urlscan.io logo urlscan.io
SecurityTrails logo

leroymerlin.bloomflow.com Open in urlscan Pro
51.68.224.235  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://leroymerlin.bloomflow.com/
Effective URL: https://leroymerlin.bloomflow.com/
Submission: On February 08 via manual from ES — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 30 HTTP transactions. The main IP is 51.68.224.235, located in France and belongs to OVH, FR. The main domain is leroymerlin.bloomflow.com.
TLS certificate: Issued by R3 on December 25th 2022. Valid for: 3 months.
This is the only time leroymerlin.bloomflow.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 30 51.68.224.235 16276 (OVH)
1 2600:9000:225... 16509 (AMAZON-02)
30 2
Domain Requested by
24 leroymerlin.bloomflow.com 1 redirects leroymerlin.bloomflow.com
6 api.leroymerlin.bloomflow.com leroymerlin.bloomflow.com
1 assets.startupflow.io
30 3

This site contains no links.

Subject Issuer Validity Valid
leroymerlin.infra.startupflow.io
R3		 2022-12-25 -
2023-03-25		 3 months crt.sh
assets.startupflow.io
Amazon		 2022-10-16 -
2023-11-13		 a year crt.sh

This page contains 1 frames:

Primary Page: https://leroymerlin.bloomflow.com/
Frame ID: C335EACAFA63991938AD1A98C68F59BF
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Leroy Merlin bloomflow

Page URL History Show full URLs

  1. http://leroymerlin.bloomflow.com/ HTTP 301
    https://leroymerlin.bloomflow.com/ Page URL

Page Statistics

30
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

3549 kB
Transfer

11085 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://leroymerlin.bloomflow.com/ HTTP 301
    https://leroymerlin.bloomflow.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
leroymerlin.bloomflow.com/
Redirect Chain
  • http://leroymerlin.bloomflow.com/
  • https://leroymerlin.bloomflow.com/
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
3d3fb5ab9a6b61ad579449e807f033ed68c8deaa10db6d5b9d8b23d721b518ba
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com ALLOW-FROM https://youtube.com ALLOW-FROM https://vimeo.com ALLOW-FROM https://vars.hotjar.com DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

cache-control
max-age=0 no-cache
content-encoding
gzip
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-type
text/html
date
Wed, 08 Feb 2023 08:15:55 GMT
etag
W/"63dc1408-42d"
expires
Wed, 08 Feb 2023 08:15:55 GMT
last-modified
Thu, 02 Feb 2023 19:50:32 GMT
permissions-policy
fullscreen=*
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM https://www.youtube.com ALLOW-FROM https://youtube.com ALLOW-FROM https://vimeo.com ALLOW-FROM https://vars.hotjar.com DENY
x-xss-protection
1; mode=block

Redirect headers

Connection
keep-alive
Content-Length
162
Content-Type
text/html
Date
Wed, 08 Feb 2023 08:15:55 GMT
Location
https://leroymerlin.bloomflow.com/
Server
nginx
styles.b29b8c267e6dd115b37f.css
leroymerlin.bloomflow.com/ 		118 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/styles.b29b8c267e6dd115b37f.css
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
c5be5d361e952d87fe5cecd810d189c9b51403edae96a44883c13d2d78786bd9
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:55 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:47:54 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc136a-1d9b1"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
text/css
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
runtime-es2017.bf359af94241ae6a9624.js
leroymerlin.bloomflow.com/ 		13 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
9b0158c91e1d655e17ea3653ebb0398df2e0c2bf3bed870876e08d29ec621077
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://leroymerlin.bloomflow.com/
Origin
https://leroymerlin.bloomflow.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:55 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:47:57 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc136d-3483"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
polyfills-es2017.8aaeac78768c0a34b8dd.js
leroymerlin.bloomflow.com/ 		240 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/polyfills-es2017.8aaeac78768c0a34b8dd.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
f3c4a9dc12b74573bae9f457526707f5e2b346f6a723fb17b436442c36a4b3b2
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://leroymerlin.bloomflow.com/
Origin
https://leroymerlin.bloomflow.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:55 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:48:02 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc1372-3be0e"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
scripts.04a90b5e689abe97fe15.js
leroymerlin.bloomflow.com/ 		72 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/scripts.04a90b5e689abe97fe15.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
b87612005a10392f9c28bede4254b7a85e4ca4bfd207b9d836e654ed26bef219
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:55 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:47:54 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc136a-12112"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
main-es2017.7a67fee2000fe9928e32.js
leroymerlin.bloomflow.com/ 		8 MB
2 MB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/main-es2017.7a67fee2000fe9928e32.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
e7b6c1511c41dad47b1972d60656ef986b30cea732c568dc834e6ec7d375267d
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://leroymerlin.bloomflow.com/
Origin
https://leroymerlin.bloomflow.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:55 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 20:05:40 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc1794-82cd95"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
config
api.leroymerlin.bloomflow.com/api/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.leroymerlin.bloomflow.com/api/config
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx / Express
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,startupflow-client,startupflow-client-version
Access-Control-Request-Method
GET
Origin
https://leroymerlin.bloomflow.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,startupflow-client,startupflow-client-version
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin
https://leroymerlin.bloomflow.com
access-control-expose-headers
Content-Disposition
access-control-max-age
86400
date
Wed, 08 Feb 2023 08:15:56 GMT
server
nginx
strict-transport-security
max-age=63072000
vary
Origin, Access-Control-Request-Headers
x-powered-by
Express
config
api.leroymerlin.bloomflow.com/api/ 		36 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.leroymerlin.bloomflow.com/api/config
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/polyfills-es2017.8aaeac78768c0a34b8dd.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
e7d55a0087b36006f75f0c53f537eb06f11c41eac696207f549e49b8528962dc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json
Startupflow-Client
webapp
Referer
https://leroymerlin.bloomflow.com/
Startupflow-Client-Version
4.20.0
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63072000
server
nginx
etag
W/"90e4-j30tThwGteki2gysveP1siNitn8"
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
https://leroymerlin.bloomflow.com
access-control-expose-headers
Content-Disposition
access-control-allow-credentials
true
x-xss-protection
1; mode=block
maintenance-status
api.leroymerlin.bloomflow.com/api/config/ 		63 B
433 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.leroymerlin.bloomflow.com/api/config/maintenance-status
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/polyfills-es2017.8aaeac78768c0a34b8dd.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
6e35a89cf16858e68fc3b36adf36e0c1f65a9f5e955e8a560b7d9a816b73f881
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json
Startupflow-Client
webapp
Referer
https://leroymerlin.bloomflow.com/
Startupflow-Client-Version
4.20.0
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
server
nginx
etag
W/"3f-uOw6Ax/anINeHVpk8WVSQoqYtE0"
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
https://leroymerlin.bloomflow.com
access-control-expose-headers
Content-Disposition
access-control-allow-credentials
true
content-length
63
x-xss-protection
1; mode=block
maintenance-status
api.leroymerlin.bloomflow.com/api/config/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.leroymerlin.bloomflow.com/api/config/maintenance-status
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx / Express
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,startupflow-client,startupflow-client-version
Access-Control-Request-Method
GET
Origin
https://leroymerlin.bloomflow.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,startupflow-client,startupflow-client-version
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin
https://leroymerlin.bloomflow.com
access-control-expose-headers
Content-Disposition
access-control-max-age
86400
date
Wed, 08 Feb 2023 08:15:56 GMT
server
nginx
strict-transport-security
max-age=63072000
vary
Origin, Access-Control-Request-Headers
x-powered-by
Express
i18n1-es2017.a10528da4b0d9d66668e.js
leroymerlin.bloomflow.com/ 		273 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/i18n1-es2017.a10528da4b0d9d66668e.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
b954509da7a3da05e053a33af077491038fa490d18dbd08a4734ff922e4551e0
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:48:08 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc1378-442b8"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
default-src_app_shared_filters_countries-filter_countries-filter_module_ts-src_app_shared_ite-36e390-es2017.6b852936d230119d0e78.js
leroymerlin.bloomflow.com/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/default-src_app_shared_filters_countries-filter_countries-filter_module_ts-src_app_shared_ite-36e390-es2017.6b852936d230119d0e78.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
3114bd3a678be4369d9671d0454712314221aa95a48d471125acd9b26ea6f40c
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:49:00 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc13ac-49d6"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
default-node_modules_rxjs__esm2015_internal_observable_interval_js-src_app_shared_filters_fil-cb51cd-es2017.7830c2d75818f1e65dd8.js
leroymerlin.bloomflow.com/ 		39 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/default-node_modules_rxjs__esm2015_internal_observable_interval_js-src_app_shared_filters_fil-cb51cd-es2017.7830c2d75818f1e65dd8.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
33d9573c1294624c9225b1af30aa14f149a956bc132a1d699d14a05172e2d723
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:49:02 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc13ae-9b7d"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
common-es2017.5ad3b7218750d7b6271c.js
leroymerlin.bloomflow.com/ 		34 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/common-es2017.5ad3b7218750d7b6271c.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
08b28eadf2c11f5746c556a6d29054794278320c2df39f89e55ad364e1e8f79f
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:49:22 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc13c2-89dc"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
src_app_pages_auth_auth_module_ts-es2017.bd7213c32e78ff75a397.js
leroymerlin.bloomflow.com/ 		56 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/src_app_pages_auth_auth_module_ts-es2017.bd7213c32e78ff75a397.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
fceaa23faff1f135453b2e0713b8b82d9f45f481112908547e979ab33a13738f
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:48:10 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc137a-e039"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
default-src_app_pages_startupform_startupform_module_ts-es2017.f9f0d95b3f1bee17fff6.js
leroymerlin.bloomflow.com/ 		68 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/default-src_app_pages_startupform_startupform_module_ts-es2017.f9f0d95b3f1bee17fff6.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
5a01b6d792496e5c469e889150229e531c6f13dda3398dcfc7b9dadfcc8d28fb
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:49:06 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc13b2-1115a"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
default-src_app_shared_dynamic-components_dynamic-components_module_ts-es2017.43352d3838721a7954b7.js
leroymerlin.bloomflow.com/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/default-src_app_shared_dynamic-components_dynamic-components_module_ts-es2017.43352d3838721a7954b7.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
b92530abb25d058542999cad30c2108cf2a77e48ce2b9c95eba3983a32fcb042
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:49:06 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc13b2-41af"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
default-src_app_pages_startupflow_tools_application-portal_services_application-portal_service_ts-es2017.64448a4e42adeeb55990.js
leroymerlin.bloomflow.com/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/default-src_app_pages_startupflow_tools_application-portal_services_application-portal_service_ts-es2017.64448a4e42adeeb55990.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
01dbece7e140f7e470fd18ea310aa2fbf09deee3e2a78e2509641af973be9840
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:49:19 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc13bf-2d35"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
src_app_pages_application-form_application-form_module_ts-es2017.910b200a085ce463aee3.js
leroymerlin.bloomflow.com/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/src_app_pages_application-form_application-form_module_ts-es2017.910b200a085ce463aee3.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
317c486a50c63b0898a77f953caf7f60e51bafae212997b15584d73a9c8af576
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:48:12 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc137c-60c6"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
src_app_pages_external-need-form_external-need-form_module_ts-es2017.acd0f78d3d8d8847e3bd.js
leroymerlin.bloomflow.com/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/src_app_pages_external-need-form_external-need-form_module_ts-es2017.acd0f78d3d8d8847e3bd.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
b0dd0e87e2116f53e00f6253c42c465b037cfe26a3b877c1aa370684eacaf513
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:48:11 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc137b-2123"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
src_app_components_assets_i18n_fr_json-es2017.4c7ed0815aa03a058cf2.js
leroymerlin.bloomflow.com/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/src_app_components_assets_i18n_fr_json-es2017.4c7ed0815aa03a058cf2.js
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/runtime-es2017.bf359af94241ae6a9624.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
b561a3112694bb54525caa8134e852dfacd181e6901662758e892d7e13f2d758
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:48:03 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
content-encoding
gzip
etag
W/"63dc1373-21c4"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
application/javascript
permissions-policy
fullscreen=*
x-xss-protection
1; mode=block
hinted-WorkSans-Medium.woff2
leroymerlin.bloomflow.com/assets/fonts/ 		56 KB
57 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://leroymerlin.bloomflow.com/assets/fonts/hinted-WorkSans-Medium.woff2
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/styles.b29b8c267e6dd115b37f.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
21564db91c7d847f2daf4595f7bf22a12dbc853f28dee5269e1a7c5ca4045d64
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://leroymerlin.bloomflow.com/styles.b29b8c267e6dd115b37f.css
Origin
https://leroymerlin.bloomflow.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:50:32 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
etag
"63dc1408-e1b4"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
font/woff2
permissions-policy
fullscreen=*
accept-ranges
bytes
content-length
57780
x-xss-protection
1; mode=block
logo-leroymerlin.png
assets.startupflow.io/logos/ 		51 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.startupflow.io/logos/logo-leroymerlin.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:2600:c:2d50:3f80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ed047c0f18e2f40af43ebe0e35a4af81d1ff27178b21e412f8c1326ec049ef16

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-amz-version-id
null
date
Wed, 08 Feb 2023 08:15:57 GMT
via
1.1 1b3f5dc0b3c577dc5e7394bf12aed238.cloudfront.net (CloudFront)
last-modified
Wed, 16 Jun 2021 09:13:40 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P2
etag
"e94ba92281c659062c2d18a72116d544"
x-cache
RefreshHit from cloudfront
content-type
image/png
content-length
52236
x-amz-cf-id
ookPenMvbXq_SO_B59bUg6fPdGZspLexWJfVVKG6dL-0AqyKd18eNg==
bloomflow_logo.png
leroymerlin.bloomflow.com/assets/illustrations/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://leroymerlin.bloomflow.com/assets/illustrations/bloomflow_logo.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
6d44749b081e410e6954f5191d0cd0217ea500cc477400bcafedd11168482071
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:50:32 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
etag
"63dc1408-3535"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
image/png
permissions-policy
fullscreen=*
accept-ranges
bytes
content-length
13621
x-xss-protection
1; mode=block
product_pilar_1.png
leroymerlin.bloomflow.com/assets/illustrations/login/ 		481 KB
482 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://leroymerlin.bloomflow.com/assets/illustrations/login/product_pilar_1.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
22679f658d289f574cf183a0946c8ffee4346fd5e312e1897cfa3d842e578b60
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:50:32 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
etag
"63dc1408-782d9"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
image/png
permissions-policy
fullscreen=*
accept-ranges
bytes
content-length
492249
x-xss-protection
1; mode=block
product_pilar_2.png
leroymerlin.bloomflow.com/assets/illustrations/login/ 		430 KB
431 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://leroymerlin.bloomflow.com/assets/illustrations/login/product_pilar_2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
21d9c7cabc16c1c0078f2269df5872823097acd6149a0cb81be0fd3a35936b28
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:50:32 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
etag
"63dc1408-6b62e"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
image/png
permissions-policy
fullscreen=*
accept-ranges
bytes
content-length
439854
x-xss-protection
1; mode=block
product_pilar_3.png
leroymerlin.bloomflow.com/assets/illustrations/login/ 		350 KB
351 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://leroymerlin.bloomflow.com/assets/illustrations/login/product_pilar_3.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
320ca373b7f848cc08179f8435cc3040ee8f1d8ba9749e865d0024a044f970c2
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:50:32 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
etag
"63dc1408-577a7"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
image/png
permissions-policy
fullscreen=*
accept-ranges
bytes
content-length
358311
x-xss-protection
1; mode=block
product_pilar_4.png
leroymerlin.bloomflow.com/assets/illustrations/login/ 		294 KB
295 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://leroymerlin.bloomflow.com/assets/illustrations/login/product_pilar_4.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
97a863e663d8b7b4a570b1d57b5fcb2f71c6e9b4d3daa7f8e6f424c6b631589e
Security Headers
Name Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://leroymerlin.bloomflow.com/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 Feb 2023 19:50:32 GMT
server
nginx
content-security-policy
frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
etag
"63dc1408-49983"
x-frame-options
ALLOW-FROM https://www.youtube.com, ALLOW-FROM https://youtube.com, ALLOW-FROM https://vimeo.com, ALLOW-FROM https://vars.hotjar.com, DENY
content-type
image/png
permissions-policy
fullscreen=*
accept-ranges
bytes
content-length
301443
x-xss-protection
1; mode=block
actions
api.leroymerlin.bloomflow.com/api/ 		560 B
932 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.leroymerlin.bloomflow.com/api/actions
Requested by
Host: leroymerlin.bloomflow.com
URL: https://leroymerlin.bloomflow.com/polyfills-es2017.8aaeac78768c0a34b8dd.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx /
Resource Hash
f1ddb8f756583b50fe5e5212442b7081e004c66226c7df0bd38e597e19a1b406
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json
Startupflow-Client
webapp
Referer
https://leroymerlin.bloomflow.com/
Startupflow-Client-Version
4.20.0
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 08 Feb 2023 08:15:56 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
server
nginx
etag
W/"230-vtSfEPOjDF6I592VihL8+mK1K0M"
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
https://leroymerlin.bloomflow.com
access-control-expose-headers
Content-Disposition
access-control-allow-credentials
true
content-length
560
x-xss-protection
1; mode=block
actions
api.leroymerlin.bloomflow.com/api/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.leroymerlin.bloomflow.com/api/actions
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.224.235 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-007fcb9d.vps.ovh.net
Software
nginx / Express
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,startupflow-client,startupflow-client-version
Access-Control-Request-Method
POST
Origin
https://leroymerlin.bloomflow.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,startupflow-client,startupflow-client-version
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin
https://leroymerlin.bloomflow.com
access-control-expose-headers
Content-Disposition
access-control-max-age
86400
date
Wed, 08 Feb 2023 08:15:56 GMT
server
nginx
strict-transport-security
max-age=63072000
vary
Origin, Access-Control-Request-Headers
x-powered-by
Express

Verdicts & Comments Add Verdict or Comment

163 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange object| webpackChunksflow_flamingo function| setImmediate function| clearImmediate boolean| __Zone_disable_requestAnimationFrame object| __zone_symbol__UNPATCHED_EVENTS function| Zone function| __zone_symbol__Promise function| __zone_symbol__fetch object| __zone_symbol__BLACK_LISTED_EVENTS function| __zone_symbol__queueMicrotask function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__setImmediate function| __zone_symbol__clearImmediate function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader boolean| __zone_symbol__ononsearchpatched boolean| __zone_symbol__ononappinstalledpatched boolean| __zone_symbol__ononbeforeinstallpromptpatched boolean| __zone_symbol__ononbeforexrselectpatched boolean| __zone_symbol__ononabortpatched boolean| __zone_symbol__ononbeforeinputpatched boolean| __zone_symbol__ononblurpatched boolean| __zone_symbol__ononcancelpatched boolean| __zone_symbol__ononcanplaypatched boolean| __zone_symbol__ononcanplaythroughpatched boolean| __zone_symbol__ononchangepatched boolean| __zone_symbol__ononclickpatched boolean| __zone_symbol__ononclosepatched boolean| __zone_symbol__ononcontextlostpatched boolean| __zone_symbol__ononcontextmenupatched boolean| __zone_symbol__ononcontextrestoredpatched boolean| __zone_symbol__ononcuechangepatched boolean| __zone_symbol__onondblclickpatched boolean| __zone_symbol__onondragpatched boolean| __zone_symbol__onondragendpatched boolean| __zone_symbol__onondragenterpatched boolean| __zone_symbol__onondragleavepatched boolean| __zone_symbol__onondragoverpatched boolean| __zone_symbol__onondragstartpatched boolean| __zone_symbol__onondroppatched boolean| __zone_symbol__onondurationchangepatched boolean| __zone_symbol__ononemptiedpatched boolean| __zone_symbol__ononendedpatched boolean| __zone_symbol__ononerrorpatched boolean| __zone_symbol__ononfocuspatched boolean| __zone_symbol__ononformdatapatched boolean| __zone_symbol__ononinputpatched boolean| __zone_symbol__ononinvalidpatched boolean| __zone_symbol__ononkeydownpatched boolean| __zone_symbol__ononkeypresspatched boolean| __zone_symbol__ononkeyuppatched boolean| __zone_symbol__ononloadpatched boolean| __zone_symbol__ononloadeddatapatched boolean| __zone_symbol__ononloadedmetadatapatched boolean| __zone_symbol__ononloadstartpatched boolean| __zone_symbol__ononmousedownpatched boolean| __zone_symbol__ononmouseenterpatched boolean| __zone_symbol__ononmouseleavepatched boolean| __zone_symbol__ononmousemovepatched boolean| __zone_symbol__ononmouseoutpatched boolean| __zone_symbol__ononmouseoverpatched boolean| __zone_symbol__ononmouseuppatched boolean| __zone_symbol__ononmousewheelpatched boolean| __zone_symbol__ononpausepatched boolean| __zone_symbol__ononplaypatched boolean| __zone_symbol__ononplayingpatched boolean| __zone_symbol__ononprogresspatched boolean| __zone_symbol__ononratechangepatched boolean| __zone_symbol__ononresetpatched boolean| __zone_symbol__ononresizepatched boolean| __zone_symbol__ononscrollpatched boolean| __zone_symbol__ononsecuritypolicyviolationpatched boolean| __zone_symbol__ononseekedpatched boolean| __zone_symbol__ononseekingpatched boolean| __zone_symbol__ononselectpatched boolean| __zone_symbol__ononslotchangepatched boolean| __zone_symbol__ononstalledpatched boolean| __zone_symbol__ononsubmitpatched boolean| __zone_symbol__ononsuspendpatched boolean| __zone_symbol__onontimeupdatepatched boolean| __zone_symbol__onontogglepatched boolean| __zone_symbol__ononvolumechangepatched boolean| __zone_symbol__ononwaitingpatched boolean| __zone_symbol__ononwebkitanimationendpatched boolean| __zone_symbol__ononwebkitanimationiterationpatched boolean| __zone_symbol__ononwebkitanimationstartpatched boolean| __zone_symbol__ononwebkittransitionendpatched boolean| __zone_symbol__ononwheelpatched boolean| __zone_symbol__ononauxclickpatched boolean| __zone_symbol__onongotpointercapturepatched boolean| __zone_symbol__ononlostpointercapturepatched boolean| __zone_symbol__ononpointerdownpatched boolean| __zone_symbol__ononpointermovepatched boolean| __zone_symbol__ononpointerrawupdatepatched boolean| __zone_symbol__ononpointeruppatched boolean| __zone_symbol__ononpointercancelpatched boolean| __zone_symbol__ononpointeroverpatched boolean| __zone_symbol__ononpointeroutpatched boolean| __zone_symbol__ononpointerenterpatched boolean| __zone_symbol__ononpointerleavepatched boolean| __zone_symbol__ononselectstartpatched boolean| __zone_symbol__ononselectionchangepatched boolean| __zone_symbol__ononanimationendpatched boolean| __zone_symbol__ononanimationiterationpatched boolean| __zone_symbol__ononanimationstartpatched boolean| __zone_symbol__onontransitionrunpatched boolean| __zone_symbol__onontransitionstartpatched boolean| __zone_symbol__onontransitionendpatched boolean| __zone_symbol__onontransitioncancelpatched boolean| __zone_symbol__ononafterprintpatched boolean| __zone_symbol__ononbeforeprintpatched boolean| __zone_symbol__ononbeforeunloadpatched boolean| __zone_symbol__ononhashchangepatched boolean| __zone_symbol__ononlanguagechangepatched boolean| __zone_symbol__ononmessagepatched boolean| __zone_symbol__ononmessageerrorpatched boolean| __zone_symbol__ononofflinepatched boolean| __zone_symbol__onononlinepatched boolean| __zone_symbol__ononpagehidepatched boolean| __zone_symbol__ononpageshowpatched boolean| __zone_symbol__ononpopstatepatched boolean| __zone_symbol__ononrejectionhandledpatched boolean| __zone_symbol__ononstoragepatched boolean| __zone_symbol__ononunhandledrejectionpatched boolean| __zone_symbol__ononunloadpatched boolean| __zone_symbol__onondevicemotionpatched boolean| __zone_symbol__onondeviceorientationpatched boolean| __zone_symbol__onondeviceorientationabsolutepatched boolean| __zone_symbol__ononbeforematchpatched boolean| __zone_symbol__ononcontentvisibilityautostatechangepatched object| global function| _ function| saveAs object| FileSaver object| __SENTRY__ function| Mousetrap function| __zone_symbol__ON_PROPERTYerror object| __zone_symbol__errorfalse function| __zone_symbol__ON_PROPERTYunhandledrejection object| __zone_symbol__unhandledrejectionfalse function| Color function| Chart object| __zone_symbol__popstatefalse object| __zone_symbol__hashchangefalse function| getAngularTestability function| getAllAngularTestabilities function| getAllAngularRootElements object| frameworkStabilizers function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener undefined| __zone_symbol__eventListeners undefined| __zone_symbol__removeAllListeners function| eventListeners function| removeAllListeners

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-src https://www.youtube.com https://www.dailymotion.com https://player.vimeo.com https://*.crisp.chat; style-src 'unsafe-inline' 'self' https://*.crisp.chat; script-src 'self' https://*.crisp.chat; object-src 'none'
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://www.youtube.com ALLOW-FROM https://youtube.com ALLOW-FROM https://vimeo.com ALLOW-FROM https://vars.hotjar.com DENY
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.leroymerlin.bloomflow.com
assets.startupflow.io
leroymerlin.bloomflow.com
2600:9000:2250:2600:c:2d50:3f80:93a1
51.68.224.235
01dbece7e140f7e470fd18ea310aa2fbf09deee3e2a78e2509641af973be9840
08b28eadf2c11f5746c556a6d29054794278320c2df39f89e55ad364e1e8f79f
21564db91c7d847f2daf4595f7bf22a12dbc853f28dee5269e1a7c5ca4045d64
21d9c7cabc16c1c0078f2269df5872823097acd6149a0cb81be0fd3a35936b28
22679f658d289f574cf183a0946c8ffee4346fd5e312e1897cfa3d842e578b60
3114bd3a678be4369d9671d0454712314221aa95a48d471125acd9b26ea6f40c
317c486a50c63b0898a77f953caf7f60e51bafae212997b15584d73a9c8af576
320ca373b7f848cc08179f8435cc3040ee8f1d8ba9749e865d0024a044f970c2
33d9573c1294624c9225b1af30aa14f149a956bc132a1d699d14a05172e2d723
3d3fb5ab9a6b61ad579449e807f033ed68c8deaa10db6d5b9d8b23d721b518ba
5a01b6d792496e5c469e889150229e531c6f13dda3398dcfc7b9dadfcc8d28fb
6d44749b081e410e6954f5191d0cd0217ea500cc477400bcafedd11168482071
6e35a89cf16858e68fc3b36adf36e0c1f65a9f5e955e8a560b7d9a816b73f881
97a863e663d8b7b4a570b1d57b5fcb2f71c6e9b4d3daa7f8e6f424c6b631589e
9b0158c91e1d655e17ea3653ebb0398df2e0c2bf3bed870876e08d29ec621077
b0dd0e87e2116f53e00f6253c42c465b037cfe26a3b877c1aa370684eacaf513
b561a3112694bb54525caa8134e852dfacd181e6901662758e892d7e13f2d758
b87612005a10392f9c28bede4254b7a85e4ca4bfd207b9d836e654ed26bef219
b92530abb25d058542999cad30c2108cf2a77e48ce2b9c95eba3983a32fcb042
b954509da7a3da05e053a33af077491038fa490d18dbd08a4734ff922e4551e0
c5be5d361e952d87fe5cecd810d189c9b51403edae96a44883c13d2d78786bd9
e7b6c1511c41dad47b1972d60656ef986b30cea732c568dc834e6ec7d375267d
e7d55a0087b36006f75f0c53f537eb06f11c41eac696207f549e49b8528962dc
ed047c0f18e2f40af43ebe0e35a4af81d1ff27178b21e412f8c1326ec049ef16
f1ddb8f756583b50fe5e5212442b7081e004c66226c7df0bd38e597e19a1b406
f3c4a9dc12b74573bae9f457526707f5e2b346f6a723fb17b436442c36a4b3b2
fceaa23faff1f135453b2e0713b8b82d9f45f481112908547e979ab33a13738f