54+kslREsk+U9MqzcjmCkUSmUKnTavUNXmWm1WXROmreip+tXhqNxqhJtNiCTZvNFssm+tNjnCDs9gcjk3TvLO6qcVcbncm48Xu9Pt9p-88cCUKhwTmobD4dREcjiEOdhim2e1bjxObO6t8ESSWSKVT1zSktVM-zGSqSXHpzZDk9x5OBvwFIU91FcVJUiPdfz3Kd-yVOw-xndVNTnHUF3vQYDRPIcTTNAlcMtRgbRoe1HWdV13ToT1vV9f1TyobIYXjFVT2zKh7EcFx3BULwfD8QJk1eQZsBACMoxjADiFBZNs1jeNTUsCRNBACJimkKR7lYzIYBCHAtnYqhLhUUMmmAABPRSMk5YhTOIczQ1BEJB30+y2PjHANQCMRxB0jAQy2LiMkMzRjO8szUNDYySLCiKosc+MNK0-ZdKkaR8VQMp9jspKBnE6LiGkCIcnKSpIRAOxpDsgcioktyKgAbTS7TdIAXVgIyBEDVCcBa1SVHUzSOvCbrCv61qXIkKzrO65hmsG2a3O0ARFumwbXBUEAdJ21B+km3qtpana9okBArg2nrIr65aWvCHpQCQDxjru07fKEfykgy4KxBuqaHtm+L3uM072oyp6ZByvLpDB+6BpaotJEhnSJqgBrA2ymAWtm+bNtBHG8diiQ1s2QniZBgRgAR7HzDasaoYQLLYYWeHbvB8NI0kUAQHU1Dik5vqhFcKBmBpsWWoAIhc6WABpZamAQIiZayFel87pDgFANcrVhpc6zBXGAPBJOuSZkEkGBNCKKBA3iOwoCAA
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bf9d1b39f31e38750440567b75e6eeb7.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.4.53 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 53.4.117.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: fe3fcb884394be745dbd11141b6d780028a4d86106b6292d7502db096f582218

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:03 GMT
via: 1.1 google
server: istio-envoy
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-encoding: gzip
x-envoy-upstream-service-time: 19
content-type: text/html; charset=UTF-8
alt-svc: clear

GET
H2 204 cjs-logger
e.cdnwidget.com/ 0
68 B 259ms
158ms Image
image/png 34.107.221.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e.cdnwidget.com/cjs-logger?source=ID%20generation%20error&severity=Warning&error=Country%2520not%2520allowed&cookieID=&deviceID=&BXWID=4263&warpspeed=2%5EHIykD&loadID=fHGQ6oDhQZCwuRI&version=1.5.9
Requested by: Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.221.36 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 36.221.107.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:03 GMT
via: 1.1 google
alt-svc: clear
content-type: image/png

GET
H/1.1 200
OK 2CCB709CDC50 Show response
api.datasteam.io/v1/C/RawData/ 208 B
795 B 135ms
134ms Script
text/plain 3.213.211.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.datasteam.io/v1/C/RawData/2CCB709CDC50?v=588eec63-3448-41ae-8985-ac4ebd18d2e1&se=817b32d3-398c-4644-8d18-5e41fc57fcd3&d=eyJ2IjoiNTg4ZWVjNjMtMzQ0OC00MWFlLTg5ODUtYWM0ZWJkMThkMmUxIiwibSI6ImYxODUyOTRkLWFkZjAtNDhhZi1hZDUwLTQzZjgwYThmMmUwZSIsImNzaSI6IiIsInNlIjoiODE3YjMyZDMtMzk4Yy00NjQ0LThkMTgtNWU0MWZjNTdmY2QzIiwicCI6IjA5Njg0ZGFmLTVjMmItNGE0Yy05YmFmLTIwYjc3MTQ0ZjhiZiIsInUiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpej91dG1fc291cmNlPWNqX2FmZmlsaWF0ZSZmcmllbmRzPXRydWUmdXRtX21lZGl1bT1jcGEmdXRtX2NhbXBhaWduPTE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjImdXRtX3Rlcm09JnV0bV9jb250ZW50PTEzNTUyODQ1XzYrQm90dGxlcytmb3IrJTI0NDArUGx1cytGcmVlK1NoaXBwaW5nK2ZvcithK1llYXImdXRtX3N1YmNhbXBhaWduPTIwOTcwNjImY2pldmVudD0yMDYwMTU2MjA0ZjcxMWVjODNlZjAzOGMwYTE4MDUxMiIsInBuIjoiL3F1aXoiLCJyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tLyIsInQiOiJCdXlpbmcgQXdhcmQtV2lubmluZyBXaW5lIElzIFNpbXBsZSBXaXRoIEZpcnN0bGVhZiIsImMiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpeiIsInByIjoiOUNEQzUwIiwiZWlkIjoibnNfc2VnXzAwMCIsInV0bV9zIjoiY2pfYWZmaWxpYXRlIiwidXRtX20iOiJjcGEiLCJ1dG1fYyI6IjE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjIiLCJzIjozLCJ2cyI6MSwibCI6IkFjdGlvbiIsInYwMSI6IkVzMSJ9&callback=cb29efb1962c0e9
Requested by: Host: cdn.datasteam.io
URL: https://cdn.datasteam.io/js/D22CCB709CDC50.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.211.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-211-223.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: 9efdeb0952eceb45725573be89af79b8292ccd2703c5edeb86ad37473a7b8177

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 24 Aug 2021 16:20:02 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 208

GET
H2 200 web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js Show response
static.zdassets.com/web_widget/latest/ Frame 460B 337 B
786 B 61ms
60ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a3ab89bc8d4feb680748ba773ff13a07c2db610c1308ec9c12040aa9b65d46b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:03 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3080158
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: R0EMPM7SV24WKMWR
x-amz-id-2: aWz5ad5XM0iHyU++SxDxGYjYuW1Z0JSzwBoxQMyjMvXiyFhtmx5owXFlv1YsrrZfAiWHdGssAI4=
last-modified: Mon, 19 Jul 2021 02:04:04 GMT
server: cloudflare
etag: W/"200371227ff3b0fb85badb2d2faef3b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gOjehqgD31p%2B7qMtAXwhVqgrgfqpJJQIpZzbPkbz%2BqGyvcp3u%2BlHdQXeSnDBWTvjLG4XaUp8fSGkh0zspEoM%2FOnrj3rKKvRMFU0CC17u6I%2BMrw9JtGyxcGN3waJ8VhIHtxnyH6A%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: ___O_wFiyDX4A56Xq4fDhtClHpW0qk0i
cf-ray: 683de7e02904fa78-AMS
expires: Tue, 19 Jul 2022 02:04:03 GMT

GET
H2 200 web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js Show response
static.zdassets.com/web_widget/latest/ Frame A732 337 B
518 B 58ms
57ms Script
application/javascript 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a3ab89bc8d4feb680748ba773ff13a07c2db610c1308ec9c12040aa9b65d46b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:03 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3080158
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-amz-request-id: R0EMPM7SV24WKMWR
x-amz-id-2: aWz5ad5XM0iHyU++SxDxGYjYuW1Z0JSzwBoxQMyjMvXiyFhtmx5owXFlv1YsrrZfAiWHdGssAI4=
last-modified: Mon, 19 Jul 2021 02:04:04 GMT
server: cloudflare
etag: W/"200371227ff3b0fb85badb2d2faef3b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LS%2Fims1P3pA%2F6sWVZqk4Fjnq2cnRHDPvzKEX0x%2BCe63YqXBAMDuDlyH57DMEIJcL%2FwGO94NhDl6wtzj5nz3HeXkChvFmBpa1GpBnH87SMSETJ0x5ntnXXvmYStzU16VRooCFrBQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: ___O_wFiyDX4A56Xq4fDhtClHpW0qk0i
cf-ray: 683de7e0a984fa78-AMS
expires: Tue, 19 Jul 2022 02:04:03 GMT

GET
H2 206 fda6cd35495c75f83508d9d2e77ee33d.mp3
static.zdassets.com/web_widget/latest/ Frame 460B 19 KB
20 KB 104ms
104ms Media
audio/mpeg 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/fda6cd35495c75f83508d9d2e77ee33d.mp3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97e5b0b6cfc2ba9815028429c069631ba12b294aa7419d1ea130accd0adc2d46

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 24 Aug 2021 16:20:03 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: GP6CYKE3TV0B88NT
x-amz-server-side-encryption: AES256
cf-ray: 683de7e0e9c7fa78-AMS
Content-Range: bytes 0-19697/19698
x-amz-replication-status: COMPLETED
Content-Length: 19698
x-amz-id-2: owoEjhLXz08ITSaa3A7hZQ/17W4oHdCiSy3WIFZWga6Ui5ggQhuK2aBBuBvfEtT/XLe4oPVNRHM=
last-modified: Mon, 23 Aug 2021 23:28:35 GMT
server: cloudflare
etag: "f11ce9e8f40a392830217253fe75d6de"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BjtLX4RxbN4Sh38h%2BxGU6J5qCn8m0824JF21Om%2BD7VaeTHAPW1QvugNvUR%2BQzvC3q0r1z9k9pIRwbdbfccqv30gNqvIBWdTYCUzf%2FbhESMoyQMyaO3GQ3VYqEtXu0coUwobsJPY%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: O7Ps8bp437FYfPdbGZPcf1VBhcf9ZiJE
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: audio/mpeg; charset=utf-8
expires: Tue, 23 Aug 2022 23:28:34 GMT

GET
H2 206 fda6cd35495c75f83508d9d2e77ee33d.mp3
static.zdassets.com/web_widget/latest/ Frame A732 19 KB
20 KB 106ms
105ms Media
audio/mpeg 104.18.72.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/fda6cd35495c75f83508d9d2e77ee33d.mp3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97e5b0b6cfc2ba9815028429c069631ba12b294aa7419d1ea130accd0adc2d46

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 24 Aug 2021 16:20:03 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: GP67GZR0JH728BRP
x-amz-server-side-encryption: AES256
cf-ray: 683de7e109e3fa78-AMS
Content-Range: bytes 0-19697/19698
x-amz-replication-status: COMPLETED
Content-Length: 19698
x-amz-id-2: gr2DVziZF3eNKAa0hSVvaycVRqtTfVMu+/FGYT7Y6htq+BNZykGHHsLjbLxhAli8uFhLXeb35xw=
last-modified: Mon, 23 Aug 2021 23:28:35 GMT
server: cloudflare
etag: "f11ce9e8f40a392830217253fe75d6de"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n1aZOllMXFv1Yfzq5yEMqow0k22gl2b7z05L6YeggzL%2F8Xvfe1zFUQ%2FkkoRwdEBePpDHrTsirzmzZfPNqJDon3ULMINJ6W%2BFyv2GgSaPfpzmUe5GHYi3yVFDB5rwKMhjPnFsBxA%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: O7Ps8bp437FYfPdbGZPcf1VBhcf9ZiJE
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: audio/mpeg; charset=utf-8
expires: Tue, 23 Aug 2022 23:28:34 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
658 B 365ms
266ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=nzfyd&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3D2060156204f711ec83ef038c0a180512

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:20:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Tue, 24 Aug 2021 16:20:03 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 0639a12b3663ed00a34e7467a7781b1b12717cb84a530499f52d2f6c30a7f654
x-transaction: 3a75b230fdec4d43
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H2 200 rum Show response
page.firstleaf.club/cdn-cgi/ 0
185 B 24ms
24ms XHR
text/plain 2606:4700:10::ac43:1a84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://page.firstleaf.club/cdn-cgi/rum?req_id=683de7c63aefc2ef

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-fetch-mode: cors
origin: https://page.firstleaf.club
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
cookie: __zlcmid=15jkHOMozIG5JEN
content-length: 46505
:path: /cdn-cgi/rum?req_id=683de7c63aefc2ef
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: page.firstleaf.club
referer: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=2060156204f711ec83ef038c0a180512
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/json

Response headers

date: Tue, 24 Aug 2021 16:20:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://page.firstleaf.club
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 683de7e29ad0c2ef-FRA
vary: Origin

OPTIONS
H2 200 two
ec.instapagemetrics.com/t/ Frame 0
0 461ms
151ms Preflight 35.222.120.150
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ec.instapagemetrics.com/t/two

Protocol

Server

35.222.120.150 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

150.120.222.35.bc.googleusercontent.com

Software

akka-http/10.1.12 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://page.firstleaf.club
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://page.firstleaf.club
access-control-max-age: 5
date: Tue, 24 Aug 2021 16:20:04 GMT
referrer-policy: same-origin
server: akka-http/10.1.12
strict-transport-security: max-age=315360000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
content-length: 0

POST
H2 200 two Show response
ec.instapagemetrics.com/t/ 2 B
439 B 444ms
149ms XHR
text/plain 35.222.120.150
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ec.instapagemetrics.com/t/two

Requested by

Host: cdn.instapagemetrics.com
URL: https://cdn.instapagemetrics.com/t/js/3/it.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.222.120.150 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

150.120.222.35.bc.googleusercontent.com

Software

akka-http/10.1.12 /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

date: Tue, 24 Aug 2021 16:20:04 GMT
referrer-policy: same-origin
server: akka-http/10.1.12
x-frame-options: SAMEORIGIN
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
access-control-allow-origin: https://page.firstleaf.club
access-control-allow-credentials: true
x-content-type-options: nosniff
strict-transport-security: max-age=315360000; includeSubDomains
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
content-length: 2
x-xss-protection: 1; mode=block

POST
H2 200 bundle Show response
rs.fullstory.com/rec/ 29 B
88 B 390ms
389ms XHR
application/json 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/bundle?OrgId=134SPF&UserId=4645873318666240&SessionId=4791531866464256&PageId=4731174154182656&Seq=2&PageStart=1629822002096&PrevBundleTime=1629822002707&LastActivity=4390&IsNewSession=true
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 0932dc81ba71f667f655b7d165da0bf5c976cfa52a0a1a5a623dc38050c0a73f

Request headers

Referer: https://page.firstleaf.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://page.firstleaf.club
date: Tue, 24 Aug 2021 16:20:07 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: clear
content-length: 29
content-type: application/json; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google-analytics.com
URL: https://www.google-analytics.com/g/collect?v=2&tid=G-8J161FED5Z&gtm=2oe8n0&_p=674208957&sr=1600x1200&ul=en-us&cid=931040915.1629821996&dl=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&dt=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&sid=1629821995&sct=1&seg=0&_s=2

Domain: fbapi.firstleaf.club
URL: https://fbapi.firstleaf.club/.open-bridge/config?pixel_id=1669030446688031

Verdicts & Comments Add Verdict or Comment

169 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.firstleaf.club/	1970-01-20 05:29:18	Name: __zlcmid Value: 15jkHOMozIG5JEN

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://connect.facebook.net/en_US/fbevents.js(Line 24) Message: [Facebook Pixel] - Duplicate Pixel ID: 1669030446688031.
console-api	warning	URL: https://connect.facebook.net/en_US/fbevents.js(Line 24) Message: Error was Error sending XHR: 0 -

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
aa.trkn.us
ak.sail-horizon.com
alb.reddit.com
analytics.twitter.com
anthill.instapage.com
api.bounceexchange.com
api.datasteam.io
assets.bounceexchange.com
assets.zendesk.com
az416426.vo.msecnd.net
b-code.liadm.com
bat.bing.com
cdn.datasteam.io
cdn.heapanalytics.com
cdn.instapagemetrics.com
cdn.rollbar.com
cdn.taboola.com
cdn1-res.sundaysky.com
cj.dotomi.com
cloud.typography.com
collector-7547.tvsquared.com
connect.facebook.net
ct.firstleaf.club
d1hdjv7b05hja2.cloudfront.net
d1lu3pmaz2ilpx.cloudfront.net
d2hrivdxn8ekm8.cloudfront.net
d330aiyvva2oww.cloudfront.net
data.cdnbasket.net
dc.services.visualstudio.com
dvqigh9b7wa32.cloudfront.net
e.cdnwidget.com
ec.instapagemetrics.com
edge.fullstory.com
ekr.zdassets.com
email.perkspot.com
ext.chtbl.com
fbapi.firstleaf.club
fonts.googleapis.com
fonts.gstatic.com
g.fastcdn.co
googleads.g.doubleclick.net
heapanalytics.com
heatmap-events-collector.instapage.com
hello.myfonts.net
i.liadm.com
i6.liadm.com
ids.cdnwidget.com
images.firstleaf.club
init.blackcrow.ai
jacobs.perkspot.com
jelly.mdhv.io
page.cdnbasket.net
page.firstleaf.club
penrosehill.zendesk.com
perkspot.zendesk.com
psprods3ep.azureedge.net
rbv9j7km.firstleaf.club
rp.liadm.com
rp4.liadm.com
rs.fullstory.com
s-vop.sundaysky.com
sailthru.perkspot.com
sc-static.net
script.hotjar.com
static.ads-twitter.com
static.cloudflareinsights.com
static.hotjar.com
static.zdassets.com
stats.g.doubleclick.net
stdomi.com
t.co
tag.wknd.ai
tags.srv.stackadapt.com
tr.snapchat.com
trkn.us
v.fastcdn.co
vars.hotjar.com
view.cdnbasket.net
web.chtbl.com
www.anrdoezrs.net
www.emjcd.com
www.facebook.com
www.firstleaf.club
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.redditstatic.com
fbapi.firstleaf.club
www.google-analytics.com
104.111.232.231
104.111.239.203
104.16.51.111
104.18.70.113
104.18.72.113
104.244.42.5
104.244.42.67
13.224.102.111
13.224.102.122
13.224.102.19
13.224.102.20
13.224.102.36
13.224.102.6
13.224.194.217
13.224.196.60
13.224.89.92
13.225.87.11
13.225.87.19
13.69.106.212
130.211.47.17
142.250.186.162
151.101.12.157
151.101.13.140
151.101.13.44
159.203.152.67
167.172.228.26
192.229.133.208
216.239.36.21
23.96.203.178
2600:1f18:444a:4680:5b76:7408:bdd4:1592
2600:1f18:730:b110:c4cb:f288:bc78:c53b
2600:9000:20eb:1600:3:760:2800:21
2600:9000:20eb:4200:b:dc44:3680:21
2600:9000:20eb:a00:8:8845:1500:93a1
2600:9000:2190:1600:a:b27c:d040:93a1
2600:9000:21f3:2600:17:3f5c:f800:21
2600:9000:21f3:3400:17:f683:1d40:21
2600:9000:21f3:6000:0:cc59:3900:93a1
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:4700:10::ac43:1a84
2606:4700::6810:5e41
2606:4700::6811:f349
2620:1ec:48::45
2620:1ec:c11::200
2a00:1450:4001:800::2004
2a00:1450:4001:802::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:812::2003
2a00:1450:4001:813::2004
2a00:1450:4001:828::2008
2a00:1450:4001:829::2002
2a00:1450:4001:831::200a
2a00:1450:400c:c08::9a
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.12.200.117
3.213.211.223
3.226.166.212
34.107.221.36
34.117.4.53
34.120.253.250
34.120.27.38
34.206.124.188
34.98.72.95
35.176.195.187
35.186.194.58
35.186.223.76
35.186.226.184
35.201.112.186
35.222.120.150
35.227.203.40
35.227.224.109
35.244.137.202
52.202.102.177
52.205.8.225
52.206.179.19
54.237.151.241
54.237.157.181
89.207.16.72
01af466f48d14857d97a67cd7025ce67c8a0b9ca83ddb6d3f313c7369c432868
0255458c627efd907d6313000cabccc2af24fbebd5c14cc112d3eaf6d1649f11
039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
082a814158a4221fc2e1da585435b8d31fa704f221169ebe12b9b4d3573016a2
0932dc81ba71f667f655b7d165da0bf5c976cfa52a0a1a5a623dc38050c0a73f
0987ab417187ff28db7f13e2ba5a66623e2b2cc83ba11308c8735df9a9db2792
0a77ebced88a45b7146f3e8b0359f37d658f0f6e0eb481583ee9319cb601d893
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
0e4968ab56283d1d1a44b663b9d471fa366a41d3d11dbb748618efe3df0a7cbd
0e567066985125e7974f68b42914dcb134e3c38373a4a3d668bdb38a3e55f299
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
162a3eebb385684e99a8b624b77189f9b5c38cb51d1b814c1c3a84fc17c324a7
16cc547456ffa0052c3679e6c5ece2e14ad57c92b93562deb7bcb5829b7afcb7
1a764c2e4e6cc6808b49bff5d27d1db28790d291c525f3849e12fc492fb62076
1c3bd00be556bf95f92a2ab1119b8b26544a1997ab0c09f86490bc32339ad32e
200d01f0cd516bfaff8f477ceb07b4eb083cf7e56ac403153175071990d53380
2066a5c2ea3def6ac7eb16471ef8c07c031e70970d70275185fbe53d0ae85bac
255733aa26ecbe1a2608fc086d6b510fafce3647ad1ddf22392c390a1306e640
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
26ae7b7f0278c3b81b2ee4901d669167f1a6a20d3c22d3a2e1922ca6a263549f
27dc4f62298834987d3d8e5608c1af94c82ee3d18ee31858d39e0202697b5308
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
2e02c4c060db17b5b8fbeb44c56540ba2af433fd6f428f4176c46651514782a1
3185fb7f070716c9f9705f6eab9b4bbcb0d8c90c3b53eb9e894d315738e01dc4
32b56ae665e6fa2c28e14760615cb0f5ad99a1f5da920d1d073481cf9d4e3046
364571a2f5be79b1b7cd8ed5e011ac1d62d3c05326b879582018d4bed97cac49
3a3ab89bc8d4feb680748ba773ff13a07c2db610c1308ec9c12040aa9b65d46b
3b5ec8ee05daecb254a5b42fd0742c2d9b0dfa20223156fa43a29f96de97d2d0
40f2d552c0db3ead874ec52bf624d9ec88007d8b659cd7189fecc3ff19d3d248
42ae1eb8cc55b4e2382e02323c96a40e80432d3e810bce85f10c75ddacbd2e2b
437a1672bb11b8d01e8867a7cbe9f16fb1b6217b3849f15f4247ab19cb5d6a34
43f628aef4c9eac54a0548718d071dc2e93af243dc2bb0c6bf900fd524691b96
449319f85e3e51826d1452e7dfe201765992eeb42366d5b862c497af03721d4b
44bf4e4a70686f89b0205cf1ddac04c3f26368f6512380169cb3a996d8e4f236
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
51b06909334339bd5f4027e70f4d2fd30a2a3977ee44cce7385b908ec8f51903
525f091870c1282bb4823f9e64192983f1652a3bbc84c97ca5e6c4f063ca6e82
55a72ceec0d570523aea5267ed47bbefe802949f7c3b7426554f277f96b1344f
5c1282fb121104f5a505ecbfd7194e64c98db6b830684450dcfc478021d05257
5efd1cdc9fe57d8ee4c5ee8839c2deb5a4c0a6f0eae362825bf0c94785c01632
5f9fdb61e50cacfa4aeb8191d50c647ce1507ab13801d8848d4d00be1ad6bf1d
60035f8d3292fc0b3155089baabc76fce2178f8d104ef606e4e31cbe0a2803b2
6038138cc175775b42f31d117e20be6d12d56bc495b4ccac86f2db8ca6b1240b
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
65e4d18477e0e194ae2b3848fe053621a40508eeb817ab8c832b8005edd2c6af
6627c5ab36fa407f18fc9b6987e359eccef005ae6d35b370d2142b7daa770324
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6eb4e5bf06118c495126b1cf6f5f370f94bc7651c6525d6c606877170afbf53a
7084ebbefbe4e68b8d66c66b4f05795676a2c51bd8e7fffc47a7c2e015aa0544
7125a66456daa35dd3e3e8cca4b9523e05caf0b4fa5bd5874676e7c6db40f3aa
7160bf300aedb0d16945e3ee5e15851ac0f21c571e2d4632e121eb6f1ab1d9aa
724bbf6dc23c60a8ebfc0a3c99c7499c17c90182f148efb0057c9a5f2fc2a1ae
747fd9fef704d10db66417d93d5b8a4076a25a01f3b36f4da5b0bf8d62a7b6df
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d
779ea318ca1aa1b8d459103115b7ed6ce64ccc1e411a816ca7806b09e3f03bc5
7a44e0685d8929b5d4d50476273c9957c8c76f03afc424c665a4066e5bc1beb9
7a58cec4842503db6949177b80ece47d5f5aba937676400675bfea596bc7492b
7e7c84efcf8e336f390d7a51a24cba3873782769b33470b31d2cef95b2f01cee
7f16b41c0ac3d3c2b732a3c136d94a34ccaef99f0d8cce5f3ef244b78c03e036
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8426b2d0a63cc9d3f8122abdd2864b0b956b0ebd6bd93e62e57fb42cf7415ed2
8459ec0213bcf434156ac2e810c8ad3f800e2fadef7b41950c4399d0ed0c1e1e
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
871a395274807a496ca51c603b7320eca9fc11a7949c0df992be96f29dcb7211
878514ad86b3587bf26342fa8dd5da06fac5ea3992312a65b6bb7547e398ff95
89c69b70386c8e4a1be1f0dfe4b485807c2ac88bfe195de3a254a855f36d8c0c
89d2b04a6542b3cfa82cce050c54aa0039de047b27072f7c1dc1b9b82ab2e5a8
8dd95d85ec6c727b643ee77877b0f0f871e5e0c23c4a4f8b2717c8e2992113ea
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
8fd170635383b0c3166c17896a4b975f48d4d76d8f1a1d603d0481442f052d84
9052548b73711c81589b805f3ef741747fca42bb7c6760bd1ded1bddd5c7823c
9109f62db3dea9641df567a892e97d9338cd63248fb97f6c4903eb33a4dfbb60
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
93e5fd37ff6841584c06ada6f8a127be04fd8427ab0d817b4d301a58a5272dc3
94c6483dadce933e499cc7f0a7cbd22d2565bbaf160f19086d55bd2e2df69f7b
95bdb8a3cd90e91621c9e68d4b157dd7fedab021ee89e9e173d17f93f0f03305
95c3e9694940734aa400f378ae328969cde4fb39e4bc343c68ecf9245b1bc9ad
97893424c202706d78df96de52159bc3c84e300d73ec2b4c2f4e81453933f47d
97e5b0b6cfc2ba9815028429c069631ba12b294aa7419d1ea130accd0adc2d46
97f5ecdc5516a2af7d1d027d72a74f42e41755e0039f330331cd66bd330e7b39
9dcaeb939318effbb2db3a742e54dba4b1d31e84858207fb43b75a4b6a576dd7
9e446e75dc20b6dc693b247aaf7704112e55ef434588368aa0761fc76b3a29a5
9efdeb0952eceb45725573be89af79b8292ccd2703c5edeb86ad37473a7b8177
9f0fab72c8a1fea1df1d6c5d128115031a8c44ccbc7f37e314acee6acb98779b
9f4331078abd467835bcf0b2367872f497045d37ebfb32fe7d9f82cf6843d282
9fd678871d5c502175e5233f33bb7c2cb09eda96eebfa139f527b72683f8b92b
a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4
a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839
a6e9e1722cffa254dc5061e3d89fc40a4faec0cd7d44819923657d498e8df822
a825805da94e038e12f102f89e46f27ad9646d7ab7057753fb82786431ecc64e
a899a0398bbfbb8343c67e83098446254c1609aae412962cff6929087135a51c
a92b99b413aa8afe65e9a4943c148fdedab142e7b913dafc52a040d850a5b197
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c
b8e39dad2211fe2aafd3c487471c94934a5230aeb00608f59b80c880ce777440
b96b4f9b3146047939f342700eb43b54b7ab687d070048efa199320fc250844e
bafaf035161ee03b515d06003c1c5559b047e4ab9f72302843850618740482a8
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb30148d9df7671c14f2cd5be91e6b7a1488932efb740a80b66f39052744c168
bbf7c43612543660ff95df57151eeca1a83e4dc59ff40df67fde5c3e20d7b71f
bce81f2aefa4042dd1af80d01b7f9c874e95aadb151fa05cfaae23e64e8f3e86
bdeda331b720b33bf5b8bc88d52d16a1c40da840b41f4692e3ed70253fed9486
c151d0f1c12c1ca6dc262f901b62a2e595d7da89411a6a43101d869f015d666e
c3060cd252f0a0a5f81a15fbef41b596d2db68cefe3de3e0a8c16fdc7177da0f
c4a07a396ffa057bcc0ca3da5adb8ffc76619e7246b4d8d13b327427fa00709c
c77d5979a9eb0e45bd243053b0724ea63b2d3381a0b43a3ec80ad58df66cf781
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cb5dd16308166e2fa952b70971f4911960c584ab7da699608bec15fce74cc8ca
cf4731e62066a0dd232bda3ae64cb3293df6488f92969b61457622cab819cf8f
d06ae5e97e495832fc4526c3e93d7e9440f1faf5f77669b41678c9d564a25faf
d08f06cab5fa2985cb68919ae3f4b53ae0ed16f3d1079aeb2bd339402a3ff345
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393
d358bee9f01dc4b30c08363249d150e71b02738bff6b8258ba121c37b06313e3
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
d4446ee603d5545233a34ace6d355c2e251fd2a1a02a23b976ef4adbbc8030de
d88d643839a4133a341acdbb486111679804cbce0b2d9af9cf7423a3bc62450d
d96709da01a87621fce7114b4f51beabccde158af5ddb2e4de80ef900f10bd59
d9a4a375ae347d1c5512808a99d0eac792fb416af21bd90fc9993df6ff1692ff
d9aeeae782fdde78411155839930b81c16fa4154002c1573462fa61806910409
db398ae2a6bcdac2506e0b532026b62c4058013a757d28b613a1188de22a066b
dddf04d190be2e7006f807221d5f5852bf45a97c2aad4c66b1f0a1661efa7dda
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e14b6036972fd446c62212fe39351614667c28fa0de47e41e836b45d35ee6366
e1847eaa967fa68572b15907b46b8c40d76095549e9af076ac613e21d8de52eb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4ebb4fc0904aae6b08aaa40be3f5d6d1bc00794ef5f3bb0d608b3e2428f4ec4
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
e62bc837007999cb7c58bb6aab499ba2d02bd49c40149db8bc60936e982564e4
eccbf3fae72a87817cd2d39cca489de2c2d9f73b130d223882a1c36b88919da0
ee12de8d2df7f136ccb75917bef79b12a373b8b7cef9322d119ce8e444f98255
ee59049a77ecefd16b8b808229676b9f061ca97da27d3daf1271ef59dd5268e2
ee8f1e346db3e2c4537ca018738ee6cbb15ed36930c126beb8384a97dc8de5bd
eeaf2e313228f5fa957d5cf730e42df5cf45b7e2132a594d470576a88736a481
eee2bc6e4edf311a6a0337c339dbd85d0d8d4040b25e390ab18237e2fa84f1c9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660
f201df44d5c747fcb0e34380d77409cd02be1f6e8810138d75394674b057a929
f2f11e4d45030f1f21ec7d3ae67a65b83c4c67016fe861fbebdff04ca0c8cd60
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70
f7c20d02ef54341b1562afe8db32d1bc701bb7974db2ffc0a560097e3875c1be
fbb99457e56765ea4bea432267ab799598687f0a3cedf17ca67efb913ee9d9ec
fdf5dfab742b9d6c8c626174cd7e8899d2350d3ada34202ad6f3e87dadabb36c
fe3fcb884394be745dbd11141b6d780028a4d86106b6292d7502db096f582218
ffb92ab9eefa3b6e3f6313d9a4194715887b0b8442d7be6cd1a472db7e810e5a

page.firstleaf.club Open in urlscan Pro 2606:4700:10::ac43:1a84 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

208 Requests

99 %HTTPS

33 %IPv6

56 Domains

90 Subdomains

74 IPs

5 Countries

6731 kBTransfer

17689 kBSize

1 Cookies

8 Outgoing links

Page URL History

Redirected requests

208 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

page.firstleaf.club Open in urlscan Pro
2606:4700:10::ac43:1a84 Public Scan

Screenshot
Live screenshot

Full Image

208
Requests

99 %
HTTPS

33 %
IPv6

56
Domains

90
Subdomains

74
IPs

5
Countries

6731 kB
Transfer

17689 kB
Size

1
Cookies

208 HTTP transactions
9 data transactions