employeeretentioncredit.business Open in urlscan Pro
2606:4700:3037::6815:414c Public Scan

Software

BunnyCDN-DE1-756 /

Resource Hash

6240744a19f326be4e22778eb7c5a39abce05826a8728531b9fddc0a75863e8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cdn-edgestorageid: 756
x-dns-prefetch-control: off
cdn-cachedat: 01/27/2022 22:19:10
cdn-pullzone: 173232
content-encoding: br
vary: Accept-Encoding, Accept-Encoding
x-xss-protection: 1; mode=block
server: BunnyCDN-DE1-756
last-modified: Wed, 19 Jan 2022 15:46:53 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
x-frame-options: SAMEORIGIN
etag: W/"5bd1-17e7304f9c8"
x-download-options: noopen
strict-transport-security: max-age=15552000; includeSubDomains
content-type: application/javascript; charset=UTF-8
cdn-cache: HIT
cdn-uid: 48a72dd7-1732-4103-a906-fc257bffa1c1
cache-control: public, max-age=31536000
cdn-requestid: 3c8ccfbffbc9c19b1fd1428d8c3bd5fc
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 video-js.min.css
cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/ Frame E20F 39 KB
9 KB 90ms
70ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/video-js.min.css

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91f94a3c7e05d1c1afd01260e88ebea5be6720ed3514c7a82bba96a33d4d6b21

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 345151
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9046
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:35 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0401f-9c5c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fpIdiPp1%2FdxF4RNiylIN4OoHStgLgDA%2FXjGwZ8z8xglDPUfFnmBZr7Xo4Y47I313r6sYhLauMxyaowMX9XIIWcuZ5JhpoQY6hTaerSZoDO%2BVbQ8izlW5DDJPRcyMWXVR%2FESpO2fTaC8BhMGaEYANf41B"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d51065fedf9918c-FRA
expires: Thu, 19 Jan 2023 08:17:34 GMT

GET
H2 200 video.min.js Show response
cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/ Frame E20F 470 KB
105 KB 89ms
69ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/video.min.js

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19bd09a46cd5735572bec1a138df1d0c1d408767e59c890581a417bdfcd29b25

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 346429
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 107564
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:35 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0401f-757c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=va67cdnnz3bx0LTZ5PavD7LtWkVpwVuGyOctIVZUWqpDRPZEvQlMkwd39RnySZ%2FmZGSa4mGb1%2BXOuoE%2FgJxM9XunxHw2JAjUhTOoxcYQpIPvY6cYZIi84oV14JqNa0uFt5jAw9uViMUG1cBO1TC3ZGB1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d51065fedff918c-FRA
expires: Thu, 19 Jan 2023 08:17:34 GMT

GET
H2 200 videojs-ie8.min.js Show response
cdnjs.cloudflare.com/ajax/libs/video.js/5.2.2/ie8/ Frame E20F 19 KB
6 KB 90ms
70ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/video.js/5.2.2/ie8/videojs-ie8.min.js

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6cdefb09aa8ed6fcfcb5ee50239a85d38f1a700653ce9f0420878508c07925ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 345151
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5911
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:34 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0401e-4a99"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SgKVvRuJ6MDynrk9M1EsNJWuLxVMy3nzw2ltkXnlapQeT16%2FZg532I7epaNzSj9VZvBqR6GZMM50ZCo508jjB4k46sGeWMdoYjtC5GIL10heATRC%2FRpOzY6sn3xp6t%2BTyIlD%2B7GkxTXOqMvHFo5URGBY"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d51065fee03918c-FRA
expires: Thu, 19 Jan 2023 08:17:34 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame E20F 12 KB
792 B 156ms
86ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;0,900;1,400&display=swap

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1c8894064a04f2ac7b3e03d6cb7ac9028b08bd2f24b69971319c04ef0cf5aed5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 29 Jan 2022 08:17:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 29 Jan 2022 08:17:34 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 29 Jan 2022 08:17:34 GMT

GET
H2 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/ Frame E20F 70 KB
4 KB 89ms
70ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 346981
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4216
timing-allow-origin: *
last-modified: Mon, 07 Sep 2020 12:33:38 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f5628a2-11846"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cUPliocllyDnsFRw%2B0nt4QVDR%2B%2BHkrnOR9G5uvdS9Msv7FPvbXfYRfHcg0qQuydMYxWZzMtZ%2F%2B%2FOlA%2BskpexYQgkJEQFDwoljDDYTF%2BM%2BvVNXGZ4rD27yX434EdhCoH5KR7TQEAlbcoqwSwswTbtPZ%2FR"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d51065fedfa918c-FRA
expires: Thu, 19 Jan 2023 08:17:34 GMT

GET
H2 200 app.f9b70c98.css
app.groove.cm/groovevideo/css/ Frame E20F 43 KB
8 KB 25ms
24ms Stylesheet
text/css 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/css/app.f9b70c98.css
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d9fd12f77fb5544bc03dd762f81abdde322107fc8f013041f9364a6d701af52

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:34 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 28 Jan 2022 16:35:31 GMT
server: cloudflare
age: 3293
etag: W/"61f41b53-acdc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AABSM2FvQWeGB47RGfsX80uZeAhlyhCAR99u0DMyjBoHoB92df%2BuZ%2BBBX52gGARXV7SDKq7c1i8ZQ1Xq19tllvQ1HLXLlHvLSVhFF2yeW%2B9RD6bX4oCzVnU1cgw0tup0LtHHyV3zCQhjVjTU"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d51065fca7a900c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 chunk-vendors.b2eb74f3.css
app.groove.cm/groovevideo/css/ Frame E20F 2 MB
213 KB 31ms
30ms Stylesheet
text/css 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/css/chunk-vendors.b2eb74f3.css
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ea5cb388c3ad281d879fdaabd916ed97977d6b41fb25b97e030759eb2b02abe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:34 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 28 Jan 2022 16:35:31 GMT
server: cloudflare
age: 3293
etag: W/"61f41b53-1e7069"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dtda7%2FYudXXjdYJ06lK2BHeE4TbOqf%2BLBvLLh1M84Gq%2FVr2u%2BsrG%2B1dbsHPYY%2FasNLRSf1FfMft24lNMs7WVFIqIa18O8R2iC5hrwi9J3ZTknp%2BXzY6BhI37jwla7uedCxlXTs6xmkCNM3Yq"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d51065fca7b900c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 app.17f572f0.js Show response
app.groove.cm/groovevideo/js/ Frame E20F 2 MB
311 KB 39ms
39ms Script
application/javascript 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/js/app.17f572f0.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7472651ea611f520745721473f61d89bbc8b6e8938adf558e2fff8433a1f8d4b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:34 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 28 Jan 2022 16:35:31 GMT
server: cloudflare
age: 3293
etag: W/"61f41b53-19c169"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HzleX%2Bxxe5EUOU9FP5LereaZslStcHjE8RoD669csYrmlqVxnCQWH2OU%2BqYpUcb45umUNT1upyM2FRAxw3EyDFUcZHX238JdI5fNKBeUU6hEQlwNaK1n0mddUPdumcCeVrZwL0sqjkiwdKNm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d51065fca7d900c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 chunk-vendors.041dd9f7.js Show response
app.groove.cm/groovevideo/js/ Frame E20F 7 MB
2 MB 54ms
54ms Script
application/javascript 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/js/chunk-vendors.041dd9f7.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2dcf39bbf1cfe78dd75423b47e8a4f0b1613f36d673b40c0a2fb3d8e67d1320

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:34 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 28 Jan 2022 16:35:31 GMT
server: cloudflare
age: 6706
etag: W/"61f41b53-76728f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zhnMVtgcAavedqv6wsy%2FMk2lgX9lUz5HwHBS%2BA1QZ9TIQ5LHH0WaANdgFm%2FM2tJuVEufjx%2Fgv5bO3kXUwSgYHH1YJOXYxwrbSDb4RW6gDTFGECY1rPHIkvxdPraWSu7gOVzU6Dd54Smp2AVR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d51065fca80900c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 widget.min.js Show response
cdn.productstash.io/js/ Frame E20F 23 KB
6 KB 152ms
39ms Script
application/javascript 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.productstash.io/js/widget.min.js?v=0.8

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

BunnyCDN-DE1-756 /

Resource Hash

6240744a19f326be4e22778eb7c5a39abce05826a8728531b9fddc0a75863e8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cdn-edgestorageid: 756
x-dns-prefetch-control: off
cdn-cachedat: 01/27/2022 22:19:10
cdn-pullzone: 173232
content-encoding: br
vary: Accept-Encoding, Accept-Encoding
x-xss-protection: 1; mode=block
server: BunnyCDN-DE1-756
last-modified: Wed, 19 Jan 2022 15:46:53 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
x-frame-options: SAMEORIGIN
etag: W/"5bd1-17e7304f9c8"
x-download-options: noopen
strict-transport-security: max-age=15552000; includeSubDomains
content-type: application/javascript; charset=UTF-8
cdn-cache: HIT
cdn-uid: 48a72dd7-1732-4103-a906-fc257bffa1c1
cache-control: public, max-age=31536000
cdn-requestid: 1877c33bbb4c3677bc793b60563c670a
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame E20F 196 KB
68 KB 238ms
91ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bc5e4fb08cd0b5d20e6816b415d30188db7ee1211ce6289b324efc77ef5a9cfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69581
x-xss-protection: 0
last-modified: Sat, 29 Jan 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 29 Jan 2022 08:17:35 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame E20F 714 KB
136 KB 107ms
107ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/css/chunk-vendors.b2eb74f3.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

72e3d573ed18a093145f0b3c93afc1f946703d5556418202d603087d44325a97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 29 Jan 2022 08:17:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 29 Jan 2022 08:17:34 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 29 Jan 2022 08:17:34 GMT

GET
BLOB 200
OK b055748b-6ad4-4ae9-a87d-097e6d1a7f54
https://app.groove.cm/ Frame 620F 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://app.groove.cm/b055748b-6ad4-4ae9-a87d-097e6d1a7f54
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 620F 196 KB
68 KB 338ms
220ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bc5e4fb08cd0b5d20e6816b415d30188db7ee1211ce6289b324efc77ef5a9cfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69581
x-xss-protection: 0
last-modified: Sat, 29 Jan 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 29 Jan 2022 08:17:35 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame 620F 714 KB
136 KB 170ms
170ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/css/chunk-vendors.b2eb74f3.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

72e3d573ed18a093145f0b3c93afc1f946703d5556418202d603087d44325a97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 29 Jan 2022 08:17:35 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 29 Jan 2022 08:17:35 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 29 Jan 2022 08:17:35 GMT

GET
BLOB 200
OK 87c3043e-5253-4ec3-b209-4aa4296e9763
https://app.groove.cm/ Frame E20F 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://app.groove.cm/87c3043e-5253-4ec3-b209-4aa4296e9763
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H2 200 jquery-ui.css
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/ Frame 6226 36 KB
9 KB 122ms
38ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 01:40:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23833
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8422
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 Jan 2023 01:40:22 GMT

GET
H2 200 fonts8.css
fs22.formsite.com/include/form/ Frame 6226 20 KB
5 KB 98ms
97ms Stylesheet
text/css 3.209.162.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/fonts8.css?3391679876992
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.162.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-162-165.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 9221b2c07e1ad6a168982f0fbb342131b2e96c0ebe5902d98653d3a546a34632

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: gzip
last-modified: Thu, 21 Oct 2021 13:46:26 GMT
server: Apache
etag: "4e63-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 4202
expires: Sat, 05 Feb 2022 08:17:35 GMT

GET
H2 200 screen8.css
fs22.formsite.com/include/form/ Frame 6226 20 KB
9 KB 193ms
192ms Stylesheet
text/css 3.209.162.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/screen8.css?3391679876992
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.162.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-162-165.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 6b223bb6c3fb8210034350b25e704c74c30d87756cdda5432b4649483e366e78

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: gzip
last-modified: Wed, 10 Nov 2021 15:07:12 GMT
server: Apache
etag: "4f2f-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 8161
expires: Sat, 05 Feb 2022 08:17:35 GMT

GET
H2 200 responsive8.css
fs22.formsite.com/include/form/ Frame 6226 3 KB
1 KB 194ms
193ms Stylesheet
text/css 3.209.162.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/responsive8.css?3391679876992
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.162.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-162-165.compute-1.amazonaws.com
Software: Apache /
Resource Hash: faa7999a9bc916746448d20ba389c7360faea9bc01a9e53fc08275e565cbf399

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: gzip
last-modified: Wed, 10 Nov 2021 15:07:12 GMT
server: Apache
etag: "bb2-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 876
expires: Sat, 05 Feb 2022 08:17:35 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ Frame 6226 87 KB
30 KB 127ms
43ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 23 Jan 2022 17:42:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484518
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 23 Jan 2023 17:42:17 GMT

GET
H2 200 jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ Frame 6226 248 KB
66 KB 169ms
85ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 22:15:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36133
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67948
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 28 Jan 2023 22:15:22 GMT

GET
H2 200 form8.js Show response
fs22.formsite.com/include/form/ Frame 6226 27 KB
8 KB 194ms
193ms Script
application/javascript 3.209.162.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/form8.js?3391679876992
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.162.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-162-165.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 7b47ae80afa3203ba35b6f17e9a9c0641ac3f8f5d37b3ae9f01f06730b1e7ae6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: gzip
last-modified: Wed, 10 Nov 2021 15:07:12 GMT
server: Apache
etag: "6c5c-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=604800
accept-ranges: bytes
content-length: 7457
expires: Sat, 05 Feb 2022 08:17:35 GMT

GET
H2 200 embed.js Show response
fs22.formsite.com/include/form/ Frame 6226 2 KB
1 KB 193ms
192ms Script
application/javascript 3.209.162.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/embed.js
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.162.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-162-165.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 9bf76c0981f3d7cb30be16f19b1419bad27dbccc3c5c5496cd1c84982e756dd8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: gzip
last-modified: Mon, 30 Mar 2020 16:25:53 GMT
server: Apache
etag: "8fe-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=604800
accept-ranges: bytes
content-length: 855
expires: Sat, 05 Feb 2022 08:17:35 GMT

GET
H2 200 print8.css
fs22.formsite.com/include/form/ Frame 6226 375 B
763 B 97ms
97ms Stylesheet
text/css 3.209.162.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/print8.css?3391679876992
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.162.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-162-165.compute-1.amazonaws.com
Software: Apache /
Resource Hash: fe096c1a1b3636490559c3e3d5c51dedcfed669ef95394071a765d922937dc6d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: gzip
last-modified: Mon, 01 Apr 2019 18:07:07 GMT
server: Apache
etag: "177-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 200
expires: Sat, 05 Feb 2022 08:17:36 GMT

OPTIONS
H/1.1 204
No Content ping
api.loopedin.io/v1/users/ Frame 0
0 116ms
28ms Preflight 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/v1/users/ping

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://app.groove.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: Cowboy
Connection: keep-alive
Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
X-Dns-Prefetch-Control: off
Expect-Ct: max-age=0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: no-referrer
X-Xss-Protection: 0
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Headers: Content-Type,Authorization
Content-Length: 0
Date: Sat, 29 Jan 2022 08:17:35 GMT
Via: 1.1 vegur

GET
H2 200 iframe_api Show response
www.youtube.com/ Frame 620F 980 B
2 KB 142ms
55ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.041dd9f7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

329a39ab474db744dd4b3ab9ab10fa5d1a45e36a0428232f18390409b9b64b01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"
expires: Sat, 29 Jan 2022 08:17:35 GMT

GET
H3 200 matomo.js Show response
matomo.groovetech.io/ Frame 620F 62 KB
21 KB 21ms
21ms Script
application/javascript 2606:4700:3036::6815:6071
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.041dd9f7.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:6071 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43af579102b8c4adff968a3a00280fc2061cc33538c7bbad1d8d6ec775f0807b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 20 Jan 2022 08:13:46 GMT
server: cloudflare
age: 248
etag: W/"f93c-5d5ff14dbef14-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pnGUrUSt2%2F0q%2BNDsaKK3aWPg0c6MZyChGDyjML0iN%2B4GFxtxBpmR03REU8895uFofrFSrVSKWxRhwCG3Kus596xdiyV3Jrkomb8WBk7bVor1Uu9vUEOuewBjqho79o9jStQFDmYfAOdabg9Lw%2BOmjHib0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d510665de24913c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
BLOB 200
OK cca6c5ac-552d-43d8-bfbc-6bdb3fe8fdf3 Show response
https://app.groove.cm/ Frame 620F 98 B
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://app.groove.cm/cca6c5ac-552d-43d8-bfbc-6bdb3fe8fdf3
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.041dd9f7.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e62a11a09ac7db71941c207b245269b47f2a219be53912e504cf545a84cfb3cc

Request headers

Referer
Origin: https://app.groove.cm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 98
Content-Type: text/javascript

POST
H/1.1 200
OK ping Show response
api.loopedin.io/v1/users/ Frame 620F 3 B
1 KB 29ms
29ms Fetch
application/json 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/v1/users/ping

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

27badc983df1780b60c2b3fa9d3a19a00e46aac798451f0febdca52920faaddf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Dns-Prefetch-Control: off
Date: Sat, 29 Jan 2022 08:17:35 GMT
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 3
X-Xss-Protection: 0
Referrer-Policy: no-referrer
Server: Cowboy
X-Frame-Options: SAMEORIGIN
Etag: W/"3-n5rwKVhboBTgfNORDKl2z1YWBhY"
Expect-Ct: max-age=0
X-Ratelimit-Remaining: 48
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
X-Ratelimit-Reset: 1643444285
X-Ratelimit-Limit: 50
Content-Type: application/json; charset=utf-8

GET
H/1.1 200
OK app-config Show response
api.loopedin.io/ Frame 620F 525 B
2 KB 120ms
31ms XHR
application/json 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/app-config?product_id=f634edf5-70e7-429d-8c94-c26dfaeaee26&timestamp=0&public=true&user=public&domain=app.groove.cm

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

2d4fd9284f07de9bf7456fa126660dfe493e2e3c7faf5f7d5c8ab6dcb9b52a35

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Dns-Prefetch-Control: off
Date: Sat, 29 Jan 2022 08:17:35 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=15552000; includeSubDomains
Vary: Accept-Encoding
Content-Length: 525
X-Xss-Protection: 0
Referrer-Policy: no-referrer
Server: Cowboy
Etag: W/"20d-IqsYcYx6mEJIl8/aTyvwwKH+3G8"
Expect-Ct: max-age=0
X-Ratelimit-Remaining: 49
Access-Control-Allow-Methods: GET
X-Download-Options: noopen
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
X-Ratelimit-Reset: 1643444285
X-Ratelimit-Limit: 50
Content-Type: application/json; charset=utf-8

GET
H2 200 notification.png
cdn.productstash.io/images/ Frame 620F 1 KB
2 KB 8ms
8ms Image
image/png 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.productstash.io/images/notification.png

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

BunnyCDN-DE1-756 /

Resource Hash

87608a8dea58460e4b38f3445a737f999eb6a62dee361be55e06625d505c4e5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cdn-edgestorageid: 756
x-dns-prefetch-control: off
cdn-cachedat: 01/29/2022 07:25:49
cdn-pullzone: 173232
content-length: 1156
x-xss-protection: 1; mode=block
server: BunnyCDN-DE1-756
last-modified: Wed, 19 Jan 2022 15:46:53 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
x-frame-options: SAMEORIGIN
etag: W/"484-17e7304f9c8"
x-download-options: noopen
strict-transport-security: max-age=15552000; includeSubDomains
content-type: image/png
cdn-cache: HIT
cdn-uid: 48a72dd7-1732-4103-a906-fc257bffa1c1
cache-control: public, max-age=31536000
cdn-requestid: 7ae96806ec4765a3f560f6e72eec70c7
accept-ranges: bytes
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

OPTIONS
H/1.1 204
No Content ping
api.loopedin.io/v1/users/ Frame 0
0 28ms
28ms Preflight 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/v1/users/ping

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://app.groove.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: Cowboy
Connection: keep-alive
Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
X-Dns-Prefetch-Control: off
Expect-Ct: max-age=0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: no-referrer
X-Xss-Protection: 0
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Headers: Content-Type,Authorization
Content-Length: 0
Date: Sat, 29 Jan 2022 08:17:35 GMT
Via: 1.1 vegur

GET
H3 200 iframe_api Show response
www.youtube.com/ Frame E20F 980 B
512 B 105ms
58ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.041dd9f7.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

329a39ab474db744dd4b3ab9ab10fa5d1a45e36a0428232f18390409b9b64b01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"
expires: Sat, 29 Jan 2022 08:17:35 GMT

GET
H3 200 matomo.js Show response
matomo.groovetech.io/ Frame E20F 62 KB
21 KB 20ms
20ms Script
application/javascript 2606:4700:3036::6815:6071
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.041dd9f7.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:6071 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43af579102b8c4adff968a3a00280fc2061cc33538c7bbad1d8d6ec775f0807b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 20 Jan 2022 08:13:46 GMT
server: cloudflare
age: 248
etag: W/"f93c-5d5ff14dbef14-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AgHpilZdYVXbULEfALuM1nWSLX83CH2bNqniPcnx%2FMkxsjjiiduDGSQpE78o4RJOVYqhWCJAJ96HPtQ2Ubh%2FWMtd1YbKt3MrCAI6xNovth9m3Jnc8y9NGyxK0acnjzV9rTcBfZlfBszw%2Fxjs2sE0NUucfg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d510666e9a7913c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
BLOB 200
OK 2b9a4229-af37-43ed-ba73-442f17be54f3 Show response
https://app.groove.cm/ Frame E20F 98 B
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://app.groove.cm/2b9a4229-af37-43ed-ba73-442f17be54f3
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.041dd9f7.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dddd02177bb2cd3aa51fb610886a7c4e11320b4b5f818101aa4182e7bc32d309

Request headers

Referer
Origin: https://app.groove.cm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 98
Content-Type: text/javascript

GET
H2 200 notification.png
cdn.productstash.io/images/ Frame E20F 1 KB
2 KB 10ms
9ms Image
image/png 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.productstash.io/images/notification.png

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

BunnyCDN-DE1-756 /

Resource Hash

87608a8dea58460e4b38f3445a737f999eb6a62dee361be55e06625d505c4e5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cdn-edgestorageid: 756
x-dns-prefetch-control: off
cdn-cachedat: 01/29/2022 07:25:49
cdn-pullzone: 173232
content-length: 1156
x-xss-protection: 1; mode=block
server: BunnyCDN-DE1-756
last-modified: Wed, 19 Jan 2022 15:46:53 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
x-frame-options: SAMEORIGIN
etag: W/"484-17e7304f9c8"
x-download-options: noopen
strict-transport-security: max-age=15552000; includeSubDomains
content-type: image/png
cdn-cache: HIT
cdn-uid: 48a72dd7-1732-4103-a906-fc257bffa1c1
cache-control: public, max-age=31536000
cdn-requestid: c399e5ff08a0507399afc1f64a650a0b
accept-ranges: bytes
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

POST
H/1.1 200
OK ping Show response
api.loopedin.io/v1/users/ Frame E20F 3 B
1 KB 29ms
29ms Fetch
application/json 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/v1/users/ping

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

27badc983df1780b60c2b3fa9d3a19a00e46aac798451f0febdca52920faaddf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Dns-Prefetch-Control: off
Date: Sat, 29 Jan 2022 08:17:35 GMT
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 3
X-Xss-Protection: 0
Referrer-Policy: no-referrer
Server: Cowboy
X-Frame-Options: SAMEORIGIN
Etag: W/"3-n5rwKVhboBTgfNORDKl2z1YWBhY"
Expect-Ct: max-age=0
X-Ratelimit-Remaining: 46
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
X-Ratelimit-Reset: 1643444285
X-Ratelimit-Limit: 50
Content-Type: application/json; charset=utf-8

GET
H/1.1 200
OK app-config Show response
api.loopedin.io/ Frame E20F 525 B
2 KB 31ms
31ms XHR
application/json 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/app-config?product_id=f634edf5-70e7-429d-8c94-c26dfaeaee26&timestamp=0&public=true&user=public&domain=app.groove.cm

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

2d4fd9284f07de9bf7456fa126660dfe493e2e3c7faf5f7d5c8ab6dcb9b52a35

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Dns-Prefetch-Control: off
Date: Sat, 29 Jan 2022 08:17:35 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=15552000; includeSubDomains
Vary: Accept-Encoding
Content-Length: 525
X-Xss-Protection: 0
Referrer-Policy: no-referrer
Server: Cowboy
Etag: W/"20d-IqsYcYx6mEJIl8/aTyvwwKH+3G8"
Expect-Ct: max-age=0
X-Ratelimit-Remaining: 47
Access-Control-Allow-Methods: GET
X-Download-Options: noopen
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
X-Ratelimit-Reset: 1643444285
X-Ratelimit-Limit: 50
Content-Type: application/json; charset=utf-8

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame E20F 165 KB
61 KB 117ms
72ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VQKC5VQTH1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

be3e3604e0fd7d9092e9c562d9f66f32fd2c10f184661a3c72635177e2950341

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62378
x-xss-protection: 0
expires: Sat, 29 Jan 2022 08:17:36 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame E20F 49 KB
20 KB 124ms
38ms Script
text/javascript 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2562
date: Sat, 29 Jan 2022 07:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sat, 29 Jan 2022 09:34:54 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame E20F 39 KB
15 KB 142ms
57ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

63158f73aa9f4d442cf349762c6beac9fcf35c14c3376888e728164acfde3b86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14855
x-xss-protection: 0
server: cafe
etag: 17539559064140624452
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 29 Jan 2022 08:17:36 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ Frame E20F 15 KB
6 KB 70ms
22ms Script
application/javascript 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

10354e9bc6b485028971a1f58fccff5c89d722db324d42bc07963aab24ebb956

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sat, 29 Jan 2022 07:55:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1336
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5748
x-amz-id-2: cuXLss1Rhcnj7s4L4XfIXscY8iRwKJNdTK5XkI8+aw4RqCtz0yeH53OKynvWjL7ao2z/Yd5K++U=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 22 Feb 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 17 Jan 2022 12:00:39 GMT
server: ATS
etag: "13a189bb8f25228852b3279db3659c28-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 5477X4MN7B76Q744
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: pAIvW1wzOXi43b8v53GVflu.j8ZqoXS3
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 bat.js Show response
bat.bing.com/ Frame E20F 36 KB
11 KB 59ms
35ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: gzip
last-modified: Fri, 03 Dec 2021 01:53:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 525D277ECF3D4D128E63FE5579EC34E3 Ref B: FRAEDGE1306 Ref C: 2022-01-29T08:17:36Z
etag: "0cb09ee8e7d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 10468

GET
H2 200 ld.js Show response
static.criteo.net/js/ld/ Frame E20F 40 KB
13 KB 46ms
15ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/ld.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

4758ffc00e2d3413aece1a57fc3e89b9709202312386d57eb74b5c198cf6800e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: gzip
last-modified: Tue, 14 Dec 2021 12:51:58 GMT
server: nginx
etag: W/"61b8936e-9faf"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 30 Jan 2022 08:17:36 GMT

GET
H2 200 universal-script Show response
175592.tracking.hyros.com/v1/lst/ Frame E20F 0
169 B 1038ms
814ms Script
text/plain 44.194.124.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.124.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-124-170.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
access-control-allow-credentials: true
content-length: 0
access-control-max-age: 86400
access-control-allow-methods: GET, PUT, POST, OPTIONS, DELETE
access-control-expose-headers: Session-ID

GET
H3 200 0dTEPzkLWceF7z0koJaX1A.woff2
fonts.gstatic.com/s/raleway/v22/ Frame 6226 46 KB
46 KB 40ms
40ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v22/0dTEPzkLWceF7z0koJaX1A.woff2

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/include/form/fonts8.css?3391679876992

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fs22.formsite.com/
Origin: https://fs22.formsite.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 27 Jan 2022 00:02:34 GMT
x-content-type-options: nosniff
age: 202502
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47312
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 19:40:31 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 27 Jan 2023 00:02:34 GMT

GET
H2 200 config.js Show response
app.groove.cm/config/ Frame 620F 324 B
512 B 14ms
14ms Script
application/javascript 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/config/config.js
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d7560c8b33f798d429fa0e84d88e11aff034ec7ab72a758d3ed52fc9b285a18

Request headers

Referer
Origin: https://app.groove.cm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 28 Jan 2022 16:55:21 GMT
server: cloudflare
age: 3289
etag: W/"61f41ff9-144"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JnDpT%2FAvtFzaROvsQe5aaRdb374BAvpSI5%2Bp2wLJdb0rHaM5FQ%2Fjg31Euo1hxXTMfHA0z37wQbmGYpDKMbb5usTXaSpk7cb4ezeE9p4o7RqLwgUtqs07fctRpw2DRB%2FZWlaXTBd7BBdMBJI0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d510668eb70900c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 config.js Show response
app.groove.cm/config/ Frame E20F 324 B
453 B 16ms
16ms Script
application/javascript 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/config/config.js
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d7560c8b33f798d429fa0e84d88e11aff034ec7ab72a758d3ed52fc9b285a18

Request headers

Referer
Origin: https://app.groove.cm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 28 Jan 2022 16:55:21 GMT
server: cloudflare
age: 3289
etag: W/"61f41ff9-144"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=evkYyRuQAu7Q1eZMp%2FrDPHeIeWeBViMLoY5wgdI1TSD5%2FCD878tsT5DXEeHkdBlZLRct80VgOOUbO14O0Rvy7R8EMKwi1iV%2FEgSgPh6dkTK%2BSkVLS6cAuyMKFUfx%2BCAXs83%2BejTc6rUklGKw"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d510668eb71900c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 620F 165 KB
61 KB 58ms
51ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VQKC5VQTH1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

40c29e23c81b84b8cd671bcd0d147a29db5ed9d94edfe8800d25b4b13cf58b50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62380
x-xss-protection: 0
expires: Sat, 29 Jan 2022 08:17:36 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 620F 49 KB
20 KB 100ms
52ms Script
text/javascript 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2562
date: Sat, 29 Jan 2022 07:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sat, 29 Jan 2022 09:34:54 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame 620F 39 KB
15 KB 128ms
80ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

63158f73aa9f4d442cf349762c6beac9fcf35c14c3376888e728164acfde3b86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14855
x-xss-protection: 0
server: cafe
etag: 17539559064140624452
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 29 Jan 2022 08:17:36 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ Frame 620F 15 KB
6 KB 34ms
23ms Script
application/javascript 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

10354e9bc6b485028971a1f58fccff5c89d722db324d42bc07963aab24ebb956

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sat, 29 Jan 2022 07:55:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1336
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5748
x-amz-id-2: cuXLss1Rhcnj7s4L4XfIXscY8iRwKJNdTK5XkI8+aw4RqCtz0yeH53OKynvWjL7ao2z/Yd5K++U=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 22 Feb 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 17 Jan 2022 12:00:39 GMT
server: ATS
etag: "13a189bb8f25228852b3279db3659c28-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 5477X4MN7B76Q744
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: pAIvW1wzOXi43b8v53GVflu.j8ZqoXS3
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 bat.js Show response
bat.bing.com/ Frame 620F 36 KB
10 KB 30ms
30ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: gzip
last-modified: Fri, 03 Dec 2021 01:53:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0DDD5AA3284545A884A14D3ED1F1568A Ref B: FRAEDGE1306 Ref C: 2022-01-29T08:17:36Z
etag: "0cb09ee8e7d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 10468

GET
H2 200 ld.js Show response
static.criteo.net/js/ld/ Frame 620F 40 KB
13 KB 21ms
21ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/ld.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

4758ffc00e2d3413aece1a57fc3e89b9709202312386d57eb74b5c198cf6800e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: gzip
last-modified: Tue, 14 Dec 2021 12:51:58 GMT
server: nginx
etag: W/"61b8936e-9faf"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 30 Jan 2022 08:17:36 GMT

GET
H2 200 universal-script Show response
175592.tracking.hyros.com/v1/lst/ Frame 620F 0
170 B 1000ms
813ms Script
text/plain 44.194.124.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.124.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-124-170.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
access-control-allow-credentials: true
content-length: 0
access-control-max-age: 86400
access-control-allow-methods: GET, PUT, POST, OPTIONS, DELETE
access-control-expose-headers: Session-ID

GET
H3 200 zOdksD_UUTk1LJF9z4tURA.woff2
fonts.gstatic.com/s/cinzel/v12/ Frame 6226 24 KB
24 KB 41ms
40ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/cinzel/v12/zOdksD_UUTk1LJF9z4tURA.woff2

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/include/form/fonts8.css?3391679876992

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

304cbbc575c227a24f183d9800167ab06418327356f73099404136d8bb9a6c92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fs22.formsite.com/
Origin: https://fs22.formsite.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 19:13:59 GMT
x-content-type-options: nosniff
age: 47017
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24996
x-xss-protection: 0
last-modified: Tue, 04 May 2021 22:35:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 28 Jan 2023 19:13:59 GMT

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/495d0f2b/www-widgetapi.vflset/ Frame 620F 146 KB
47 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/495d0f2b/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13981d9c52845e37ee092024bca57dac8e3a897e6261d22b6cab604659e41cc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 04:59:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11897
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48252
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 01:14:49 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 29 Jan 2023 04:59:19 GMT

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/495d0f2b/www-widgetapi.vflset/ Frame E20F 146 KB
47 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/495d0f2b/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13981d9c52845e37ee092024bca57dac8e3a897e6261d22b6cab604659e41cc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 04:59:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11897
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48252
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 01:14:49 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 29 Jan 2023 04:59:19 GMT

GET
H3 200 fetch-with-permalink Show response
v1.gdapis.com/api/groovevideo/ Frame 620F 2 KB
1 KB 200ms
200ms XHR
application/json 2606:4700:3034::6815:2dae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=7KE4VhYEZBAF7a6M9DFD&id=75176
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.041dd9f7.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:2dae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash: e878e156a2598d876b2f274ec391cabfae5b46ee0d127979d4751aeb6c65a6af

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.groove.cm/
x-auth-provider: auth0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: PHP/7.3.24
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining: 599
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6GXO0Gv2HUXz%2BYXViCDSzTJ2CQOe9HxEMDluV3jayJjD6ccq70xSU4%2FB84C6n%2B%2B2mgN%2FkE%2BA2knYDx2QWCCJjnyKxR945XyttAW2eyg4RnSrdLjmNh%2FJ2p8WOENqRt0c%2Ba%2F0%2BknH9Ps%2BFrIy"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma
cache-control: no-cache, private
x-ratelimit-limit: 600
cf-ray: 6d51066b99166987-FRA

OPTIONS
H3 204 fetch-with-permalink
v1.gdapis.com/api/groovevideo/ Frame 0
0 386ms
370ms Preflight
text/html 2606:4700:3034::6815:2dae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=7KE4VhYEZBAF7a6M9DFD&id=75176
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:2dae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-auth-provider
Origin: https://app.groove.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.3.24
cache-control: no-cache, private
access-control-allow-methods: POST, GET, OPTIONS, PUT, PATCH, DELETE
access-control-allow-headers: Content-Type, X-Auth-Token, Origin, Authorization, *
access-control-allow-origin: *
access-control-max-age: 86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7GVJwgWH%2Fmx3TFd8nCQtPUF4LP3M1TJy7hxTIBId19uXlUEqBki28XQ16i2AxAtZtZK4jaY0zwdyeicQxrB00Y9I7D51rBCwrl3ZxjylfIM3JdHOOW2xDe3QNZdKw%2FeZuLUmSacxHqQbXHR4"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6d5106694caf6987-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

OPTIONS
H3 204 fetch-with-permalink
v1.gdapis.com/api/groovevideo/ Frame 0
0 373ms
373ms Preflight
text/html 2606:4700:3034::6815:2dae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=u1kHEnHT9wSJ2kyJJs0e&id=75215
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:2dae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-auth-provider
Origin: https://app.groove.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.3.24
cache-control: no-cache, private
access-control-allow-methods: POST, GET, OPTIONS, PUT, PATCH, DELETE
access-control-allow-headers: Content-Type, X-Auth-Token, Origin, Authorization, *
access-control-allow-origin: *
access-control-max-age: 86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Wg4CRPTY%2FsN6%2F46BauT0Idz8HONqYBhcWMiAvU5cPQTyRHkqSe4XizOwjoGORt%2FGDLeIvIogGK5kHKWSUPd0HWOEBE99ax5352cab7sQwMLjoXlJ1sq3dQCBV2AQa64F7sF%2FgvVeEu27m0j"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6d5106695cc96987-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 fetch-with-permalink Show response
v1.gdapis.com/api/groovevideo/ Frame E20F 2 KB
1 KB 191ms
190ms XHR
application/json 2606:4700:3034::6815:2dae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=u1kHEnHT9wSJ2kyJJs0e&id=75215
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.041dd9f7.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:2dae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash: 91dd55b0b01d4232eb158271f55fdc0f468ae88dff12672e77d90ca64f618c89

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.groove.cm/
x-auth-provider: auth0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: PHP/7.3.24
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining: 598
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mUb%2BDD0VyyGwxsrXL2eew6U7PN5iAQc2ImFxGf%2F7V35xaGuHY%2Fp8qeWUnfRjE98YJWU%2Bo5Z43cwFkXl3cLhaXygrqbwui8rGqKGPC8Oj1HCWfjPEA6VtxDH3aBTV44N67lrzlosPs%2Fno2YlH"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma
cache-control: no-cache, private
x-ratelimit-limit: 600
cf-ray: 6d51066ba92f6987-FRA

POST
H3 204 matomo.php
matomo.groovetech.io/ Frame 620F 0
523 B 314ms
314ms Ping
text/plain 2606:4700:3036::6815:6071
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.php?action_name=GrooveFunnels&idsite=5&rec=1&r=162021&h=8&m=17&s=36&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&urlref=https%3A%2F%2Femployeeretentioncredit.business%2F&_id=59b080600c13a689&_idn=1&_refts=1643444256&_ref=https%3A%2F%2Femployeeretentioncredit.business%2F&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=Rtc8Xt&pf_net=0&pf_srv=208&pf_tfr=1&pf_dm1=1032
Requested by: Host: matomo.groovetech.io
URL: https://matomo.groovetech.io/matomo.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:6071 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.0.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.0.14
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=muJqzmaDvTKsnHIB%2BVcaNed8cbDUGseuQIXRUYxIUC58Px234AxOo59DgE2HKPkhLJkvMX00UY2FGEQHiqrKq8pbA5en1c1oEnnziCO4klZ7G9NatFZVT7b9bVnkgqrX%2FD9UtpcQTmOYawXV%2FBD7s74Ilg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://app.groove.cm
access-control-allow-credentials: true
cf-ray: 6d51066999ed913c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 204 matomo.php
matomo.groovetech.io/ Frame E20F 0
521 B 295ms
294ms Ping
text/plain 2606:4700:3036::6815:6071
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.php?action_name=GrooveFunnels&idsite=5&rec=1&r=522803&h=8&m=17&s=36&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&urlref=https%3A%2F%2Femployeeretentioncredit.business%2F&_id=cffa5d4941ab1cbd&_idn=1&_refts=1643444256&_ref=https%3A%2F%2Femployeeretentioncredit.business%2F&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=xZZ4rw&pf_net=0&pf_srv=209&pf_tfr=0&pf_dm1=1171
Requested by: Host: matomo.groovetech.io
URL: https://matomo.groovetech.io/matomo.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:6071 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.0.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.0.14
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nuon0eF6JQXPUi88vfC5MgZPr14zcNp7ON1Zoz5iaTidluE2Rc979idD3MLHeDgaNsWlBb3HbhoAhmgDzgzvlR6acqrpVgpAQcMbK09jkDFeUexLPDO%2B%2BKiD0fFdqyqWjsgxeDTr%2FsiNQ9M0dGFc6zefZg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://app.groove.cm
access-control-allow-credentials: true
cf-ray: 6d510669aa02913c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame C51B 13 KB
5 KB 66ms
25ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=employeeretentioncredit.business&origin=onetag

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/ld.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

7225c811b9035a4ce65639eb7ab5e7850833a340a866cc8e4bc5c2ce4abe8756

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 1884
date: Sat, 29 Jan 2022 08:17:36 GMT
content-length: 5180
strict-transport-security: max-age=31536000; preload;

GET
H2 200 17533112.js Show response
bat.bing.com/p/action/ Frame E20F 682 B
753 B 288ms
288ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/17533112.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: 302a3f44949b3ee709c665a8974077152143f44db6c6113e3a27a0bb16328cf6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B4F5EF26B03E430D899DB375B42BDA18 Ref B: FRAEDGE1306 Ref C: 2022-01-29T08:17:36Z
x-powered-by: ARR/3.0
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store,no-cache
content-length: 584

GET
H2 204 0
bat.bing.com/action/ Frame E20F 0
150 B 35ms
35ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=17533112&Ver=2&mid=38b90525-97e1-4179-b029-7bd28be4bb3f&sid=ea88f48080db11ecba73b58fdb34ba0a&vid=ea89958080db11ecb0323198964ec16b&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Groovevideo%20%C2%B7%20Groovevideo&p=https%3A%2F%2Femployeeretentioncredit.business%2F&r=&lt=1457&evt=pageLoad&ifm=1&msclkid=N&sv=1&rn=546061
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:35 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8590A29FD2054071B859AF6BE7E22BE3 Ref B: FRAEDGE1306 Ref C: 2022-01-29T08:17:36Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10139345.json Show response
s.yimg.com/wi/config/ Frame E20F 2 B
448 B 99ms
45ms XHR
application/json 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10139345.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 07:34:27 GMT
x-content-type-options: nosniff
age: 2589
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: X25XS7T8R41YYVNB
x-amz-id-2: r/cVLpFLAoLYzac9ru+467P/gmRacaC2guJKl+F2VCtj5Nshv43dHNt/aEXdVCmq2mgaR4irwxk=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H2 200 17533112.js Show response
bat.bing.com/p/action/ Frame 620F 727 B
718 B 314ms
313ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/17533112.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: 19676b0a5a6005251d12604649139fe3c2d8d777d362844ed9ad28f2245055b7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:35 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AFC1444053004EA38A0970E9CF553AD6 Ref B: FRAEDGE1306 Ref C: 2022-01-29T08:17:36Z
x-powered-by: ARR/3.0
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store,no-cache
content-length: 597

GET
H2 204 0
bat.bing.com/action/ Frame 620F 0
96 B 32ms
32ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=17533112&Ver=2&mid=c1fb7c73-acf1-4e2e-9dd8-314efa90f133&sid=ea88f48080db11ecba73b58fdb34ba0a&vid=ea89958080db11ecb0323198964ec16b&vids=0&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Groovevideo%20%C2%B7%20Groovevideo&p=https%3A%2F%2Femployeeretentioncredit.business%2F&r=&lt=1306&evt=pageLoad&ifm=1&msclkid=N&sv=1&rn=863982
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:35 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BCBB86BF238B45A8A051E5EE36F6687D Ref B: FRAEDGE1306 Ref C: 2022-01-29T08:17:36Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10139345.json Show response
s.yimg.com/wi/config/ Frame 620F 2 B
37 B 180ms
130ms XHR
application/json 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10139345.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 07:34:27 GMT
x-content-type-options: nosniff
age: 2589
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: X25XS7T8R41YYVNB
x-amz-id-2: r/cVLpFLAoLYzac9ru+467P/gmRacaC2guJKl+F2VCtj5Nshv43dHNt/aEXdVCmq2mgaR4irwxk=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 511C 13 KB
5 KB 38ms
26ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=employeeretentioncredit.business&origin=onetag

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/ld.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

7225c811b9035a4ce65639eb7ab5e7850833a340a866cc8e4bc5c2ce4abe8756

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 1824
date: Sat, 29 Jan 2022 08:17:36 GMT
content-length: 5180
strict-transport-security: max-age=31536000; preload;

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/ Frame E20F 2 KB
2 KB 300ms
102ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/?random=1643444256348&cv=9&fst=1643444256348&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1q0&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Femployeeretentioncredit.business%2F&tiba=Groovevideo%20%C2%B7%20Groovevideo&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b338163eb38111e87d351aaf3018234ce32f55e893259bffb5a5a548c187759

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1062
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/ Frame 620F 2 KB
1 KB 299ms
102ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/?random=1643444256351&cv=9&fst=1643444256351&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1q0&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&ref=https%3A%2F%2Femployeeretentioncredit.business%2F&tiba=Groovevideo%20%C2%B7%20Groovevideo&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1555a963572a2d3a43bcb9d62c824a43b8e5000e7b3651b9ad42f3f5abe8cbe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1063
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame E20F 43 B
328 B 341ms
80ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Sat%2C%2029%20Jan%202022%2008%3A17%3A36%20GMT&n=0&b=Groovevideo%20%C2%B7%20Groovevideo&.yp=10139345&f=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&e=https%3A%2F%2Femployeeretentioncredit.business%2F&enc=UTF-8&yv=1.12.0&isIframe=1&tagmgr=gtm

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Sat, 29 Jan 2022 08:17:36 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame C51B
Redirect Chain

https://gum.criteo.com/sid/json?origin=onetag&domain=app.groove.cm&sn=ChromeSyncframe&so=0&topUrl=employeeretentioncredit.business&lsw=1
https://mug.criteo.com/sid?cpp=X3-IZnx6R3BNT0VtMzYyNFdZK0wvRVptZFowT0RSbTRBUjh2VEtUL25ObzlUYy9pYmxtdDVHYmNzZHFUMnhHb3Zoa3licy85YVBYNzN5bFordWg4dld2Z0xiK2ZyR2R5QTNoR3p1R0lJOWpFTmpDV1NQdnlJQVlKRDJLTm...

454 B
651 B

291ms
32ms

Fetch
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=X3-IZnx6R3BNT0VtMzYyNFdZK0wvRVptZFowT0RSbTRBUjh2VEtUL25ObzlUYy9pYmxtdDVHYmNzZHFUMnhHb3Zoa3licy85YVBYNzN5bFordWg4dld2Z0xiK2ZyR2R5QTNoR3p1R0lJOWpFTmpDV1NQdnlJQVlKRDJLTm02MHVqa1FKU0xQQWRheSsrS3FrNkpEejNIbnZOd1NOYWZYVHZjRHIzNGhUdE1CL01sNDROWG9UWXMyVXZ1VFpxTXQ3bm1RZWtyMEFEN1hBU0wrNCtuYkNyOG9SSWRnN1Z0TFNIZ25wYkZWLzZzT2x6QVJQTzdVUENpWFN1dzl0TjFCMkdCdkNzYlVkbHBOUnAzd0dCRjNlMGdrdXVjVXVkem5yck5TVERKMkhOSVR1Qjc5VEx4Z0ZjU1MyaktTL01wOUgrL0JGR3w&cppv=2

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

7bef6c824dbc0b0958e59de377d1b377ffd09cb428cec681dfd40c70c2fd204e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3706
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:35 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=X3-IZnx6R3BNT0VtMzYyNFdZK0wvRVptZFowT0RSbTRBUjh2VEtUL25ObzlUYy9pYmxtdDVHYmNzZHFUMnhHb3Zoa3licy85YVBYNzN5bFordWg4dld2Z0xiK2ZyR2R5QTNoR3p1R0lJOWpFTmpDV1NQdnlJQVlKRDJLTm02MHVqa1FKU0xQQWRheSsrS3FrNkpEejNIbnZOd1NOYWZYVHZjRHIzNGhUdE1CL01sNDROWG9UWXMyVXZ1VFpxTXQ3bm1RZWtyMEFEN1hBU0wrNCtuYkNyOG9SSWRnN1Z0TFNIZ25wYkZWLzZzT2x6QVJQTzdVUENpWFN1dzl0TjFCMkdCdkNzYlVkbHBOUnAzd0dCRjNlMGdrdXVjVXVkem5yck5TVERKMkhOSVR1Qjc5VEx4Z0ZjU1MyaktTL01wOUgrL0JGR3w&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1751
content-length: 594
expires: 0

GET
H2

200

sid Show response
mug.criteo.com/ Frame 511C
Redirect Chain

https://gum.criteo.com/sid/json?origin=onetag&domain=app.groove.cm&sn=ChromeSyncframe&so=0&topUrl=employeeretentioncredit.business&lsw=1
https://mug.criteo.com/sid?cpp=Iq_OnnxQNXlZVXZCVTIyUWk5MFBJVk5tcHo1alB0WUJ6S1VJeGNlUVlCRUR4ZGFwNkNvTTZ0Z2I5ZVNtUGJraGVLTmVYVjNzM0hWRmlsYUdaTUYvRUVOdXc4cUpBU1QrWEFPYzhiVFFOODN2bUpSMDBEV3JYWXcySVEzS0...

459 B
649 B

247ms
33ms

Fetch
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=Iq_OnnxQNXlZVXZCVTIyUWk5MFBJVk5tcHo1alB0WUJ6S1VJeGNlUVlCRUR4ZGFwNkNvTTZ0Z2I5ZVNtUGJraGVLTmVYVjNzM0hWRmlsYUdaTUYvRUVOdXc4cUpBU1QrWEFPYzhiVFFOODN2bUpSMDBEV3JYWXcySVEzS0pCRGhlR255bzNDK2FXN0E4YlZHdkM3N3lYVjlCTklpZUNnN1A3NXMrMEwyWW51TVdCbHRzaWxFSnlENzBFOTRTRTR3OC9PV1VTQk5CUGRwTjVzSENuUitwTEZwdEVtVlIxR3BLZmhHeUlhYzlOVmlGTHJZV21tLy9Db1JyN1RScVRoVUNabFNzZWVyVUY0czZPZWdhTlhZakRQeEdaM1ZKb3kzRGwzZk9nNVVaSUlmTHE3T0ZsdUNuV1FCcGJPeUxueGpOc2p0U3w&cppv=2

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

8a481210e27958ca795335f2a0923bde39dab1788cb7a050c77060ba06f72578

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3824
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:35 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=Iq_OnnxQNXlZVXZCVTIyUWk5MFBJVk5tcHo1alB0WUJ6S1VJeGNlUVlCRUR4ZGFwNkNvTTZ0Z2I5ZVNtUGJraGVLTmVYVjNzM0hWRmlsYUdaTUYvRUVOdXc4cUpBU1QrWEFPYzhiVFFOODN2bUpSMDBEV3JYWXcySVEzS0pCRGhlR255bzNDK2FXN0E4YlZHdkM3N3lYVjlCTklpZUNnN1A3NXMrMEwyWW51TVdCbHRzaWxFSnlENzBFOTRTRTR3OC9PV1VTQk5CUGRwTjVzSENuUitwTEZwdEVtVlIxR3BLZmhHeUlhYzlOVmlGTHJZV21tLy9Db1JyN1RScVRoVUNabFNzZWVyVUY0czZPZWdhTlhZakRQeEdaM1ZKb3kzRGwzZk9nNVVaSUlmTHE3T0ZsdUNuV1FCcGJPeUxueGpOc2p0U3w&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1983
content-length: 594
expires: 0

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame 620F 43 B
717 B 264ms
79ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Sat%2C%2029%20Jan%202022%2008%3A17%3A36%20GMT&n=0&b=Groovevideo%20%C2%B7%20Groovevideo&.yp=10139345&f=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&e=https%3A%2F%2Femployeeretentioncredit.business%2F&enc=UTF-8&yv=1.12.0&isIframe=1&tagmgr=gtm

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Sat, 29 Jan 2022 08:17:36 GMT

GET
H2 200 clarity.js Show response
d.clarity.ms/s/0.6.31/ Frame E20F 52 KB
23 KB 341ms
93ms Script
application/javascript 40.76.174.66
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.clarity.ms/s/0.6.31/clarity.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/17533112.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b2d2f11eb78159e31bce4355ffd5e696717de4270a77ba1d2038e066462008ad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: br
etag: "1d811e72bf47200"
last-modified: Tue, 25 Jan 2022 12:29:18 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111

GET
H2

200

c.gif
c.clarity.ms/ Frame E20F
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=91547502830740188FA5D2098EC771A2&RedC=c.clarity.ms&MXFR=116EFBC16B7E6C9D06C9EAFA6F7E62D4
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=91547502830740188FA5D2098EC771A2&MUID=244CB9B8E0936DB12B4CA883E1416C10

42 B
442 B

160ms
160ms

Image
image/gif

40.91.78.9
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=91547502830740188FA5D2098EC771A2&MUID=244CB9B8E0936DB12B4CA883E1416C10
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Server: 40.91.78.9 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
last-modified: Thu, 13 Jan 2022 19:51:59 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "3bc6e26b78d81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8B2F1D9C0C9242859ACF01C53251E379 Ref B: FRAEDGE1306 Ref C: 2022-01-29T08:17:37Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=91547502830740188FA5D2098EC771A2&MUID=244CB9B8E0936DB12B4CA883E1416C10
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H2

200

c.gif
c.clarity.ms/ Frame 620F
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=CD8CC3BB9708416B8937838F24F759EF&RedC=c.clarity.ms&MXFR=020C2148044C6D4535EC3073004C63AB
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=CD8CC3BB9708416B8937838F24F759EF&MUID=244CB9B8E0936DB12B4CA883E1416C10

42 B
85 B

160ms
159ms

Image
image/gif

40.91.78.9
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=CD8CC3BB9708416B8937838F24F759EF&MUID=244CB9B8E0936DB12B4CA883E1416C10
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Server: 40.91.78.9 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
last-modified: Thu, 13 Jan 2022 19:51:59 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "3bc6e26b78d81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 13A5BB89EDC84C978EC4496B6A397363 Ref B: FRAEDGE1306 Ref C: 2022-01-29T08:17:37Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=CD8CC3BB9708416B8937838F24F759EF&MUID=244CB9B8E0936DB12B4CA883E1416C10
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H2 200 clarity.js Show response
g.clarity.ms/s/0.6.31/ Frame 620F 52 KB
23 KB 447ms
133ms Script
application/javascript 52.182.214.99
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.clarity.ms/s/0.6.31/clarity.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/17533112.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.182.214.99 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b2d2f11eb78159e31bce4355ffd5e696717de4270a77ba1d2038e066462008ad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
content-encoding: br
etag: "1d8113fbaad3400"
last-modified: Mon, 24 Jan 2022 16:30:42 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:7f62cbe7-9d8b-4a41-a628-fbaa3aa5c695

GET
H2 200 /
www.google.com/pagead/1p-user-list/646915355/ Frame E20F 42 B
108 B 171ms
49ms Image
image/gif 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/646915355/?random=1643444256348&cv=9&fst=1643443200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1q0&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Femployeeretentioncredit.business%2F&tiba=Groovevideo%20%C2%B7%20Groovevideo&async=1&fmt=3&is_vtc=1&random=3841235210&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/646915355/ Frame E20F 42 B
108 B 174ms
52ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/646915355/?random=1643444256348&cv=9&fst=1643443200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1q0&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Femployeeretentioncredit.business%2F&tiba=Groovevideo%20%C2%B7%20Groovevideo&async=1&fmt=3&is_vtc=1&random=3841235210&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/646915355/ Frame 620F 42 B
548 B 170ms
48ms Image
image/gif 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/646915355/?random=1643444256351&cv=9&fst=1643443200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1q0&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&ref=https%3A%2F%2Femployeeretentioncredit.business%2F&tiba=Groovevideo%20%C2%B7%20Groovevideo&async=1&fmt=3&is_vtc=1&random=97268293&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/646915355/ Frame 620F 42 B
548 B 173ms
51ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/646915355/?random=1643444256351&cv=9&fst=1643443200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1q0&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&ref=https%3A%2F%2Femployeeretentioncredit.business%2F&tiba=Groovevideo%20%C2%B7%20Groovevideo&async=1&fmt=3&is_vtc=1&random=97268293&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

event Show response
widget.us.criteo.com/ Frame E20F
Redirect Chain

https://sslwidget.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeeretentioncredit.business&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=M57UJV9ZYkdm...
https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeeretentioncredit.business&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=M57UJV9ZYkdm...

7 KB
8 KB

507ms
108ms

Script
application/x-javascript

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeeretentioncredit.business&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=M57UJV9ZYkdmUWZPdFB3bTNSJTJCM2htQVg3SFJocjUxTW1wMiUyQmJycGFlaVZxZVNpMzc3SnlaR0Rqc3Q0JTJGdDFidmpINEw2ZjdPUEV2bk9POEhNZGJFb1l0T1hxZU1ab1hEQzFPZHN6UFFpeVdYd1pBZ0U2dGFiVmhjTDIyYjJiUTkyeUsxZ0VpOHZkUk44NWFmOUJBcnoybWg2QkVtUFlhUVowZXoyTW1ZbE84aHZ3cG8lM0Q&tld=app.groove.cm&dtycbr=6951

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fb2f08462c6ac61adb8a15d5a9a1dc7927c683b0473de1bf78669689ae74a5bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
content-type: application/x-javascript
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 14365278
timing-allow-origin: *
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
location: https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeeretentioncredit.business&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=M57UJV9ZYkdmUWZPdFB3bTNSJTJCM2htQVg3SFJocjUxTW1wMiUyQmJycGFlaVZxZVNpMzc3SnlaR0Rqc3Q0JTJGdDFidmpINEw2ZjdPUEV2bk9POEhNZGJFb1l0T1hxZU1ab1hEQzFPZHN6UFFpeVdYd1pBZ0U2dGFiVmhjTDIyYjJiUTkyeUsxZ0VpOHZkUk44NWFmOUJBcnoybWg2QkVtUFlhUVowZXoyTW1ZbE84aHZ3cG8lM0Q&tld=app.groove.cm&dtycbr=6951
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2522408
timing-allow-origin: *
content-length: 0
expires: 0

GET
H2

200

event Show response
widget.us.criteo.com/ Frame 620F
Redirect Chain

https://sslwidget.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeeretentioncredit.business&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Z4sev19ZcmUy...
https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeeretentioncredit.business&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Z4sev19ZcmUy...

7 KB
8 KB

503ms
104ms

Script
application/x-javascript

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeeretentioncredit.business&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Z4sev19ZcmUyVHRybll0VXZnTVFtMk1Ka3o4aGdLRUE4TjFNJTJGaENmQjdIMzcyOUdRa1J1ZFFsV1BQYUhtJTJCeSUyQjhJWVByaER2JTJGQUZVTFdkM3J0NWRleng1RnNBTlhxVlN2VlAzRE02TTd5dWZTZUYyZ0JtNWZxa3NTM0RCOFFudEtWN1NybXRPdDJ6UTg5OEYzODFmT0dKUU1tU2hRNU5LOG9mYXlTNTclMkZZTzB4RWZnJTNE&tld=app.groove.cm&dtycbr=60329

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e601f42affabbc5b7f3dc24fb2878f7bfe1ce8b67d8f79924cf791da8850f936

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
content-type: application/x-javascript
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 11337914
timing-allow-origin: *
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
location: https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeeretentioncredit.business&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Z4sev19ZcmUyVHRybll0VXZnTVFtMk1Ka3o4aGdLRUE4TjFNJTJGaENmQjdIMzcyOUdRa1J1ZFFsV1BQYUhtJTJCeSUyQjhJWVByaER2JTJGQUZVTFdkM3J0NWRleng1RnNBTlhxVlN2VlAzRE02TTd5dWZTZUYyZ0JtNWZxa3NTM0RCOFFudEtWN1NybXRPdDJ6UTg5OEYzODFmT0dKUU1tU2hRNU5LOG9mYXlTNTclMkZZTzB4RWZnJTNE&tld=app.groove.cm&dtycbr=60329
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2640792
timing-allow-origin: *
content-length: 0
expires: 0

GET
DATA 200
OK truncated
/ Frame 620F 4 KB
4 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aef991b2e0b693a95d41986576dd3901ea7ac03b379501b1caba966058753308

Request headers

Referer
Origin: https://app.groove.cm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 206 groovevideo-8d2985e0fd35262fe8daa16a82295540.mp4
videos.groovevideo.com/5dd590f1c586100f1285ee7a/ Frame 620F 289 KB
0 510ms
469ms Media
video/mp4 2600:9000:223d:1800:b:d801:7900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://videos.groovevideo.com/5dd590f1c586100f1285ee7a/groovevideo-8d2985e0fd35262fe8daa16a82295540.mp4
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:1800:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://app.groove.cm/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Range: bytes=0-

Response headers

date: Sat, 29 Jan 2022 08:17:38 GMT
via: 1.1 456733511c088f8435091e663b2c5430.cloudfront.net (CloudFront)
last-modified: Fri, 12 Nov 2021 16:18:22 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P3
etag: "d01b8de36dff0efab6b88f31a7dbeabc"
x-cache: Miss from cloudfront
content-type: video/mp4
Content-Range: bytes 0-20764396/20764397
accept-ranges: bytes
Content-Length: 20764397
x-amz-cf-id: EhqdaAFTNUYcQA3UFi0WPv90T7YqidPfTUD4GfQWag97UOtBwKxCRQ==

GET
H2 206 groovevideo-213d95e6b4b4fcf88270eebb4d673595.mp4
videos.groovevideo.com/5dd590f1c586100f1285ee7a/ Frame E20F 3 MB
3 MB 46ms
9ms Media
video/mp4 2600:9000:223d:1800:b:d801:7900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://videos.groovevideo.com/5dd590f1c586100f1285ee7a/groovevideo-213d95e6b4b4fcf88270eebb4d673595.mp4
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:1800:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 56d3bf72133f30f5e4ea2824f5906c580070865a0355d83013bc22d1849d8e42

Request headers

Referer: https://app.groove.cm/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Range: bytes=0-

Response headers

date: Fri, 28 Jan 2022 16:08:09 GMT
via: 1.1 456733511c088f8435091e663b2c5430.cloudfront.net (CloudFront)
last-modified: Fri, 12 Nov 2021 21:33:10 GMT
server: AmazonS3
age: 58168
etag: "f0a1f3fafedb3b07b52afe73134ecc80"
x-cache: Hit from cloudfront
content-type: video/mp4
Content-Range: bytes 0-2626605/2626606
x-amz-cf-pop: FRA56-P3
accept-ranges: bytes
Content-Length: 2626606
x-amz-cf-id: _OSxcjaP2DtJxbzuubDODwJmFXV1cx949BDH5qfJ4s3wJffXooGzlQ==

POST
H3 204 matomo.php
matomo.groovetech.io/ Frame 620F 0
523 B 138ms
137ms Ping
text/plain 2606:4700:3036::6815:6071
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.php?action_name=GrooveFunnels&idsite=5&rec=1&r=388426&h=8&m=17&s=36&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&urlref=https%3A%2F%2Femployeeretentioncredit.business%2F&_id=ea85f3fe72e90003&_idn=1&_refts=1643444257&_ref=https%3A%2F%2Femployeeretentioncredit.business%2F&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=panSrT&pf_net=0&pf_srv=208&pf_tfr=1&pf_dm1=1032
Requested by: Host: matomo.groovetech.io
URL: https://matomo.groovetech.io/matomo.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:6071 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.0.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.0.14
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YhBXvLWVgO%2FbYtg3vCvIAGTuYgn1UxKFhprGLOrO1JHashIX%2Frx2R4cnl0cJ3Ckp0US6VCCt3glnF%2Fv8s96hFIZ7i2aQnh0IOGzUaP4VUF5WycJHiQFlThg7OHdv0m1j8DK3E57xROJHn25QyOrAf581uA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://app.groove.cm
access-control-allow-credentials: true
cf-ray: 6d51066e981d913c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 204 matomo.php
matomo.groovetech.io/ Frame E20F 0
525 B 133ms
133ms Ping
text/plain 2606:4700:3036::6815:6071
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.php?action_name=GrooveFunnels&idsite=5&rec=1&r=170339&h=8&m=17&s=36&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&urlref=https%3A%2F%2Femployeeretentioncredit.business%2F&_id=f60497a673a77d2b&_idn=1&_refts=1643444257&_ref=https%3A%2F%2Femployeeretentioncredit.business%2F&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=RyPmw7&pf_net=0&pf_srv=209&pf_tfr=0&pf_dm1=1171
Requested by: Host: matomo.groovetech.io
URL: https://matomo.groovetech.io/matomo.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:6071 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.0.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.0.14
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r5vdiHJr9U0teGU67hgQ4tZTUpGw84OS6GC9gxQQeVcBG2Fh2oO7ajBRGNSgNqhWfR02iYFJ8Qk8GQkwW%2B7wVtA2imPORAejMpY5ldC%2FJguCjC1y5mfHsgIFoB%2FLgnGOD49CvYc3%2FDJyzRt2Nqq4%2BnHp2A%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://app.groove.cm
access-control-allow-credentials: true
cf-ray: 6d51066ea828913c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H2 204 collect Show response
d.clarity.ms/ Frame E20F 0
68 B 182ms
182ms XHR
text/plain 40.76.174.66
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.clarity.ms/collect
Requested by: Host: d.clarity.ms
URL: https://d.clarity.ms/s/0.6.31/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: https://app.groove.cm
date: Sat, 29 Jan 2022 08:17:36 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111

POST
H2 204 collect Show response
g.clarity.ms/ Frame 620F 0
68 B 250ms
250ms XHR
text/plain 52.182.214.99
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.clarity.ms/collect
Requested by: Host: g.clarity.ms
URL: https://g.clarity.ms/s/0.6.31/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.182.214.99 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: https://app.groove.cm
date: Sat, 29 Jan 2022 08:17:36 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:7f62cbe7-9d8b-4a41-a628-fbaa3aa5c695

GET
H2 200 / Show response
beacon-v2.helpscout.net/ Frame E20F 293 B
622 B 34ms
8ms Script
application/javascript 13.32.99.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-112.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96824d0ee7486936bfe1478c4884c0109f7b2d182fc0b66fdc8bc50348de04ae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:16:37 GMT
content-encoding: gzip
last-modified: Thu, 27 Jan 2022 12:46:28 GMT
server: AmazonS3
age: 61
etag: "bbc22d981edc10190286c8f2ddcab9b8"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
cache-control: max-age=120, s-maxage=120, public
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
content-length: 244
x-amz-cf-id: _XCyGGTl3sBy1KKy_zcZ66ZmpbMI8_gzpR_yx0WHV7GgCf2eKmAXxw==

GET
H2

200

397596.gif
idsync.rlcdn.com/ Frame 067C
Redirect Chain

https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40
https://idsync.rlcdn.com/397596.gif?partner_uid=2i_wKrc8vXE_AOOMNwSVMyAGQaJswweU

42 B
415 B

61ms
20ms

Image
image/gif

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/397596.gif?partner_uid=2i_wKrc8vXE_AOOMNwSVMyAGQaJswweU
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 29 Jan 2022 08:17:37 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/397596.gif?partner_uid=2i_wKrc8vXE_AOOMNwSVMyAGQaJswweU
date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2502
content-length: 197
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 067C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay1ZQlFfSEFnNWhfcjZaMTNRLUEyV3ByTDRfZFBWRUotTjZXSkZPQQ
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

43 B
369 B

23ms
13ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Server

178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 277998
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 279
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

204
No Content

/
partner.mediawallahscript.com/ Frame 067C
Redirect Chain

https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-YBQ_HAg5h_r6Z13Q-A2WprL4_dPVEJ-N6WJFOA&custom=&tag_format=img&tag_action=sync&custom=&cb=68c27417-bdac-4322-85f1-defb102...
https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-YBQ_HAg5h_r6Z13Q-A2WprL4_dPVEJ-N6WJFOA&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=68c27417-bdac-432...

0
638 B

31ms
31ms

Image
text/plain

34.254.114.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-YBQ_HAg5h_r6Z13Q-A2WprL4_dPVEJ-N6WJFOA&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=68c27417-bdac-4322-85f1-defb102f7b34&final=true&reqid=eb501550-80db-11ec-889a-17251f303e01&timestamp=2022-01-29T08%3A17%3A37.573Z
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Server: 34.254.114.92 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-114-92.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 29 Jan 2022 08:17:37 GMT
Cache-Control: private, no-cache, must-revalidate, no-store, max-age=0
Server: nginx/1.18.0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Sat, 29 Jan 2022 08:17:37 GMT
Server: nginx/1.18.0
Vary: Accept, Accept-Encoding
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: /?account_id=1043&partner_id=1048&uid=k-YBQ_HAg5h_r6Z13Q-A2WprL4_dPVEJ-N6WJFOA&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=68c27417-bdac-4322-85f1-defb102f7b34&final=true&reqid=eb501550-80db-11ec-889a-17251f303e01&timestamp=2022-01-29T08%3A17%3A37.573Z
Cache-Control: private, no-cache, must-revalidate, no-store, max-age=0
Connection: keep-alive
Content-Type: text/plain; charset=utf-8
Content-Length: 294
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 204 v1
ads.yahoo.com/cms/ Frame 067C 0
47 B 26ms
20ms Image
text/plain 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~7315a025058f3128185459bfaf16e164414683fc&nwid=10000545908&sigv=1

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H2 200 spp.pl
sp.analytics.yahoo.com/ Frame 067C 43 B
374 B 41ms
38ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/spp.pl?a=10001287818027&.yp=10028862&js=no

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Sat, 29 Jan 2022 08:17:37 GMT

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58301/ Frame 067C 0
480 B 35ms
10ms Image
text/plain 18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-xVFUWgg5h_r6Z13Q-A2WprL4_dP_VFaVkfbWGw

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

ATS/9.1.0.33 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
server: ATS/9.1.0.33
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK cookie-sync
sync.outbrain.com/ Frame 067C 0
476 B 344ms
82ms Image
text/plain 70.42.32.159
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-k7tAVQg5h_r6Z13Q-A2WprL4_dPqO8RbwdyncA
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.159 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 29 Jan 2022 08:17:37 GMT
Cache-Control: no-cache
X-TraceId: c9f502899141ca3c126bc3528a1b074d
Content-Length: 0

GET
H2 204 t.gif
cw.addthis.com/ Frame 067C 0
428 B 247ms
205ms Image
text/plain 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cw.addthis.com/t.gif?pid=113&pdid=k-hID2Bwg5h_r6Z13Q-A2WprL4_dOWE05X3nM1ow
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-126.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 29 Jan 2022 08:17:37 GMT

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame 067C 0
239 B 33ms
9ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-hID2Bwg5h_r6Z13Q-A2WprL4_dOWE05X3nM1ow&expires=30
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Content-Type: image/gif

GET
H/1.1

200
OK

bounce
secure.adnxs.com/ Frame 067C
Redirect Chain

https://secure.adnxs.com/setuid?entity=52&code=k-3dep-gg5h_r6Z13Q-A2WprL4_dPFo28Kl2sb9g&seg=95287
https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-3dep-gg5h_r6Z13Q-A2WprL4_dPFo28Kl2sb9g%26seg%3D95287

43 B
1 KB

13ms
13ms

Image
image/gif

185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-3dep-gg5h_r6Z13Q-A2WprL4_dPFo28Kl2sb9g%26seg%3D95287

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

HTTP/1.1

Server

185.33.221.13 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 29 Jan 2022 08:17:37 GMT
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 729.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 0e037a57-a2aa-4746-a68b-73738dbfbaba
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 29 Jan 2022 08:17:37 GMT
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 729.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 0f3fa5bf-b74a-45b9-a206-d1794613f192
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-3dep-gg5h_r6Z13Q-A2WprL4_dPFo28Kl2sb9g%26seg%3D95287
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 067C 42 B
673 B 56ms
15ms Image
image/gif 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-JQHvtgg5h_r6Z13Q-A2WprL4_dO-dnth-xaSSw
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug030:0:290
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

xuid
eb2.3lift.com/ Frame 067C
Redirect Chain

https://eb2.3lift.com/xuid?mid=2711&xuid=k-N92PdAg5h_r6Z13Q-A2WprL4_dPA9AJFMxySqA&dongle=013b
https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-N92PdAg5h_r6Z13Q-A2WprL4_dPA9AJFMxySqA&dongle=013b&gdpr=1&cmp_cs=&us_privacy=

37 B
354 B

14ms
13ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-N92PdAg5h_r6Z13Q-A2WprL4_dPA9AJFMxySqA&dongle=013b&gdpr=1&cmp_cs=&us_privacy=
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=2711&xuid=k-N92PdAg5h_r6Z13Q-A2WprL4_dPA9AJFMxySqA&dongle=013b&gdpr=1&cmp_cs=&us_privacy=
date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 cksync.php
contextual.media.net/ Frame 067C 45 B
784 B 57ms
32ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-Mg6oJQg5h_r6Z13Q-A2WprL4_dMZIHo8DgS0pA

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Sat, 29 Jan 2022 08:17:37 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 45
x-mnet-hl2: E
expires: Sat, 29 Jan 2022 08:17:37 GMT

GET
H/1.1

200
OK

rum
r.casalemedia.com/ Frame 067C
Redirect Chain

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-xPo0MQg5h_r6Z13Q-A2WprL4_dMiEQrt78InHw
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-xPo0MQg5h_r6Z13Q-A2WprL4_dMiEQrt78InHw&C=1

43 B
1 KB

26ms
26ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-xPo0MQg5h_r6Z13Q-A2WprL4_dMiEQrt78InHw&C=1
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 29 Jan 2022 08:17:37 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 29 Jan 2022 08:17:37 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 29 Jan 2022 08:17:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-xPo0MQg5h_r6Z13Q-A2WprL4_dMiEQrt78InHw&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 296
Expires: Sat, 29 Jan 2022 08:17:37 GMT

GET
H2 204 /
s.ad.smaato.net/c/ Frame 067C 0
241 B 49ms
10ms Image
text/plain 2600:9000:224a:c600:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?dspInit=1001851&dspCookie=k-Arihtwg5h_r6Z13Q-A2WprL4_dOdK9zpj_ciCg
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:c600:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
via: 1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
server: CloudFront
cache-control: no-cache, must-revalidate
x-amz-cf-pop: DUS51-P1
x-amz-cf-id: EekhdqHKR3DQhNOybPiXOC8yagt6hxr2RnzNM6zgDPCn2YCqSExdLw==
x-cache: FunctionGeneratedResponse from cloudfront

GET
H/1.1

200
OK

sync
x.bidswitch.net/ul_cb/ Frame 067C
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=46&user_id=k-FX93vwg5h_r6Z13Q-A2WprL4_dM9V64sbWZbsA&expires=30&user_group=5
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-FX93vwg5h_r6Z13Q-A2WprL4_dM9V64sbWZbsA&expires=30&user_group=5

43 B
495 B

10ms
10ms

Image
image/gif

18.197.236.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-FX93vwg5h_r6Z13Q-A2WprL4_dM9V64sbWZbsA&expires=30&user_group=5
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Server: 18.197.236.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-236-215.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 29 Jan 2022 08:17:37 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-FX93vwg5h_r6Z13Q-A2WprL4_dM9V64sbWZbsA&expires=30&user_group=5
Date: Sat, 29 Jan 2022 08:17:37 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 pixel_sync
trends.revcontent.com/cm/ Frame 067C 35 B
336 B 102ms
31ms Image
image/gif 52.215.125.248
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k-HZSXtAg5h_r6Z13Q-A2WprL4_dOtqATrIBH0qw
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.125.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-125-248.eu-west-1.compute.amazonaws.com
Software: / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
x-powered-by: Express
content-length: 35
content-type: image/gif

GET
H2 200 um
criteo-sync.teads.tv/ Frame 067C 23 B
172 B 80ms
36ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-sync.teads.tv/um?eid=80&uid=k-bPdVkQg5h_r6Z13Q-A2WprL4_dMD_lngHGxJtg
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 29 Jan 2022 08:17:37 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H2 200 /
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 067C 0
231 B 69ms
16ms Image
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-m-js_gg5h_r6Z13Q-A2WprL4_dNQoY068LaiFA
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 13641

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame 067C 43 B
163 B 58ms
21ms Image
image/gif 185.86.139.113
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-yULYsAg5h_r6Z13Q-A2WprL4_dMjqBNpMUhPbQ
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.113 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H2 200 v1
match.sharethrough.com/sync/ Frame 067C 68 B
262 B 42ms
7ms Image
image/png 52.28.128.181
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-c0kgbAg5h_r6Z13Q-A2WprL4_dPTfC2I3WEp9w
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.128.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-128-181.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
content-length: 68
content-type: image/png

GET
H2

200

match
ad.360yield.com/ul_cb/ Frame 067C
Redirect Chain

https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-65wjCAg5h_r6Z13Q-A2WprL4_dO_JM7xBg1lgg
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-65wjCAg5h_r6Z13Q-A2WprL4_dO_JM7xBg1lgg

43 B
446 B

33ms
32ms

Image
image/gif

54.246.150.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-65wjCAg5h_r6Z13Q-A2WprL4_dO_JM7xBg1lgg
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Server: 54.246.150.87 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-150-87.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 29 Jan 2022 08:17:37 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

location: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-65wjCAg5h_r6Z13Q-A2WprL4_dO_JM7xBg1lgg
date: Sat, 29 Jan 2022 08:17:37 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

28292
i6.liadm.com/s/ Frame 067C
Redirect Chain

https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--1NoUAg5h_r6Z13Q-A2WprL4_dMhO-eL8HBXRw
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--1NoUAg5h_r6Z13Q-A2WprL4_dMhO-eL8HBXRw&_li_chk=true&previous_uuid=feb3de82befb44168ef3a0203da4f847
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--1NoUAg5h_r6Z13Q-A2WprL4_dMhO-eL8HBXRw

43 B
419 B

311ms
103ms

Image
image/gif

2600:1f18:444a:4602:f850:4eec:7dd:fbc1
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--1NoUAg5h_r6Z13Q-A2WprL4_dMhO-eL8HBXRw

Protocol

HTTP/1.1

Server

2600:1f18:444a:4602:f850:4eec:7dd:fbc1 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 29 Jan 2022 08:17:38 GMT
Cache-Control: no-store
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--1NoUAg5h_r6Z13Q-A2WprL4_dMhO-eL8HBXRw
Date: Sat, 29 Jan 2022 08:17:37 GMT
Connection: keep-alive
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H2 200 1017
jadserve.postrelease.com/suid/ Frame 067C 43 B
427 B 343ms
100ms Image
image/gif 54.146.124.230
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/1017?vk=k-Xieb_Qg5h_r6Z13Q-A2WprL4_dPncOWlHAjCCg
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.124.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-124-230.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
server: nginx/1.12.1
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55945/ Frame 067C
Redirect Chain

https://pixel.advertising.com/ups/55945/sync?uid=k-xaABPwg5h_r6Z13Q-A2WprL4_dPvLuTMdukutA&_origin=1
https://pixel.advertising.com/ups/55945/sync?uid=k-xaABPwg5h_r6Z13Q-A2WprL4_dPvLuTMdukutA&_origin=1&verify=true
https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-xaABPwg5h_r6Z13Q-A2WprL4_dPvLuTMdukutA&_origin=1&apid=UPeb5df869-80db-11ec-9a03-02aec6d80f0c

0
20 B

11ms
10ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-xaABPwg5h_r6Z13Q-A2WprL4_dPvLuTMdukutA&_origin=1&apid=UPeb5df869-80db-11ec-9a03-02aec6d80f0c

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.0.33 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
server: ATS/9.1.0.33
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-xaABPwg5h_r6Z13Q-A2WprL4_dPvLuTMdukutA&_origin=1&apid=UPeb5df869-80db-11ec-9a03-02aec6d80f0c
date: Sat, 29 Jan 2022 08:17:37 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 sync
criteo-partners.tremorhub.com/ Frame 067C 43 B
182 B 313ms
100ms Image
image/gif 2600:1f18:612b:4264:c62f:533:271f:3e7e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-partners.tremorhub.com/sync?UICR=k-WeVswAg5h_r6Z13Q-A2WprL4_dNNyH54p7yGkA
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4264:c62f:533:271f:3e7e Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H/1.1

200
OK

empty.gif
cdn.stickyadstv.com/one-shot/ Frame 067C
Redirect Chain

https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-ZNqqdwg5h_r6Z13Q-A2WprL4_dOV8YuzrsrD4A&redirectId=69
https://cdn.stickyadstv.com/one-shot/empty.gif?

43 B
438 B

110ms
19ms

Image
image/gif

2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.stickyadstv.com/one-shot/empty.gif?
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Server: 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 29 Jan 2022 08:17:37 GMT
Last-Modified: Thu, 28 Feb 2013 15:45:35 GMT
ETag: "1362066335"
X-HW: 1643444257.dop140.am5.t,1643444257.cds155.am5.shn,1643444257.cds155.am5.c
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=7200
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 43

Redirect headers

Pragma: no-cache
Date: Sat, 29 Jan 2022 08:17:37 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cdn.stickyadstv.com/one-shot/empty.gif?
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1643444257545071-535
Expires: Sat, 29 Jan 2022 08:17:37 GMT

GET
H2 200 sync
sync-criteo.ads.yieldmo.com/ Frame 067C 43 B
220 B 331ms
101ms Image
image/gif 34.200.184.86
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-criteo.ads.yieldmo.com/sync?id=k-M1grUgg5h_r6Z13Q-A2WprL4_dP7RI78dsrOrQ&pn_id=criteo&ext=1
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.184.86 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-184-86.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 200 vendor.b307fc80.js Show response
beacon-v2.helpscout.net/static/js/ Frame E20F 703 KB
196 KB 8ms
8ms Script
application/javascript 13.32.99.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/static/js/vendor.b307fc80.js
Requested by: Host: beacon-v2.helpscout.net
URL: https://beacon-v2.helpscout.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-112.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e6d6ef47656a5af517c16cf77da1ab763a5eb3272fab1ef60322efa24de23e6a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 06:47:14 GMT
content-encoding: gzip
last-modified: Thu, 27 Jan 2022 12:46:28 GMT
server: AmazonS3
age: 5424
etag: "ed6d91f839ba2de0467292b0dd07ccd4"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
cache-control: max-age=315360000, s-maxage=7200, public
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
content-length: 200130
x-amz-cf-id: cyIzjXVaIQj_HdYMBDBorCj1v2lkSLrBERUcH3D1FIKWxehL7B_jsw==

GET
H2 200 main.a773da62.js Show response
beacon-v2.helpscout.net/static/js/ Frame E20F 264 KB
67 KB 31ms
31ms Script
application/javascript 13.32.99.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/static/js/main.a773da62.js
Requested by: Host: beacon-v2.helpscout.net
URL: https://beacon-v2.helpscout.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-112.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: de96b1ca5c6d4290f4fdcf9fe496cf73c19ad6568efd171b75a84f1eec2717dc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:11:02 GMT
content-encoding: gzip
last-modified: Thu, 27 Jan 2022 12:46:28 GMT
server: AmazonS3
age: 396
etag: "c66ae151b19acd5b31d40c94b37194e9"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
cache-control: max-age=315360000, s-maxage=7200, public
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
content-length: 67853
x-amz-cf-id: qh5f-tMNa6E188fHF5qxNhXJe-cRVjC7yidi3dWNMwkzJQFtuFTI7Q==

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame 067C
Redirect Chain

https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID
https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=3090851003624543797

43 B
370 B

17ms
17ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=3090851003624543797

Protocol

Server

178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:36 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2940968
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 29 Jan 2022 08:17:37 GMT
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 729.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f447505e-d8db-46e6-a7cd-2de99c8ab558
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=3090851003624543797
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/cdb/ Frame 067C
Redirect Chain

https://gum.criteo.com/sync?c=383&r=1&a=1&u=https%3A%2F%2Fd.turn.com%2Fr%2Fdd%2Fid%2FL2NzaWQvMS9jaWQvMTc0ODc0NDU2Ni90LzI%2Fdpuid%2F%40USERID%40%2Furl%2Fhttps%253A%252F%252Fdis.criteo.com%252Fdis%25...
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODc0NDU2Ni90LzI/dpuid/p1iQ9DOMm9lYQwKuF7FLWeUMKYYuvTZC/url/https%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fcdb%2Fcookiematch.aspx%3F%26extid%3D%24!%7BTURN_...
https://dis.criteo.com/dis/rtb/cdb/cookiematch.aspx?&extid=8402538545384128416

43 B
370 B

19ms
19ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/cdb/cookiematch.aspx?&extid=8402538545384128416

Protocol

Server

178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1910187
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://dis.criteo.com/dis/rtb/cdb/cookiematch.aspx?&extid=8402538545384128416
pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 200 / Show response
beacon-v2.helpscout.net/ Frame 620F 293 B
622 B 7ms
7ms Script
application/javascript 13.32.99.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-112.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96824d0ee7486936bfe1478c4884c0109f7b2d182fc0b66fdc8bc50348de04ae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:16:37 GMT
content-encoding: gzip
last-modified: Thu, 27 Jan 2022 12:46:28 GMT
server: AmazonS3
age: 61
etag: "bbc22d981edc10190286c8f2ddcab9b8"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
cache-control: max-age=120, s-maxage=120, public
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
content-length: 244
x-amz-cf-id: EmCyPgwQ6Gg3ZO47to9NRG_d1E2wNzSZBMhogkYmrYAXjCvypCFG8w==

GET
H2

200

397596.gif
idsync.rlcdn.com/ Frame 3AF6
Redirect Chain

https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40
https://idsync.rlcdn.com/397596.gif?partner_uid=xMT5sSkoHWK31mbG3Y4X6Ukkqj7Nf6Xr

42 B
285 B

34ms
34ms

Image
image/gif

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/397596.gif?partner_uid=xMT5sSkoHWK31mbG3Y4X6Ukkqj7Nf6Xr
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 29 Jan 2022 08:17:37 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/397596.gif?partner_uid=xMT5sSkoHWK31mbG3Y4X6Ukkqj7Nf6Xr
date: Sat, 29 Jan 2022 08:17:36 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2852
content-length: 197
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 3AF6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay1ZQlFfSEFnNWhfcjZaMTNRLUEyV3ByTDRfZFBWRUotTjZXSkZPQQ
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

43 B
369 B

14ms
14ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Server

178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 246837
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 279
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 spp.pl
sp.analytics.yahoo.com/ Frame 3AF6 43 B
79 B 46ms
38ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/spp.pl?a=10001287818027&.yp=10028862&js=no

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Sat, 29 Jan 2022 08:17:37 GMT

GET
H/1.1 200
OK cookie-sync
sync.outbrain.com/ Frame 3AF6 0
476 B 270ms
83ms Image
text/plain 70.42.32.159
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-k7tAVQg5h_r6Z13Q-A2WprL4_dPqO8RbwdyncA
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.159 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 29 Jan 2022 08:17:37 GMT
Cache-Control: no-cache
X-TraceId: 97a2da950257289c9f58fe3bce3d1dd7
Content-Length: 0

GET
H2 204 t.gif
cw.addthis.com/ Frame 3AF6 0
428 B 176ms
168ms Image
text/plain 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cw.addthis.com/t.gif?pid=113&pdid=k-hID2Bwg5h_r6Z13Q-A2WprL4_dOWE05X3nM1ow
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-126.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 29 Jan 2022 08:17:37 GMT

GET
H/1.1 200
OK setuid
secure.adnxs.com/ Frame 3AF6 43 B
1023 B 31ms
26ms Image
image/gif 185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/setuid?entity=52&code=k-3dep-gg5h_r6Z13Q-A2WprL4_dPFo28Kl2sb9g&seg=95287

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 29 Jan 2022 08:17:37 GMT
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 729.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: fae3a3f1-8877-4b4f-9266-cda3a3ca543b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 3AF6 42 B
113 B 24ms
17ms Image
image/gif 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-JQHvtgg5h_r6Z13Q-A2WprL4_dO-dnth-xaSSw
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug029:0:2420
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 xuid
eb2.3lift.com/ Frame 3AF6 37 B
354 B 17ms
10ms Image
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2711&xuid=k-N92PdAg5h_r6Z13Q-A2WprL4_dPA9AJFMxySqA&dongle=013b
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 cksync.php
contextual.media.net/ Frame 3AF6 45 B
620 B 41ms
34ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-Mg6oJQg5h_r6Z13Q-A2WprL4_dMZIHo8DgS0pA

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Sat, 29 Jan 2022 08:17:37 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 45
x-mnet-hl2: E
expires: Sat, 29 Jan 2022 08:17:37 GMT

GET
H/1.1 200
OK rum
r.casalemedia.com/ Frame 3AF6 43 B
1 KB 22ms
15ms Image
image/gif 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-xPo0MQg5h_r6Z13Q-A2WprL4_dMiEQrt78InHw
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 29 Jan 2022 08:17:37 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 29 Jan 2022 08:17:37 GMT

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 3AF6 43 B
220 B 15ms
9ms Image
image/gif 18.197.236.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-FX93vwg5h_r6Z13Q-A2WprL4_dM9V64sbWZbsA&expires=30&user_group=5
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.236.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-236-215.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 29 Jan 2022 08:17:37 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 pixel_sync
trends.revcontent.com/cm/ Frame 3AF6 35 B
215 B 41ms
35ms Image
image/gif 52.215.125.248
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k-HZSXtAg5h_r6Z13Q-A2WprL4_dOtqATrIBH0qw
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.125.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-125-248.eu-west-1.compute.amazonaws.com
Software: / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
x-powered-by: Express
content-length: 35
content-type: image/gif

GET
H2 200 um
criteo-sync.teads.tv/ Frame 3AF6 23 B
172 B 38ms
33ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-sync.teads.tv/um?eid=80&uid=k-bPdVkQg5h_r6Z13Q-A2WprL4_dMD_lngHGxJtg
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 29 Jan 2022 08:17:37 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H2 200 /
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 3AF6 0
230 B 20ms
15ms Image
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-m-js_gg5h_r6Z13Q-A2WprL4_dNQoY068LaiFA
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 13637

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame 3AF6 43 B
163 B 20ms
17ms Image
image/gif 185.86.139.113
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-yULYsAg5h_r6Z13Q-A2WprL4_dMjqBNpMUhPbQ
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.113 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:36 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H2 200 v1
match.sharethrough.com/sync/ Frame 3AF6 68 B
263 B 29ms
7ms Image
image/png 52.28.128.181
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-c0kgbAg5h_r6Z13Q-A2WprL4_dPTfC2I3WEp9w
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.128.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-128-181.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
content-length: 68
content-type: image/png

GET
H2

200

match
ad.360yield.com/ul_cb/ Frame 3AF6
Redirect Chain

https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-65wjCAg5h_r6Z13Q-A2WprL4_dO_JM7xBg1lgg
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-65wjCAg5h_r6Z13Q-A2WprL4_dO_JM7xBg1lgg

43 B
446 B

43ms
43ms

Image
image/gif

54.246.150.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-65wjCAg5h_r6Z13Q-A2WprL4_dO_JM7xBg1lgg
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Server: 54.246.150.87 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-150-87.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 29 Jan 2022 08:17:37 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

location: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-65wjCAg5h_r6Z13Q-A2WprL4_dO_JM7xBg1lgg
date: Sat, 29 Jan 2022 08:17:37 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

28292
i6.liadm.com/s/ Frame 3AF6
Redirect Chain

https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--1NoUAg5h_r6Z13Q-A2WprL4_dMhO-eL8HBXRw
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--1NoUAg5h_r6Z13Q-A2WprL4_dMhO-eL8HBXRw&_li_chk=true&previous_uuid=65e9289e7d7043988c4b1bb6a3647903
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--1NoUAg5h_r6Z13Q-A2WprL4_dMhO-eL8HBXRw

43 B
419 B

309ms
101ms

Image
image/gif

2600:1f18:444a:4602:f850:4eec:7dd:fbc1
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--1NoUAg5h_r6Z13Q-A2WprL4_dMhO-eL8HBXRw

Protocol

HTTP/1.1

Server

2600:1f18:444a:4602:f850:4eec:7dd:fbc1 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 29 Jan 2022 08:17:38 GMT
Cache-Control: no-store
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--1NoUAg5h_r6Z13Q-A2WprL4_dMhO-eL8HBXRw
Date: Sat, 29 Jan 2022 08:17:37 GMT
Connection: keep-alive
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H2 200 1017
jadserve.postrelease.com/suid/ Frame 3AF6 43 B
428 B 343ms
100ms Image
image/gif 54.146.124.230
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/1017?vk=k-Xieb_Qg5h_r6Z13Q-A2WprL4_dPncOWlHAjCCg
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.124.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-124-230.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
server: nginx/1.12.1
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55945/ Frame 3AF6
Redirect Chain

https://pixel.advertising.com/ups/55945/sync?uid=k-xaABPwg5h_r6Z13Q-A2WprL4_dPvLuTMdukutA&_origin=1
https://pixel.advertising.com/ups/55945/sync?uid=k-xaABPwg5h_r6Z13Q-A2WprL4_dPvLuTMdukutA&_origin=1&verify=true
https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-xaABPwg5h_r6Z13Q-A2WprL4_dPvLuTMdukutA&_origin=1&apid=UPeb5df869-80db-11ec-9a03-02aec6d80f0c

0
343 B

11ms
10ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-xaABPwg5h_r6Z13Q-A2WprL4_dPvLuTMdukutA&_origin=1&apid=UPeb5df869-80db-11ec-9a03-02aec6d80f0c

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.0.33 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
server: ATS/9.1.0.33
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-xaABPwg5h_r6Z13Q-A2WprL4_dPvLuTMdukutA&_origin=1&apid=UPeb5df869-80db-11ec-9a03-02aec6d80f0c
date: Sat, 29 Jan 2022 08:17:37 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 sync
criteo-partners.tremorhub.com/ Frame 3AF6 43 B
183 B 295ms
99ms Image
image/gif 2600:1f18:612b:4264:c62f:533:271f:3e7e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-partners.tremorhub.com/sync?UICR=k-WeVswAg5h_r6Z13Q-A2WprL4_dNNyH54p7yGkA
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4264:c62f:533:271f:3e7e Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H/1.1

200
OK

empty.gif
cdn.stickyadstv.com/one-shot/ Frame 3AF6
Redirect Chain

https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-ZNqqdwg5h_r6Z13Q-A2WprL4_dOV8YuzrsrD4A&redirectId=69
https://cdn.stickyadstv.com/one-shot/empty.gif?

43 B
438 B

129ms
15ms

Image
image/gif

2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.stickyadstv.com/one-shot/empty.gif?
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Server: 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 29 Jan 2022 08:17:37 GMT
Last-Modified: Thu, 28 Feb 2013 15:45:35 GMT
ETag: "1362066335"
X-HW: 1643444257.dop140.am5.t,1643444257.cds155.am5.shn,1643444257.cds155.am5.c
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=7200
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 43

Redirect headers

Pragma: no-cache
Date: Sat, 29 Jan 2022 08:17:37 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cdn.stickyadstv.com/one-shot/empty.gif?
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1643444257672004-517
Expires: Sat, 29 Jan 2022 08:17:37 GMT

GET
H2 200 sync
sync-criteo.ads.yieldmo.com/ Frame 3AF6 43 B
219 B 320ms
102ms Image
image/gif 34.200.184.86
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-criteo.ads.yieldmo.com/sync?id=k-M1grUgg5h_r6Z13Q-A2WprL4_dP7RI78dsrOrQ&pn_id=criteo&ext=1
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.184.86 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-184-86.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Sat, 29 Jan 2022 08:17:37 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H/1.1 204
No Content /
partner.mediawallahscript.com/ Frame 3AF6 0
638 B 42ms
42ms Image
text/plain 34.254.114.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-YBQ_HAg5h_r6Z13Q-A2WprL4_dPVEJ-N6WJFOA&custom=&tag_format=img&tag_action=sync&custom=&cb=dfec1da9-4412-4278-a14c-be92d75831f4
Requested by: Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.114.92 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-114-92.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 29 Jan 2022 08:17:37 GMT
Cache-Control: private, no-cache, must-revalidate, no-store, max-age=0
Server: nginx/1.18.0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 204 v1
ads.yahoo.com/cms/ Frame 3AF6 0
17 B 21ms
21ms Image
text/plain 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~7315a025058f3128185459bfaf16e164414683fc&nwid=10000545908&sigv=1

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 08:17:37 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58301/ Frame 3AF6 0
18 B 13ms
10ms Image
text/plain 18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-xVFUWgg5h_r6Z13Q-A2WprL4_dP_VFaVkfbWGw

Requested by

Host: employeeretentioncredit.business
URL: https://employeeretentioncredit.business/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS