Submitted URL: https://join.nordvpn.com/en/order/
Effective URL: https://join.nordvpn.com/order/
Submission: On March 20 via manual from GB

Summary

This website contacted 16 IPs in 4 countries across 15 domains to perform 84 HTTP transactions. The main IP is 104.18.230.229, located in United States and belongs to CLOUDFLARENET, US. The main domain is join.nordvpn.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on April 17th 2018. Valid for: 2 years.
This is the only time join.nordvpn.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 10 104.18.230.229 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
4 172.217.22.66 15169 (GOOGLE)
1 151.101.112.157 54113 (FASTLY)
1 104.244.42.69 13414 (TWITTER)
3 4 2a00:1450:400... 15169 (GOOGLE)
5 6 2a00:1450:400... 15169 (GOOGLE)
6 2001:4860:480... 15169 (GOOGLE)
2 26 2a00:1450:400... 15169 (GOOGLE)
27 2606:4700::68... 13335 (CLOUDFLAR...)
1 104.244.42.195 13414 (TWITTER)
1 13.227.198.63 16509 (AMAZON-02)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
2 52.213.86.83 16509 (AMAZON-02)
2 2 2a00:1450:400... 15169 (GOOGLE)
1 4 34.255.115.245 16509 (AMAZON-02)
84 16
Domain Requested by
27 s1.nordcdn.com join.nordvpn.com
26 www.google-analytics.com 2 redirects join.nordvpn.com
www.google-analytics.com
www.googletagmanager.com
10 join.nordvpn.com 1 redirects join.nordvpn.com
6 www.google.de join.nordvpn.com
6 www.google.com 5 redirects join.nordvpn.com
4 nordvpn.nanorep.co 1 redirects join.nordvpn.com
4 googleads.g.doubleclick.net 3 redirects www.googleadservices.com
4 www.googleadservices.com www.googletagmanager.com
www.googleadservices.com
2 stats.g.doubleclick.net 2 redirects
2 collector-3215.tvsquared.com join.nordvpn.com
2 bat.bing.com join.nordvpn.com
1 cdn-eu1-1.nanorep.com join.nordvpn.com
1 analytics.twitter.com static.ads-twitter.com
1 t.co join.nordvpn.com
1 static.ads-twitter.com www.googletagmanager.com
1 www.googletagmanager.com join.nordvpn.com
84 16
Subject Issuer Validity Valid
nordvpn.com
DigiCert SHA2 Extended Validation Server CA
2018-04-17 -
2020-04-15
2 years crt.sh
*.google-analytics.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
www.googleadservices.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2019-08-14 -
2020-08-18
a year crt.sh
t.co
DigiCert SHA2 High Assurance Server CA
2020-03-05 -
2021-03-02
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
www.google.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
www.google.de
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
ssl872525.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-12-13 -
2020-06-20
6 months crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA
2020-03-05 -
2021-03-02
a year crt.sh
*.nanorep.com
GlobalSign Organization Validation CA - SHA256 - G2
2019-01-24 -
2020-03-26
a year crt.sh
www.bing.com
Microsoft IT TLS CA 2
2019-04-30 -
2021-04-30
2 years crt.sh
*.tvsquared.com
COMODO RSA Domain Validation Secure Server CA
2018-10-23 -
2020-10-22
2 years crt.sh
*.nanorep.co
GlobalSign RSA OV SSL CA 2018
2020-03-17 -
2021-04-29
a year crt.sh

This page contains 1 frames:

Primary Page: https://join.nordvpn.com/order/
Frame ID: ECFFFC14551864771AE00BAAD2C90512
Requests: 86 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://join.nordvpn.com/en/order/ HTTP 301
    https://join.nordvpn.com/order/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
  • script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Page Statistics

84
Requests

100 %
HTTPS

50 %
IPv6

15
Domains

16
Subdomains

16
IPs

4
Countries

737 kB
Transfer

2935 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://join.nordvpn.com/en/order/ HTTP 301
    https://join.nordvpn.com/order/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/855955555/?random=821149676&cv=9&fst=*&num=1&value=0&label=_1tjCKmc6J0BEOOwk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=ITN1XtumGbLC7_UP48Gr-A0&sscte=1&crd=&gtd=&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcIpZOMVCxY5T3pgCGTH4Xvn6EfM1mb-4ng HTTP 302
  • https://www.google.com/pagead/1p-conversion/855955555/?random=821149676&cv=9&fst=*&num=1&value=0&label=_1tjCKmc6J0BEOOwk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XtumGbLC7_UP48Gr-A0&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcPor7g4JoQuJd3qzrJps67VNm-aKiD5zUw&random=3964674424&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-conversion/855955555/?random=821149676&cv=9&fst=*&num=1&value=0&label=_1tjCKmc6J0BEOOwk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XtumGbLC7_UP48Gr-A0&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcPor7g4JoQuJd3qzrJps67VNm-aKiD5zUw&random=3964674424&resp=GooglemKTybQhCsO&ipr=y
Request Chain 16
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/761663410/?random=277283146&cv=9&fst=*&num=1&value=0&label=xYO8CN7N-6EBELKfmOsC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=ITN1XrSqGfqG7_UPkdakmA4&sscte=1&crd=&gtd=&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcPNhgwJt5DaFeEElr7Vo1WvPspUkVeV8TA HTTP 302
  • https://www.google.com/pagead/1p-conversion/761663410/?random=277283146&cv=9&fst=*&num=1&value=0&label=xYO8CN7N-6EBELKfmOsC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XrSqGfqG7_UPkdakmA4&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcC_eCXRlJNRwcgNTe0R7D5cpXbicDAA2nQ&random=1450051975&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-conversion/761663410/?random=277283146&cv=9&fst=*&num=1&value=0&label=xYO8CN7N-6EBELKfmOsC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XrSqGfqG7_UPkdakmA4&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcC_eCXRlJNRwcgNTe0R7D5cpXbicDAA2nQ&random=1450051975&resp=GooglemKTybQhCsO&ipr=y
Request Chain 17
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/855954128/?random=2036851868&cv=9&fst=*&num=1&value=0&label=bbdxCKnNoqIBENClk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=ITN1XvOtGbqH7_UP7Nyt-Ao&sscte=1&crd=&gtd=&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcC-Z97OaZFjp7q2OxRlJ1o_-I76sfXURbg HTTP 302
  • https://www.google.com/pagead/1p-conversion/855954128/?random=2036851868&cv=9&fst=*&num=1&value=0&label=bbdxCKnNoqIBENClk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XvOtGbqH7_UP7Nyt-Ao&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcNx8Dv4QzknWJ5rxTBUJWQDQqe6J7w9Y4A&random=3646758886&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-conversion/855954128/?random=2036851868&cv=9&fst=*&num=1&value=0&label=bbdxCKnNoqIBENClk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XvOtGbqH7_UP7Nyt-Ao&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcNx8Dv4QzknWJ5rxTBUJWQDQqe6J7w9Y4A&random=3646758886&resp=GooglemKTybQhCsO&ipr=y
Request Chain 40
  • https://www.google-analytics.com/r/collect?v=1&_v=j81&a=871476449&t=pageview&_s=1&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&dp=%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAAABQ~&jid=1431356779&gjid=813947564&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&_r=1&cd32=1&z=1996305403 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-42858496-1&cid=445825551.1584739106&jid=1431356779&_gid=1504766459.1584739106&gjid=813947564&_v=j81&z=1996305403 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=1431356779&_v=j81&z=1996305403 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=1431356779&_v=j81&z=1996305403&slf_rd=1&random=2220059272
Request Chain 54
  • https://nordvpn.nanorep.co/~nordvpn/api/widget/v1/cnf?format=json&widgetType=float&referer=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F HTTP 301
  • https://nordvpn.nanorep.co/~nordvpn/api/widget/v1/cnf?format=json&widgetType=float&referer=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&cookieAdded=1
Request Chain 59
  • https://www.google-analytics.com/r/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=1&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Scroll%20Depth&ea=%2Forder%2F&el=20%25&ev=20&_u=aGDAAUArQ~&jid=913276708&gjid=1689116011&cid=445825551.1584739106&uid=&tid=UA-42858496-1&_gid=1504766459.1584739106&_r=1&cd32=&gtm=2wg3b2WX5CH8&cd10=&cd20=1584739106142.7ecgq5rq&cd21=2020-03-20T22%3A18%3A26.142%2B01%3A00&cd22=&cd24=&cd25=&cd26=&cd27=&cd28=&cd29=&cd30=&cd19=445825551.1584739106&z=1265749888 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-42858496-1&cid=445825551.1584739106&jid=913276708&_gid=1504766459.1584739106&gjid=1689116011&_v=j81&z=1265749888 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=913276708&_v=j81&z=1265749888 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=913276708&_v=j81&z=1265749888&slf_rd=1&random=4185481120

84 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
join.nordvpn.com/order/
Redirect Chain
  • https://join.nordvpn.com/en/order/
  • https://join.nordvpn.com/order/
184 KB
35 KB
Document
General
Full URL
https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.230.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9f438b8fa6f282a64fad0bb55d28ef8b4a0773336114e555cbb1d739da5cd37e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

:method
GET
:authority
join.nordvpn.com
:scheme
https
:path
/order/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d4e4c30b9c26317fcf68309a1bce8f3a91584739104; PHPSESSID=e3165416ba2a3dd1ec438c5941f77d32; locale=en
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
date
Fri, 20 Mar 2020 21:18:25 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
set-cookie
locale=en; domain=nordvpn.com; path=/; HttpOnly
x-frame-options
SAMEORIGIN
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
cloudflare
cf-ray
5772772f2bc2d911-AMS
content-encoding
br

Redirect headers

status
301
date
Fri, 20 Mar 2020 21:18:25 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d4e4c30b9c26317fcf68309a1bce8f3a91584739104; expires=Sun, 19-Apr-20 21:18:24 GMT; path=/; domain=.nordvpn.com; HttpOnly; SameSite=Lax; Secure PHPSESSID=e3165416ba2a3dd1ec438c5941f77d32; path=/; secure; HttpOnly locale=en; domain=nordvpn.com; path=/; HttpOnly
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
location
https://join.nordvpn.com/order/
x-frame-options
SAMEORIGIN
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
cloudflare
cf-ray
5772772e18c6d911-AMS
head-bundle-fe235d.js
join.nordvpn.com/assets/js/
5 KB
2 KB
Script
General
Full URL
https://join.nordvpn.com/assets/js/head-bundle-fe235d.js
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.230.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8bcf5f83e349919ffb30874685f1e55a51653072d0c857b809aa50819029f91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Mar 2020 13:37:24 GMT
server
cloudflare
age
27499
etag
W/"5e74c714-1351"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=2592000, immutable
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
577277304f15d911-AMS
gtm.js
www.googletagmanager.com/
149 KB
42 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WX5CH8
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
87bd3dae2e4ecf9fec15cb714194dbe05118dbe3fa9a0173411235c9aa1d5c2c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42526
x-xss-protection
0
last-modified
Fri, 20 Mar 2020 21:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 20 Mar 2020 21:18:25 GMT
main-bundle-fe235d.js
join.nordvpn.com/assets/js/
3 KB
939 B
Script
General
Full URL
https://join.nordvpn.com/assets/js/main-bundle-fe235d.js
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.230.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c785e0f845c288de0c4bb62ea8ce1d652c378472ab4498d0d45f78a089d415b6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Mar 2020 13:37:24 GMT
server
cloudflare
age
27499
etag
W/"5e74c714-c6a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=2592000, immutable
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
577277306f6dd911-AMS
app-bundle-fe235d.js
join.nordvpn.com/assets/js/
2 MB
386 KB
Script
General
Full URL
https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.230.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
828e6cbae9eb48d1964442211d8cd8c6187a4ff00f879bb8d51398d10eb75b01
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Mar 2020 13:37:24 GMT
server
cloudflare
age
27499
etag
W/"5e74c714-19be2d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=2592000, immutable
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
577277306f71d911-AMS
windowonload-bundle-fe235d.js
join.nordvpn.com/assets/js/
3 KB
969 B
Script
General
Full URL
https://join.nordvpn.com/assets/js/windowonload-bundle-fe235d.js
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.230.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f909b2a37769d1cb77909c4db94eccc4de12cb13f31fd1b6ec12a175dcdf2d14
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Mar 2020 13:37:24 GMT
server
cloudflare
age
27499
etag
W/"5e74c714-a3c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=2592000, immutable
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
577277306f76d911-AMS
conversion_async.js
www.googleadservices.com/pagead/
26 KB
10 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WX5CH8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s17-in-f66.1e100.net
Software
cafe /
Resource Hash
ea399158ef2d93ca8c14598e1ee6bfddf924d4b877c8972928d30ff23bcf1a30
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
9947
x-xss-protection
0
server
cafe
etag
2742097851886756974
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 20 Mar 2020 21:18:25 GMT
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WX5CH8
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
gzip
age
47070
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-hhn4068-HHN
last-modified
Tue, 23 Jan 2018 20:09:00 GMT
x-timer
S1584739105.365188,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes
adsct
t.co/i/
43 B
170 B
Image
General
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o28e0&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=0
content-length
65
x-xss-protection
0
x-response-time
119
pragma
no-cache
last-modified
Fri, 20 Mar 2020 21:18:25 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
24ec8fa927838af7f36a4f33609cf382
x-transaction
00b10e87004564bc
expires
Tue, 31 Mar 1981 05:00:00 GMT
truncated
/
240 B
240 B
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a1f389a4a583504e955a630f2dc66ba3ef895fed89b6c6477f30fef9e09fd631

Request headers

Origin
https://join.nordvpn.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
font/woff2
/
www.googleadservices.com/pagead/conversion/855955555/
2 KB
1 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/855955555/?random=1584739105397&cv=9&fst=1584739105397&num=1&value=0&label=_1tjCKmc6J0BEOOwk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s17-in-f66.1e100.net
Software
cafe /
Resource Hash
610b1a8ddd9fd01a3d0ad3855413ebd2ea81980918d1991f1a012bb8cca48683
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1189
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.googleadservices.com/pagead/conversion/761663410/
2 KB
1 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/761663410/?random=1584739105399&cv=9&fst=1584739105399&num=1&value=0&label=xYO8CN7N-6EBELKfmOsC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s17-in-f66.1e100.net
Software
cafe /
Resource Hash
8e8886400eeccce2068c8402eb9dd43a122bee6d4e0468858d36b5eeaee38644
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1187
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.googleadservices.com/pagead/conversion/855954128/
2 KB
1 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/855954128/?random=1584739105400&cv=9&fst=1584739105400&num=1&value=0&label=bbdxCKnNoqIBENClk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s17-in-f66.1e100.net
Software
cafe /
Resource Hash
9f872af69b68e7038dc3095f5300620d16ad3bf27b6de239ab59d035bc7ebb7e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1190
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/950534254/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950534254/?random=1584739105401&cv=9&fst=1584739105401&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
78bdf0db8dcdd2288f8333dfad12a76cf7d0a878d8ba80f7d39a501ff5baab1d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1029
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/950534254/
42 B
110 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/950534254/?random=1584739105401&cv=9&fst=1584738000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&frm=0&url=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&async=1&fmt=3&is_vtc=1&random=2769653163&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/950534254/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/950534254/?random=1584739105401&cv=9&fst=1584738000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&frm=0&url=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&async=1&fmt=3&is_vtc=1&random=2769653163&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::75 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-conversion/855955555/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/855955555/?random=821149676&cv=9&fst=*&num=1&value=0&label=_1tjCKmc6J0BEOOwk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah...
  • https://www.google.com/pagead/1p-conversion/855955555/?random=821149676&cv=9&fst=*&num=1&value=0&label=_1tjCKmc6J0BEOOwk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=...
  • https://www.google.de/pagead/1p-conversion/855955555/?random=821149676&cv=9&fst=*&num=1&value=0&label=_1tjCKmc6J0BEOOwk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=2...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/855955555/?random=821149676&cv=9&fst=*&num=1&value=0&label=_1tjCKmc6J0BEOOwk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XtumGbLC7_UP48Gr-A0&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcPor7g4JoQuJd3qzrJps67VNm-aKiD5zUw&random=3964674424&resp=GooglemKTybQhCsO&ipr=y
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::75 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-conversion/855955555/?random=821149676&cv=9&fst=*&num=1&value=0&label=_1tjCKmc6J0BEOOwk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XtumGbLC7_UP48Gr-A0&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcPor7g4JoQuJd3qzrJps67VNm-aKiD5zUw&random=3964674424&resp=GooglemKTybQhCsO&ipr=y
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-conversion/761663410/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/761663410/?random=277283146&cv=9&fst=*&num=1&value=0&label=xYO8CN7N-6EBELKfmOsC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah...
  • https://www.google.com/pagead/1p-conversion/761663410/?random=277283146&cv=9&fst=*&num=1&value=0&label=xYO8CN7N-6EBELKfmOsC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=...
  • https://www.google.de/pagead/1p-conversion/761663410/?random=277283146&cv=9&fst=*&num=1&value=0&label=xYO8CN7N-6EBELKfmOsC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=2...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/761663410/?random=277283146&cv=9&fst=*&num=1&value=0&label=xYO8CN7N-6EBELKfmOsC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XrSqGfqG7_UPkdakmA4&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcC_eCXRlJNRwcgNTe0R7D5cpXbicDAA2nQ&random=1450051975&resp=GooglemKTybQhCsO&ipr=y
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::75 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-conversion/761663410/?random=277283146&cv=9&fst=*&num=1&value=0&label=xYO8CN7N-6EBELKfmOsC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XrSqGfqG7_UPkdakmA4&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcC_eCXRlJNRwcgNTe0R7D5cpXbicDAA2nQ&random=1450051975&resp=GooglemKTybQhCsO&ipr=y
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-conversion/855954128/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/855954128/?random=2036851868&cv=9&fst=*&num=1&value=0&label=bbdxCKnNoqIBENClk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_a...
  • https://www.google.com/pagead/1p-conversion/855954128/?random=2036851868&cv=9&fst=*&num=1&value=0&label=bbdxCKnNoqIBENClk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd...
  • https://www.google.de/pagead/1p-conversion/855954128/?random=2036851868&cv=9&fst=*&num=1&value=0&label=bbdxCKnNoqIBENClk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/855954128/?random=2036851868&cv=9&fst=*&num=1&value=0&label=bbdxCKnNoqIBENClk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XvOtGbqH7_UP7Nyt-Ao&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcNx8Dv4QzknWJ5rxTBUJWQDQqe6J7w9Y4A&random=3646758886&resp=GooglemKTybQhCsO&ipr=y
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::75 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-conversion/855954128/?random=2036851868&cv=9&fst=*&num=1&value=0&label=bbdxCKnNoqIBENClk5gD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg3b2&sendb=1&ig=1&frm=0&url=https://join.nordvpn.com/order/&tiba=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=ITN1XvOtGbqH7_UP7Nyt-Ao&eitems=ChAI8NPR8wUQms61zdrd9rcFEh0AueTPcNx8Dv4QzknWJ5rxTBUJWQDQqe6J7w9Y4A&random=3646758886&resp=GooglemKTybQhCsO&ipr=y
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/
44 KB
18 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
2390
date
Fri, 20 Mar 2020 20:38:35 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
18174
expires
Fri, 20 Mar 2020 22:38:35 GMT
count
join.nordvpn.com/api/v1/servers/
14 B
92 B
Fetch
General
Full URL
https://join.nordvpn.com/api/v1/servers/count
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.230.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f678d4a822b887d3d821ea1001d8eed77fb536c5ba2da249775607bc2685edac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json
Referer
https://join.nordvpn.com/order/
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
application/json
status
200
cache-control
no-store, no-cache, must-revalidate
strict-transport-security
max-age=31536000; includeSubDomains; preload
accept-ranges
bytes
cf-ray
577277330ebcd911-AMS
content-length
14
expires
Thu, 19 Nov 1981 08:52:00 GMT
plans
join.nordvpn.com/api/v1/
1 KB
332 B
Fetch
General
Full URL
https://join.nordvpn.com/api/v1/plans
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.230.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d93a4f0a7f0786cb6cac2652abb85cdaf12103078279cdf52cd8520618841ba1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json
Referer
https://join.nordvpn.com/order/
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
status
200
cache-control
no-store, no-cache, must-revalidate
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
577277330ebdd911-AMS
expires
Thu, 19 Nov 1981 08:52:00 GMT
providers
join.nordvpn.com/api/v1/payments/
1 KB
742 B
Fetch
General
Full URL
https://join.nordvpn.com/api/v1/payments/providers
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.230.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7d76b1df0e0c517ac669cfbe0f703af836c610436f4ca553e89a72726534fcc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json
Referer
https://join.nordvpn.com/order/
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
status
200
cache-control
no-store, no-cache, must-revalidate
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
577277332ef2d911-AMS
expires
Thu, 19 Nov 1981 08:52:00 GMT
tick.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/
186 B
212 B
XHR
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/tick.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc8acb0e3bd1080462bea938c78d5c722c5977acb1438ab2db87d363b9a387d2
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
status
200
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5619
x-frame-options
SAMEORIGIN
etag
W/"5e6b486b-ba"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
cf-ray
577277336cf9d6f9-FRA
facebook.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/
267 B
600 B
XHR
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/facebook.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff2dfab965385bc265a1d7624a040a750b5c8c61f22ab1e732f5ccb9b217b008
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
status
200
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5619
x-frame-options
SAMEORIGIN
etag
W/"5e6b486b-10b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
cf-ray
577277336cfbd6f9-FRA
twitter.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/
492 B
357 B
XHR
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/twitter.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d83f47db74903a7d93b3f4c1c24a8c1e2c25104435cab82b3abe6defaa6b3a08
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
status
200
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5619
x-frame-options
SAMEORIGIN
etag
W/"5e6b486b-1ec"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
cf-ray
577277336cfdd6f9-FRA
instagram.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/
503 B
356 B
XHR
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/instagram.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d853f3cd90af6f151b116b96a6ed0ae2a02a2b75927b9e5bee74fd0ff57ba9bd
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
status
200
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5619
x-frame-options
SAMEORIGIN
etag
W/"5e6b486b-1f7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
cf-ray
577277336cfed6f9-FRA
youtube.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/
359 B
302 B
XHR
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/youtube.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3aea4142f9d59c374644126424ef7a25fa1327ea7816de43c914d22eec6b113f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
status
200
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5619
x-frame-options
SAMEORIGIN
etag
W/"5e6b486b-167"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
cf-ray
577277336d07d6f9-FRA
clock.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/24/
262 B
251 B
XHR
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/24/clock.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7f65431758094b801a3879959848a5f6e3ffd8578f308045a9483e204d76b96
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
status
200
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5619
x-frame-options
SAMEORIGIN
etag
W/"5e6b486b-106"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
cf-ray
577277336d04d6f9-FRA
nordvpn.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/horizontal/
2 KB
1002 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/horizontal/nordvpn.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a33a80013bb48d80ed49d506258eded30de3202dc0faa75ca7de2add0b9872cf
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5619
etag
W/"5e6b486b-78f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
577277339bbb3244-FRA
access-control-allow-origin
*
pcmag-ec.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/vertical/
8 KB
4 KB
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/vertical/pcmag-ec.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d2489a04bca56b8daccc0eb0ef0ad320f602298ccf03b458cb7858f9bc106bd
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-217c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
577277339bbe3244-FRA
access-control-allow-origin
*
norton-secured.png
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/fixed-height/
2 KB
2 KB
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/fixed-height/norton-secured.png
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
47f61864428ba26b1115d4e540a31c5de72a2a327736f508770ba4977058f967
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
cf-cache-status
HIT
age
5609
status
200
content-length
1866
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"5e6b486b-74a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
accept-ranges
bytes
cf-ray
577277339bc23244-FRA
visa-card.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
1 KB
732 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/visa-card.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b07e99ecb5e1b6b2f06343714c0d6da8a75bd6dd35d8d7f6bb7520a616fdc85b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-4d8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
577277339bc53244-FRA
access-control-allow-origin
*
mastercard-card.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
727 B
479 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/mastercard-card.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9da8e5272e73a6c59036474aa9a12c1f59e704d2d2fede9f709c26eb1b6a720
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-2d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
577277339bcb3244-FRA
access-control-allow-origin
*
amex-card.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
941 B
958 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/amex-card.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
844bfc2c459eb7aad66b59333b5359a9f2eb16c7ea849c39c09fef3a0c1aecea
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-3ad"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
577277339bc83244-FRA
access-control-allow-origin
*
discover-card.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
1 KB
748 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/discover-card.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de5e3c0f209dfc228dc9a4866159a83d0dab403e77779407f1dc649938147da2
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-570"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
577277339bcd3244-FRA
access-control-allow-origin
*
adsct
analytics.twitter.com/i/
31 B
283 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o28e0&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
x-response-time
122
pragma
no-cache
last-modified
Fri, 20 Mar 2020 21:18:25 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
c198d5479730f1a5fa847604a6e613b4
x-transaction
00ca538e00366879
expires
Tue, 31 Mar 1981 05:00:00 GMT
floating-widget.js
cdn-eu1-1.nanorep.com/web/
562 KB
132 KB
Script
General
Full URL
https://cdn-eu1-1.nanorep.com/web/floating-widget.js?account=nordvpn
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.227.198.63 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-227-198-63.ams54.r.cloudfront.net
Software
nanoRepServer /
Resource Hash
bc35c6dafe62aa8c071c9d8d48e75844c8d887e031dc50554e10234a7f9c61e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Fri, 20 Mar 2020 20:34:44 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
2624
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
134356
X-XSS-Protection
1; mode=block
Server
nanoRepServer
ETag
"8D7BB8C63C6C100"
Content-Type
text/javascript;charset=utf-8
Via
1.1 b619a16f6f8fe9793bf642d2a8434284.cloudfront.net (CloudFront)
Cache-Control
public, max-age=3600, s-maxage=3600
Access-Control-Allow-Credentials
*
X-Amz-Cf-Pop
AMS54-C1
X-Amz-Cf-Id
XLhaHdB3tshATyW-G0CnF4XmK5xwy4YYa1GJqNmGZlhckadklYfhVg==
bat.js
bat.bing.com/
24 KB
8 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
0d0cbd713d59b1214b24864c2d86699c88d951162983b8e20011a8738be20589

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
gzip
last-modified
Thu, 19 Mar 2020 02:21:04 GMT
x-msedge-ref
Ref A: 09F0A189CD02485CB73D047470B9572F Ref B: FRAEDGE0808 Ref C: 2020-03-20T21:18:25Z
access-control-allow-origin
*
etag
"0682da95fdd51:0"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
7461
tv2track.js
collector-3215.tvsquared.com/
20 KB
9 KB
Script
General
Full URL
https://collector-3215.tvsquared.com/tv2track.js
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.86.83 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-86-83.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
0a9aa75388f20120607c9ca759ff9be8076260ee661c01ca367dada52c8f36a0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Fri, 20 Mar 2020 21:18:25 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 Nov 2019 13:48:19 GMT
Server
nginx
ETag
"5de121a3-2113"
Content-Type
application/javascript
Cache-Control
max-age=600
Connection
keep-alive
X-Robots-Tag
noindex
Content-Length
8467
Expires
Fri, 20 Mar 2020 21:28:25 GMT
js
www.google-analytics.com/gtm/
120 KB
29 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/js?id=GTM-KV49WTQ&cid=445825551.1584739106
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2c9b5cbb00298760f6a9b6f5125e6f5ab1cec342de285bbdd35e27bd5fc6a8bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 21:18:25 GMT
content-encoding
br
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
cache-control
private, max-age=900
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Cache-Control
content-length
30030
x-xss-protection
0
expires
Fri, 20 Mar 2020 21:18:25 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j81&a=871476449&t=pageview&_s=1&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&dp=%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%2...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-42858496-1&cid=445825551.1584739106&jid=1431356779&_gid=1504766459.1584739106&gjid=813947564&_v=j81&z=1996305403
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=1431356779&_v=j81&z=1996305403
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=1431356779&_v=j81&z=1996305403&slf_rd=1&random=2220059272
42 B
109 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=1431356779&_v=j81&z=1996305403&slf_rd=1&random=2220059272
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::75 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:26 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=1431356779&_v=j81&z=1996305403&slf_rd=1&random=2220059272
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/
0
93 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5060812&Ver=2&mid=5a793d59-5958-297a-4d6c-ab0fa57f070a&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&p=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&r=&lt=907&evt=pageLoad&msclkid=N&rn=276918
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
204
pragma
no-cache
date
Fri, 20 Mar 2020 21:18:25 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: D2E176FEC660467199E19E2BE06584FF Ref B: FRAEDGE0808 Ref C: 2020-03-20T21:18:25Z
access-control-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
99 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=2&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Feature%20Flags&ea=Order&el=SuccessNordPassPromo&_u=aGBAAAADQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=1970561116
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357540
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
94 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=3&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=JoinVariation&ea=undefined&el=JoinVariation&_u=aGBAAAADQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=543431468
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357540
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
94 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=4&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Cookie%20Consent&ea=Cookie%20Consent&el=Loaded&_u=aGBAAAADQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=625611124
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357540
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
94 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=5&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Order%20Currency&ea=Loaded&el=EUR&_u=aGBAAAADQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=2125948712
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357540
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
checkbox-tick.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/
176 B
337 B
XHR
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/checkbox-tick.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2ce5e9649172a30b614b52ab60c01d7620cab645526a13b8e391c2713dc3313
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
status
200
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5619
x-frame-options
SAMEORIGIN
etag
W/"5e6b486b-b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
cf-ray
577277348fddd6f9-FRA
collect
www.google-analytics.com/
35 B
100 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=6&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Plans&ea=Loaded&el=nordvpn_web_year_3_12564&_u=aGBAAAADQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=1920401070
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
94 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=7&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Plans&ea=Loaded&el=nordvpn_web_year_2_11976&_u=aGBAAAADQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=1511035333
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
94 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=8&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Plans&ea=Loaded&el=nordvpn_web_year_1_8388&_u=aGBAAAADQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=600825773
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
94 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=9&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Plans&ea=Loaded&el=nordvpn_month_1_1195&_u=aGBAAAADQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=181873937
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
info.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/
228 B
232 B
XHR
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/info.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8a2b9586518a319a2f379cec9ee268d9d738dc5968f34e53140dad750f7ab70
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
status
200
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5619
x-frame-options
SAMEORIGIN
etag
W/"5e6b486b-e4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
cf-ray
57727734d8fcd6f9-FRA
collect
www.google-analytics.com/
35 B
94 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=10&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Plans&ea=Selected&el=nordvpn_web_year_3_12564&_u=aGBAAAADQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=862983857
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
tv2track.php
collector-3215.tvsquared.com/
43 B
371 B
Image
General
Full URL
https://collector-3215.tvsquared.com/tv2track.php?action_name=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&idsite=TV-63728145-1&rec=1&r=834548&h=22&m=18&s=26&url=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&_id=7af1fb70e4bcd3fb&_idts=1584739106&_idvc=0&_idn=1&_viewts=&cookie=1&res=1600x1200&gt_ms=199
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/order/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.86.83 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-86-83.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Fri, 20 Mar 2020 21:18:26 GMT
Server
nginx
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
P3P
CP='OTI DSP COR NID STP UNI OTPa OUR'
cnf
nordvpn.nanorep.co/~nordvpn/api/widget/v1/
Redirect Chain
  • https://nordvpn.nanorep.co/~nordvpn/api/widget/v1/cnf?format=json&widgetType=float&referer=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F
  • https://nordvpn.nanorep.co/~nordvpn/api/widget/v1/cnf?format=json&widgetType=float&referer=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&cookieAdded=1
0
-1 B
XHR
General
Full URL
https://nordvpn.nanorep.co/~nordvpn/api/widget/v1/cnf?format=json&widgetType=float&referer=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&cookieAdded=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
34.255.115.245 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-255-115-245.eu-west-1.compute.amazonaws.com
Software
nanoRepServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 20 Mar 2020 21:17:45 GMT
X-Content-Type-Options
nosniff
Server
nanoRepServer
Location
https://nordvpn.nanorep.co/~nordvpn/api/widget/v1/cnf?format=json&widgetType=float&referer=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&cookieAdded=1
Vary
Origin
Access-Control-Allow-Origin
https://join.nordvpn.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Keep-Alive
max=9999, timeout=600
Content-Length
0
X-XSS-Protection
1; mode=block
Expires
Sat, 15 Feb 2020 06:48:01 GMT

Redirect headers

Date
Fri, 20 Mar 2020 21:17:45 GMT
X-Content-Type-Options
nosniff
Server
nanoRepServer
Access-Control-Allow-Origin
https://join.nordvpn.com
Vary
Origin
Location
https://nordvpn.nanorep.co/~nordvpn/api/widget/v1/cnf?format=json&widgetType=float&referer=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&cookieAdded=1
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Keep-Alive
max=9999, timeout=600
Content-Length
0
X-XSS-Protection
1; mode=block
Expires
Sat, 15 Feb 2020 06:48:01 GMT
collect
www.google-analytics.com/
35 B
94 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=11&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Load%20time&ea=Loaded&el=%2Forder%2F&ev=776&_u=aGBAAAADQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=1237612385
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
925 B
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 20:48:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
1789
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
859
x-xss-protection
0
expires
Fri, 20 Mar 2020 21:48:37 GMT
ec.js
www.google-analytics.com/plugins/ua/
3 KB
1 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 20 Mar 2020 20:30:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
2885
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1306
x-xss-protection
0
expires
Fri, 20 Mar 2020 21:30:21 GMT
analytics.js
www.google-analytics.com/
44 KB
18 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WX5CH8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
2391
date
Fri, 20 Mar 2020 20:38:35 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
18174
expires
Fri, 20 Mar 2020 22:38:35 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=1&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%2...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-42858496-1&cid=445825551.1584739106&jid=913276708&_gid=1504766459.1584739106&gjid=1689116011&_v=j81&z=1265749888
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=913276708&_v=j81&z=1265749888
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=913276708&_v=j81&z=1265749888&slf_rd=1&random=4185481120
42 B
109 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=913276708&_v=j81&z=1265749888&slf_rd=1&random=4185481120
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::75 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:26 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42858496-1&cid=445825551.1584739106&jid=913276708&_v=j81&z=1265749888&slf_rd=1&random=4185481120
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
95 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=2&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Scroll%20Depth&ea=%2Forder%2F&el=40%25&ev=40&_u=aGDAAUArQ~&jid=&gjid=&cid=445825551.1584739106&uid=&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=&gtm=2wg3b2WX5CH8&cd10=&cd20=1584739106150.pvd0ih5g&cd21=2020-03-20T22%3A18%3A26.150%2B01%3A00&cd22=&cd24=&cd25=&cd26=&cd27=&cd28=&cd29=&cd30=&cd19=445825551.1584739106&z=670353726
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
cnf
nordvpn.nanorep.co/~nordvpn/api/widget/v1/
11 KB
5 KB
XHR
General
Full URL
https://nordvpn.nanorep.co/~nordvpn/api/widget/v1/cnf?format=json&widgetType=float&referer=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&cookieAdded=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
34.255.115.245 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-255-115-245.eu-west-1.compute.amazonaws.com
Software
nanoRepServer /
Resource Hash
60c433d92370417fe4f9c7fb55a4fd1bbbd6b080b904bfe46b666506190f7d4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 20 Mar 2020 21:17:45 GMT
Content-Encoding
deflate
X-Content-Type-Options
nosniff
Server
nanoRepServer
ETag
"8D7C8ACDFF6FB501047377312_Float-8062447087481820359"
Vary
Origin
Content-type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://join.nordvpn.com
Access-Control-Allow-Credentials
true
Keep-Alive
max=9999, timeout=600
Content-Length
4335
X-XSS-Protection
1; mode=block
Expires
Sat, 15 Feb 2020 06:48:01 GMT
truncated
/
507 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9c9ed67b654036cf116b79f668153f4de72bbd5ecdade4f0d7b39974655db561

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
collect
www.google-analytics.com/
35 B
95 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=12&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=nanoRep&ea=float%20widget%20loaded&_u=aGDAAUArQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=508672128
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
faqs
nordvpn.nanorep.co/~nordvpn/api/widget/v1/
1 KB
2 KB
XHR
General
Full URL
https://nordvpn.nanorep.co/~nordvpn/api/widget/v1/faqs?format=json&widgetType=float&account=nordvpn&configId=1047377312&referer=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
34.255.115.245 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-255-115-245.eu-west-1.compute.amazonaws.com
Software
nanoRepServer /
Resource Hash
b3f8cfa839fee4a6c05e6742aca1c81573ec7fbaa8db643653a512acc83a72ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 20 Mar 2020 21:17:45 GMT
X-Content-Type-Options
nosniff
Server
nanoRepServer
ETag
"8D7CD11DFBF0330Nordvpn_3E6DB64A_domain_3E6DB5A0_Float_"
Vary
Origin
Content-type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://join.nordvpn.com
Access-Control-Allow-Credentials
true
Keep-Alive
max=9999, timeout=600
Content-Length
1258
X-XSS-Protection
1; mode=block
Expires
Sat, 15 Feb 2020 06:48:01 GMT
bancontact-16.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
8 KB
2 KB
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/bancontact-16.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
759d55167b8a485b9065454153085b88f94bc815d68a13ca7e4af1a4641684a0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:27 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
MISS
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
access-control-allow-origin
*
etag
W/"5e6b486c-1e22"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
57727737eef63244-FRA
visa-loose-16.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
1007 B
630 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/visa-loose-16.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
873a47050ebf90804f146892686c01966f720616f45a13bc9ebf30682eca15f3
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-3ef"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
57727737eef73244-FRA
access-control-allow-origin
*
mastercard-loose-16.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
562 B
380 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/mastercard-loose-16.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22a6c96c3c54e15f57550c1dfce3734482fb246226691bb622553d8a698c86ab
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-232"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
57727737eef83244-FRA
access-control-allow-origin
*
amex-loose-16.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
804 B
546 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/amex-loose-16.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e263d3ac35fe7c3f1ef794b162bbddb91f28093629c20457c62d412e819bc6d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-324"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
57727737eef93244-FRA
access-control-allow-origin
*
discover-loose-16.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
2 KB
1 KB
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/discover-loose-16.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cc5f9cee8f8ea416198a2e48e7850c6bdc5a120c18222f1e08c52872013474a
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-8bb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
57727737eefa3244-FRA
access-control-allow-origin
*
amazon-pay-light-16.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
5 KB
2 KB
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/amazon-pay-light-16.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2bd411565b7907426f6a795061200d74e61ce722e117318d666a9fec2cecbc68
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-137c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
57727737eefc3244-FRA
access-control-allow-origin
*
sofort-16.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
7 KB
3 KB
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/sofort-16.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d42de1e1e6fe2c63243ed847724231ccf9383470cce9043b20f668a51d59961
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-1c79"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
57727737eefe3244-FRA
access-control-allow-origin
*
bitcoin-16.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
896 B
588 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/bitcoin-16.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
031c96d0b3b261de6aefc18374286a6ec560b6e84604a662c28b9b82bd9af0c6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-380"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
57727737eeff3244-FRA
access-control-allow-origin
*
ethereum-16.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
514 B
320 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/ethereum-16.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4e1c6fb6f88de11e18cc4b7bc2a9f5422a4707367c130384ab2b6b447dfdd18
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-202"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
57727737ef003244-FRA
access-control-allow-origin
*
ripple-16.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/
931 B
556 B
Image
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/logos/mini/ripple-16.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1cc4ce35439316609153a8120fe310c0d8a969e6d13fa33459ad6917a856594f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:36 GMT
server
cloudflare
age
5619
etag
W/"5e6b486c-3a3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
public, max-age=16070400, immutable
cf-ray
57727737ef023244-FRA
access-control-allow-origin
*
collect
www.google-analytics.com/
35 B
95 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=13&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Order%20Payment%20provider&ea=Loaded&el=payssion_bancontact&ev=0&_u=aGDAAUArQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=1679058942
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
95 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=14&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Order%20Payment%20provider&ea=Loaded&el=adyen_credit_card&ev=0&_u=aGDAAUArQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=1969482507
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
95 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=15&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Order%20Payment%20provider&ea=Loaded&el=amazon_pay_widget&ev=0&_u=aGDAAUArQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=1540830674
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
95 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=16&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Order%20Payment%20provider&ea=Loaded&el=checkout_sofort&ev=0&_u=aGDAAUArQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=1010637858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
95 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=17&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Order%20Payment%20provider&ea=Loaded&el=coin_payments&ev=0&_u=aGDAAUArQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=178594069
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
95 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=18&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Order%20Payment%20provider&ea=Pre-selected&el=payssion_bancontact&ev=0&_u=aGDAAUArQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=1681237419
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
taxes
join.nordvpn.com/api/v1/payments/
24 KB
3 KB
Fetch
General
Full URL
https://join.nordvpn.com/api/v1/payments/taxes
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.230.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d689341ed2b9b05cc0859c0b46c5f8a4545d184fa66e5268a1222638780dba9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json
Referer
https://join.nordvpn.com/order/
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
status
200
cache-control
no-store, no-cache, must-revalidate
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
577277389dfbd911-AMS
expires
Thu, 19 Nov 1981 08:52:00 GMT
reload.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/
391 B
308 B
XHR
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/reload.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad71f71924c09ddd0cc1e5ef7b354694a79d36b725d2219df4d6b3ddd7ae80c6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
status
200
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5618
x-frame-options
SAMEORIGIN
etag
W/"5e6b486b-187"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
cf-ray
577277389ba7d6f9-FRA
lock.svg
s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/
280 B
252 B
XHR
General
Full URL
https://s1.nordcdn.com/nordvpn/media/1.344.0/images/global/icons/16/lock.svg
Requested by
Host: join.nordvpn.com
URL: https://join.nordvpn.com/assets/js/app-bundle-fe235d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:a71e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
213e32bb1913a5b4fe9c18d1f4eaba711bccfe73fb0ca7dadec87dfbdc5ad034
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://join.nordvpn.com/order/
Origin
https://join.nordvpn.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Mar 2020 21:18:26 GMT
content-encoding
br
status
200
cf-cache-status
HIT
last-modified
Fri, 13 Mar 2020 08:46:35 GMT
server
cloudflare
age
5618
x-frame-options
SAMEORIGIN
etag
W/"5e6b486b-118"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=16070400, immutable
cf-ray
577277389badd6f9-FRA
collect
www.google-analytics.com/
35 B
95 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=871476449&t=event&ni=1&_s=19&dl=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2F&ul=en-us&de=UTF-8&dt=Buy%20VPN%20with%20Credit%20Card%20or%20Other%20Method%20in%2060%20sec&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Order%20Tax&ea=Loaded&el=US&_u=aGDAAUArQ~&jid=&gjid=&cid=445825551.1584739106&tid=UA-42858496-1&_gid=1504766459.1584739106&cd32=1&z=1595458390
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://join.nordvpn.com/order/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 04:12:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1357541
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

43 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| dataLayer object| google_tag_manager function| postscribe function| twq number| executionStart object| twttr function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| IntlPolyfill object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| platform object| React object| ReactDOM object| ReactDOMServer function| App string| GoogleAnalyticsObject function| ga function| filter_departments object| nanorep object| uetq boolean| isStatusBarHovered object| statusBarUnprotectedElement object| _tvq object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| UET object| google_optimize object| JSON2 object| TV2Track

12 Cookies

Domain/Path Name / Value
.nordvpn.com/ Name: _gat_True
Value: 1
.nordvpn.com/ Name: _gat
Value: 1
.nordvpn.com/ Name: _gid
Value: GA1.2.1504766459.1584739106
join.nordvpn.com/ Name: _tq_id.TV-63728145-1.e9ea
Value: 7af1fb70e4bcd3fb.1584739106.0.1584739106..
.nordvpn.com/ Name: _gcl_au
Value: 1.1.1786388159.1584739105
.nordvpn.com/ Name: nord_countdown
Value: 1584773869757
.nordvpn.com/ Name: _ga
Value: GA1.2.445825551.1584739106
.nordvpn.com/ Name: FirstSession
Value: source%3D%28direct%29%26campaign%3D%28direct%29%26medium%3D%28none%29%26term%3D%26content%3D%26hostname%3Djoin.nordvpn.com%26pathname%3D/order/%26date%3D20200320
.nordvpn.com/ Name: CurrentSession
Value: source%3D%28direct%29%26campaign%3D%28direct%29%26medium%3D%28none%29%26term%3D%26content%3D%26hostname%3Djoin.nordvpn.com%26pathname%3D/order/%26date%3D20200320
.nordvpn.com/ Name: locale
Value: en
join.nordvpn.com/ Name: PHPSESSID
Value: e3165416ba2a3dd1ec438c5941f77d32
.nordvpn.com/ Name: __cfduid
Value: d4e4c30b9c26317fcf68309a1bce8f3a91584739104

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
bat.bing.com
cdn-eu1-1.nanorep.com
collector-3215.tvsquared.com
googleads.g.doubleclick.net
join.nordvpn.com
nordvpn.nanorep.co
s1.nordcdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
104.18.230.229
104.244.42.195
104.244.42.69
13.227.198.63
151.101.112.157
172.217.22.66
2001:4860:4802:36::75
2606:4700::6811:a71e
2620:1ec:c11::200
2a00:1450:4001:800::200e
2a00:1450:4001:806::2004
2a00:1450:4001:808::2002
2a00:1450:4001:81d::2008
2a00:1450:400c:c0c::9d
34.255.115.245
52.213.86.83
031c96d0b3b261de6aefc18374286a6ec560b6e84604a662c28b9b82bd9af0c6
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
0a9aa75388f20120607c9ca759ff9be8076260ee661c01ca367dada52c8f36a0
0d0cbd713d59b1214b24864c2d86699c88d951162983b8e20011a8738be20589
0d2489a04bca56b8daccc0eb0ef0ad320f602298ccf03b458cb7858f9bc106bd
1cc4ce35439316609153a8120fe310c0d8a969e6d13fa33459ad6917a856594f
1d42de1e1e6fe2c63243ed847724231ccf9383470cce9043b20f668a51d59961
1d689341ed2b9b05cc0859c0b46c5f8a4545d184fa66e5268a1222638780dba9
213e32bb1913a5b4fe9c18d1f4eaba711bccfe73fb0ca7dadec87dfbdc5ad034
22a6c96c3c54e15f57550c1dfce3734482fb246226691bb622553d8a698c86ab
2bd411565b7907426f6a795061200d74e61ce722e117318d666a9fec2cecbc68
2c9b5cbb00298760f6a9b6f5125e6f5ab1cec342de285bbdd35e27bd5fc6a8bd
2e263d3ac35fe7c3f1ef794b162bbddb91f28093629c20457c62d412e819bc6d
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
3aea4142f9d59c374644126424ef7a25fa1327ea7816de43c914d22eec6b113f
47f61864428ba26b1115d4e540a31c5de72a2a327736f508770ba4977058f967
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
60c433d92370417fe4f9c7fb55a4fd1bbbd6b080b904bfe46b666506190f7d4e
610b1a8ddd9fd01a3d0ad3855413ebd2ea81980918d1991f1a012bb8cca48683
6cc5f9cee8f8ea416198a2e48e7850c6bdc5a120c18222f1e08c52872013474a
759d55167b8a485b9065454153085b88f94bc815d68a13ca7e4af1a4641684a0
78bdf0db8dcdd2288f8333dfad12a76cf7d0a878d8ba80f7d39a501ff5baab1d
828e6cbae9eb48d1964442211d8cd8c6187a4ff00f879bb8d51398d10eb75b01
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
844bfc2c459eb7aad66b59333b5359a9f2eb16c7ea849c39c09fef3a0c1aecea
873a47050ebf90804f146892686c01966f720616f45a13bc9ebf30682eca15f3
87bd3dae2e4ecf9fec15cb714194dbe05118dbe3fa9a0173411235c9aa1d5c2c
8e8886400eeccce2068c8402eb9dd43a122bee6d4e0468858d36b5eeaee38644
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9c9ed67b654036cf116b79f668153f4de72bbd5ecdade4f0d7b39974655db561
9f438b8fa6f282a64fad0bb55d28ef8b4a0773336114e555cbb1d739da5cd37e
9f872af69b68e7038dc3095f5300620d16ad3bf27b6de239ab59d035bc7ebb7e
a1f389a4a583504e955a630f2dc66ba3ef895fed89b6c6477f30fef9e09fd631
a33a80013bb48d80ed49d506258eded30de3202dc0faa75ca7de2add0b9872cf
a8a2b9586518a319a2f379cec9ee268d9d738dc5968f34e53140dad750f7ab70
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad71f71924c09ddd0cc1e5ef7b354694a79d36b725d2219df4d6b3ddd7ae80c6
b07e99ecb5e1b6b2f06343714c0d6da8a75bd6dd35d8d7f6bb7520a616fdc85b
b3f8cfa839fee4a6c05e6742aca1c81573ec7fbaa8db643653a512acc83a72ea
bc35c6dafe62aa8c071c9d8d48e75844c8d887e031dc50554e10234a7f9c61e4
c4e1c6fb6f88de11e18cc4b7bc2a9f5422a4707367c130384ab2b6b447dfdd18
c785e0f845c288de0c4bb62ea8ce1d652c378472ab4498d0d45f78a089d415b6
d2ce5e9649172a30b614b52ab60c01d7620cab645526a13b8e391c2713dc3313
d7f65431758094b801a3879959848a5f6e3ffd8578f308045a9483e204d76b96
d83f47db74903a7d93b3f4c1c24a8c1e2c25104435cab82b3abe6defaa6b3a08
d853f3cd90af6f151b116b96a6ed0ae2a02a2b75927b9e5bee74fd0ff57ba9bd
d93a4f0a7f0786cb6cac2652abb85cdaf12103078279cdf52cd8520618841ba1
de5e3c0f209dfc228dc9a4866159a83d0dab403e77779407f1dc649938147da2
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7d76b1df0e0c517ac669cfbe0f703af836c610436f4ca553e89a72726534fcc
e8bcf5f83e349919ffb30874685f1e55a51653072d0c857b809aa50819029f91
e9da8e5272e73a6c59036474aa9a12c1f59e704d2d2fede9f709c26eb1b6a720
ea399158ef2d93ca8c14598e1ee6bfddf924d4b877c8972928d30ff23bcf1a30
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f678d4a822b887d3d821ea1001d8eed77fb536c5ba2da249775607bc2685edac
f909b2a37769d1cb77909c4db94eccc4de12cb13f31fd1b6ec12a175dcdf2d14
fc8acb0e3bd1080462bea938c78d5c722c5977acb1438ab2db87d363b9a387d2
ff2dfab965385bc265a1d7624a040a750b5c8c61f22ab1e732f5ccb9b217b008