action.cair.com Open in urlscan Pro
13.32.99.77 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://action.cair.com/a/gazaunderattack
Submission: On October 19 via manual (October 19th 2023, 8:17:46 pm UTC) from US — Scanned from DE

Summary HTTP 27 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 9 domains to perform 27 HTTP transactions. The main IP is 13.32.99.77, located in United States and belongs to AMAZON-02, US. The main domain is action.cair.com.
TLS certificate: Issued by Amazon RSA 2048 M02 on February 28th 2023. Valid for: a year.

This is the only time action.cair.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	13.32.99.77 13.32.99.77	16509 (AMAZON-02) (AMAZON-02)
5	2600:9000:249... 2600:9000:2490:7a00:3:1d53:4780:93a1	16509 (AMAZON-02) (AMAZON-02)
3	20.60.58.97 20.60.58.97	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	143.204.98.103 143.204.98.103	16509 (AMAZON-02) (AMAZON-02)
1	2606:2800:133... 2606:2800:133:206e:1315:22a5:2006:24fd	15133 (EDGECAST) (EDGECAST)
9	45.60.33.183 45.60.33.183	19551 (INCAPSULA) (INCAPSULA)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
2	13.69.106.216 13.69.106.216	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
27	10

4 13.32.99.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-77.fra60.r.cloudfront.net

action.cair.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:2490:7a00:3:1d53:4780:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.everyaction.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.60.58.97 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

nvlupin.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-103.fra50.r.cloudfront.net

js.verygoodvault.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:133:206e:1315:22a5:2006:24fd (United States)

ASN15133 (EDGECAST, US)

az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 45.60.33.183 (United States)

ASN19551 (INCAPSULA, US)

profile.ngpvan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
advocator.ngpvan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fastaction.ngpvan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.everyaction.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.69.106.216 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	everyaction.com static.everyaction.com — Cisco Umbrella Rank: 111227 secure.everyaction.com — Cisco Umbrella Rank: 88806	434 KB
4	ngpvan.com profile.ngpvan.com — Cisco Umbrella Rank: 76744 advocator.ngpvan.com — Cisco Umbrella Rank: 426898 fastaction.ngpvan.com — Cisco Umbrella Rank: 154035	9 KB
4	cair.com action.cair.com	25 KB
3	windows.net nvlupin.blob.core.windows.net — Cisco Umbrella Rank: 99828	243 KB
2	visualstudio.com dc.services.visualstudio.com — Cisco Umbrella Rank: 902	281 B
1	gstatic.com fonts.gstatic.com	24 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 49	921 B
1	msecnd.net az416426.vo.msecnd.net — Cisco Umbrella Rank: 2552	47 KB
1	verygoodvault.com js.verygoodvault.com — Cisco Umbrella Rank: 40730	44 KB
27	9

	Domain	Requested by
5	secure.everyaction.com	static.everyaction.com action.cair.com secure.everyaction.com
5	static.everyaction.com	action.cair.com static.everyaction.com
4	action.cair.com	action.cair.com
3	nvlupin.blob.core.windows.net	action.cair.com secure.everyaction.com
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
2	profile.ngpvan.com	static.everyaction.com az416426.vo.msecnd.net
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	secure.everyaction.com
1	fastaction.ngpvan.com	az416426.vo.msecnd.net
1	advocator.ngpvan.com	az416426.vo.msecnd.net
1	az416426.vo.msecnd.net	action.cair.com
1	js.verygoodvault.com	action.cair.com
27	12

This site contains links to these domains. Also see Links.

Domain
bush.house.gov
www.youtube.com
fastaction.ngpvan.com
www.everyaction.com

Subject Issuer	Validity	Valid
cair-oa.edge.targetedaction.net Amazon RSA 2048 M02	`2023-02-28` - `2024-01-22`	a year	crt.sh
static.everyaction.com Amazon RSA 2048 M02	`2023-05-09` - `2024-06-06`	a year	crt.sh
*.blob.core.windows.net Microsoft Azure TLS Issuing CA 02	`2023-08-17` - `2024-06-27`	10 months	crt.sh
*.verygoodvault.com Amazon RSA 2048 M02	`2023-02-28` - `2024-02-16`	a year	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2023-05-05` - `2024-04-28`	a year	crt.sh
*.ngpvan.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-12-09` - `2023-12-08`	a year	crt.sh
*.everyaction.com RapidSSL TLS ECC CA G1	`2023-03-17` - `2024-04-10`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-28` - `2023-12-21`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-28` - `2023-12-21`	3 months	crt.sh
in.applicationinsights.azure.com Microsoft Azure RSA TLS Issuing CA 03	`2023-09-02` - `2024-08-27`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://action.cair.com/a/gazaunderattack
Frame ID: 127321A4B56C296C83932659FB465FFF
Requests: 20 HTTP requests in this frame

Frame: https://secure.everyaction.com/FormProgress/g5x37EE7Lk-uFl2ifH-_aA2?formShortCode=
Frame ID: CB84C44F1B63D3F5046C796378C930C7
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Urge Your Members of Congress to Support the Ceasefire Now Resolution!

Detected technologies

Imperva (Security) Expand

Overall confidence: 100%
Detected patterns

/_Incapsula_Resource

Page Statistics

27
Requests

100 %
HTTPS

44 %
IPv6

9
Domains

12
Subdomains

10
IPs

3
Countries

826 kB
Transfer

2399 kB
Size

9
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://bush.house.gov/imo/media/doc/bushceasefirenowresolution.pdf
Title: Ceasefire Now Resolution

Search URL Search Domain Scan URL

URL: https://bush.house.gov/media/press-releases/reps-bush-tlaib-carson-lee-ramirez-lead-colleagues-in-call-for-immediate-ceasefire
Title: championed by Representatives Cori Bush, Rashida Tlaib, André Carson, Summer Lee, and Delia C. Ramirez

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=5P1weZi2Hz4
Title: participated in the joint-congressional press conference

Search URL Search Domain Scan URL

URL: https://bush.house.gov/imo/media/doc/ceasefire_now_resolution_endorsement_quotes.pdf
Title: Endorsed by CAIR and nearly 50 other organizations

Search URL Search Domain Scan URL

URL: https://fastaction.ngpvan.com/##whats-this
Title: ?

Search URL Search Domain Scan URL

URL: https://fastaction.ngpvan.com/auth/actionid_signup
Title: Sign up with your email address

Search URL Search Domain Scan URL

URL: https://fastaction.ngpvan.com/terms
Title: terms of service

Search URL Search Domain Scan URL

URL: https://fastaction.ngpvan.com/privacy
Title: privacy policy.

Search URL Search Domain Scan URL

URL: https://fastaction.ngpvan.com/auth/actionid
Title: Log in with your email address

Search URL Search Domain Scan URL

URL: http://www.everyaction.com/?utm_source=act.myngp.com&utm_medium=poweredby&utm_campaign=ngpnext
Title: EveryAction

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request gazaunderattack Show response
action.cair.com/a/ 10 KB
4 KB 3547ms
177ms Document
text/html 13.32.99.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://action.cair.com/a/gazaunderattack

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-77.fra60.r.cloudfront.net

Software

Resource Hash

f1bdde3be30d26104bdf69b800d782d45494e579b15e8e01e6fb2d4515198e92

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-expose-headers: Request-Context
cache-control: public, max-age=10
content-encoding: gzip
content-security-policy: default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
content-type: text/html; charset=utf-8
date: Thu, 19 Oct 2023 20:17:40 GMT
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3
strict-transport-security: max-age=31536000
vary: Accept-Encoding
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront)
x-amz-cf-id: iXqYb2NdSP3bxF4e-CMDXoa2kxFuIRfJP5vx4eVYGK6tIzL0q8cM2g==
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
x-cdn: Imperva
x-content-type-options: nosniff
x-iinfo: 14-42190304-42184959 2NNN RT(1697746653744 6817) q(0 0 0 0) r(1 1)
x-xss-protection: 1; mode=block

GET
H2 200 published.css
action.cair.com/Content/css/forms/ 499 B
979 B 72ms
70ms Stylesheet
text/css 13.32.99.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://action.cair.com/Content/css/forms/published.css
Requested by: Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-77.fra60.r.cloudfront.net
Software: /
Resource Hash: 5282adf860a0adb36eaa493d236cf7203c0fd5a2492af96f92dd47ad6848190f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/a/gazaunderattack
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 20:17:40 GMT
content-encoding: gzip
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront)
last-modified: Wed, 20 Sep 2023 22:50:50 GMT
x-cdn: Imperva
x-amz-cf-pop: FRA60-P3
etag: "081cfe614ecd91:0"
x-cache: Miss from cloudfront
content-type: text/css
x-iinfo: 14-8759272-0 0CNN RT(1697746645050 15715) q(0 -1 -1 0) r(0 -1)
content-length: 351
x-amz-cf-id: k0wVAXTvXxxofQLdlbDl3mQLK9RzLuomJdmtrLNekw6WvCbtbdPgQw==

GET
H2 200 at.js Show response
static.everyaction.com/ea-actiontag/ 844 KB
237 KB 148ms
45ms Script
application/javascript 2600:9000:2490:7a00:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.everyaction.com/ea-actiontag/at.js
Requested by: Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:7a00:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3d2cdf350217c0c308d7e35c1136619407e4c2af21812dbfc8508d78e344e6e

Request headers

Referer: https://action.cair.com/
Origin: https://action.cair.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 03:33:17 GMT
content-encoding: gzip
via: 1.1 bb5a1c03f2335d92378a3e68542733da.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
age: 60265
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 242193
last-modified: Tue, 10 Oct 2023 14:37:40 GMT
server: AmazonS3
etag: "084736e3f2fb6ea5ca39c9998ec3f226"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=900, s-maxage=86400, public
accept-ranges: bytes
x-amz-cf-id: mBexwYXXfX8L-5FbxKmucHQEiwceNgxxMTrRoZtEx6t-ylz31oYfmw==

GET
H2 200 at.min.css
static.everyaction.com/ea-actiontag/ 59 KB
12 KB 147ms
44ms Stylesheet
text/css 2600:9000:2490:7a00:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.everyaction.com/ea-actiontag/at.min.css
Requested by: Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:7a00:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 20e7c0f660f2d7b1bb3ed089bfd9aeaf6a163e7afac9059a142c849c40577150

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 05:20:16 GMT
content-encoding: gzip
via: 1.1 f13110b40e6214ad566c753a838f49f4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
age: 53846
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 11514
last-modified: Tue, 10 Oct 2023 14:37:39 GMT
server: AmazonS3
etag: "49f7079e91b67eee64ace81f03c5e3d4"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=900, s-maxage=86400, public
accept-ranges: bytes
x-amz-cf-id: 8bYqI5Nhw8VE8-UPrKpTzRpHlIsYucVBZYAgMBUsxxNYdEiNJIrBcA==

GET
H/1.1 200
OK CustomStylesheet_bfd520112694f23eef1fe7c94360aa3ec00e3842a6adfa38d54238150f1f77f4.css
nvlupin.blob.core.windows.net/designs/ 24 KB
25 KB 571ms
136ms Stylesheet
text/css 20.60.58.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://nvlupin.blob.core.windows.net/designs/CustomStylesheet_bfd520112694f23eef1fe7c94360aa3ec00e3842a6adfa38d54238150f1f77f4.css
Requested by: Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.60.58.97 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 2d589a633d53be2660fdaff66b1bdb23120a39f3a08e6db145e3167a325f5fd1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Thu, 19 Oct 2023 20:17:41 GMT
Last-Modified: Thu, 23 Mar 2023 12:44:40 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: t8j9iLsB8BMvbRqPbTOVxQ==
ETag: 0x8DB2B9C5E5FAEC8
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
x-ms-request-id: 04e6df56-501e-0058-1ec9-029f0e000000
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control: max-age=31536000
x-ms-version: 2009-09-19
Content-Length: 24962

GET
H/1.1 200
OK Action%20Alert-twitter.jpg
nvlupin.blob.core.windows.net/images/van/CAIR/CAIR/1/87547/images/ 192 KB
193 KB 588ms
150ms Image
image/jpeg 20.60.58.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nvlupin.blob.core.windows.net/images/van/CAIR/CAIR/1/87547/images/Action%20Alert-twitter.jpg
Requested by: Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.60.58.97 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 6bf48046c8f479cac896aae380bdc34bd9d137ee2747aa776ce291574864e210

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Thu, 19 Oct 2023 20:17:40 GMT
Last-Modified: Fri, 30 Apr 2021 16:16:44 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8D90BF3588CABAC
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
x-ms-request-id: b8c85e3d-701e-005f-39c9-02f36d000000
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
Content-Length: 196597

GET
H/1.1 200
OK vgs-collect.js Show response
js.verygoodvault.com/vgs-collect/2.18.4/ 134 KB
44 KB 181ms
49ms Script
application/javascript 143.204.98.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/2.18.4/vgs-collect.js
Requested by: Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-103.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 575b2165304d899b7001ab593aeee31b371a46aee8b899c22a87ab9313389eda

Request headers

Referer: https://action.cair.com/
Origin: https://action.cair.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

x-amz-version-id: jfBMjoXBTwBLxrf4sD.h_N_F9QJn5gdY
Content-Encoding: gzip
Via: 1.1 9eb0e845437929074828e0cf53f179ae.cloudfront.net (CloudFront)
Date: Thu, 19 Oct 2023 20:17:36 GMT
X-Amz-Cf-Pop: FRA50-C1
Age: 13
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Thu, 16 Mar 2023 10:29:55 GMT
Server: AmazonS3
ETag: W/"156be461dd96d02fce3792c020f7748a"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=60
X-Amz-Cf-Id: G_b1qmf_ZNixd0EZMbPxLnY4sCBlZtFQYEsiNeLmrS8Xe_yEwphaBA==

GET
H2 200 _Incapsula_Resource Show response
action.cair.com/ 136 KB
20 KB 66ms
66ms Script
application/javascript 13.32.99.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://action.cair.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=291983536
Requested by: Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-77.fra60.r.cloudfront.net
Software: /
Resource Hash: ef7c1557b1419ace098717079ff51165e2e3fdec319221d48d34b262ab836e78

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/a/gazaunderattack
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 20:17:41 GMT
content-encoding: gzip
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-type: application/javascript
cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 19585
x-amz-cf-id: hjdQjiAA2W74qOesHcltJPRXTNYfAWSGFABXv3TAND9bLGtMD7tYJQ==

GET
H2 200 ai.2.min.js Show response
az416426.vo.msecnd.net/scripts/b/ 120 KB
47 KB 158ms
39ms Script
text/javascript 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Requested by: Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CFD) /
Resource Hash: 6c14d731b13bcdec4325028eb0d8d2cb0190b3b1e65e0fcb52907fe6f55c2707

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 19 Oct 2023 20:17:41 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-07 00:07:47
content-md5: OTYl0s1WUyP5rZ8mTmvbyA==
age: 1726
x-cache: HIT
x-ms-meta-aijssdksrc: [cdn]/scripts/b/ai.2.8.16.min.js
content-length: 47958
x-ms-lease-status: unlocked
last-modified: Wed, 20 Sep 2023 16:12:29 GMT
server: ECAcc (frc/4CFD)
x-ms-meta-aijssdkver: 2.8.16
etag: 0x8DBB9F46341BD96
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
x-ms-request-id: b5c9d00c-101e-0007-27c5-024985000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800, immutable, no-transform
x-ms-version: 2009-09-19
expires: Thu, 19 Oct 2023 20:47:41 GMT

GET
H2 200 _Incapsula_Resource
action.cair.com/ 1 B
533 B 59ms
58ms Image
text/plain 13.32.99.77
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://action.cair.com/_Incapsula_Resource?SWKMTFSR=1&e=0.621626283951866
Requested by: Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-77.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/a/gazaunderattack
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 20:17:41 GMT
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-type: text/plain
cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 1
x-amz-cf-id: wTKEAbA5hhY3psa7VHwQWjdTalnhylME5Rnt4WyfvqdRBMWF2W1elA==

GET
H2 200 extra.min.css
static.everyaction.com/ea-actiontag/ 78 KB
14 KB 48ms
48ms Stylesheet
text/css 2600:9000:2490:7a00:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.everyaction.com/ea-actiontag/extra.min.css
Requested by: Host: static.everyaction.com
URL: https://static.everyaction.com/ea-actiontag/at.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:7a00:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: da519fa3d8d13e9b07ad93ebccc1ae4ff01b3641d183331399b35aa5bf0adf8e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 06:49:26 GMT
content-encoding: gzip
via: 1.1 f13110b40e6214ad566c753a838f49f4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
age: 48496
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 14162
last-modified: Tue, 10 Oct 2023 14:37:39 GMT
server: AmazonS3
etag: "61e901d7a6faad6f8e8d5f761e44e520"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=900, s-maxage=86400, public
accept-ranges: bytes
x-amz-cf-id: _2wkWjyyX4jIppHzY5lcvjaIT24dK3j7XJ_-z7aXK-r8PDBCV3TWuw==

GET
H2 200 identity Show response
profile.ngpvan.com/ 72 B
910 B 911ms
799ms Script
text/javascript 45.60.33.183
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://profile.ngpvan.com/identity?callback=_jqjsp

Requested by

Host: static.everyaction.com
URL: https://static.everyaction.com/ea-actiontag/at.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.33.183 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / Express, ASP.NET

Resource Hash

42b3231710e614628af4260f280d30a1450942b91a0faa31a9e4a00c64267fc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 20:17:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Microsoft-IIS/10.0
x-cdn: Imperva
etag: W/"48-iVfv1PRied4kp2c3UNraTFA6Y0k"
x-powered-by: Express, ASP.NET
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
p3p: CP="NOI ADM DEV PSAi OUR OTRo STP IND COM NAV DEM"
x-iinfo: 3-4974843-4974846 NNNN CT(155 314 0) RT(1697746660932 45) q(0 0 5 0) r(8 8) U24
x-incap-sess-cookie-hdr: PtRgBVnYpitGYdCiLXwhCuWOMWUAAAAAIFAJpmZJjNpzEfcGDty05g==
content-length: 194
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3

GET
H/1.1 200
OK ngpForm Show response
advocator.ngpvan.com/https%3a%2f%2fsecure.everyaction.com%2fv1%2fForms%2fg5x37EE7Lk-uFl2ifH-_aA2/ 14 KB
6 KB 540ms
408ms XHR
application/json 45.60.33.183
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://advocator.ngpvan.com/https%3a%2f%2fsecure.everyaction.com%2fv1%2fForms%2fg5x37EE7Lk-uFl2ifH-_aA2/ngpForm

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.33.183 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Cowboy / Express

Resource Hash

40681dc4e5ab9705749b5e24e2049b39f47c790acdac1de9d7be1ca412913d39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://action.cair.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Thu, 19 Oct 2023 20:17:41 GMT
Via: 1.1 vegur
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
X-CDN: Imperva
Content-Encoding: gzip
X-Powered-By: Express
Transfer-Encoding: chunked
X-Iinfo: 13-18797259-18797263 NNYN CT(101 105 0) RT(1697746660959 64) q(0 0 2 3) r(3 3) U4
Connection: keep-alive
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1697746661&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&s=4MxLtX6QEKU6%2BsjGsKixTLT3HusbXalciJEL32BkTrU%3D
Request-Context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3
Server: Cowboy
Etag: W/"36d2-MU/VOiPEfM8lR/F5lsr82cy5rjo"
Vary: Origin
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1697746661&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&s=4MxLtX6QEKU6%2BsjGsKixTLT3HusbXalciJEL32BkTrU%3D"}]}
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://action.cair.com
Access-Control-Allow-Credentials: true
x-incap-sess-cookie-hdr: jXhuQKBiUWFaYdCiLXwhCuWOMWUAAAAAhx/+J76CdepMUU2A+mW96w==

GET
H2 200 ngpvan-logo-16.png
static.everyaction.com/ea-actiontag/assets/images/ 617 B
1 KB 41ms
40ms Image
image/png 2600:9000:2490:7a00:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.everyaction.com/ea-actiontag/assets/images/ngpvan-logo-16.png
Requested by: Host: static.everyaction.com
URL: https://static.everyaction.com/ea-actiontag/extra.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:7a00:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2decb492a5b143c935ba3f8b6a9a1dc970335e8981fb5f42b3ee7966735eeb16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.everyaction.com/ea-actiontag/extra.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 01:13:44 GMT
via: 1.1 f13110b40e6214ad566c753a838f49f4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
age: 7412638
x-cache: Hit from cloudfront
content-length: 617
last-modified: Tue, 07 Dec 2021 15:33:44 GMT
server: AmazonS3
etag: "3d6f9aab1e809b87c195e78264cb01f8"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
x-amz-cf-id: rZQfeYPmqlpg_5kzJgACWHpNXYehA4EzN90UrcyoFuP6aiB_P3h3LQ==

GET
H2 200 identity Show response
fastaction.ngpvan.com/api/v2/ 136 B
1016 B 176ms
136ms XHR
application/json 45.60.33.183
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://fastaction.ngpvan.com/api/v2/identity

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.33.183 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / Express, ASP.NET

Resource Hash

0c8f340d72b876009fda4b161e3d3754cb7f909490362c6ce4f3243bae61301e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://action.cair.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 20:17:41 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubdomains
x-cdn: Imperva
x-powered-by: Express, ASP.NET
p3p: CP="NOI ADM DEV COM NAV OUR STP"
x-iinfo: 3-4974843-4974857 NNNY CT(87 178 0) RT(1697746660932 647) q(0 0 0 0) r(1 1) U4
content-length: 250
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3
server: Microsoft-IIS/10.0
etag: W/"88-foK5n1H59b3VGdjFrw0zMbj275g"
vary: Accept-Encoding,Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://action.cair.com
access-control-allow-credentials: true
x-incap-sess-cookie-hdr: rjzJBsGFkW4ZYtCiLXwhCuWOMWUAAAAAo1SsZG2cdbJchGXiBARPag==

GET
H2 200 g5x37EE7Lk-uFl2ifH-_aA2 Show response
secure.everyaction.com/FormProgress/ Frame CB84 1 KB
1 KB 432ms
326ms Document
text/html 45.60.33.183
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.everyaction.com/FormProgress/g5x37EE7Lk-uFl2ifH-_aA2?formShortCode=

Requested by

Host: static.everyaction.com
URL: https://static.everyaction.com/ea-actiontag/at.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.33.183 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

9e927cbdaba2a9fe14c5d729bb8f871b8422aa7cc98342028ce29b059af76d59

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://action.cair.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-expose-headers: Request-Context
cache-control: private
content-encoding: gzip
content-security-policy: default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
content-type: text/html; charset=utf-8
date: Thu, 19 Oct 2023 20:17:42 GMT
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-cdn: Imperva
x-content-type-options: nosniff
x-iinfo: 11-13777897-13777902 NNNN CT(85 86 0) RT(1697746661612 43) q(0 0 2 0) r(3 3) U2
x-incap-sess-cookie-hdr: iKr2NxMsOHhBYtCiLXwhCuWOMWUAAAAA/9mcvLLPKyq+DQ0YErRNGw==
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ 784 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe62bab84590322ae4bfcde20dfb50a72c1b68b330c2a7f1b0aefb65999f16bc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 g5x37EE7Lk-uFl2ifH-_aA2
secure.everyaction.com/v1/Track/ 0
814 B 372ms
309ms Image
text/plain 45.60.33.183
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.everyaction.com/v1/Track/g5x37EE7Lk-uFl2ifH-_aA2?formSessionId=1324ce3d-dd0c-44a3-a092-0f7f9b9a8e72&bName=chrome&dType=desktop&formVersion=10/19/2023%208:05:35%20PM|&fUrl=aHR0cHM6Ly9hY3Rpb24uY2Fpci5jb20vYS9nYXphdW5kZXJhdHRhY2s%3D&fRef=

Requested by

Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.33.183 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

expires: -1
pragma: no-cache
date: Thu, 19 Oct 2023 20:17:42 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
x-cdn: Imperva
x-frame-options: SAMEORIGIN
x-iinfo: 11-13777897-13777902 PNNN RT(1697746661612 44) q(0 0 2 2) r(3 3) U2
access-control-expose-headers: Request-Context
cache-control: no-cache
x-incap-sess-cookie-hdr: ew1ZOdx9101BYtCiLXwhCuWOMWUAAAAAtl+/ePYaIrIBlCr+AmGSlA==
content-length: 0
x-xss-protection: 1; mode=block
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3

GET
H2 200 fast-action.svg
static.everyaction.com/ea-actiontag/assets/images/ 9 KB
9 KB 49ms
48ms Image
image/svg+xml 2600:9000:2490:7a00:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.everyaction.com/ea-actiontag/assets/images/fast-action.svg
Requested by: Host: action.cair.com
URL: https://action.cair.com/a/gazaunderattack
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:7a00:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b60497a77afdcb315e270ec5f6fe3d53797c486032fc6752523aa8c65be7b985

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.cair.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 23:48:17 GMT
via: 1.1 f13110b40e6214ad566c753a838f49f4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
age: 73766
x-cache: Hit from cloudfront
content-length: 9203
last-modified: Tue, 07 Dec 2021 15:33:44 GMT
server: AmazonS3
etag: "babd47dc25531a9faeadc04f1afa1910"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: 8_ZENYFO_05s_GSOLPd--9Ll3wmYlLB8FeLrqMFr_zoq0--xGPieqQ==

GET
H2 200 nvtag Show response
profile.ngpvan.com/v2/data/Hmixt2p4Y_QR8qHotGavYK_7/ 2 B
833 B 1024ms
939ms XHR
application/json 45.60.33.183
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://profile.ngpvan.com/v2/data/Hmixt2p4Y_QR8qHotGavYK_7/nvtag
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.33.183 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / Express, ASP.NET
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://action.cair.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 20:17:42 GMT
content-encoding: gzip
server: Microsoft-IIS/10.0
x-cdn: Imperva
etag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
x-powered-by: Express, ASP.NET
vary: Origin,Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://action.cair.com
x-iinfo: 12-16485476-16485481 NNNN CT(155 318 0) RT(1697746661824 40) q(0 0 5 -1) r(9 9) U24
access-control-allow-credentials: true
x-incap-sess-cookie-hdr: 5HwgVqi2GXdGYdCiLXwhCuaOMWUAAAAAuCD6nfTIqPkPIL+cOJBehw==
content-length: 123
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3

GET
H2 200 formProgress
secure.everyaction.com/Content/css/ Frame CB84 586 KB
138 KB 396ms
395ms Stylesheet
text/css 45.60.33.183
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.everyaction.com/Content/css/formProgress?v=TED-uOqcr23Muata_FHMS_aCmYZC-zWtebhscBgOPnI1
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/FormProgress/g5x37EE7Lk-uFl2ifH-_aA2?formShortCode=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.33.183 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 0d5eb9d85e7d44c3b3baab9fb660f88c5de73083a93cd39c8ad35917b0727e2e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.everyaction.com/FormProgress/g5x37EE7Lk-uFl2ifH-_aA2?formShortCode=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 20:17:42 GMT
content-encoding: gzip
last-modified: Thu, 19 Oct 2023 13:09:06 GMT
x-cdn: Imperva
content-type: text/css; charset=utf-8
x-iinfo: 11-13777897-13768597 2VNN RT(1697746661612 377) q(0 0 0 -1) r(4 4)
access-control-expose-headers: Request-Context
cache-control: max-age=31510284, public
content-length: 140431
expires: Fri, 18 Oct 2024 13:09:06 GMT

GET
H/1.1 200
OK CustomStylesheet_bfd520112694f23eef1fe7c94360aa3ec00e3842a6adfa38d54238150f1f77f4.css
nvlupin.blob.core.windows.net/designs/ Frame CB84 24 KB
25 KB 147ms
146ms Stylesheet
text/css 20.60.58.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://nvlupin.blob.core.windows.net/designs/CustomStylesheet_bfd520112694f23eef1fe7c94360aa3ec00e3842a6adfa38d54238150f1f77f4.css
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/FormProgress/g5x37EE7Lk-uFl2ifH-_aA2?formShortCode=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.60.58.97 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 2d589a633d53be2660fdaff66b1bdb23120a39f3a08e6db145e3167a325f5fd1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.everyaction.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Thu, 19 Oct 2023 20:17:41 GMT
Last-Modified: Thu, 23 Mar 2023 12:44:40 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: t8j9iLsB8BMvbRqPbTOVxQ==
ETag: 0x8DB2B9C5E5FAEC8
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
x-ms-request-id: b8c86135-701e-005f-7ac9-02f36d000000
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control: max-age=31536000
x-ms-version: 2009-09-19
Content-Length: 24962

GET
H2 200 _Incapsula_Resource Show response
secure.everyaction.com/ Frame CB84 138 KB
20 KB 48ms
48ms Script
application/javascript 45.60.33.183
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.everyaction.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=297961081
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/FormProgress/g5x37EE7Lk-uFl2ifH-_aA2?formShortCode=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.33.183 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 45d24dd47e4c5ad1e608c0990d42d982e8b45e90f960ec0ecdb5aeb5fbdfdbf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.everyaction.com/FormProgress/g5x37EE7Lk-uFl2ifH-_aA2?formShortCode=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
x-robots-tag: noindex
content-length: 20087
content-type: application/javascript

GET
H2 200 _Incapsula_Resource
secure.everyaction.com/ Frame CB84 1 B
35 B 40ms
39ms Image
text/plain 45.60.33.183
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.everyaction.com/_Incapsula_Resource?SWKMTFSR=1&e=0.44986324042259307
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/FormProgress/g5x37EE7Lk-uFl2ifH-_aA2?formShortCode=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.33.183 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.everyaction.com/FormProgress/g5x37EE7Lk-uFl2ifH-_aA2?formShortCode=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 1
content-type: text/plain

GET
H2 200 css
fonts.googleapis.com/ Frame CB84 4 KB
921 B 285ms
66ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700,300italic,400italic,700italic

Requested by

Host: secure.everyaction.com
URL: https://secure.everyaction.com/Content/css/formProgress?v=TED-uOqcr23Muata_FHMS_aCmYZC-zWtebhscBgOPnI1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6b9f1135ba160e5dc694ad7977f6bf73d40d3c15742b14ca8910ea23bb3e6e79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.everyaction.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 19 Oct 2023 20:17:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 19 Oct 2023 18:47:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 19 Oct 2023 20:17:43 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ Frame CB84 23 KB
24 KB 129ms
41ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,300italic,400italic,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://secure.everyaction.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 04:39:37 GMT
x-content-type-options: nosniff
age: 56286
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 18 Oct 2024 04:39:37 GMT

OPTIONS
H2 200 track
dc.services.visualstudio.com/v2/ Frame 0
0 244ms
46ms Preflight 13.69.106.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.69.106.216 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,sdk-context
Access-Control-Request-Method: POST
Origin: https://action.cair.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 3600
content-length: 0
date: Thu, 19 Oct 2023 20:17:43 GMT
x-content-type-options: nosniff

POST
H2 200 track Show response
dc.services.visualstudio.com/v2/ 96 B
281 B 92ms
92ms XHR
application/json 13.69.106.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.69.106.216 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7acd994005f04a39f775d8d21a566ab63a04cc7c3bfe0f25f0ca50c069cac6b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://action.cair.com/
accept-language: de-DE,de;q=0.9
Sdk-Context: appId
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-type: application/json

Response headers

x-ms-session-id: F80903B7-E80F-4903-B609-F9A23DCAB267
strict-transport-security: max-age=31536000
date: Thu, 19 Oct 2023 20:17:43 GMT
x-content-type-options: nosniff
access-control-max-age: 3600
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length: 96

Verdicts & Comments Add Verdict or Comment

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
action.cair.com/	1970-01-20 15:36:15	Name: SessionKeyCookie Value:
action.cair.com/	1970-01-21 00:21:22	Name: ai_user Value: AiKwQzD3btrRjX7FmHy8qc\|2023-10-19T20:17:41.342Z
action.cair.com/	1970-01-20 15:35:46	Name: ___utmvc Value: UB3K3O5Iyh+Iin6ULQsTS0v/oRoSkqODQpEv2fqM1zJWnuUtPeSrm41xBusjeyOi/zP3gK/jLR/VCXwZq16p4besv8EmFlrCaHJsv9xDxwTdyD7q+c6waNzf1BONU9kyMqlsu3zQMM+PD6CwInavrkTx31WxbWy+xit8fYPcRia3KbxS92Sf5wz0ClXX8PQMxoSQtQ3QmAK7CAILuOHX/ToHdltOxCOqcpW1g8LyaxBP4R+UE3nPR5UVxI22qb1EaZEUMXJKDAyK16pwG9cXls8S1vXW5JC0cIKzF4mApRj8frYG1wDICEgdykBUEkd2KIFnrVJKjcBFVX1URfPt2rY0V+BFoU/vfVf/B2xSMWLoWBHN5b9JclquKvQ8Bp0wfnKiXC3kx5hYmJm6vFG+O2oL1V+byFJl+SUyq03j31pLKn+/gbxRfXNcmwszX/RyW0Gl0JXks3/ct/JZWmIR83mSt/JzavJtDkZzT8zcdRHtfySOQA/2gzpc5bLji1uUmXtVedKpcMQZB1P7Pasd8PPOuCg8k6U99EzBJLvaDO4Ehjc80rMFdSkUKlJfjTHq/XGX0YBUCX13n7bNDWTYyzVXNGVUBjSiP4WUKFefJ3JTHYk/48NsrdkQEt+HRlox+B4wEdfN/bf35LfONdIoLtm7raSbdS5V8KWVWkbtK663nKK+T5jO3wGx7QYSxvGlOYZDcHcnjTJgrx0SplVf6N62+HX7WWKr4HpC2YJNApKepCjd/yS1Vwje+03glOxTVyf0wgHJqNygzHkdUcSVu9n3TkAkc5aHDd/CnxGZ/Ns9fkRGT2dw//3LfbHUs+VqpKJG1hzHDf5/FDQaitkrV66XFb1ZtQBObMtnbEj0NB5joVhqRSdE3Ke2BtghDcUDzo45KuWCKwEc5Z5rYocpVRVKV+aF6kupLCR+phLjaDUwpRM1yg4k4+DeX6at7GiTE+dOJ1p+G/I9ozgdYfw0YsK0H12yAmeyhvwIe+st5J8nH2iVRM3UlscXq/tGMCGd9c4VuXceeTh28el4sWM9oPky96pn1/1xZWT63p4QuIWWsAeMh/ALtAYxPHwRNJvnONKqxRq9Zwb6zFKaSRyTkuEr92AHjK/eKVATQ426hfH2oY/pIOFgsw2EvezjyeM3oIAhIE3BJSBNLggmPulIeH+My5J8GHz2CmfY5+MpKGXwmg+qDRBsPajrQXewdDrccutqjov3NfcgO6faJPcK0juckZE1qzlWgsWMOfL8f2xk2JoEdkhI3KGZZBNFY1ud7P5uURURmuT2TbzwoAUTqzPCRmMLMkeUm3bNgiDVTQPXKGZtJo2s4bDl9ymrtszsMTXak9e7FNwAC2h/jKJgLAeJkkOCAY6WilNSzv5kLMHqhp6rLFlA6BtmjlSK2e6s2UO3et2OJBlWzMxcNCVBW0HTmr4/fbWFkBvWswLZTxhjUa4xjUSXvh/SNm4qRUNNZSUPtweXdHgo/nBR3+A1IY88WNuzouRn9D3CNcEkU7t/Z6FrhbO2fYMObw5KCggTlS6j9EG/uOWTwn+4JEebnDrbzxuR2rQCIH1rd6Le8UMvNs4jMcWWmACZgGaP3427qKIuR31OVImP+yX4cnA3Lp2GR27gLHX1cIrIfGVAWhwVhENLe8C2RSBdR6J+94s0E4aneTfYwqK638kPxHGUjEta9ocNdyKBhLo6TrH8CF0Z6mH+eFonnUKB2mncnz54ind5VhLQygV1tbMSDUirybyWk41wZzRv5z4KTWn4Y4rc1oPPd1gJSVx4/Imm+bL+jktczwLC46SiPboj42y6WSBGmqkiHHMo7dAM6nwQ6VfYESuwokgzH1/YjeDZdyljAbiepL4BTiTWvX6JEmRsRIOlf2UOOhxewY1+05ofJqfq7jjKYFDFb2ho7O4wviNYzs6W4EZ4UAUrP1AFBDkbNwS1vRuczFqxXHXtZnXWCsa/NXYSUFMm+tjnwnmrteco4ZzejEyNQVVdPNU8905fnPU+W+bijzNgjXK67jbcu1kyCTYeHA4SDRZk/rCTirkYxXEUCzJNcHKhbZZWhiqG5I+eRhiEIguEDlsr1IiCM/2sTBp6rcctB7+4mBQQ9uJKomDIJ5QTGbLYCcWoLF3ITMXeZs3yVM9048izPb4B28QyTWImLWoTCc0JjJmmKcUfV0H8eMfGg0XxUHDJJyuS0Fpv4wvmMpUyS4rkJ+l1HZaFpLHsLDLBDOiFIucM1CpuSEoTVt9R4I4Leqkve8Un9EnfNxa2zOVEfNZkCgZ8sxDek+vLVuZW9h7EDqxXqKcDTSv3Xvdb9vGR5OrLW2OHXKyPxVxsVTFZiAqtXSHv0GoZszqHL+IKGnNAALesH6r6Dg8lt+nz1+uL/hRVIZRbl+rf14+qIGHe9D+w6NEUifZ3+FLF+aOC+3HRP2LMywW3FMSkgiLZuCmp47A9afiiICdCCgU01nMFpytdMcrMIr2LpcRYXKn/aBnugJF4Lhkro2y31pDNi5b27+WMtt6t61akBTiX3p5UqLEmCQzPdDDE9lnqOwVveluEN/MhYtgR2O/4H60BkpDO9pbPP6GSxmobWPndXYz7LfA7qalWsSfK4gk5ljfKsjNrLNIOKF1Pdf0Qf8ILbJEYsqcceHqW6lDOSZtPhJ/EzupXMCso2OR36ELFBywFvlt7e2rAwCxpz8YiObD9et98PxaFkKlvc/eOmQ2zOfpVitoH6+p38QkQ7cX8qdRpQ/3tAHghyvFnz2yXNY/4VyR4bUtB9M+fmSQF5gjFZx9nrF1yNk6ETDp+xOr00oyiV5VVFNuPpy8FMrDrLGRpZ2VzdD0scz1OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU5OYU4=
action.cair.com/	1970-01-20 15:35:48	Name: ai_session Value: Vh4r1HCvphfFTCfpl2rjl5\|1697746661526\|1697746661526
profile.ngpvan.com/	1970-01-21 01:11:46	Name: ngpvanuser Value: Hmixt2p4Y_QR8qHotGavYK_7
.everyaction.com/	1970-01-21 00:20:05	Name: visid_incap_823975 Value: MHJ0e1U/S5GgKRSuRMEphOWOMWUAAAAAQUIPAAAAAACc1ulCl359O4c0p2mudZc4
.everyaction.com/	1969-12-31 23:59:59	Name: nlbi_823975 Value: 3GcUdtwesHHVzZpZxwoUeQAAAAC3rRefoTW6Q4lBmM05ldbu
.everyaction.com/	1969-12-31 23:59:59	Name: incap_ses_730_823975 Value: AFiMCIEXbj5BYtCiLXwhCuWOMWUAAAAASiZmk+uldQgxBsK5A5xDXw==
secure.everyaction.com/	1970-01-20 15:36:15	Name: SessionKeyCookie Value:

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

action.cair.com
advocator.ngpvan.com
az416426.vo.msecnd.net
dc.services.visualstudio.com
fastaction.ngpvan.com
fonts.googleapis.com
fonts.gstatic.com
js.verygoodvault.com
nvlupin.blob.core.windows.net
profile.ngpvan.com
secure.everyaction.com
static.everyaction.com
13.32.99.77
13.69.106.216
143.204.98.103
20.60.58.97
2600:9000:2490:7a00:3:1d53:4780:93a1
2606:2800:133:206e:1315:22a5:2006:24fd
2a00:1450:4001:80b::200a
2a00:1450:4001:831::2003
45.60.33.183
0c8f340d72b876009fda4b161e3d3754cb7f909490362c6ce4f3243bae61301e
0d5eb9d85e7d44c3b3baab9fb660f88c5de73083a93cd39c8ad35917b0727e2e
20e7c0f660f2d7b1bb3ed089bfd9aeaf6a163e7afac9059a142c849c40577150
2d589a633d53be2660fdaff66b1bdb23120a39f3a08e6db145e3167a325f5fd1
2decb492a5b143c935ba3f8b6a9a1dc970335e8981fb5f42b3ee7966735eeb16
40681dc4e5ab9705749b5e24e2049b39f47c790acdac1de9d7be1ca412913d39
42b3231710e614628af4260f280d30a1450942b91a0faa31a9e4a00c64267fc3
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45d24dd47e4c5ad1e608c0990d42d982e8b45e90f960ec0ecdb5aeb5fbdfdbf5
5282adf860a0adb36eaa493d236cf7203c0fd5a2492af96f92dd47ad6848190f
575b2165304d899b7001ab593aeee31b371a46aee8b899c22a87ab9313389eda
6b9f1135ba160e5dc694ad7977f6bf73d40d3c15742b14ca8910ea23bb3e6e79
6bf48046c8f479cac896aae380bdc34bd9d137ee2747aa776ce291574864e210
6c14d731b13bcdec4325028eb0d8d2cb0190b3b1e65e0fcb52907fe6f55c2707
7acd994005f04a39f775d8d21a566ab63a04cc7c3bfe0f25f0ca50c069cac6b7
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
9e927cbdaba2a9fe14c5d729bb8f871b8422aa7cc98342028ce29b059af76d59
b60497a77afdcb315e270ec5f6fe3d53797c486032fc6752523aa8c65be7b985
da519fa3d8d13e9b07ad93ebccc1ae4ff01b3641d183331399b35aa5bf0adf8e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef7c1557b1419ace098717079ff51165e2e3fdec319221d48d34b262ab836e78
f1bdde3be30d26104bdf69b800d782d45494e579b15e8e01e6fb2d4515198e92
f3d2cdf350217c0c308d7e35c1136619407e4c2af21812dbfc8508d78e344e6e
fe62bab84590322ae4bfcde20dfb50a72c1b68b330c2a7f1b0aefb65999f16bc

action.cair.com Open in urlscan Pro 13.32.99.77 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

27 Requests

100 %HTTPS

44 %IPv6

9 Domains

12 Subdomains

10 IPs

3 Countries

826 kBTransfer

2399 kBSize

9 Cookies

10 Outgoing links

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

42 JavaScript Global Variables

9 Cookies

action.cair.com Open in urlscan Pro
13.32.99.77 Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

100 %
HTTPS

44 %
IPv6

9
Domains

12
Subdomains

10
IPs

3
Countries

826 kB
Transfer

2399 kB
Size

9
Cookies

27 HTTP transactions
1 data transactions