offtherecord.com Open in urlscan Pro
99.86.4.113 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://fight.offtherecord.com/
Effective URL:
https://offtherecord.com/
Submission: On May 17 via api (May 17th 2024, 1:55:47 pm UTC) from US — Scanned from DE

Summary HTTP 178 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 46 IPs in 4 countries across 30 domains to perform 178 HTTP transactions. The main IP is 99.86.4.113, located in United States and belongs to AMAZON-02, US. The main domain is offtherecord.com.
TLS certificate: Issued by Amazon RSA 2048 M02 on November 16th 2023. Valid for: a year.

This is the only time offtherecord.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.56.48.216 13.56.48.216	16509 (AMAZON-02) (AMAZON-02)
52	99.86.4.113 99.86.4.113	16509 (AMAZON-02) (AMAZON-02)
4	216.58.212.132 216.58.212.132	15169 (GOOGLE) (GOOGLE)
16	2606:4700:440... 2606:4700:4400::ac40:93bc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a04:4e42::729 2a04:4e42::729	54113 (FASTLY) (FASTLY)
2	151.101.192.176 151.101.192.176	54113 (FASTLY) (FASTLY)
1	54.156.207.182 54.156.207.182	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1 11	35.169.238.116 35.169.238.116	14618 (AMAZON-AES) (AMAZON-AES)
3	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
2	151.101.0.176 151.101.0.176	54113 (FASTLY) (FASTLY)
10	100.25.50.51 100.25.50.51	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	34.196.69.230 34.196.69.230	14618 (AMAZON-AES) (AMAZON-AES)
4	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
2	2a04:4e42::396 2a04:4e42::396	54113 (FASTLY) (FASTLY)
3	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:803::200e	15169 (GOOGLE) (GOOGLE)
1	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:8bd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:11::215:14ca	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	216.58.206.67 216.58.206.67	15169 (GOOGLE) (GOOGLE)
2	157.240.252.13 157.240.252.13	32934 (FACEBOOK) (FACEBOOK)
7	34.96.102.137 34.96.102.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	151.101.65.140 151.101.65.140	54113 (FASTLY) (FASTLY)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c1d::9c	15169 (GOOGLE) (GOOGLE)
2	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
1	142.250.181.232 142.250.181.232	15169 (GOOGLE) (GOOGLE)
2	18.173.205.111 18.173.205.111	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::ac40:991b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:afc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:6dfe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.66.112.46 18.66.112.46	16509 (AMAZON-02) (AMAZON-02)
1	216.58.206.78 216.58.206.78	15169 (GOOGLE) (GOOGLE)
1	34.102.211.197 34.102.211.197	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	104.19.175.188 104.19.175.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.201.112.186 35.201.112.186	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	3.95.80.55 3.95.80.55	14618 (AMAZON-AES) (AMAZON-AES)
1	52.222.214.121 52.222.214.121	16509 (AMAZON-02) (AMAZON-02)
1	18.245.60.105 18.245.60.105	16509 (AMAZON-02) (AMAZON-02)
1	54.84.112.40 54.84.112.40	14618 (AMAZON-AES) (AMAZON-AES)
178	46

1 13.56.48.216 (San Jose, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-56-48-216.us-west-1.compute.amazonaws.com

fight.offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

52 99.86.4.113 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-113.fra6.r.cloudfront.net

offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.58.212.132 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2606:4700:4400::ac40:93bc (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ka-p.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::729 (United States)

ASN54113 (FASTLY, US)

browser.sentry-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.192.176 (San Francisco, United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.156.207.182 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-156-207-182.compute-1.amazonaws.com

relay.offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 35.169.238.116 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-169-238-116.compute-1.amazonaws.com

relay.offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.0.176 (San Francisco, United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 100.25.50.51 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-100-25-50-51.compute-1.amazonaws.com

otr-backend-service-us-prod.offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.196.69.230 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-69-230.compute-1.amazonaws.com

wchat.freshchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.130 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f130.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8bd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:11::215:14ca (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

websdk.appsflyer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.67 (United States)

ASN15169 (GOOGLE, US)
PTR: tzfraa-aa-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.252.13 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.96.102.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c1d::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.173.205.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-205-111.fra56.r.cloudfront.net

wa.onelink.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:991b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7574 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:afc9 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:6dfe (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.46 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-46.fra56.r.cloudfront.net

wa.appsflyer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.78 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s11-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.211.197 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 197.211.102.34.bc.googleusercontent.com

anhkgav0.apicdn.sanity.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.175.188 (None, )

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.112.186 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 186.112.201.35.bc.googleusercontent.com

edge.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.95.80.55 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-95-80-55.compute-1.amazonaws.com

wchat.freshchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.214.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-121.fra56.r.cloudfront.net

snippets.freshchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.60.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-60-105.fra60.r.cloudfront.net

httpsofftherecordcom.webpush.freshchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.84.112.40 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-84-112-40.compute-1.amazonaws.com

relay.offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
76	offtherecord.com 2 redirects fight.offtherecord.com offtherecord.com relay.offtherecord.com otr-backend-service-us-prod.offtherecord.com	1 MB
16	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1866 ka-p.fontawesome.com — Cisco Umbrella Rank: 3346	334 KB
8	freshchat.com wchat.freshchat.com — Cisco Umbrella Rank: 12143 snippets.freshchat.com — Cisco Umbrella Rank: 71685 httpsofftherecordcom.webpush.freshchat.com	35 KB
7	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 2757	55 KB
7	google.com www.google.com — Cisco Umbrella Rank: 2 apis.google.com — Cisco Umbrella Rank: 139 region1.analytics.google.com — Cisco Umbrella Rank: 3095	117 KB
6	gstatic.com www.gstatic.com fonts.gstatic.com	302 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 183	160 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33	4 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	355 KB
4	stripe.com js.stripe.com — Cisco Umbrella Rank: 1088	188 KB
3	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 4098 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 4060 track.hubspot.com — Cisco Umbrella Rank: 2393	27 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 32	22 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 345	14 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4572 forms.hscollectedforms.net — Cisco Umbrella Rank: 4722	26 KB
2	onelink.me wa.onelink.me — Cisco Umbrella Rank: 11060	872 B
2	google.de www.google.de — Cisco Umbrella Rank: 7810	126 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 89	405 B
2	appsflyer.com websdk.appsflyer.com — Cisco Umbrella Rank: 4578 wa.appsflyer.com — Cisco Umbrella Rank: 7184	10 KB
2	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1160	13 KB
2	sentry-cdn.com browser.sentry-cdn.com — Cisco Umbrella Rank: 4448	22 KB
1	fullstory.com edge.fullstory.com — Cisco Umbrella Rank: 2197	12 KB
1	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 4386	926 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 101	273 B
1	sanity.io anhkgav0.apicdn.sanity.io	3 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2225	21 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2189	23 KB
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1376	637 B
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2460	1 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 126	18 KB
0	amazonaws.com Failed off-the-record-service.s3.us-west-2.amazonaws.com Failed
178	30

	Domain	Requested by
52	offtherecord.com	offtherecord.com browser.sentry-cdn.com
15	ka-p.fontawesome.com	kit.fontawesome.com offtherecord.com
13	relay.offtherecord.com	1 redirects offtherecord.com browser.sentry-cdn.com relay.offtherecord.com
10	otr-backend-service-us-prod.offtherecord.com	browser.sentry-cdn.com
7	dev.visualwebsiteoptimizer.com	relay.offtherecord.com offtherecord.com dev.visualwebsiteoptimizer.com
6	wchat.freshchat.com	offtherecord.com wchat.freshchat.com
5	fonts.gstatic.com	fonts.googleapis.com
4	connect.facebook.net	offtherecord.com connect.facebook.net
4	fonts.googleapis.com	offtherecord.com
4	www.googletagmanager.com	offtherecord.com www.googletagmanager.com
4	js.stripe.com	offtherecord.com js.stripe.com
4	www.google.com	offtherecord.com www.gstatic.com
3	www.google-analytics.com	offtherecord.com www.google-analytics.com browser.sentry-cdn.com
3	bat.bing.com	offtherecord.com bat.bing.com
2	wa.onelink.me	browser.sentry-cdn.com
2	www.google.de	offtherecord.com
2	stats.g.doubleclick.net	www.googletagmanager.com browser.sentry-cdn.com
2	www.redditstatic.com	www.googletagmanager.com browser.sentry-cdn.com
2	apis.google.com	offtherecord.com apis.google.com
2	browser.sentry-cdn.com	offtherecord.com
1	httpsofftherecordcom.webpush.freshchat.com	wchat.freshchat.com
1	snippets.freshchat.com	offtherecord.com
1	track.hubspot.com
1	edge.fullstory.com	offtherecord.com
1	perf-na1.hsforms.com	offtherecord.com
1	forms.hscollectedforms.net	browser.sentry-cdn.com
1	cta-service-cms2.hubspot.com	browser.sentry-cdn.com
1	www.facebook.com	offtherecord.com
1	anhkgav0.apicdn.sanity.io	browser.sentry-cdn.com
1	wa.appsflyer.com	browser.sentry-cdn.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	region1.analytics.google.com	www.googletagmanager.com
1	alb.reddit.com	offtherecord.com
1	websdk.appsflyer.com	offtherecord.com
1	js.hs-scripts.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	www.gstatic.com	www.google.com
1	kit.fontawesome.com	offtherecord.com
1	fight.offtherecord.com	1 redirects
0	off-the-record-service.s3.us-west-2.amazonaws.com Failed	offtherecord.com
178	43

This site contains links to these domains. Also see Links.

Domain
www.kiro7.com
kmph.com
www.king5.com
www.geekwire.com
www.facebook.com
www.reviews.io
www.google.com
fight.offtherecord.com
play.google.com
mylawfirm.offtherecord.com
facebook.com
twitter.com
www.instagram.com

Subject Issuer	Validity	Valid
*.offtherecord.com Amazon RSA 2048 M02	`2023-11-16` - `2024-12-14`	a year	crt.sh
*.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-04` - `2025-01-03`	a year	crt.sh
*.sentry-cdn.com GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-08-01` - `2024-09-01`	a year	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2024-03-27` - `2024-06-27`	3 months	crt.sh
*.apis.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.gstatic.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.google-analytics.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-02-24` - `2024-05-24`	3 months	crt.sh
*.freshchat.com Amazon RSA 2048 M02	`2024-01-22` - `2025-02-18`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-08` - `2024-07-06`	6 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-05-01` - `2024-06-27`	2 months	crt.sh
*.googleadservices.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
hs-scripts.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
*.appsflyer.com DigiCert TLS RSA SHA256 2020 CA1	`2023-07-27` - `2024-07-27`	a year	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2023-07-06` - `2024-07-06`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-01-15` - `2024-07-13`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.google.de WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.onelink.me Amazon RSA 2048 M02	`2024-05-05` - `2025-06-02`	a year	crt.sh
hs-banner.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
hs-analytics.net GTS CA 1P5	`2024-04-13` - `2024-07-12`	3 months	crt.sh
hscollectedforms.net E1	`2024-03-29` - `2024-06-27`	3 months	crt.sh
*.apicdn.sanity.io Sectigo RSA Domain Validation Secure Server CA	`2023-10-10` - `2024-09-30`	a year	crt.sh
hsforms.com GTS CA 1P5	`2024-04-17` - `2024-07-16`	3 months	crt.sh
freshchat.com Amazon RSA 2048 M02	`2023-06-26` - `2024-07-23`	a year	crt.sh
*.wchat.webpush.myfreshworks.com Amazon RSA 2048 M01	`2023-06-21` - `2024-07-18`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://offtherecord.com/
Frame ID: 88587F6AA494CDB305CE875040FEE5D5
Requests: 174 HTTP requests in this frame

Frame: https://js.stripe.com/v2/channel.html?stripe_xdm_e=https%3A%2F%2Fofftherecord.com&stripe_xdm_c=default574722&stripe_xdm_p=1
Frame ID: A7E2BCA7BE731392E5B8E9C54E5D659F
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
Frame ID: F80BE563CD207F7CB09BE4DBFF34EE99
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3&co=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29tOjQ0Mw..&hl=de&v=8k85QBI-qzxmenDv318AZH30&size=invisible&cb=jls5s51dngpz
Frame ID: C9A68B3D9A0BC121FE6EEC1BF2EEAD77
Requests: 1 HTTP requests in this frame

Frame: https://wchat.freshchat.com/widget/config_iframe.html?host=https://wchat.freshchat.com&token=c36ed4b1-ac05-4052-a91f-83203339cd7c&origin=https://offtherecord.com
Frame ID: 3AA72E1F8D4157AD0DA1F0EA0F2A0A61
Requests: 1 HTTP requests in this frame

Frame: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
Frame ID: B22B0E6D885B7E3A2A54682EDCC7B1E9
Requests: 1 HTTP requests in this frame

Frame: https://httpsofftherecordcom.webpush.freshchat.com/index.html?ref=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t
Frame ID: 3AEDCD817F36EB78B3F49C7B668C7ACA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Fight Your Moving Violation | Traffic Ticket Lawyer Local & Online

Page URL History Show full URLs

http://fight.offtherecord.com/ HTTP 307
https://fight.offtherecord.com/ HTTP 307
https://offtherecord.com/ Page URL

Detected technologies

Sentry (Issue Trackers) Expand

Overall confidence: 100%
Detected patterns

browser\.sentry\-cdn\.com/([0-9.]+)/bundle(?:\.tracing)?(?:\.min)?\.js

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+(?:-?rc[.\d]*)*)/angular(?:\.min)?\.js
\bangular.{0,32}\.js

Freshchat (Live Chat) Expand

Overall confidence: 100%
Detected patterns

wchat\.freshchat\.com/js/widget\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

178
Requests

93 %
HTTPS

43 %
IPv6

30
Domains

43
Subdomains

46
IPs

4
Countries

2881 kB
Transfer

9393 kB
Size

39
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://www.kiro7.com/news/local/got-at-ticket-theres-an-app-for-that/273024500/

Search URL Search Domain Scan URL

URL: https://kmph.com/news/local/traffic-ticket-theres-an-app-for-that

Search URL Search Domain Scan URL

URL: https://www.king5.com/video/news/local/new-app-helps-drivers-fight-traffic-tickets/281-922497

Search URL Search Domain Scan URL

URL: https://www.geekwire.com/2016/off-record-speeding-ticket-app/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/OffTheRecordApp/
Title: 4.58 656 reviews

Search URL Search Domain Scan URL

URL: https://www.reviews.io/company-reviews/store/offtherecord-com
Title: 4.95 2546 reviews

Search URL Search Domain Scan URL

URL: https://www.google.com/search?q=off+the+record+fight+your+ticket
Title: 4.69 1684 reviews

Search URL Search Domain Scan URL

URL: https://fight.offtherecord.com/a/key_live_oik1hC6SvaFGaQl6L4f5chghyqkDbk9G?channel=website&feature=iOSBadge&stage=footer&$fallback_url=https%3A%2F%2Fapps.apple.com%2Fapp%2Fapple-store%2Fid1032930471%3Fpt%3D117925041%26ct%3Dcustomer_website%26mt%3D8

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.offtherecord.otr_mobile_app&referrer=utm_source%3Dwebsite%26utm_medium%3Dfooter

Search URL Search Domain Scan URL

URL: https://mylawfirm.offtherecord.com/
Title: Law Firm Portal

Search URL Search Domain Scan URL

URL: https://facebook.com/OffTheRecordApp

Search URL Search Domain Scan URL

URL: https://twitter.com/OffTheRecordApp

Search URL Search Domain Scan URL

URL: https://www.instagram.com/offtherecordapp/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://fight.offtherecord.com/ HTTP 307
https://fight.offtherecord.com/ HTTP 307
https://offtherecord.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 167

https://relay.offtherecord.com/datalayer/v4/latest.js HTTP 302
https://edge.fullstory.com/datalayer/v4/latest.js

178 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
offtherecord.com/
Redirect Chain

http://fight.offtherecord.com/
https://fight.offtherecord.com/
https://offtherecord.com/

15 KB
5 KB

231ms
201ms

Document
text/html

99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: f304f3fd3d8bb15da7a2bafcf83f90bb40bff5bbe00bc0671ebca41e0128d903

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

cache-control: no-store, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 17 May 2024 13:55:40 GMT
etag: W/"3bb6-18f304cd220"
expires: 0
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
vary: Accept-Encoding
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
x-amz-cf-id: ffn2mNOd4ZU5n768DpeFWl3Qg9CLuVt11GlpcoUVw7KpxUJz4aB1Kw==
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
x-powered-by: Express

Redirect headers

Accept-CH: Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
Connection: keep-alive
Date: Fri, 17 May 2024 13:55:40 GMT
Last-Modified: Fri, 17 May 2024 13:55:40 GMT
Location: https://offtherecord.com
Server: openresty
Strict-Transport-Security: max-age=31536000; includeSubDomains
Transfer-Encoding: chunked

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
973 B 126ms
48ms Script
text/javascript 216.58.212.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f4.1e100.net

Software

GSE /

Resource Hash

a660a82226cc76c6674f060a12de2c7eb6b5aa98ee9e725d296fa7b5934d0f20

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Fri, 17 May 2024 13:55:40 GMT

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
947 B 123ms
46ms Script
text/javascript 216.58.212.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=explicit

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f4.1e100.net

Software

GSE /

Resource Hash

53355e92ca37f077ef5fb7dbcc40b579ab0fa9178e19121d54ce99ece2f39aeb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Fri, 17 May 2024 13:55:40 GMT

GET
H2 200 af20baf93e.js Show response
kit.fontawesome.com/ 12 KB
5 KB 47ms
28ms Script
text/javascript 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kit.fontawesome.com/af20baf93e.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55e9a08cde71ec47754aef6c72a216b2900fecfe5015d035cc04a0935cdd4e42

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
age: 33
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
content-type: text/javascript
cache-control: max-age=60, public, stale-while-revalidate=30
cf-ray: 88541b42d88d3a9e-FRA
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F89xcRHrgyOB76W_k2cB

GET
H2 200 bundle.min.js Show response
browser.sentry-cdn.com/6.19.7/ 65 KB
21 KB 29ms
9ms Script
application/javascript 2a04:4e42::729
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::729 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

6ba797956f6d29b650d458897e48a190cddf0a6ba374350c0bb565fa04f80d65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Tue, 26 Apr 2022 13:11:05 GMT
server: Fastly
age: 1835306
etag: "4dc87c1e025f84ef0d14fe9187946dfd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 20887
expires: Wed, 26 Apr 2023 13:34:47 GMT

GET
H2 200 angular.min.js Show response
browser.sentry-cdn.com/6.19.7/ 2 KB
976 B 29ms
10ms Script
application/javascript 2a04:4e42::729
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://browser.sentry-cdn.com/6.19.7/angular.min.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::729 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

8971fe0a892f03a0f0ba568b545194578eaf62dcafabc254e2677c7af64200c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Tue, 26 Apr 2022 13:11:05 GMT
server: Fastly
age: 2612076
etag: "14f18525c8f97317f08d5cc6f80a1953"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 882
expires: Thu, 19 Sep 2024 13:29:39 GMT

GET
H2 200 / Show response
js.stripe.com/v2/ 62 KB
22 KB 38ms
6ms Script
application/javascript 151.101.192.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v2/

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.192.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

91ab93b25227f8a29a716fdc41831b0a8a8729d8cde9f8adb29f4c8392457b9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Fri, 17 May 2024 13:55:40 GMT
via: 1.1 varnish
age: 17
x-cache: HIT
content-length: 21836
x-request-id: 9364ba0b-cf27-4771-9e17-aaf97fba5c7b
x-served-by: cache-fra-eddf8230052-FRA
last-modified: Thu, 03 Feb 2022 12:42:55 GMT
server: Fastly
etag: "4e0e5080f8f45588fcc33b82ee08fa3c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=300
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2

GET
H2 200 / Show response
js.stripe.com/v3/ 603 KB
167 KB 38ms
7ms Script
text/javascript 151.101.192.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.192.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

752632740de79ea8871a43460bd6473ae1f3cb4fec3bee3f2d0c6b7ed6bd12dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Fri, 17 May 2024 13:55:40 GMT
via: 1.1 varnish
age: 10
x-cache: HIT
content-length: 170252
x-request-id: 6a92aa5c-12fc-4bf4-a7dc-3432f1f96e3f
x-served-by: cache-fra-eddf8230052-FRA
last-modified: Thu, 16 May 2024 20:19:59 GMT
server: Fastly
etag: "7774010f63d7ce7ce23d2319c921368f"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 5

GET
H2 200 177.06b438bd9abf459b0af4.js Show response
offtherecord.com/ 3 MB
558 KB 11ms
11ms Script
application/javascript 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/177.06b438bd9abf459b0af4.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 770ab091f87c39b70a00d92d2479d6564064e4a89859285c6cdc08a502e8aa52

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 15:18:03 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 427057
x-powered-by: Express
etag: W/"2a4abc-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: iZvFlp7E2SzPoqyGh8hjf80KK9eW5SmP7-EZbqkgtYqpZH47cwLzdQ==

GET
H2 200 main.23e6b8d8263921a9720d.js Show response
offtherecord.com/ 458 KB
122 KB 19ms
15ms Script
application/javascript 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/main.23e6b8d8263921a9720d.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 3ef96cf8ace7331eac86b1109658ad523a208e1f2d4cffb715964b5c3611930f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:58:08 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 464252
x-powered-by: Express
etag: W/"72832-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: 64ESGx9_77SODQgzkgfkk1pfNIdBTStnxLYVSGvPLQw_xMekZ_OxiA==

GET
H2 200 main.38e6b04a9facc3b0a6c9.css
offtherecord.com/ 361 KB
62 KB 11ms
10ms Stylesheet
text/css 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/main.38e6b04a9facc3b0a6c9.css
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 3bf4e07601b268d1d7e49c3d59f63db2263c9e69868e27d9f5cf87e6ddd74c84

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:58:08 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 464252
x-powered-by: Express
etag: W/"5a57d-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: A0CRceGYPngyLCY4pdbUkXHUvJY0EqttlNv_QQ4fiHmXfB9jFhRjkg==

GET
H2 200 j.php Show response
relay.offtherecord.com/ 13 KB
4 KB 505ms
263ms Script
application/javascript 54.156.207.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com:447/j.php?a=660553&u=https%3A%2F%2Fofftherecord.com%2F&vn=2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.156.207.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-156-207-182.compute-1.amazonaws.com
Software: gnv1 /
Resource Hash: 6a66c1106c740e4f94cf62ccbcc7166c912876ecd57d5d14d6d377fb4aa75bda

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
content-encoding: gzip
via: 1.1 google
server: gnv1
etag: W/"1715920839"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=0, no-cache, must-revalidate
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 inline-scripts.js Show response
offtherecord.com/app/common/preprocessor/ 320 B
701 B 16ms
12ms Script
application/javascript 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/app/common/preprocessor/inline-scripts.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 28503820ff423a3e61dcab001567d362860dfed3863e3143f5046316a2f262f2

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:58:08 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 464252
x-powered-by: Express
etag: W/"140-18f304cd220"
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 320
x-amz-cf-id: COXGTI3E47SwytHfHD4zlmsV89mtMfumwYnMMWiTpjl3MJY7wLTaeA==

GET
H2 200 client.js Show response
apis.google.com/js/ 15 KB
6 KB 158ms
50ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/client.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

abe72c7981d3e55e05f111caebead10a7e80cf20b3b60776600724f251c4790d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 17 May 2024 13:55:40 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5900
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "41280b644365012e"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 May 2024 13:55:40 GMT

GET
H2 200 autotrack.js Show response
offtherecord.com/node_modules/autotrack/ 24 KB
8 KB 16ms
13ms Script
application/javascript 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/node_modules/autotrack/autotrack.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: bceb73993d094c4c821c7571921103bdc8c05e9082c4fc513d244358d53593db

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 11:17:33 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Wed, 01 May 2024 17:29:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 182287
x-powered-by: Express
etag: W/"60d8-18f35340521"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: L0E-a91aNZyz_FiOi89b0rrchPSqv9DqtGQl94G1ZlkCGSfaU9daJg==

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/8k85QBI-qzxmenDv318AZH30/ 519 KB
207 KB 130ms
36ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/8k85QBI-qzxmenDv318AZH30/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e92f0b552deffbf207cee5389713056c7c3d27e4b9b9edaf29338d01a83c5962

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 11:46:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7771
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 210834
x-xss-protection: 0
last-modified: Mon, 13 May 2024 17:44:43 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 17 May 2025 11:46:09 GMT

GET
H2 200 pro.min.css Show response
ka-p.fontawesome.com/releases/v6.5.2/css/ 672 KB
118 KB 41ms
40ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/css/pro.min.css?token=af20baf93e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/af20baf93e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01a3066991f4af85d35aaa0068aa00054f9762f39c263853f49518d5f9784c4b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:26 GMT
server: cloudflare
age: 3872643
etag: "660c23a2-1d791"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b4389623a9e-FRA
content-length: 120721

GET
H2 200 pro-v4-shims.min.css Show response
ka-p.fontawesome.com/releases/v6.5.2/css/ 27 KB
4 KB 39ms
38ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/css/pro-v4-shims.min.css?token=af20baf93e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/af20baf93e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f3387f11826be4923a2d3a8c1542780abd6d4c66ce13f2de770f2e386989593

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:24 GMT
server: cloudflare
age: 3872643
etag: "660c23a0-10e7"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b4389613a9e-FRA
content-length: 4327

GET
H2 200 pro-v5-font-face.min.css Show response
ka-p.fontawesome.com/releases/v6.5.2/css/ 50 KB
7 KB 33ms
32ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/css/pro-v5-font-face.min.css?token=af20baf93e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/af20baf93e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1580a6a19cb081a84215f13b42f765469beb87d7401f16349760cd067fc4da71

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:24 GMT
server: cloudflare
age: 3872643
etag: "660c23a0-1c3b"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b43895f3a9e-FRA
content-length: 7227

GET
H2 200 pro-v4-font-face.min.css Show response
ka-p.fontawesome.com/releases/v6.5.2/css/ 7 KB
2 KB 37ms
36ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/css/pro-v4-font-face.min.css?token=af20baf93e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/af20baf93e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 516640faeb856df6599d165f26ee51ce8cbaaf34f7c09d818509e75f6a48ae13

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:24 GMT
server: cloudflare
age: 3872643
etag: "660c23a0-6ca"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b43895d3a9e-FRA
content-length: 1738

GET
H2 200 custom-icons.css Show response
ka-p.fontawesome.com/assets/af20baf93e/109913681/ 3 KB
2 KB 35ms
34ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/assets/af20baf93e/109913681/custom-icons.css?token=af20baf93e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/af20baf93e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7b242b6fc836be7b2e892946b2c7293d65da02a12ba9cb368e3ce404ad33819

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 14 May 2024 19:25:06 GMT
server: cloudflare
age: 239421
etag: W/"30d71755cd19cfbab359506a397b8df0"
x-cache-status: MISS
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
cf-ray: 88541b4389633a9e-FRA

GET
H2 200 fs.js Show response
relay.offtherecord.com/s/ 273 KB
74 KB 344ms
116ms Script
application/javascript 35.169.238.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/s/fs.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.169.238.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-238-116.compute-1.amazonaws.com
Software: UploadServer /
Resource Hash: 0f7c8ca4341ce357e0424f80dd36181ae812a3449b09b5d7e804133df7c30ebf

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
content-encoding: br
age: 3096
x-guploader-uploadid: ABPtcPrLqvOMeZnWIovcyD2g0zUNRvac3dsJMx_1Nw7ytziaMGpBPez-s9ZnYZlRfdXYPeDs0D4
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75399
last-modified: Thu, 16 May 2024 15:58:30 GMT
server: UploadServer
etag: "9518bfdd8ce5a4d07426912e49eab44e"
vary: Accept-Encoding
x-goog-generation: 1715875109988133
content-type: application/javascript
access-control-allow-origin: *
x-goog-hash: crc32c=iqU1ow==, md5=lRi/3YzlpNB0JpEuSeq0Tg==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=3600,no-transform
x-goog-stored-content-length: 75399
accept-ranges: bytes
expires: Fri, 17 May 2024 14:04:05 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 273 KB
93 KB 149ms
68ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/app/common/preprocessor/inline-scripts.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

586ad2fca3b935a5eaaebc7e29a1fdd4ef5e09b9355c007afaf86cd5bc32705c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95324
x-xss-protection: 0
last-modified: Fri, 17 May 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 17 May 2024 13:55:40 GMT

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
814 B 126ms
47ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700&display=swap

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

31d196afc7bf97b61be0a9881f623b3b8a7b56d4b0c08c6b78c37ce92d7827b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 May 2024 13:23:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 17 May 2024 13:55:40 GMT

GET
H2 200 css
fonts.googleapis.com/ 6 KB
2 KB 125ms
46ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c3061c3788ad5783ef8a5d10c454bafe7eb942c48200dccc852cc6d3c9f303d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 May 2024 13:22:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 17 May 2024 13:55:40 GMT

GET
H2 200 css
fonts.googleapis.com/ 12 KB
790 B 127ms
48ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Nunito:200,300,400,600,700,800,900&display=swap

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7b7ca9dee8acbf03925b43a2cb76e364ba514c30a18de9f1523d0b156093c7d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 May 2024 13:55:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 17 May 2024 13:55:40 GMT

GET
H2 200 css2
fonts.googleapis.com/ 6 KB
1 KB 123ms
44ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Nunito+Sans:wght@400;600;700&display=swap

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7b5edcbf4a04dec3e1381046ccfe8e7135eaca4cc47973ccfd4ec6384b39b8bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 May 2024 12:47:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 17 May 2024 13:55:40 GMT

GET
H2 200 channel.html
js.stripe.com/v2/ Frame A7E2 0
0 18ms
6ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v2/channel.html?stripe_xdm_e=https%3A%2F%2Fofftherecord.com&stripe_xdm_c=default574722&stripe_xdm_p=1

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 60
cache-control: public, max-age=300
content-encoding: br
content-length: 563
content-security-policy: report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: default-src 'self'; connect-src https://api.stripe.com; base-uri 'none'; form-action 'none'; img-src 'self' https://q.stripe.com; script-src 'self' 'sha256-M1LJiJCn3XBCZ1erCVATqpCSJ5Yd9sUrS2npRlBZ6YE='; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Fri, 17 May 2024 13:55:40 GMT
etag: "19af0c6cc7a0bca20a355b3362dc64a0"
last-modified: Tue, 05 Oct 2021 15:24:12 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 4
x-content-type-options: nosniff
x-request-id: ef5173d8-6a04-4ca7-bcdd-9e503947e72f
x-served-by: cache-fra-eddf8230151-FRA

GET
H2 200 m-outer-3437aaddcdf6922d623e172c2d6f9278.html
js.stripe.com/v3/ Frame F80B 0
0 18ms
8ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 2116753
cache-control: max-age=31536000
content-encoding: br
content-length: 154
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Fri, 17 May 2024 13:55:40 GMT
etag: "3437aaddcdf6922d623e172c2d6f9278"
last-modified: Fri, 11 Nov 2022 20:25:37 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 599264
x-content-type-options: nosniff
x-request-id: 2e626632-d594-4f63-ae2b-07fa4f39776d
x-served-by: cache-fra-eddf8230151-FRA

OPTIONS
H2 200 user
otr-backend-service-us-prod.offtherecord.com/api/v1/ Frame 0
0 381ms
123ms Preflight 100.25.50.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=we6v62adl9s
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.25.50.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-25-50-51.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: api-token
Access-Control-Request-Method: GET
Origin: https://offtherecord.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept, Api-Token, X-Api-Token, X-Feature, X-Captcha-Token, X-Captcha-Version, X-Resource-Id
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
access-control-max-age: 3600
date: Fri, 17 May 2024 13:55:41 GMT
server: nginx/1.22.1

GET
H2 200 _r Show response
relay.offtherecord.com/app-link/ 91 B
629 B 482ms
249ms Script
text/javascript 35.169.238.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:444/app-link/_r?sdk=web2.74.0&branch_key=key_live_oik1hC6SvaFGaQl6L4f5chghyqkDbk9G&callback=branch_callback__0

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/177.06b438bd9abf459b0af4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.169.238.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-169-238-116.compute-1.amazonaws.com

Software

openresty /

Resource Hash

17b5300f889c44391ef59649f0510c20b4f6c186ab9fbb7bd016b7cfdaf1cba1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e20259e84d7d881ed453b1f0e4f9a4c6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
server: openresty
x-amz-cf-pop: IAD55-P4
etag: W/"5b-1pc5s0CTa8CXazI/vCo54LjaKxw"
x-cache: Miss from cloudfront
content-type: text/javascript; charset=utf-8
content-length: 91
x-amz-cf-id: QGOcWCPo0Xtn97LrfA5-VK_r2JSOyR_PlbOrMF-TkepqwZahq9N42g==

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
4 KB 26ms
8ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/main.23e6b8d8263921a9720d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b98f2cc291f1599d79b73bb15343019c208c0932f69200bf15bccce4133b2db2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 17 May 2024 13:55:41 GMT
content-md5: cOUUQ44VhizaQsqtEPfgKA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1688
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=12, mss=1326, tbw=2789, tp=-1, tpl=-1, uplat=0, ullat=-1
x-fb-debug: yskwN21OAZylrT5n4T21neOXHrBhbXp5pEUG4gzMuoDwR5r17pWIoMAgChgmc1XFmy8ZZzkr5oiShdWCQVmcGg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: aa408d5c4d7ab2d9e8bf08e4c1978c32
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "daf5b5f842f7241ce57368dfb79f1401"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
expires: Fri, 17 May 2024 14:04:27 GMT

GET
H2 200 widget.js Show response
wchat.freshchat.com/js/ 67 KB
22 KB 481ms
217ms Script
application/javascript 34.196.69.230
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/js/widget.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/main.23e6b8d8263921a9720d.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.196.69.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-196-69-230.compute-1.amazonaws.com

Software

fwe /

Resource Hash

87d1d3eff67f2586e9039d705d502f782613f87dac4850653e10973940ffb7c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-trace-id: 00-d59a6f298df9335bd124614d3556f976-88da256fc50a3a37-00
date: Fri, 17 May 2024 13:55:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Wed, 08 May 2024 05:23:06 GMT
server: fwe
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/javascript
x-fw-ratelimiting-managed: false
cache-control: max-age=900, must-revalidate
x-server: dl2xr
x-envoy-upstream-service-time: 1
x-xss-protection: 1; mode=block
x-request-id: 0469e65d-2b01-4017-b855-bf6a7a6a4acc

GET
H2 200 user Show response
otr-backend-service-us-prod.offtherecord.com/api/v1/ 163 B
585 B 333ms
112ms XHR
application/json 100.25.50.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=we6v62adl9s

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

100.25.50.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-25-50-51.compute-1.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

7e7558ddd527f6452c7c72f510f48964f6319f317b314829c2786e42346c372e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Api-Token: vKWrNZN8UMwxcqPxyRqbJo9x6OABtoqMA7scyCkpkSy82UcA
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
server: nginx/1.22.1
x-frame-options: DENY
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 default-template.8ffdc728dbde00888df0.html Show response
offtherecord.com/templates/ 732 B
1 KB 13ms
12ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/default-template.8ffdc728dbde00888df0.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: bd90f865472fe70f7acafca83b79b17cea7a2687024d4842309ad97e7bc04f7c

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:58:09 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 464252
x-powered-by: Express
etag: W/"2dc-18f304cd220"
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 732
x-amz-cf-id: q9hyTYnn-p4tGDXCwdvkCddfTSZtLagac7xR6eqIOGPnuv_bCd7oug==

GET
H2 200 home.component.210dcaefd5226e739222.html Show response
offtherecord.com/templates/ 32 KB
7 KB 11ms
10ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/home.component.210dcaefd5226e739222.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 32a55c673dfbcccd608dfa96cd2aa9b34d0b503ba32de13ace9f5b81c05e0386

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:58:09 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 464252
x-powered-by: Express
etag: W/"7eff-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: H0HBGUXxxuG6AnuqP11pyCI0Ts4ZJF-KHfeZUDNuN18RhoMbJGz_ng==

GET
H2 200 login.6cfe931c8bfbec9ed705.html Show response
offtherecord.com/templates/ 24 KB
5 KB 14ms
14ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/login.6cfe931c8bfbec9ed705.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: cad08c9782cbde27b90104ded5f58eddcf7fcf469f6a7f61ee8c489a8f377e2e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 15:18:05 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 427056
x-powered-by: Express
etag: W/"5eb6-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: VhPpRHO-11dPuxCdFZeMY80Wduph8Le-04A2nqzYdK5pi-OohCqjJg==

GET
H2 200 state-selection.82c570e66814fe0590fd.html Show response
offtherecord.com/templates/ 1 KB
938 B 12ms
12ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/state-selection.82c570e66814fe0590fd.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: f01d3fe2a8106b2ac0fe9ed20c7c3548c198cb1402e5fba6ac150841ea4bd65f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 15:18:04 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 427056
x-powered-by: Express
etag: W/"572-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: Kkn6PZNaW9YhgDjLwrRepSO-upVQtsCzkddpTS7vbM0QFGMjig4F6g==

GET
H2 200 main-header.partial.b3df9044de97598fd08b.html Show response
offtherecord.com/templates/ 12 KB
2 KB 12ms
11ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/main-header.partial.b3df9044de97598fd08b.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 489d06131e031d27a033f924daba197f6b483b9bc8602b0dddaea8ebe90f60d8

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 29 Apr 2024 12:53:54 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1558907
x-powered-by: Express
etag: W/"3005-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: iAgW6SAonxHuCpFdMRZ8yJkfu2g4yzBfqHBW2vOOW9b_mCMSBCLDkA==

GET
H2 200 footer.partial.faad4b1502206a050e24.html Show response
offtherecord.com/templates/ 11 KB
3 KB 10ms
10ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/footer.partial.faad4b1502206a050e24.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 46deed2d373abe70cb9a8271dd451b2d3c1e4959f88a21613ee3141689a1a8cb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:58:09 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 464252
x-powered-by: Express
etag: W/"2a07-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: yn-yWCXH0mIUSx7O_IzQL6uc45EJq-RU1M8baR1yFw-5uVPhkI80Ug==

GET
H2 200 featured-on.partial.e808beb00cc7948f5691.html Show response
offtherecord.com/templates/ 1 KB
790 B 13ms
12ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/featured-on.partial.e808beb00cc7948f5691.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 5d904be0b7b81df09b9197c0b09baac3340e08a583a17f64b75e1c0b467dd07f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:11 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407750
x-powered-by: Express
etag: W/"593-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: 9Gy0Skps-C0t1zkqZQ9CYJx_No4hLMdN_vwq-8kbyFHnVOwVUsVpAA==

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame C9A6 0
0 148ms
70ms Document
text/html 216.58.212.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3&co=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29tOjQ0Mw..&hl=de&v=8k85QBI-qzxmenDv318AZH30&size=invisible&cb=jls5s51dngpz

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/8k85QBI-qzxmenDv318AZH30/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f4.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-08FCss4QknOoEWZLmA0SCg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-08FCss4QknOoEWZLmA0SCg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 17 May 2024 13:55:41 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.Dsoa_Wdo28w.O/m=client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_vT9SKJEh9EgzMdmSuOtg3sj0vqg/ 318 KB
109 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.Dsoa_Wdo28w.O/m=client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_vT9SKJEh9EgzMdmSuOtg3sj0vqg/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67a8b91c7b7e19e80feb9b82d946c3eb063d7ef3c3b4f58eb8d60a3dacebaf2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 14:12:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 258220
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111053
x-xss-protection: 0
last-modified: Mon, 15 Apr 2024 18:15:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 May 2025 14:12:01 GMT

GET
H2 200 pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-s.woff2
fonts.gstatic.com/s/nunitosans/v15/ 30 KB
31 KB 175ms
35ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v15/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-s.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Nunito+Sans:wght@400;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1393acc632c160def86b45c2521c8ee742b7e6239d0d90fb95f51d55cf48b9c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 13:46:45 GMT
x-content-type-options: nosniff
age: 518936
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31052
x-xss-protection: 0
last-modified: Thu, 27 Apr 2023 00:27:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 11 May 2025 13:46:45 GMT

OPTIONS
H2 200 reviews
otr-backend-service-us-prod.offtherecord.com/api/v1/ Frame 0
0 254ms
117ms Preflight 100.25.50.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://otr-backend-service-us-prod.offtherecord.com/api/v1/reviews?includeAnonymous=false&includeDeleted=false&limit=24
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.25.50.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-25-50-51.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: api-token
Access-Control-Request-Method: GET
Origin: https://offtherecord.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept, Api-Token, X-Api-Token, X-Feature, X-Captcha-Token, X-Captcha-Version, X-Resource-Id
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
access-control-max-age: 3600
date: Fri, 17 May 2024 13:55:41 GMT
server: nginx/1.22.1

GET
H2 200 banner-alert.component.8a7c752689bd6dd38776.html Show response
offtherecord.com/templates/ 2 KB
925 B 10ms
9ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/banner-alert.component.8a7c752689bd6dd38776.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 0632be9691818d992c04349dc8030b55f18c2fe82ee831a4bf1a49d9198431ab

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 15:18:05 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 427056
x-powered-by: Express
etag: W/"601-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: vvsG24cag2pPtBo34pT2U2qTckdsc9P4lblb6FPhrHYuU2E-qdKljw==

GET
H2 200 side-nav.partial.6838a80488aaaa725f31.html Show response
offtherecord.com/templates/ 4 KB
1 KB 10ms
10ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/side-nav.partial.6838a80488aaaa725f31.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 031f287592b33afc19eee9195f23b5146d5922bc004dc439df3e3d8b0bf54008

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 11:17:33 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 182288
x-powered-by: Express
etag: W/"1153-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: GPf9DmFwqyzMvKUV8xyPycAeTrxbaTO0mPcKF8Diyso9tNnHeIzReQ==

GET
H2 200 app-text-reveal.component.ec73460453e9a8290e8b.html Show response
offtherecord.com/templates/ 304 B
676 B 9ms
9ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/app-text-reveal.component.ec73460453e9a8290e8b.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: d100a79e9ca4f220f81fd0729136ce2839c361f0850a3ddabb987bb04c99b925

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"130-18f176c4290"
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 304
x-amz-cf-id: EU73-LIpjuccILlNnEwR9qSoGxyESmomp1jHE-10fn3VtDr5SoQAlw==

GET
H2 200 stats-banner.component.1cdbc52a8051d62bdd92.html Show response
offtherecord.com/templates/ 3 KB
1 KB 10ms
10ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/stats-banner.component.1cdbc52a8051d62bdd92.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 9d64ce89336a149d954573c477ff7d9b320f92db397e754626c809b1d1313503

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 11:17:33 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 182288
x-powered-by: Express
etag: W/"ba1-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: Lrmvkq856SqaUWqgOUES-3MLpXOm3lKNGSnr_Ek1gOfQFrtiYu4GDQ==

GET
H2 200 reviews Show response
otr-backend-service-us-prod.offtherecord.com/api/v1/ 26 KB
4 KB 341ms
114ms XHR
application/json 100.25.50.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://otr-backend-service-us-prod.offtherecord.com/api/v1/reviews?includeAnonymous=false&includeDeleted=false&limit=24

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

100.25.50.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-25-50-51.compute-1.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

6002241965e81f2dc4d22a857056f179554f5bfcd682bc24df045425a7389b46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Api-Token: vKWrNZN8UMwxcqPxyRqbJo9x6OABtoqMA7scyCkpkSy82UcA
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
server: nginx/1.22.1
x-frame-options: DENY
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 faq-dropdown.1f8e8ecca146a162f7ea.html Show response
offtherecord.com/templates/ 1 KB
788 B 10ms
9ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/faq-dropdown.1f8e8ecca146a162f7ea.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 99141deb1e06c17d62b664d1b8bacde6c827cd0559a8cd2c2a81b45e0ac3304c

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 19:59:15 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 669386
x-powered-by: Express
etag: W/"42a-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: -9yKHZe_TLiyyY2B3fUX0F_pMQPuWUhWUA-v7iZDwGm9JRv3Byobrg==

GET
H2 200 9b29c8910f036259af20.webp
offtherecord.com/ 5 KB
5 KB 9ms
9ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/9b29c8910f036259af20.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/main.38e6b04a9facc3b0a6c9.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 3f0730cd0abfa61ab736fc7797e8d6ed2ad78d1b1a903a0664bcfb2f67b04adb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/main.38e6b04a9facc3b0a6c9.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"1344-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 4932
x-amz-cf-id: MF1AEt_21yt7xQZrVnrOuHo8_OeU4XlO_DprvzNstml2Vdr5lvR0kw==

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 39ms
36ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 13:57:28 GMT
x-content-type-options: nosniff
age: 259093
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 May 2025 13:57:28 GMT

GET
H2 200 pro-fa-solid-900-0.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 12 KB
12 KB 23ms
21ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-solid-900-0.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39f976b287176178a645cb4f743ec4f3dbb7a08c31ca34c3b096e7bba425c322

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:22 GMT
server: cloudflare
age: 3872643
etag: "660c297a-2ee4"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b478e883a9e-FRA
content-length: 12004

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 45ms
43ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 14:40:21 GMT
x-content-type-options: nosniff
age: 256520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 May 2025 14:40:21 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v40/ 18 KB
18 KB 53ms
51ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 00:32:18 GMT
x-content-type-options: nosniff
age: 566603
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18668
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:00:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 11 May 2025 00:32:18 GMT

GET
H2 200 pro-fa-brands-400-1.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 39 KB
39 KB 24ms
23ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-brands-400-1.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b852e041e35b676cf550d19cf8d15bc58db780a3827626518f4e0dfc5fb3109

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:13 GMT
server: cloudflare
age: 3872643
etag: "660c2971-9d0c"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b478e8a3a9e-FRA
content-length: 40204

GET
H2 200 pro-fa-brands-400-0.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 37 KB
37 KB 23ms
22ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-brands-400-0.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faf47e501cdae61064aed4b03b1129d37c6e004ebde6f6452f1632f835c9f318

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:13 GMT
server: cloudflare
age: 3872643
etag: "660c2971-946c"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b478e8d3a9e-FRA
content-length: 37996

GET
H2 200 otr-main-header-logo.svg
offtherecord.com/assets/img/ 9 KB
4 KB 26ms
20ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/otr-main-header-logo.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 648c698dd41bf291833204226476e7d092b281fd06255a70a4925f45ca8c96c2

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:58:10 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 464251
x-powered-by: Express
etag: W/"2495-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: 1Q6Xrfv3ZtDTjJpLe1HjdAQ-uDxXa6uZSrF1qKqmy1MdcWWb08I-cA==

GET
H2 200 badge_ios.webp
offtherecord.com/assets/img/ 2 KB
2 KB 17ms
12ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/badge_ios.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: f1e6a0811f0df7be7482db95552fd57017ca33d5a35f07c330859debd46d135c

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 23 Apr 2024 19:40:08 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Mon, 22 Apr 2024 18:27:06 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 2052933
x-powered-by: Express
etag: W/"6f4-18f070fc890"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 1780
x-amz-cf-id: etBhjRrbvqH2y2AI-ppvCBWV10BhCK1xtxlAyKN33ST3Vh-LpdHDNg==

GET
H2 200 badge_google_play.webp
offtherecord.com/assets/img/ 3 KB
4 KB 24ms
19ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/badge_google_play.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 6b771d8c7719a4d6187fb47de02b830ba0ccf68e66be12526786ded85cb960b2

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 11:17:33 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 182288
x-powered-by: Express
etag: W/"cd2-18f304cd220"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 3282
x-amz-cf-id: VQUdNlY5XODtqM2SIFdjsMIa7v3umUWefXb2uDHJkwr2JAnSxXCT9w==

GET
H2 200 hero-img.webp
offtherecord.com/assets/img/ 36 KB
37 KB 28ms
23ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/hero-img.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: c625a259d52303bc63e165e0326e1d78de9bb5b5074423f368df77fca407b7bf

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"90b4-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 37044
x-amz-cf-id: T2wOc7bLhSZ296N4cH0AU81UXFQuX8nzG6lq67Paj-PfTu6TlUwteA==

GET
H2 200 facebook--gray.webp
offtherecord.com/assets/img/logos/ 2 KB
2 KB 26ms
21ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/facebook--gray.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 7e3f2e5c9c0f642f19eb5d1488c3257ad89341700795e0e6253400c876c4e06d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 03:56:17 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 727164
x-powered-by: Express
etag: W/"7fe-18f304cd220"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 2046
x-amz-cf-id: wkj1VOjSxGruNnQtDGJgy49GADxb52hg76Fn8mBfECyu7RFDy4MeyA==

GET
H2 200 reviews-io--gray.webp
offtherecord.com/assets/img/logos/ 3 KB
3 KB 32ms
27ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/reviews-io--gray.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: e2eb49ebf978dd7140eacd08fca34dfe6da0db3bebdee08606996d00766d60af

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"c0a-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 3082
x-amz-cf-id: fPq1OtjwYGSUHIumRRkNBUQco8G45LQ2t0pezQbcMUFJHSnG5st57g==

GET
H2 200 google--gray.webp
offtherecord.com/assets/img/logos/ 5 KB
5 KB 43ms
38ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/google--gray.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: d52af8243ca6afe270829cfe2853cb79a486b81650f8b575374a220c311d5411

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"145c-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 5212
x-amz-cf-id: xrh2_z0fXpvxHZAPZQPGVyZnnAPgibHupwSykRqLUexqdGBHnVTl8g==

GET
H2 200 icon-handfull-stars.svg
offtherecord.com/assets/img/ 4 KB
2 KB 38ms
33ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-handfull-stars.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: c46812c7c91d67dcc84ac30ff32138415af25b3416ea5b6588628cb3e2d1f686

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"11aa-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: hXxW60qahvnXEUiSNVrl2KTlMIdas-2Bsl7xQERryyB8GpDWvZKNIA==

GET
H2 200 icon-wallet.svg
offtherecord.com/assets/img/ 2 KB
1 KB 39ms
32ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-wallet.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 8e742fbd7146cea9dee3a9c4b4474e1da43f62e8864d519c1debe7f10ec6043b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"7cf-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: -cH3syGW8FwnVqIR_MDTDOp-BJEkEMEq4UQWBZgJ2G_kq-hlnsxdHA==

GET
H2 200 icon-briefcase.svg
offtherecord.com/assets/img/ 2 KB
1 KB 40ms
33ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-briefcase.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a8510ffd3e9d2934e0ad67e81a2fc12f36e2b04ac3f3f150bd7e44ad12af3d76

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"79f-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: whBhGRBt4vU_pxpM9OZO6aBunGowOa1FczmJ2CtyKO5nns_k5uWZYg==

GET
H2 200 icon-refresh.svg
offtherecord.com/assets/img/ 2 KB
1011 B 45ms
38ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-refresh.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a3d2952330aefe690302e90460777d9b5c6fc354861336a919c83e44fe352800

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"6e0-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: HiRP8fzRa53tFMvtNM3eEd3I6unS-CX9ENvvVcQk1nl63hFEwVnYPw==

GET
H2 200 how-step-1.webp
offtherecord.com/assets/img/ 26 KB
26 KB 41ms
34ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/how-step-1.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: fac08aba895b0525de1904bc4fb04928ba03ec2cd715d084831f0dd265774bce

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"6680-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 26240
x-amz-cf-id: 7mkxs_WwOCNn9ZtNmpG8XjcbV3X5XfixseiYA0wLa4oBqGF8xMWq0g==

GET
H2 200 how-step-2.webp
offtherecord.com/assets/img/ 36 KB
37 KB 44ms
37ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/how-step-2.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 38ba6370b8d16de4ee7f82099425ead835ff7317d56bf86fe0f5bd34a1a266ef

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"9112-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 37138
x-amz-cf-id: NEX3fqMAuWPgJeEpT4EOFHa5xuvmasN4SUlLBv7Y58kqlW_ZvrDkGw==

GET
H2 200 how-step-3.webp
offtherecord.com/assets/img/ 27 KB
28 KB 48ms
41ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/how-step-3.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 099f5764acf448fdd12bdb9f709606093ea481ecf2b55f03f89ed8cbad7849fb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"6d12-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 27922
x-amz-cf-id: BBq_ZO-rR9b0-Q2-1xlRVDbo-aKFJR0lvi_0IwFWWuQVPQGJY-7Whw==

GET
H2 200 icon-tickets.svg
offtherecord.com/assets/img/ 3 KB
1 KB 46ms
39ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-tickets.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 2d367b9054bc5b92d423f2f9484c18d8b41468a7f4fd9e63829d3dba290a206e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 12:27:26 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 523695
x-powered-by: Express
etag: W/"d60-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: P38D-SWxJ-4S3QpVpoDMBTyjOt4WmAJxWshG24NTh-kc3sGaed-vAg==

GET
H2 200 icon-window-check.svg
offtherecord.com/assets/img/ 2 KB
1 KB 46ms
40ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-window-check.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 0e52361cb2f6af4bb1f5fa4f27c87ddb8c6d4918ccd75655bd1d1bb34d4eeabe

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"6b8-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: 3-LFO8XjkpfJRRgT-Aq2KXlnbgBwvlSu4TSOhnaGw_P0iaAwiLcoVQ==

GET
H2 200 icon-directions.svg
offtherecord.com/assets/img/ 2 KB
1 KB 47ms
41ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-directions.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a5d227b5d9c8b9b461d0a35df1c39685463fe0bd375c2aa2aa197dfd2776a7c8

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 11:17:33 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 182288
x-powered-by: Express
etag: W/"787-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: y6rEbR__n7NVGKdEZCSiWVoHXTEKq3SCkC7TCuTpaHR7LSoPcm32Dw==

GET
H2 200 icon-verified.svg
offtherecord.com/assets/img/ 3 KB
2 KB 58ms
52ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-verified.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 909c4adf1c2435d373b6e0d83ee64cc9888881ac24905238ea010b4da3d06b93

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"b51-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: DDWEAlD_Tnmzdk6ycDpHC-6x7VAhzifCcT6O7CBNMmcfrmPE4VUBfQ==

GET
H2 200 icon-money-back.svg
offtherecord.com/assets/img/ 2 KB
1 KB 56ms
51ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-money-back.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 17d2ee6ef525d4a35125c1ce7417ef5b7e1b611c2dc110a3add824bb078adcbf

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"897-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: R65ESNvt-Ts2tDw5TIgf0IeWUI4WUSsvDX7MnIfHWh00mRakojF78w==

GET
H2 200 icon-courthouse.svg
offtherecord.com/assets/img/ 3 KB
1 KB 62ms
56ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-courthouse.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 6a432ec996da0b400368eb6cf47f8e056f2b25e32a50b03d9a709fa6c1fecc1a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 19:59:15 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 669386
x-powered-by: Express
etag: W/"c41-18f304cd220"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: zslNGa4vKE3iuYAfD4w7iEwpfnhfwADkeACKFmtZR-sGb7W3dlYpYg==

GET
H2 200 icon-notification-bell.svg
offtherecord.com/assets/img/ 3 KB
1 KB 66ms
60ms Image
image/svg+xml 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-notification-bell.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: b07fffef0ae1504dfba7fb4096afb6e097815298973f51a1b211771e05c075b0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"a5c-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: Gs3f0D1cpZ0aJmOJ_EbVE-7-XBkqpCQBPu_z4tmNWaT6rez_Aa923w==

GET
H2 200 cbs-logo-bw-min.webp
offtherecord.com/assets/img/logos/ 2 KB
2 KB 63ms
58ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/cbs-logo-bw-min.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 98af017c05d0d89d07187e5fea5df961cfe0da03321de1daf05e545b663718a4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"866-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 2150
x-amz-cf-id: j9KoUtmZ42lrDKB9NiBqoBN3veCevkjThhJo_qE5YSOugoXcChos0w==

GET
H2 200 fox-news-logo-bw-min.webp
offtherecord.com/assets/img/logos/ 650 B
1012 B 64ms
59ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/fox-news-logo-bw-min.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: fdcc34060c0c6a0ec771d0a4f1e14f00092e96577e166be28d33b83ba72faa69

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 11:17:33 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 182288
x-powered-by: Express
etag: W/"28a-18f304cd220"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 650
x-amz-cf-id: TYxCtR1apeG0HtgS5xbWklDabRa4-GFST5VWMPIHykyRWbnZMk7gmg==

GET
H2 200 nbc-logo-bw-min.webp
offtherecord.com/assets/img/logos/ 2 KB
2 KB 66ms
61ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/nbc-logo-bw-min.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a6b9e77f842f68bf64b450048c752a189401955f45d149c5430fbc208469ffe0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 12:27:25 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 523696
x-powered-by: Express
etag: W/"76a-18f304cd220"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 1898
x-amz-cf-id: aucdnQbE4EfUMiiZTkfRFZk83iZkyEWp-30wG5Pg2NDcpAHMFx7OdQ==

GET
H2 200 geekwire-logo-bw-min.webp
offtherecord.com/assets/img/logos/ 3 KB
3 KB 69ms
64ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/geekwire-logo-bw-min.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: b1ec55a9e66fe05243e1977a0db2af48f4af4c07bfd0b9cdef32c01ab0f42b9d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"a46-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 2630
x-amz-cf-id: mEykkF67GFBhVGsVv8hG8q5Ks-3aqJNv-KvMyGwljDEPDUPdke68RQ==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 320 KB
105 KB 72ms
72ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-TMGSMNG8YY&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

424397b3ddedfa5e4f65f8073c0e2991caaa87f0671b7dda8a0df4c8397e608c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 107243
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 17 May 2024 13:55:41 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 42 KB
12 KB 91ms
8ms Script
application/javascript 2a04:4e42::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 5ccd2a2d0cfc8f7b36c238c935a36c751eb306a4f23788a0c6c33eec1a5a2071

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Tue, 07 May 2024 17:43:30 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "337f63427080a8d6a60316b759dab390"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 12083

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
58 KB 16ms
0ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 17 May 2024 13:55:41 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57845
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=20, mss=1326, tbw=6618, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: XpavybPs9Kr7mT/1cMSyVI6u99cyg2ZsOTPkzOEhhIo7jNlyTKrQk/eEuOlHsrqJh3NadyUT27pncPhu8B5eFA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 123ms
41ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Fri, 17 May 2024 13:55:40 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D1B584A177B34BB093B1B9750FF98B3A Ref B: FRAEDGE1109 Ref C: 2024-05-17T13:55:41Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 158ms
45ms Script
text/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 17 May 2024 12:20:27 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 5714
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Fri, 17 May 2024 14:20:27 GMT

GET
H3 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 49 KB
18 KB 153ms
73ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

52dcb3d5f761764b3c62050ef7a14d1680fe9af272212e1e3f54a0bb938e20a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18263
x-xss-protection: 0
server: cafe
etag: 15055761588684167684
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 17 May 2024 13:55:41 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 200 KB
72 KB 95ms
66ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-69140841-1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c3752e9c316702fad2dba976eb96dad99ba72380461fb36c67bd4f2766b303cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73825
x-xss-protection: 0
last-modified: Fri, 17 May 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 17 May 2024 13:55:41 GMT

GET
H2 200 24128821.js Show response
js.hs-scripts.com/ 2 KB
1 KB 402ms
304ms Script
application/javascript 2606:4700::6810:8bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/24128821.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d1d9410f310f55c6284b4c16146cf063c4f4015ea1b0b6a6dcef8a3fa97ae6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 880e2280-35b7-4d04-8d5b-e6c4afbc6421
x-envoy-upstream-service-time: 4
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 880e2280-35b7-4d04-8d5b-e6c4afbc6421
last-modified: Fri, 17 May 2024 10:27:21 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://offtherecord.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-5d47c8d44f-m28qb
access-control-allow-credentials: true
cache-control: public, max-age=90
cf-ray: 88541b472d492c1c-FRA
expires: Fri, 17 May 2024 13:57:11 GMT

GET
H/1.1 200
OK / Show response
websdk.appsflyer.com/ 34 KB
10 KB 89ms
10ms Script
application/javascript 2a02:26f0:3500:11::215:14ca
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://websdk.appsflyer.com/?st=pba&
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:11::215:14ca Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7ccf80229bbe586853232059978b67c1dbe6ccd7f6b4b8585b34bbcf2d9f195f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 13:55:41 GMT
Content-Encoding: gzip
x-amz-request-id: TNFWN7JAHP2EBEJM
x-amz-server-side-encryption: AES256
Connection: keep-alive
Content-Length: 9575
x-amz-id-2: rNwspp0GeeuGCVY8uOjVgWk/J3XTDq5+TTLu3jZaoCKMw4CAD3WOCSz6cVuBQQ9yvpK6HO0IqDY=
Last-Modified: Wed, 14 Jun 2023 06:58:46 GMT
Server: AmazonS3
ETag: "d4e7f1ffd74e53e33a46a668c2e9d67c"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=1725
Accept-Ranges: bytes
X-DataStream-Cache-Status: 1
Expires: Fri, 17 May 2024 14:24:26 GMT

GET
H2 200 b251b2efc9d8ee4fbafb.gif
offtherecord.com/ 2 KB
3 KB 10ms
9ms Image
image/gif 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/b251b2efc9d8ee4fbafb.gif
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/main.38e6b04a9facc3b0a6c9.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a05de9f3792048eff0cedc9370691b2a604cc1628f6aa9f70ad07444d2f02bdb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/main.38e6b04a9facc3b0a6c9.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:58:10 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:11 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 464251
x-powered-by: Express
etag: W/"9f2-18f304cce38"
x-cache: Hit from cloudfront
content-type: image/gif
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 2546
x-amz-cf-id: I20DXsU7S2cDg2dipvkVDsqNzcknLiQQ6dvU_INHx4HQkIwrgjfJFg==

OPTIONS
H2 200 user
otr-backend-service-us-prod.offtherecord.com/api/v1/ Frame 0
0 111ms
110ms Preflight 100.25.50.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=jqtdb86vdk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.25.50.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-25-50-51.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: api-token
Access-Control-Request-Method: GET
Origin: https://offtherecord.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept, Api-Token, X-Api-Token, X-Feature, X-Captcha-Token, X-Captcha-Version, X-Resource-Id
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
access-control-max-age: 3600
date: Fri, 17 May 2024 13:55:41 GMT
server: nginx/1.22.1

GET
H2 200 user Show response
otr-backend-service-us-prod.offtherecord.com/api/v1/ 163 B
584 B 291ms
113ms XHR
application/json 100.25.50.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=jqtdb86vdk

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

100.25.50.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-25-50-51.compute-1.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

7e7558ddd527f6452c7c72f510f48964f6319f317b314829c2786e42346c372e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Api-Token: vKWrNZN8UMwxcqPxyRqbJo9x6OABtoqMA7scyCkpkSy82UcA
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
server: nginx/1.22.1
x-frame-options: DENY
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 stats-banner-design.webp
offtherecord.com/assets/img/ 13 KB
14 KB 10ms
10ms Image
image/webp 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/stats-banner-design.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 4c64d183304fcb9316adeceed80e112ae71c6e33484b097896dbb6998d4b9659

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:12 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407749
x-powered-by: Express
etag: W/"353a-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 13626
x-amz-cf-id: R4C272eLfOaasr7EHckNwdZVVEni3oaQnSmvzb7xO6ZJPTTD-Bn9MA==

GET
H2 200 pro-fa-solid-900-12.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 14 KB
14 KB 35ms
35ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-solid-900-12.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7742bb16ac54dbccd2a9df6edc159ff921e1e738f08dc0d4b4b9f31424ede919

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:22 GMT
server: cloudflare
age: 3872643
etag: "660c297a-3878"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b481f1b3a9e-FRA
content-length: 14456

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 37ms
37ms Font
font/woff2 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f3.1e100.net

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 14:07:33 GMT
x-content-type-options: nosniff
age: 258488
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 May 2025 14:07:33 GMT

GET
H2 200 pro-fa-solid-900-14.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 13 KB
13 KB 39ms
38ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-solid-900-14.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7924fd2e6167be712d7efea6b2de21a7331899da86cc273461d4e40b5a522af3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:22 GMT
server: cloudflare
age: 3872643
etag: "660c297a-34b0"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b481f1d3a9e-FRA
content-length: 13488

GET
H2 200 pro-fa-solid-900-1.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 14 KB
14 KB 34ms
33ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-solid-900-1.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2b40eed2a14d541eb0ec80d05d29815fa18fd71c46455fc374a47a81226e9d6

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:22 GMT
server: cloudflare
age: 3872643
etag: "660c297a-36dc"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b481f203a9e-FRA
content-length: 14044

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 305 KB
87 KB 17ms
8ms Script
application/x-javascript 157.240.252.13
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=0223456b94637f2bb38f7f5b1ac9b4c8

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra3.fbcdn.net

Software

Resource Hash

c42a908e7cb3219e26e808d18cb1050f05d24cb31b8905fe0d70012507795b3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 17 May 2024 13:55:41 GMT
content-md5: DpALjN+CM6l0QEjw7AjNEA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 89047
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=23, mss=1232, tbw=4300, tp=9, tpl=0, uplat=0, ullat=-1
x-fb-debug: sa4Bg7IuyV31viQKEz68oRE/uhBe/Zn+LGk6qGdtwv/HyuJFfZifbsvi3mjt66qf0KpRNKkXD3TWOR/pXqwCKw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: c36227d465a766db103aaf2ad1094306
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "cbcad700ead17b155c90fd9c06c1dd2d"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Sat, 17 May 2025 13:04:16 GMT

GET
H2 200 tag-f27920e8127c636f988deb777d3577e5.js Show response
dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/ 185 KB
52 KB 86ms
47ms Script
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-f27920e8127c636f988deb777d3577e5.js
Requested by: Host: relay.offtherecord.com
URL: https://relay.offtherecord.com:447/j.php?a=660553&u=https%3A%2F%2Fofftherecord.com%2F&vn=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gams1 /
Resource Hash: 3d8e3be54a20aef89dda975f8e468db27fc034065c3b10e3780bd0812056c2fa

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:40 GMT
content-encoding: br
via: 1.1 google
last-modified: Fri, 17 May 2024 04:26:37 GMT
server: gams1
etag: "6646dc7d-ce52"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52818

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
208 B 150ms
111ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=660553&d=offtherecord.com&u=D723943AF291C77EF3243C39DB42F8B2C&h=b25ff7f75a2a6655dc56b158bc906b8e&t=false

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv2c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv2c
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=43200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35

GET
H2 200 web Show response
relay.offtherecord.com/s/settings/6DGA5/v1/ 5 KB
5 KB 156ms
156ms XHR
application/json 35.169.238.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/s/settings/6DGA5/v1/web
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.169.238.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-238-116.compute-1.amazonaws.com
Software: /
Resource Hash: 45303277878437cb8faafcbaf090aac7fd30089fd26bfe3bb4490641e7cec84f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: https://offtherecord.com
date: Fri, 17 May 2024 13:55:41 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: application/json; charset=utf-8

GET
H2 200 t2_veaca_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
700 B 28ms
14ms XHR
application/json 2a04:4e42::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_veaca_telemetry
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
content-encoding: gzip
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
server: snooserv
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
content-length: 98

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 22ms
7ms Image
image/gif 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1715954141575&id=t2_veaca&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=050a7cc9-44e1-4e7c-a629-1b9877259410&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_a8bbbcc6&dpm=&dpcc=&dprc=
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 204 16001542.js Show response
bat.bing.com/p/action/ 0
117 B 32ms
32ms Script
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/16001542.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Fri, 17 May 2024 13:55:40 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 40BCAF82DBDB4CEF8F01C4ABE3C1B8F9 Ref B: FRAEDGE1109 Ref C: 2024-05-17T13:55:41Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
285 B 80ms
79ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16001542&Ver=2&mid=3ac86358-6be6-4e39-abe1-44d30fee5645&sid=2619fdc0145511efbb4765c3f0bb3c8e&vid=261a0cc0145511ef8bbc2502a921da2e&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Fight%20Your%20Moving%20Violation%20%7C%20Traffic%20Ticket%20Lawyer%20Local%20%26%20Online&kw=traffic%20ticket%20lawyer,%20traffic%20ticket%20attorney,%20speeding%20ticket%20lawyer,%20fight%20traffic%20ticket,%20fight%20speeding%20ticket,%20contest%20ticket,%20traffic%20ticket,%20traffic%20lawyer,%20traffic%20attorney,%20speeding%20ticket&p=https%3A%2F%2Fofftherecord.com%2F&r=&lt=1065&evt=pageLoad&sv=1&rn=673055

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 May 2024 13:55:40 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7856FDB00D174306B10FF96A4C3FA1C5 Ref B: FRAEDGE1109 Ref C: 2024-05-17T13:55:41Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ecommerce.js Show response
www.google-analytics.com/plugins/ua/ 1 KB
962 B 37ms
36ms Script
text/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ecommerce.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:03:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3149
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 630
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 17 May 2024 14:03:12 GMT

GET
H3 200 185612438538592 Show response
connect.facebook.net/signals/config/ 56 KB
12 KB 170ms
170ms Script
application/x-javascript 157.240.252.13
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/185612438538592?v=2.9.156&r=stable&domain=offtherecord.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra3.fbcdn.net

Software

Resource Hash

d61c08de21fbc87ef485040ce4ca9a20c09251ae6799d5732af329da1849dfba

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 17 May 2024 13:55:41 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=14, rtx=0, c=23, mss=1232, tbw=4650, tp=12, tpl=0, uplat=160, ullat=1
pragma: public
x-fb-debug: f5beljLr8zf4jmMf52YRQmx4nzVosxvLuvfU5gRvfGDDiQuGFUcqwsTjcR1E+LZGYJLWfyBSaD8UzY74jhEKjg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
254 B 57ms
18ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-TMGSMNG8YY&gtm=45je45f0v9102325189z877772510za200&_p=1715954140764&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1495374524.1715954142&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.207%7CGoogle%2520Chrome%3B124.0.6367.207%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_s=1&sid=1715954141&sct=1&seg=0&dl=https%3A%2F%2Fofftherecord.com%2F&dt=Fight%20Your%20Moving%20Violation%20%7C%20Traffic%20Ticket%20Lawyer%20Local%20%26%20Online&en=page_view&_fv=1&_ss=1&tfd=1775
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-TMGSMNG8YY&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://offtherecord.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
254 B 58ms
19ms Ping
text/plain 2a00:1450:400c:c1d::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-TMGSMNG8YY&cid=1495374524.1715954142&gtm=45je45f0v9102325189z877772510za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-TMGSMNG8YY&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c1d::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://offtherecord.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 103ms
59ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-TMGSMNG8YY&cid=1495374524.1715954142&gtm=45je45f0v9102325189z877772510za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0&z=1117211360

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 237 KB
84 KB 65ms
65ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-937085283&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

368a80756eab36fac297e90b3c73486f7a8b2f8d1d7e1fa26a9610bd1ccc01d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86160
x-xss-protection: 0
last-modified: Fri, 17 May 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 17 May 2024 13:55:41 GMT

GET
H2 200 onelink Show response
wa.onelink.me/v1/ 13 B
363 B 69ms
35ms XHR
application/json 18.173.205.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://wa.onelink.me/v1/onelink
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.205.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-205-111.fra56.r.cloudfront.net
Software: /
Resource Hash: 38bc0f256821a9c0a02a1c0cedf8ff70c211e637ef77ac199de2fe0cf36ba9ec

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
via: 1.1 0140ca34c2d577c2578595f0c9e0050e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P12
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 13
x-amz-cf-id: tqX_Inz05jicPRAcdDdCZHqAQyPl7cZkD0vIb5lzgjz6GirvMgfeDw==

POST
H2 200 open Show response
relay.offtherecord.com/v1/ 323 B
712 B 394ms
183ms XHR
application/json 35.169.238.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:444/v1/open

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.169.238.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-169-238-116.compute-1.amazonaws.com

Software

/ Branch

Resource Hash

65a0b1c63a042df455830cfb23570063eb1017cd79760d106bdddb17ce3f5a5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
via: 1.1 8e6324c5a68bac8fd8e6eead6a5b73f2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: IAD55-P4
x-powered-by: Branch
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-branch-request-id: bf466d47-609d-405a-bae5-271742b2e947-2024051713
content-length: 323
x-amz-cf-id: 5J8rOE8DXEgsPJevOUaCD0-S0D38qRmhE2_nJ5lbFrYdLp1y5YfY0Q==

POST
H2 200 l.gif
dev.visualwebsiteoptimizer.com/ 35 B
176 B 103ms
102ms Ping
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/l.gif?experiment_id=50&account_id=660553&cu=https%3A%2F%2Fofftherecord.com%2F&combination=3&s=1&sId=1715954140&u=D723943AF291C77EF3243C39DB42F8B2C&ed=%7B%22tz%22%3A%22Europe%2FBerlin%22%2C%22tO%22%3A%22-2%22%2C%22lt%22%3A%221715954141715%22%2C%22r%22%3A%22%22%2C%22ul%22%3A%22de-de%22%2C%22de%22%3A%22UTF-8%22%2C%22sc%22%3A%2224%22%2C%22sr%22%3A%221600x1200%22%7D&vn=7.0.351&vns=undefined&vno=undefined&eTime=1715954140719&random=0.8800698912878793

Requested by

Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-f27920e8127c636f988deb777d3577e5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv2c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv2c
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

POST
H2 200 l.gif
dev.visualwebsiteoptimizer.com/ 35 B
98 B 105ms
105ms Ping
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/l.gif?experiment_id=46&account_id=660553&cu=https%3A%2F%2Fofftherecord.com%2F&combination=2&s=1&u=D723943AF291C77EF3243C39DB42F8B2C&vn=7.0.351&vns=undefined&vno=undefined&eTime=1715954140727&random=0.05642526287258898

Requested by

Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-f27920e8127c636f988deb777d3577e5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv2c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv2c
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

POST
H2 200 l.gif
dev.visualwebsiteoptimizer.com/ 35 B
98 B 105ms
104ms Ping
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/l.gif?experiment_id=28&account_id=660553&cu=https%3A%2F%2Fofftherecord.com%2F&combination=2&s=1&u=D723943AF291C77EF3243C39DB42F8B2C&vn=7.0.351&vns=undefined&vno=undefined&eTime=1715954140729&random=0.5533823808123717

Requested by

Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-f27920e8127c636f988deb777d3577e5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv2c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv2c
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H3 200 settings.js Show response
dev.visualwebsiteoptimizer.com/ 10 KB
2 KB 32ms
32ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/settings.js?a=660553&settings_type=1&vn=7.0&exc=28|46|50
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-f27920e8127c636f988deb777d3577e5.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gams1 /
Resource Hash: f8d846ab829fbebc64121363ad15ae68ab779e8e124d94ced402bcb048e42878

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
content-encoding: gzip
via: 1.1 google
server: gams1
etag: W/"1715920010"
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
53 B 105ms
104ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=660553&u=D723943AF291C77EF3243C39DB42F8B2C&s=1715954140&p=1&tags={%22si%22:{%2250%22:%223%22,%2246%22:%222%22,%2228%22:%222%22}}&update=1&cq=0&vn=7.0.351&vns=undefined&vno=undefined&_cu=https%3A%2F%2Fofftherecord.com%2F&eTime=1715954140782&random=0.17055017642104597

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv2c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv2c
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/24128821/ 71 KB
23 KB 197ms
135ms Script
text/javascript 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/24128821/banner.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/24128821.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fa8412e22a263baf0081df39a3ae64d5caa1a1c22ecbe8b865e1751792de101

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
x-amz-version-id: rk9XJpuCBNJd8V8VIEUJiw1jZ4CkcV93
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: RRQD4SBD9TNV8HEM
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 269b59a6-49f4-4a9e-86e8-616d7b25282a
x-envoy-upstream-service-time: 76
x-amz-id-2: riOVQqxyVK1MhZ4x/FEEx4lSMBt77rDU3q/UqOQiguJ9JqDKIR9lbCLDTnvnmbv99duHcdYdzWw=
x-evy-trace-listener: listener_https
x-request-id: 269b59a6-49f4-4a9e-86e8-616d7b25282a
x-evy-trace-route-configuration: listener_https/all
last-modified: Thu, 18 Apr 2024 15:13:47 GMT
server: cloudflare
etag: W/"f6665e5b886313582732efeab4c1a4e6"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://offtherecord.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-pvzd8
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 88541b4ac9122c4e-FRA
expires: Fri, 17 May 2024 14:00:41 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 82 KB
25 KB 174ms
140ms Script
application/javascript 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/24128821.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf6683ec2fb825072bc67ba2b4831425951dc365245d5334ca6f2150f50e1590

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1122/bundles/project.js&cfRay=88541b4a9e1937d2-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"fa60ef0d372e46facb8180b2d901ba81"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1122/bundles/project.js
date: Fri, 17 May 2024 13:55:41 GMT
x-amz-version-id: TKnbzs9HpFoaV4UGBsfs5UANej3HQBO9
via: 1.1 53b70ac9dc46d1c13992b291cf22a9aa.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: f75fe9ab-54fe-42d5-b1c6-342aabf1a47b
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-request-id: f75fe9ab-54fe-42d5-b1c6-342aabf1a47b
last-modified: Tue, 14 May 2024 11:26:52 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HsxEfHwL6hAXFh0qpiIHajfDVykarFvn2A7kSF6XVp25tyjd365ZUIj8I6%2BJ6QGTUeI1WAkGzQJ4%2B1jmqEqeaaJO1COjjj1i8Y%2BvLXzjoYGhyOrl5rIPm7t0F5DVeS3yTKHAzCu%2Fan3KLVvj"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-w988t
cf-ray: 88541b4a9e1937d2-FRA
x-amz-cf-id: KZlkSkS1xp26OSoCl5owG7VltaLtpg2gYBY0Pw5cUXOWmXAA08a5nw==

GET
H2 200 24128821.js Show response
js.hs-analytics.net/analytics/1715954100000/ 67 KB
21 KB 168ms
131ms Script
text/javascript 2606:4700::6811:afc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1715954100000/24128821.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/24128821.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: adf138613e55c65103aaada7a42614be1d0d604596e4ce3b2d0319e823bb0628

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: X3AEEHXHW38SFAG3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: b5e0928c-5a20-428b-99c2-e653f7024fe5
x-envoy-upstream-service-time: 18
x-amz-id-2: PegcDEoOTqZ/WXQ0TImqvsv5hIIqCC17+CPNB2q06JkBSp60Ztq+Chfkp35v18JetjmMweyrb/c=
x-evy-trace-listener: listener_https
x-request-id: b5e0928c-5a20-428b-99c2-e653f7024fe5
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 24 Apr 2024 18:58:20 GMT
server: cloudflare
etag: W/"2921ffc0801c863d1f941404464ee4ea"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-q4rbs
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 88541b4a9b7c9b4c-FRA
expires: Fri, 17 May 2024 14:00:41 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 166ms
129ms Script
application/javascript 2606:4700::6810:6dfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/24128821.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6dfe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53a3dc763a0bd679523a77f5610e4ab27231fe6763d7089c1c92966daa1663f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.503/bundles/project.js&cfRay=88541b4a9f4635fd-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"7d377a186677c174f204d466b8fa5fdb"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: collected-forms-embed-js/static-1.503/bundles/project.js
date: Fri, 17 May 2024 13:55:41 GMT
x-amz-version-id: WQne3xdBhaNpu67z_dXMAVxQ_qJQQf8W
via: 1.1 9d2dee9b44718f249b789987d2cbe62c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: f2356aae-d503-4de1-bfa2-e23d8ae43a91
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 9
x-evy-trace-route-configuration: listener_https/all
x-request-id: f2356aae-d503-4de1-bfa2-e23d8ae43a91
last-modified: Wed, 15 May 2024 14:34:44 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-vdptk
cf-ray: 88541b4a9f4635fd-FRA
x-amz-cf-id: AKKKlUSBsETdIBdenv2eKgu1PVSaRHb1pHId5Vpcy4Tp61FsPMUY1Q==

OPTIONS
H2 200 logout
otr-backend-service-us-prod.offtherecord.com/api/v1/authentication/ Frame 0
0 111ms
111ms Preflight 100.25.50.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://otr-backend-service-us-prod.offtherecord.com/api/v1/authentication/logout
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.25.50.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-25-50-51.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: api-token,content-type
Access-Control-Request-Method: POST
Origin: https://offtherecord.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept, Api-Token, X-Api-Token, X-Feature, X-Captcha-Token, X-Captcha-Version, X-Resource-Id
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
access-control-max-age: 3600
date: Fri, 17 May 2024 13:55:41 GMT
server: nginx/1.22.1

POST
H2 200 logout Show response
otr-backend-service-us-prod.offtherecord.com/api/v1/authentication/ 0
442 B 113ms
112ms XHR
text/plain 100.25.50.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://otr-backend-service-us-prod.offtherecord.com/api/v1/authentication/logout

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

100.25.50.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-25-50-51.compute-1.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Api-Token: vKWrNZN8UMwxcqPxyRqbJo9x6OABtoqMA7scyCkpkSy82UcA
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
server: nginx/1.22.1
x-frame-options: DENY
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

POST
H2 200 page Show response
relay.offtherecord.com/rec/ 1 KB
775 B 397ms
183ms XHR
application/json 35.169.238.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/rec/page
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.169.238.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-238-116.compute-1.amazonaws.com
Software: /
Resource Hash: 5832eb7492a1cfe8830af0012c3ed28aec922548cdf6b50f87daf4d19fa34cf9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://offtherecord.com
date: Fri, 17 May 2024 13:55:42 GMT
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: application/json; charset=utf-8

POST
H2 200 events Show response
wa.appsflyer.com/ 80 B
535 B 76ms
35ms XHR
application/json 18.66.112.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://wa.appsflyer.com/events?site-id=26de086f-993b-4d92-9fb8-a2ee6128f041
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-46.fra56.r.cloudfront.net
Software: /
Resource Hash: 8a0e8a9389d882a4c0378fdf5334dcc7b535daa369fc6169c6adf4b72f209043

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 17 May 2024 13:55:41 GMT
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 80
x-amz-cf-id: 1oG5GfCXtlfaccKPnueqaDDokqgrDLBLYZ00n4Rr3rWvBeioGvKIhg==

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 44ms
44ms XHR
text/plain 216.58.206.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1794814757&t=pageview&_s=1&dl=https%3A%2F%2Fofftherecord.com%2F&ul=de-de&de=UTF-8&dt=Fight%20Your%20Moving%20Violation%20%7C%20Traffic%20Ticket%20Lawyer%20Local%20%26%20Online&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAUIRAAAAACAAI~&jid=1392296846&gjid=11785394&cid=1495374524.1715954142&tid=UA-69140841-1&_gid=551364976.1715954142&_r=1&gtm=457e45f0za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&jsscut=1&did=i5iSjo&npa=1&z=1212798718

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://offtherecord.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 user
otr-backend-service-us-prod.offtherecord.com/api/v1/ Frame 0
0 111ms
110ms Preflight 100.25.50.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=8no7atojoyx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.25.50.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-25-50-51.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: api-token
Access-Control-Request-Method: GET
Origin: https://offtherecord.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept, Api-Token, X-Api-Token, X-Feature, X-Captcha-Token, X-Captcha-Version, X-Resource-Id
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
access-control-max-age: 3600
date: Fri, 17 May 2024 13:55:41 GMT
server: nginx/1.22.1

GET
H2 200 user Show response
otr-backend-service-us-prod.offtherecord.com/api/v1/ 163 B
584 B 111ms
111ms XHR
application/json 100.25.50.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=8no7atojoyx

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

100.25.50.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-25-50-51.compute-1.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

7e7558ddd527f6452c7c72f510f48964f6319f317b314829c2786e42346c372e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Api-Token: vKWrNZN8UMwxcqPxyRqbJo9x6OABtoqMA7scyCkpkSy82UcA
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:42 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
server: nginx/1.22.1
x-frame-options: DENY
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 review-rating.component.170c675fa134251aaf4c.html Show response
offtherecord.com/templates/ 948 B
1 KB 11ms
11ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/review-rating.component.170c675fa134251aaf4c.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 2d95f71505cec68b09ebcbad4208d2ede280629de1b62c329cca5aab65fad29a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:13 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407748
x-powered-by: Express
etag: W/"3b4-18f176c4290"
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 948
x-amz-cf-id: 66ClszObez7iXc9IaGeJ2Mq9Zi5t8cRo-VzrfJsDxPydsRx76CTszQ==

GET
H2 200 avatar-image-fallback.component.6d85a17c6b223631488b.html Show response
offtherecord.com/templates/ 88 B
458 B 12ms
12ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/avatar-image-fallback.component.6d85a17c6b223631488b.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 091c27084bee9182fda190c70ab01d92f1f32c72be2f4dd37946f62c315ec574

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:58:10 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 464251
x-powered-by: Express
etag: W/"58-18f304cd220"
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 88
x-amz-cf-id: CL6MA5l_EsUCtv0e9eFB8fZOrwnPuCcLivuBUjVoeLIADnY_NKsRrQ==

GET
DATA 200
OK truncated
/ 330 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1feff37397f802603ed85e9061608051d5b2a77cea125d78519057d06232b07b

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 331 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8a73d9886283369e97c809bb8b7af15cab6263559318fb730256f6da6a720426

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 330 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 85ddb6693cdac9f66361f0f0c54ba4c07eb5b0a202ff94f8692c241bc1ae1fdb

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 330 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4333f5dde7ebbe95817db62d45966b8b0ea878734e0ebdceb3cbf93b0b2620d0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 331 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45295a811f899c7eea5e4d0312049da477390afc2a94ffa491dc6979cc34c9ec

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 331 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1153b55bebff3c11194b85fe0b16ff2378fcf8c0b10a220727eb4ad762491d5c

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 331 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 35badedf2f470a003c142adac2b71949647c08863bc1010be3c418e3ad2d4850

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 production Show response
anhkgav0.apicdn.sanity.io/v2023-07-12/data/query/ 7 KB
3 KB 84ms
22ms XHR
application/json 34.102.211.197
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://anhkgav0.apicdn.sanity.io/v2023-07-12/data/query/production?query=*%5B_type+%3D%3D+%22faq%22+%26%26+%22home-page-faq%22+in+category+%26%26+state-%3EstateName+%21%3D+%22Florida%22%5D+%7C+order%28orderRank%29&perspective=published

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.102.211.197 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

197.211.102.34.bc.googleusercontent.com

Software

Resource Hash

95714ca3ccfc5da0a5d441212199e9dcaf09416e2e2137d964d3d9fde2f12289

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-sanity-shard: gcp-eu-w1-01-prod-1034
date: Fri, 17 May 2024 13:39:17 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
apicdn-cache-control: public, max-age=60, s-maxage=3600, stale-while-revalidate=60, stale-if-error=3600
via: 1.1 google
server-timing: api;dur=19
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2368
sanity-query-hash: 5eeh4a+as7Q uxvbys1qyTQ
access-control-max-age: 600
x-sanity-age: 984
content-type: application/json; charset=utf-8
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Content-Type, Content-Length, ETag, X-Sanity-Deprecated, X-Sanity-Warning
cache-control: public, max-age=60, s-maxage=60, stale-while-revalidate=15, stale-if-error=3600
access-control-allow-credentials: true
vary: accept-encoding, origin
accept-ranges: bytes

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 32ms
9ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=185612438538592&ev=PageView&dl=https%3A%2F%2Fofftherecord.com%2F&rl=&if=false&ts=1715954141945&sw=1600&sh=1200&v=2.9.156&r=stable&ec=0&o=4126&fbp=fb.1.1715954141944.1009228175&ler=empty&cdl=API_unavailable&it=1715954141596&coo=false&rqm=GET

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=10, mss=1326, tbw=2780, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 17 May 2024 13:55:41 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 21ms
20ms XHR
text/plain 2a00:1450:400c:c1d::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69140841-1&cid=1495374524.1715954142&jid=1392296846&gjid=11785394&_gid=551364976.1715954142&npa=1&_u=aGDAAUIQAAAAACAAI~&z=1850965623

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c1d::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 17 May 2024 13:55:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://offtherecord.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 onelink Show response
wa.onelink.me/v1/ 51 B
509 B 34ms
33ms XHR
application/json 18.173.205.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://wa.onelink.me/v1/onelink?af_id=f8a5315d-4b07-4e53-826a-64271bedef67-p
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.205.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-205-111.fra56.r.cloudfront.net
Software: /
Resource Hash: 1fbf09348c9004e268bf288f269b4bea71b06bb33fee42a546d73251e3fe0cd9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
via: 1.1 0140ca34c2d577c2578595f0c9e0050e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P12
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 51
x-amz-cf-id: vUpsoFJAOn7rP2WlHauCb6zXRpCyfAHnXpAR_QMVfPA17oFmxBytAA==

GET
H2 200 user-rating.component.e3e94106426db1e8d981.html Show response
offtherecord.com/templates/ 2 KB
877 B 10ms
9ms XHR
text/html 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/user-rating.component.e3e94106426db1e8d981.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: cafed8afce97ffc3d420081a23c193ac0dc3d2c70454332284233b3d151da5ad

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:14 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407748
x-powered-by: Express
etag: W/"913-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: DQjzjOKIyxERMFWOqArLrEfWPEJs819vtXux-l-CEN97xCzuL4UxJg==

GET held4qD.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET 704556.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET 691985.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET 621656.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET UTMPVgY.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET H4A4R90.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET 692094.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET 9Zo9U02.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET fn7gwCn.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET 49643.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET 643914.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 0
0

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 70ms
69ms Image
image/gif 216.58.212.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69140841-1&cid=1495374524.1715954142&jid=1392296846&npa=1&_u=aGDAAUIQAAAAACAAI~&z=1634706462

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 60ms
60ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69140841-1&cid=1495374524.1715954142&jid=1392296846&npa=1&_u=aGDAAUIQAAAAACAAI~&z=1634706462

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 17 May 2024 13:55:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pro-fa-solid-900-13.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 14 KB
14 KB 38ms
38ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-solid-900-13.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5fb457fc69058cd84b72db3a52c0ef9961aa7d18e7bab081d7f1953a7cc23dd

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:22 GMT
server: cloudflare
age: 3872427
etag: "660c297a-37d0"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b4c2c0a3a9e-FRA
content-length: 14288

GET
H2 200 pro-fa-light-300-1.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 18 KB
18 KB 37ms
37ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-light-300-1.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6892a725066e5a0c71c46574e9e5c2459c51c067c9ecd576abe77a70f442b2d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:16 GMT
server: cloudflare
age: 3872360
etag: "660c2974-4678"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b4c2c123a9e-FRA
content-length: 18040

GET
H2 200 pro-fa-light-300-13.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 17 KB
17 KB 30ms
30ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-light-300-13.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fca26b24960b9a7badc3221b8c2d0daf2f7fe9f1774da08ca290ab56bc62cd5f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:16 GMT
server: cloudflare
age: 3872360
etag: "660c2974-4484"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b4c2c153a9e-FRA
content-length: 17540

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 433 B
1 KB 148ms
135ms Fetch
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=24128821&currentUrl=https%3A%2F%2Fofftherecord.com%2F

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4bf8910a202b24bd61be26e28eaa8c5f83a48d78999b2693a9cbdf4c9910cf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 83dfc52c-8ee1-46f4-9a8a-3b622dcdf39b
content-encoding: br
x-envoy-upstream-service-time: 9
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 83dfc52c-8ee1-46f4-9a8a-3b622dcdf39b
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://offtherecord.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Vo5AnO%2BwJDSHqybLc3fxL2S6icgEPcX0CJmKuolYojo38060gcjkInCv%2FDe%2BEcZZ5JeAccLKYloml%2F7lrjCsD5Tgw88ikdrNgdGe8Z9zGNWU3aUprgk0VoWS60zZTpRHnJGuFaUenOohEFTiBUybBVK9Hvb8OkQAQg%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 88541b4c58be37d2-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-kkb7j

POST
H2 200 logout Show response
relay.offtherecord.com/v1/ 190 B
617 B 181ms
180ms XHR
application/json 35.169.238.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:444/v1/logout

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.169.238.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-169-238-116.compute-1.amazonaws.com

Software

/ Express

Resource Hash

42119792161a48aae91252fb78b97aded555739362e430b14ecd66cb79e6eaf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8e6324c5a68bac8fd8e6eead6a5b73f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: IAD55-P4
etag: W/"be-i3ECr4HFiOnjJkcU13L72klwgNc"
x-powered-by: Express
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-branch-request-id: 54e504787ea346f594966ef34b9c1e4f-2024051713
content-length: 190
x-amz-cf-id: WYOeeyChHJDYDAFfj7IsZhpC2b4F_YDnkvyNdZxP5Yul3ubuLxoEZA==

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 135 B
447 B 128ms
128ms XHR
application/json 2606:4700::6810:6dfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=24128821&utk=

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6dfe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d1ce97752f29df67b0b336f715364cb0b902c9a9cbe004f9956767448da360d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f664b593-585d-4c1f-9d21-996bcc6294a2
x-envoy-upstream-service-time: 9
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f664b593-585d-4c1f-9d21-996bcc6294a2
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://offtherecord.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-mgch5
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 88541b4c899d35fd-FRA

GET
H2 200 integrations Show response
relay.offtherecord.com/rec/ 4 KB
5 KB 134ms
134ms Script
text/javascript 35.169.238.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/rec/integrations?OrgId=6DGA5
Requested by: Host: relay.offtherecord.com
URL: https://relay.offtherecord.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.169.238.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-238-116.compute-1.amazonaws.com
Software: /
Resource Hash: fda8e2340dd0d31581f956b339da1e9533a2c6838d385e672f984d069dab2a62

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
via: 1.1 google
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: text/javascript; charset=utf-8

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
926 B 163ms
133ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 6cc29e80-7c2f-4df7-bace-c951067369f0
x-envoy-upstream-service-time: 6
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6cc29e80-7c2f-4df7-bace-c951067369f0
last-modified: Fri, 17 May 2024 13:55:42 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-rcnzv
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 88541b4d79ca1e5a-FRA

POST
H2 200 logout Show response
relay.offtherecord.com/v1/ 190 B
615 B 184ms
184ms XHR
application/json 35.169.238.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:444/v1/logout

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.169.238.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-169-238-116.compute-1.amazonaws.com

Software

/ Express

Resource Hash

e42906ddfbfe6e976dc6430c8951a442737559c9fc5abdf81e5c551135f4d9af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8e6324c5a68bac8fd8e6eead6a5b73f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: IAD55-P4
etag: W/"be-h+BHcnnfk0StrXvOYvI0uA0a1So"
x-powered-by: Express
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-branch-request-id: d9ace9bc3adf421d9657f1eb4c4a9cce-2024051713
content-length: 190
x-amz-cf-id: mDg47kIZnIiRPWpVuP966Em9waE_x46rtjv--9zxwEyC_o7EM7uLCw==

GET
H2

200

latest.js Show response
edge.fullstory.com/datalayer/v4/
Redirect Chain

https://relay.offtherecord.com/datalayer/v4/latest.js
https://edge.fullstory.com/datalayer/v4/latest.js

43 KB
12 KB

81ms
16ms

Script
application/javascript

35.201.112.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/datalayer/v4/latest.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Server: 35.201.112.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3b604f1e389d668b8535edb53e650780275dfa02e874ecc98c8f72c38662799f

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Fri, 17 May 2024 13:01:22 GMT
content-encoding: gzip
age: 3260
x-guploader-uploadid: ABPtcPrO4V3jg-qkjiDMloFFArTK-o-K5qx835xAcv-iLhMVqwXFo0WQKcLMeTkXD7QcdBM2DXk
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11986
last-modified: Fri, 10 May 2024 14:58:37 GMT
server: UploadServer
etag: "182b49f0262c0a0e6504cd3dfd20a137"
x-goog-generation: 1715353117275502
x-goog-hash: crc32c=cN3mUA==, md5=GCtJ8CYsCg5lBM09/SChNw==
access-control-allow-origin: *
content-type: application/javascript
cache-control: public, max-age=3600,no-transform
x-goog-stored-content-length: 11986
accept-ranges: bytes
expires: Fri, 17 May 2024 14:01:22 GMT

Redirect headers

location: https://edge.fullstory.com/datalayer/v4/latest.js
date: Fri, 17 May 2024 13:55:42 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72
content-type: text/html; charset=utf-8

POST
H2 200 pageview Show response
relay.offtherecord.com/v1/ 29 B
347 B 221ms
221ms XHR
application/json 35.169.238.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:444/v1/pageview

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.169.238.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-169-238-116.compute-1.amazonaws.com

Software

/ Branch

Resource Hash

c3dd5a6fff633c6393dca21ce74cd6dc95265943575b43d2d9616f020eea68fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8e6324c5a68bac8fd8e6eead6a5b73f2.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P4
x-powered-by: Branch
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 29
x-amz-cf-id: 3jmxwvtznH0Ox-JrHkCIIOn39nqkax8Ue37jrsXdlV5QxQDxrdF3cA==

GET
H2 200 eb79c0b24a5a9494cd36.png
offtherecord.com/ 5 KB
6 KB 10ms
9ms Image
image/png 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/eb79c0b24a5a9494cd36.png
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/main.38e6b04a9facc3b0a6c9.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 072583eaca4f4cf965ff3913f7bffe2108cb46c91f28a51cff411e91459ca836

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/main.38e6b04a9facc3b0a6c9.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 06:53:14 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1407748
x-powered-by: Express
etag: W/"1534-18f176c4290"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 5428
x-amz-cf-id: l7tLYszY_iWgajUms_G-kNn6clt0SwWJyMXwsaXbqEJSs-Y2LXCeEw==

GET
H2 200 pro-fa-regular-400-12.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 17 KB
17 KB 26ms
26ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-regular-400-12.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af04f015df3bbffd125ee30eaf78e7f1c9328f5b967d66f7b7f8958472464dda

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Origin: https://offtherecord.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:42 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:17 GMT
server: cloudflare
age: 3872643
etag: "660c2975-4244"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 88541b4f1f7b3a9e-FRA
content-length: 16964

GET
H2 200 59.aeb7bdac240964840cb2.js Show response
offtherecord.com/ 5 KB
2 KB 15ms
8ms Script
application/javascript 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/59.aeb7bdac240964840cb2.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/main.23e6b8d8263921a9720d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: dcf098fa11979ad3c4217bbdc012292d2aa9ea75aa644501fd7d9b3bc67c0c43

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 29 Apr 2024 12:54:07 GMT
content-encoding: gzip
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Thu, 25 Apr 2024 22:42:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 1558896
x-powered-by: Express
etag: W/"157c-18f176c4290"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: aWi5o4JhayirYkMsX7qfUsqQWeGTUy_dnajD2Sby8yaP-WOpNh2cmQ==

GET
H2 200 config_iframe.html
wchat.freshchat.com/widget/ Frame 3AA7 0
0 337ms
118ms Document
text/html 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/widget/config_iframe.html?host=https://wchat.freshchat.com&token=c36ed4b1-ac05-4052-a91f-83203339cd7c&origin=https://offtherecord.com

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-encoding: gzip
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
content-type: text/html
date: Fri, 17 May 2024 13:55:43 GMT
last-modified: Wed, 08 May 2024 05:23:06 GMT
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
server: fwe
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1
x-fw-ratelimiting-managed: false
x-request-id: 757b96c1-e60c-4e7b-a9b3-c1391e5a59e7
x-server: sksnl
x-trace-id: 00-72606b53c5d64c5f61882fa252cf7cc1-855de0fb18f88860-00
x-xss-protection: 1; mode=block

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 172ms
133ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=2492303821&v=1.1&a=24128821&rcu=https%3A%2F%2Fofftherecord.com%2F&pu=https%3A%2F%2Fofftherecord.com%2F&t=Fight+Your+Moving+Violation+%7C+Traffic+Ticket+Lawyer+Local+%26+Online&cts=1715954143195&vi=bb5fa32989c821e0ef0f76b36e1629b2&nc=true&u=77102922.bb5fa32989c821e0ef0f76b36e1629b2.1715954143187.1715954143187.1715954143187.1&b=77102922.1.1715954143187&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 40673c8b-c8c2-44d7-bf1f-11b599e4b2e9
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 7
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 40673c8b-c8c2-44d7-bf1f-11b599e4b2e9
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N9oMYG6PMRZVsm8f5qubnStAT2m49YJ6xUhRdpOEqVo9aXwlw%2BRPGY0mpd7Fc1S7F0%2F2jP%2B18IAK0tEoyduYsUZN3GbFobMwUwJrp%2B8ourbikaImVDpY2dR8wQezUznHfyP6c2OXgsOCBnUDhm1S"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-xnssc
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 88541b533d96365d-FRA
x-robots-tag: none

GET
H2 200 fc-pre-chat-form.css
snippets.freshchat.com/css/ 2 KB
1 KB 41ms
9ms Stylesheet
text/css 52.222.214.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://snippets.freshchat.com/css/fc-pre-chat-form.css
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/59.aeb7bdac240964840cb2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-121.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9027bc2ee5d559beeb81d822fd8e1b8962f6be256aaed95aca74a0a519406c3a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 7OnEBywXzVAA7dOf2qysIqyO2hTJpPUZ
content-encoding: br
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
date: Fri, 17 May 2024 13:54:02 GMT
last-modified: Wed, 30 Oct 2019 14:02:09 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P3
age: 102
x-amz-server-side-encryption: AES256
etag: W/"4e65817d49212c3bd08daf7ba74670a9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=3600
x-amz-cf-id: eF5gUowDzU1CVGA0SeTZI3FhLcksBlhUOM1kqUiLRVmGGD-h4rVyng==

GET
H2 200 favicon.ico
offtherecord.com/assets/img/favicon/ 34 KB
34 KB 11ms
10ms Other
image/x-icon 99.86.4.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/assets/img/favicon/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-113.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: c5832c43af37aceae73a95406f6115fbbe18b09d463fea354f371c79ae7b9027

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:58:13 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 18:38:12 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 464250
x-powered-by: Express
etag: W/"86be-18f304cd220"
x-cache: Hit from cloudfront
content-type: image/x-icon
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 34494
x-amz-cf-id: agvWdb6IY02FL5ptmbEWY3t9nwT-CfBRmgv7wS66ADHhWaZm0gwoRQ==

GET
H2 200 /
wchat.freshchat.com/widget/ Frame B22B 0
0 114ms
113ms Document
text/html 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-encoding: gzip
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
content-type: text/html
date: Fri, 17 May 2024 13:55:43 GMT
last-modified: Wed, 08 May 2024 05:23:06 GMT
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
server: fwe
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1
x-fw-ratelimiting-managed: false
x-request-id: 804dba28-8105-4d99-bd53-1a2f7dcd25c3
x-server: dl2xr
x-trace-id: 00-33344a266f6e2c015db3f6cffb84e6f0-60322e0dbcbe48fd-00
x-xss-protection: 1; mode=block

GET
H2 200 widget.css
wchat.freshchat.com/widget/css/ 9 KB
2 KB 116ms
116ms Stylesheet
text/css 34.196.69.230
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/widget/css/widget.css?t=1715954143644

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.196.69.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-196-69-230.compute-1.amazonaws.com

Software

fwe /

Resource Hash

58e78ddbe7394cd14a1e3bc3d8a85a8f9a5c319653ce2a50008ed33560df6b1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-envoy-upstream-service-time: 2
x-xss-protection: 1; mode=block
x-request-id: 9772e4ca-ca41-453d-abc6-b78fad49aa49
x-trace-id: 00-a8e58713c74fbeb18fe03b2a88679cae-cfd7177ef40bc9ed-00
last-modified: Wed, 08 May 2024 05:23:06 GMT
server: fwe
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: text/css
x-fw-ratelimiting-managed: false
cache-control: max-age=31536000,no-cache, no-store, must-revalidate, pre-check=0, post-check=0,public
x-server: dl2xr
expires: Sat, 17 May 2025 13:55:43 GMT

GET
H2 200 co-browsing.js Show response
wchat.freshchat.com/widget/js/ 26 KB
8 KB 114ms
114ms Script
application/javascript 34.196.69.230
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/widget/js/co-browsing.js

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.196.69.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-196-69-230.compute-1.amazonaws.com

Software

fwe /

Resource Hash

1e10e9493470eb296ba1ba705a39455e226be2906bd24a41e1f2b8287ff8f62b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-envoy-upstream-service-time: 1
x-xss-protection: 1; mode=block
x-request-id: e0f2f7ee-2b26-4402-a642-5cce47ed8b98
x-trace-id: 00-d33aed36ddc89cf03333883ebe0e6e49-a9a4984c4771880e-00
last-modified: Wed, 08 May 2024 05:23:06 GMT
server: fwe
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/javascript
x-fw-ratelimiting-managed: false
cache-control: max-age=31536000,no-cache, no-store, must-revalidate, pre-check=0, post-check=0,public
x-server: dl2xr
expires: Sat, 17 May 2025 13:55:44 GMT

GET
H2 200 cb.css
wchat.freshchat.com/widget/css/ 1 KB
1 KB 113ms
112ms Stylesheet
text/css 34.196.69.230
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/widget/css/cb.css?t=1715954144260

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/js/co-browsing.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.196.69.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-196-69-230.compute-1.amazonaws.com

Software

fwe /

Resource Hash

8029982e606b01f8d1651a46683c7a90ef2496e73823047c0e73b72e285d593e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 13:55:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-envoy-upstream-service-time: 0
x-xss-protection: 1; mode=block
x-request-id: d7d041d8-0b1b-4c37-9a8b-43861a55d687
x-trace-id: 00-3285ab297170a91efa839b28539b815a-711d8f2d21a6e514-00
last-modified: Wed, 08 May 2024 05:23:06 GMT
server: fwe
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: text/css
x-fw-ratelimiting-managed: false
cache-control: max-age=31536000,no-cache, no-store, must-revalidate, pre-check=0, post-check=0,public
x-server: kgwrl
expires: Sat, 17 May 2025 13:55:44 GMT

GET
H2 200 index.html
httpsofftherecordcom.webpush.freshchat.com/ Frame 3AED 0
0 432ms
398ms Document
text/html 18.245.60.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://httpsofftherecordcom.webpush.freshchat.com/index.html?ref=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t
Requested by: Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/js/widget.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.60.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-60-105.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
content-type: text/html
date: Fri, 17 May 2024 13:55:45 GMT
etag: W/"4d98f93ebe4eb8cedbbfdb3004920aeb"
last-modified: Fri, 25 Oct 2019 06:53:38 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 0254a3d4b384cab4933ea28efe6685c2.cloudfront.net (CloudFront)
x-amz-cf-id: uo8ZQpyg9aRBWZFSBnDOdBH9Ost6PWTA8rK_jctSQKO6W5CfUAUYrA==
x-amz-cf-pop: FRA60-P5
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront

POST
H2 200 v2 Show response
relay.offtherecord.com/rec/bundle/ 29 B
234 B 842ms
321ms XHR
application/json 35.169.238.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/rec/bundle/v2?OrgId=6DGA5&UserId=52ddea3f-737e-479c-a49e-5575a9b01b2c&SessionId=98ba5db3-c25b-489b-b1de-adac72ae979f&PageId=33dcafeb-3781-4550-9619-34acf4118205&Seq=1&ClientTime=1715954144795&PageStart=1715954142244&PrevBundleTime=0&LastActivity=2370&IsNewSession=true
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.169.238.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-238-116.compute-1.amazonaws.com
Software: /
Resource Hash: 04e54331eaa7c7be76e159e6f9702da3e83c3f3175c1802f147ddb3ddbe5f0cf

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://offtherecord.com
date: Fri, 17 May 2024 13:55:45 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
content-type: application/json; charset=utf-8

POST
H2 200 / Show response
relay.offtherecord.com/track/ 25 B
440 B 416ms
194ms XHR
application/json 54.84.112.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:446/track/?verbose=1&ip=1&_=1715954146044

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.84.112.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-84-112-40.compute-1.amazonaws.com

Software

envoy /

Resource Hash

e39a8118ec6cdf6ac33e6961518e9fe6ba3f6caf099aeeaec1389c2108ba90ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://offtherecord.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 17 May 2024 13:55:46 GMT
strict-transport-security: max-age=604800; includeSubDomains
via: 1.1 google
server: envoy
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: X-MP-CE-Backoff
cache-control: no-cache, no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 51
access-control-allow-headers: X-Requested-With, X-Amzn-Trace-Id
content-length: 25
alt-svc: clear

POST v2
relay.offtherecord.com/rec/bundle/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/held4qD.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=08c5b8dcad3a2be9e9a1db6c0d25e800d5fffdb081d5fbc8db867212f5ff8387

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/704556.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=d11dbed6d56770ce01d1e87e12e3f8a4f05976dfa3232c540d3f046032c51a13

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/691985.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=50a1f5199f8f471c9364ca234215dea67654fd7f312678659eeb674a74d42722

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/621656.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=764eb3876c673e10cf936fa6aaff376b41e0fccf9f4ea752b1e11b2de063f96d

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/UTMPVgY.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=899&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=79c271dd68934626e84c588c8ea2fa7a564f07ec7615b267918f4d4da6cb6078

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/H4A4R90.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=ca302b44f377a536affc34f7bb0a54d4b5d3e0ffbab16a1ededd90dbc5247320

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/692094.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=62be664f057805e7803f5ce828ae2c090a40a6822eab188cb9975e4bf7c3d03d

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/9Zo9U02.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=899&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=b7db8e79877e0aa19265ba6c9b8883ac3bd23088b2453025a7f1df43e032a954

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/fn7gwCn.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=b6ef051b65c9dde7237ca3d31f9006109e2af575a910f73a29c0fe65daae8661

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/49643.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=6c04f5de3195ef74f347dd557ac33507b815ab7380838c4b1f179ee8a7f1efb0

Domain: off-the-record-service.s3.us-west-2.amazonaws.com
URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/643914.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240517T133211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240517%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=6d3c42c2b19266b9d58df7e08c100da48922737a675f760891c8e7a84edeea47

Domain: relay.offtherecord.com
URL: https://relay.offtherecord.com/rec/bundle/v2?OrgId=6DGA5&UserId=52ddea3f-737e-479c-a49e-5575a9b01b2c&SessionId=98ba5db3-c25b-489b-b1de-adac72ae979f&PageId=33dcafeb-3781-4550-9619-34acf4118205&Seq=2&ClientTime=1715954147282&PageStart=1715954142244&PrevBundleTime=1715954144892&LastActivity=4857&IsNewSession=true

Verdicts & Comments Add Verdict or Comment

172 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

39 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
fight.offtherecord.com/	1970-01-21 05:24:50	Name: _s Value: x5DDAzSm3dNeDelQDQOoA%2FZefof8%2FLLN4mNWrucChWpG7DIerGv8m2t45ID6%2FgcN
.offtherecord.com/	1970-01-20 22:48:50	Name: _gcl_au Value: 1.1.1451987036.1715954141
.offtherecord.com/	1970-01-21 05:26:16	Name: _vwo_uuid_v2 Value: D723943AF291C77EF3243C39DB42F8B2C\|b25ff7f75a2a6655dc56b158bc906b8e
.offtherecord.com/	1970-01-20 22:48:50	Name: _rdt_uuid Value: 1715954141574.050a7cc9-44e1-4e7c-a629-1b9877259410
.offtherecord.com/	1970-01-20 20:40:40	Name: _uetsid Value: 2619fdc0145511efbb4765c3f0bb3c8e
.offtherecord.com/	1970-01-21 06:00:50	Name: _uetvid Value: 261a0cc0145511ef8bbc2502a921da2e
.offtherecord.com/	1970-01-20 20:40:40	Name: _gid Value: GA1.2.551364976.1715954142
.offtherecord.com/	1970-01-21 06:15:14	Name: _ga_TMGSMNG8YY Value: GS1.1.1715954141.1.0.1715954141.60.0.0
m.stripe.com/	1970-01-21 06:15:14	Name: m Value: 9ef4eb03-2f4e-4a01-b916-2a32954c7fbe30a410
.bing.com/	1970-01-21 06:00:50	Name: MUID Value: 3310130B1C3E6E3E3B7107891D556FED
.offtherecord.com/	1970-01-21 05:24:50	Name: __stripe_mid Value: b5280c11-9e94-422e-bcd4-837e8763b128966b85
.offtherecord.com/	1970-01-20 20:39:15	Name: __stripe_sid Value: 6c70a427-108c-48f4-9a7a-6880801f241a0540bd
.offtherecord.com/	1970-01-20 23:03:14	Name: _vis_opt_s Value: 1%7C
.offtherecord.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.offtherecord.com/	1970-01-21 06:15:14	Name: _vwo_uuid Value: D723943AF291C77EF3243C39DB42F8B2C
.offtherecord.com/	1970-01-20 22:48:50	Name: _vwo_ds Value: 3%241715954140%3A42.63416727%3A%3A
.offtherecord.com/	1970-01-20 20:39:15	Name: _vwo_sn Value: 0%3A1%3A%3A%3A1
.offtherecord.com/	1970-01-20 23:03:14	Name: _vis_opt_exp_28_combi Value: 2
.offtherecord.com/	1970-01-20 23:03:14	Name: _vis_opt_exp_46_combi Value: 2
.offtherecord.com/	1970-01-20 23:03:14	Name: _vis_opt_exp_50_combi Value: 3
.offtherecord.com/	1970-01-21 06:15:14	Name: _ga Value: GA1.2.1495374524.1715954142
.offtherecord.com/	1970-01-20 20:39:14	Name: _gat_gtag_UA_69140841_1 Value: 1
.offtherecord.com/	1970-01-21 05:24:50	Name: mp_971aeee0e6b3795a30de20c2cc8585b4_mixpanel Value: %7B%22distinct_id%22%3A%20%22%24device%3A18f86d647714ad-0122277146dabd-26001d51-1d4c00-18f86d647724ad%22%2C%22%24device_id%22%3A%20%2218f86d647714ad-0122277146dabd-26001d51-1d4c00-18f86d647724ad%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%2C%22__mps%22%3A%20%7B%22%24os%22%3A%20%22Windows%22%2C%22%24browser%22%3A%20%22Chrome%22%2C%22%24browser_version%22%3A%20124%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%2C%22%24vwo_user_id%22%3A%20%22D723943AF291C77EF3243C39DB42F8B2C%22%7D%2C%22__mpso%22%3A%20%7B%7D%2C%22__mpus%22%3A%20%7B%7D%2C%22__mpa%22%3A%20%7B%7D%2C%22__mpu%22%3A%20%7B%7D%2C%22__mpr%22%3A%20%5B%5D%2C%22__mpap%22%3A%20%5B%5D%7D
.appsflyer.com/	1970-01-21 06:08:02	Name: af_id Value: f8a5315d-4b07-4e53-826a-64271bedef67-p
.offtherecord.com/	1970-01-20 22:48:50	Name: _fbp Value: fb.1.1715954141944.1009228175
.offtherecord.com/	1970-01-21 06:15:14	Name: afUserId Value: f8a5315d-4b07-4e53-826a-64271bedef67-p
.onelink.me/	1970-01-21 06:15:14	Name: af_id Value: f8a5315d-4b07-4e53-826a-64271bedef67-p
.offtherecord.com/	1970-01-20 20:49:18	Name: AF_SYNC Value: 1715954142060
.offtherecord.com/	1970-01-20 21:22:26	Name: otr-referrer Value: %22https%3A%2F%2Fofftherecord.com%2F%22
.offtherecord.com/	1970-01-20 20:39:15	Name: fs_lua Value: 1.1715954142232
.offtherecord.com/	1970-01-21 05:24:50	Name: fs_uid Value: #6DGA5#52ddea3f-737e-479c-a49e-5575a9b01b2c:98ba5db3-c25b-489b-b1de-adac72ae979f:1715954142232::1#/1747490143
.hsforms.com/	1970-01-20 20:39:15	Name: __cf_bm Value: hfcNkhHrlp.xu_sRJbHg6d08LzeCpsFxmlB2D06khaE-1715954142-1.0.1.1-q.EOSZnuZ4ndO6I9L607lsrZMV7VKx9qJ4J3pg2IQ96G0gXFxY0WEAhj6A2eN6XE5RVTdP0tTwzqHol0DX535A
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: Iyed4DBKkIzOKzQ3G2hCqhcb0_1xfSz2VzFsAJfDaJE-1715954142432-0.0.1.1-604800000
.offtherecord.com/	1970-01-21 00:58:26	Name: __hstc Value: 77102922.bb5fa32989c821e0ef0f76b36e1629b2.1715954143187.1715954143187.1715954143187.1
.offtherecord.com/	1970-01-21 00:58:26	Name: hubspotutk Value: bb5fa32989c821e0ef0f76b36e1629b2
.offtherecord.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.offtherecord.com/	1970-01-20 20:39:15	Name: __hssc Value: 77102922.1.1715954143187
.hubspot.com/	1970-01-20 20:39:15	Name: __cf_bm Value: V4fwXm23W2FwyDjOCqNzdn7QUZvv0BBMqw8Vlnia.A4-1715954143-1.0.1.1-Id25.Ljmz3SrECvIjefy5V5xGjYtEY9DyQmYp5KC123Lnnon98wHhI9FBHqhT28IjLeU.owZeOGr2sYqA54Lxw
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: wAadJAKkSaYcr22su3aoVm9.qaNh8fQrRKz1M57is1Y-1715954143363-0.0.1.1-604800000

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/185612438538592?v=2.9.156&r=stable&domain=offtherecord.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105(Line 97) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alb.reddit.com
anhkgav0.apicdn.sanity.io
apis.google.com
bat.bing.com
browser.sentry-cdn.com
connect.facebook.net
cta-service-cms2.hubspot.com
dev.visualwebsiteoptimizer.com
edge.fullstory.com
fight.offtherecord.com
fonts.googleapis.com
fonts.gstatic.com
forms.hscollectedforms.net
httpsofftherecordcom.webpush.freshchat.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hscollectedforms.net
js.hubspot.com
js.stripe.com
ka-p.fontawesome.com
kit.fontawesome.com
off-the-record-service.s3.us-west-2.amazonaws.com
offtherecord.com
otr-backend-service-us-prod.offtherecord.com
perf-na1.hsforms.com
region1.analytics.google.com
relay.offtherecord.com
snippets.freshchat.com
stats.g.doubleclick.net
track.hubspot.com
wa.appsflyer.com
wa.onelink.me
wchat.freshchat.com
websdk.appsflyer.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.redditstatic.com
off-the-record-service.s3.us-west-2.amazonaws.com
relay.offtherecord.com
100.25.50.51
104.19.175.188
13.56.48.216
142.250.181.232
142.250.186.35
151.101.0.176
151.101.192.176
151.101.65.140
157.240.252.13
172.217.16.130
18.173.205.111
18.245.60.105
18.66.112.46
2001:4860:4802:32::36
216.58.206.67
216.58.206.78
216.58.212.132
2606:4700:4400::ac40:93bc
2606:4700:4400::ac40:991b
2606:4700::6810:6dfe
2606:4700::6810:7574
2606:4700::6810:8bd1
2606:4700::6811:afc9
2620:1ec:c11::237
2a00:1450:4001:803::200e
2a00:1450:4001:810::200a
2a00:1450:4001:812::2003
2a00:1450:4001:81d::2003
2a00:1450:4001:82b::200e
2a00:1450:4001:82f::2008
2a00:1450:400c:c1d::9c
2a02:26f0:3500:11::215:14ca
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
2a04:4e42::396
2a04:4e42::729
3.95.80.55
34.102.211.197
34.196.69.230
34.96.102.137
35.169.238.116
35.201.112.186
52.222.214.121
54.156.207.182
54.84.112.40
99.86.4.113
01a3066991f4af85d35aaa0068aa00054f9762f39c263853f49518d5f9784c4b
031f287592b33afc19eee9195f23b5146d5922bc004dc439df3e3d8b0bf54008
04e54331eaa7c7be76e159e6f9702da3e83c3f3175c1802f147ddb3ddbe5f0cf
0632be9691818d992c04349dc8030b55f18c2fe82ee831a4bf1a49d9198431ab
072583eaca4f4cf965ff3913f7bffe2108cb46c91f28a51cff411e91459ca836
091c27084bee9182fda190c70ab01d92f1f32c72be2f4dd37946f62c315ec574
099f5764acf448fdd12bdb9f709606093ea481ecf2b55f03f89ed8cbad7849fb
0e52361cb2f6af4bb1f5fa4f27c87ddb8c6d4918ccd75655bd1d1bb34d4eeabe
0f7c8ca4341ce357e0424f80dd36181ae812a3449b09b5d7e804133df7c30ebf
1153b55bebff3c11194b85fe0b16ff2378fcf8c0b10a220727eb4ad762491d5c
1393acc632c160def86b45c2521c8ee742b7e6239d0d90fb95f51d55cf48b9c3
1580a6a19cb081a84215f13b42f765469beb87d7401f16349760cd067fc4da71
17b5300f889c44391ef59649f0510c20b4f6c186ab9fbb7bd016b7cfdaf1cba1
17d2ee6ef525d4a35125c1ce7417ef5b7e1b611c2dc110a3add824bb078adcbf
1e10e9493470eb296ba1ba705a39455e226be2906bd24a41e1f2b8287ff8f62b
1f3387f11826be4923a2d3a8c1542780abd6d4c66ce13f2de770f2e386989593
1fbf09348c9004e268bf288f269b4bea71b06bb33fee42a546d73251e3fe0cd9
1feff37397f802603ed85e9061608051d5b2a77cea125d78519057d06232b07b
28503820ff423a3e61dcab001567d362860dfed3863e3143f5046316a2f262f2
2d367b9054bc5b92d423f2f9484c18d8b41468a7f4fd9e63829d3dba290a206e
2d95f71505cec68b09ebcbad4208d2ede280629de1b62c329cca5aab65fad29a
31d196afc7bf97b61be0a9881f623b3b8a7b56d4b0c08c6b78c37ce92d7827b2
32a55c673dfbcccd608dfa96cd2aa9b34d0b503ba32de13ace9f5b81c05e0386
35badedf2f470a003c142adac2b71949647c08863bc1010be3c418e3ad2d4850
368a80756eab36fac297e90b3c73486f7a8b2f8d1d7e1fa26a9610bd1ccc01d7
38ba6370b8d16de4ee7f82099425ead835ff7317d56bf86fe0f5bd34a1a266ef
38bc0f256821a9c0a02a1c0cedf8ff70c211e637ef77ac199de2fe0cf36ba9ec
39f976b287176178a645cb4f743ec4f3dbb7a08c31ca34c3b096e7bba425c322
3b604f1e389d668b8535edb53e650780275dfa02e874ecc98c8f72c38662799f
3bf4e07601b268d1d7e49c3d59f63db2263c9e69868e27d9f5cf87e6ddd74c84
3d8e3be54a20aef89dda975f8e468db27fc034065c3b10e3780bd0812056c2fa
3ef96cf8ace7331eac86b1109658ad523a208e1f2d4cffb715964b5c3611930f
3f0730cd0abfa61ab736fc7797e8d6ed2ad78d1b1a903a0664bcfb2f67b04adb
3fa8412e22a263baf0081df39a3ae64d5caa1a1c22ecbe8b865e1751792de101
42119792161a48aae91252fb78b97aded555739362e430b14ecd66cb79e6eaf5
424397b3ddedfa5e4f65f8073c0e2991caaa87f0671b7dda8a0df4c8397e608c
4333f5dde7ebbe95817db62d45966b8b0ea878734e0ebdceb3cbf93b0b2620d0
45295a811f899c7eea5e4d0312049da477390afc2a94ffa491dc6979cc34c9ec
45303277878437cb8faafcbaf090aac7fd30089fd26bfe3bb4490641e7cec84f
46deed2d373abe70cb9a8271dd451b2d3c1e4959f88a21613ee3141689a1a8cb
489d06131e031d27a033f924daba197f6b483b9bc8602b0dddaea8ebe90f60d8
4c64d183304fcb9316adeceed80e112ae71c6e33484b097896dbb6998d4b9659
516640faeb856df6599d165f26ee51ce8cbaaf34f7c09d818509e75f6a48ae13
52dcb3d5f761764b3c62050ef7a14d1680fe9af272212e1e3f54a0bb938e20a4
53355e92ca37f077ef5fb7dbcc40b579ab0fa9178e19121d54ce99ece2f39aeb
53a3dc763a0bd679523a77f5610e4ab27231fe6763d7089c1c92966daa1663f7
55e9a08cde71ec47754aef6c72a216b2900fecfe5015d035cc04a0935cdd4e42
5832eb7492a1cfe8830af0012c3ed28aec922548cdf6b50f87daf4d19fa34cf9
586ad2fca3b935a5eaaebc7e29a1fdd4ef5e09b9355c007afaf86cd5bc32705c
58e78ddbe7394cd14a1e3bc3d8a85a8f9a5c319653ce2a50008ed33560df6b1b
5ccd2a2d0cfc8f7b36c238c935a36c751eb306a4f23788a0c6c33eec1a5a2071
5d1d9410f310f55c6284b4c16146cf063c4f4015ea1b0b6a6dcef8a3fa97ae6f
5d904be0b7b81df09b9197c0b09baac3340e08a583a17f64b75e1c0b467dd07f
6002241965e81f2dc4d22a857056f179554f5bfcd682bc24df045425a7389b46
648c698dd41bf291833204226476e7d092b281fd06255a70a4925f45ca8c96c2
65a0b1c63a042df455830cfb23570063eb1017cd79760d106bdddb17ce3f5a5e
67a8b91c7b7e19e80feb9b82d946c3eb063d7ef3c3b4f58eb8d60a3dacebaf2d
6a432ec996da0b400368eb6cf47f8e056f2b25e32a50b03d9a709fa6c1fecc1a
6a66c1106c740e4f94cf62ccbcc7166c912876ecd57d5d14d6d377fb4aa75bda
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b771d8c7719a4d6187fb47de02b830ba0ccf68e66be12526786ded85cb960b2
6ba797956f6d29b650d458897e48a190cddf0a6ba374350c0bb565fa04f80d65
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5
752632740de79ea8871a43460bd6473ae1f3cb4fec3bee3f2d0c6b7ed6bd12dc
770ab091f87c39b70a00d92d2479d6564064e4a89859285c6cdc08a502e8aa52
7742bb16ac54dbccd2a9df6edc159ff921e1e738f08dc0d4b4b9f31424ede919
7924fd2e6167be712d7efea6b2de21a7331899da86cc273461d4e40b5a522af3
7b5edcbf4a04dec3e1381046ccfe8e7135eaca4cc47973ccfd4ec6384b39b8bb
7b7ca9dee8acbf03925b43a2cb76e364ba514c30a18de9f1523d0b156093c7d6
7ccf80229bbe586853232059978b67c1dbe6ccd7f6b4b8585b34bbcf2d9f195f
7e3f2e5c9c0f642f19eb5d1488c3257ad89341700795e0e6253400c876c4e06d
7e7558ddd527f6452c7c72f510f48964f6319f317b314829c2786e42346c372e
8029982e606b01f8d1651a46683c7a90ef2496e73823047c0e73b72e285d593e
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85ddb6693cdac9f66361f0f0c54ba4c07eb5b0a202ff94f8692c241bc1ae1fdb
87d1d3eff67f2586e9039d705d502f782613f87dac4850653e10973940ffb7c0
8971fe0a892f03a0f0ba568b545194578eaf62dcafabc254e2677c7af64200c3
8a0e8a9389d882a4c0378fdf5334dcc7b535daa369fc6169c6adf4b72f209043
8a73d9886283369e97c809bb8b7af15cab6263559318fb730256f6da6a720426
8b852e041e35b676cf550d19cf8d15bc58db780a3827626518f4e0dfc5fb3109
8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7
8e742fbd7146cea9dee3a9c4b4474e1da43f62e8864d519c1debe7f10ec6043b
9027bc2ee5d559beeb81d822fd8e1b8962f6be256aaed95aca74a0a519406c3a
909c4adf1c2435d373b6e0d83ee64cc9888881ac24905238ea010b4da3d06b93
91ab93b25227f8a29a716fdc41831b0a8a8729d8cde9f8adb29f4c8392457b9e
95714ca3ccfc5da0a5d441212199e9dcaf09416e2e2137d964d3d9fde2f12289
98af017c05d0d89d07187e5fea5df961cfe0da03321de1daf05e545b663718a4
99141deb1e06c17d62b664d1b8bacde6c827cd0559a8cd2c2a81b45e0ac3304c
9d1ce97752f29df67b0b336f715364cb0b902c9a9cbe004f9956767448da360d
9d64ce89336a149d954573c477ff7d9b320f92db397e754626c809b1d1313503
a05de9f3792048eff0cedc9370691b2a604cc1628f6aa9f70ad07444d2f02bdb
a2b40eed2a14d541eb0ec80d05d29815fa18fd71c46455fc374a47a81226e9d6
a3d2952330aefe690302e90460777d9b5c6fc354861336a919c83e44fe352800
a5d227b5d9c8b9b461d0a35df1c39685463fe0bd375c2aa2aa197dfd2776a7c8
a660a82226cc76c6674f060a12de2c7eb6b5aa98ee9e725d296fa7b5934d0f20
a6b9e77f842f68bf64b450048c752a189401955f45d149c5430fbc208469ffe0
a8510ffd3e9d2934e0ad67e81a2fc12f36e2b04ac3f3f150bd7e44ad12af3d76
abe72c7981d3e55e05f111caebead10a7e80cf20b3b60776600724f251c4790d
adf138613e55c65103aaada7a42614be1d0d604596e4ce3b2d0319e823bb0628
af04f015df3bbffd125ee30eaf78e7f1c9328f5b967d66f7b7f8958472464dda
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b07fffef0ae1504dfba7fb4096afb6e097815298973f51a1b211771e05c075b0
b1ec55a9e66fe05243e1977a0db2af48f4af4c07bfd0b9cdef32c01ab0f42b9d
b4bf8910a202b24bd61be26e28eaa8c5f83a48d78999b2693a9cbdf4c9910cf1
b6892a725066e5a0c71c46574e9e5c2459c51c067c9ecd576abe77a70f442b2d
b98f2cc291f1599d79b73bb15343019c208c0932f69200bf15bccce4133b2db2
bceb73993d094c4c821c7571921103bdc8c05e9082c4fc513d244358d53593db
bd90f865472fe70f7acafca83b79b17cea7a2687024d4842309ad97e7bc04f7c
c3061c3788ad5783ef8a5d10c454bafe7eb942c48200dccc852cc6d3c9f303d4
c3752e9c316702fad2dba976eb96dad99ba72380461fb36c67bd4f2766b303cd
c3dd5a6fff633c6393dca21ce74cd6dc95265943575b43d2d9616f020eea68fa
c42a908e7cb3219e26e808d18cb1050f05d24cb31b8905fe0d70012507795b3a
c46812c7c91d67dcc84ac30ff32138415af25b3416ea5b6588628cb3e2d1f686
c5832c43af37aceae73a95406f6115fbbe18b09d463fea354f371c79ae7b9027
c5fb457fc69058cd84b72db3a52c0ef9961aa7d18e7bab081d7f1953a7cc23dd
c625a259d52303bc63e165e0326e1d78de9bb5b5074423f368df77fca407b7bf
cad08c9782cbde27b90104ded5f58eddcf7fcf469f6a7f61ee8c489a8f377e2e
cafed8afce97ffc3d420081a23c193ac0dc3d2c70454332284233b3d151da5ad
cf6683ec2fb825072bc67ba2b4831425951dc365245d5334ca6f2150f50e1590
d100a79e9ca4f220f81fd0729136ce2839c361f0850a3ddabb987bb04c99b925
d52af8243ca6afe270829cfe2853cb79a486b81650f8b575374a220c311d5411
d61c08de21fbc87ef485040ce4ca9a20c09251ae6799d5732af329da1849dfba
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcf098fa11979ad3c4217bbdc012292d2aa9ea75aa644501fd7d9b3bc67c0c43
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e2eb49ebf978dd7140eacd08fca34dfe6da0db3bebdee08606996d00766d60af
e39a8118ec6cdf6ac33e6961518e9fe6ba3f6caf099aeeaec1389c2108ba90ba
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e42906ddfbfe6e976dc6430c8951a442737559c9fc5abdf81e5c551135f4d9af
e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6
e92f0b552deffbf207cee5389713056c7c3d27e4b9b9edaf29338d01a83c5962
e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f01d3fe2a8106b2ac0fe9ed20c7c3548c198cb1402e5fba6ac150841ea4bd65f
f1e6a0811f0df7be7482db95552fd57017ca33d5a35f07c330859debd46d135c
f304f3fd3d8bb15da7a2bafcf83f90bb40bff5bbe00bc0671ebca41e0128d903
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f7b242b6fc836be7b2e892946b2c7293d65da02a12ba9cb368e3ce404ad33819
f8d846ab829fbebc64121363ad15ae68ab779e8e124d94ced402bcb048e42878
fac08aba895b0525de1904bc4fb04928ba03ec2cd715d084831f0dd265774bce
faf47e501cdae61064aed4b03b1129d37c6e004ebde6f6452f1632f835c9f318
fca26b24960b9a7badc3221b8c2d0daf2f7fe9f1774da08ca290ab56bc62cd5f
fda8e2340dd0d31581f956b339da1e9533a2c6838d385e672f984d069dab2a62
fdcc34060c0c6a0ec771d0a4f1e14f00092e96577e166be28d33b83ba72faa69

offtherecord.com Open in urlscan Pro 99.86.4.113 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

178 Requests

93 %HTTPS

43 %IPv6

30 Domains

43 Subdomains

46 IPs

4 Countries

2881 kBTransfer

9393 kBSize

39 Cookies

13 Outgoing links

Page URL History

Redirected requests

178 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

offtherecord.com Open in urlscan Pro
99.86.4.113 Public Scan

Screenshot
Live screenshot

Full Image

178
Requests

93 %
HTTPS

43 %
IPv6

30
Domains

43
Subdomains

46
IPs

4
Countries

2881 kB
Transfer

9393 kB
Size

39
Cookies

178 HTTP transactions
7 data transactions