www.tdrewards.com Open in urlscan Pro
45.60.65.34 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://eurox.co.th/api-keys/logon.php?ttt=1673897298?idlogin=12de2235c74639cef8009f55c3f27005
Effective URL:
https://www.tdrewards.com/home-page
Submission: On February 13 via manual (February 13th 2023, 7:09:14 am UTC) from IN — Scanned from DE

Summary HTTP 169 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 29 IPs in 7 countries across 33 domains to perform 169 HTTP transactions. The main IP is 45.60.65.34, located in United States and belongs to INCAPSULA, US. The main domain is www.tdrewards.com.
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA 2022 Q4 on December 13th 2022. Valid for: 6 months.

This is the only time www.tdrewards.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	128.199.65.28 128.199.65.28	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
40	45.60.65.34 45.60.65.34	19551 (INCAPSULA) (INCAPSULA)
6	13.224.189.76 13.224.189.76	16509 (AMAZON-02) (AMAZON-02)
2 16	52.17.115.124 52.17.115.124	16509 (AMAZON-02) (AMAZON-02)
23	2a00:1450:400... 2a00:1450:400d:80e::2008	15169 (GOOGLE) (GOOGLE)
1	34.254.165.240 34.254.165.240	16509 (AMAZON-02) (AMAZON-02)
3	23.36.162.211 23.36.162.211	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8 8	18.203.152.154 18.203.152.154	16509 (AMAZON-02) (AMAZON-02)
1	99.80.163.253 99.80.163.253	16509 (AMAZON-02) (AMAZON-02)
1 1	18.200.120.46 18.200.120.46	16509 (AMAZON-02) (AMAZON-02)
1 9	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1 1	185.29.134.248 185.29.134.248	30419 (MEDIAMATH...) (MEDIAMATH-INC)
2 2	185.89.210.180 185.89.210.180	29990 (ASN-APPNEX) (ASN-APPNEX)
1 10	2a00:1450:400... 2a00:1450:400d:80c::2004	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
1	67.202.105.24 67.202.105.24	32748 (STEADFAST) (STEADFAST)
7 7	142.251.39.2 142.251.39.2	15169 (GOOGLE) (GOOGLE)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
6 12	52.213.165.255 52.213.165.255	16509 (AMAZON-02) (AMAZON-02)
1 1	2620:116:800d... 2620:116:800d:21:de2e:c7b3:55c0:d5a0	16509 (AMAZON-02) (AMAZON-02)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2 2	2606:4700::68... 2606:4700::6812:18ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	34.111.234.236 34.111.234.236	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	212.82.100.182 212.82.100.182	34010 (YAHOO-IRD) (YAHOO-IRD)
1 1	2600:1901:0:8... 2600:1901:0:8eee::	15169 (GOOGLE) (GOOGLE)
2 3	95.100.68.200 95.100.68.200	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	52.5.150.215 52.5.150.215	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1288:80:... 2a00:1288:80:807::2	203220 (YAHOO-DEB) (YAHOO-DEB)
2 3	52.46.151.131 52.46.151.131	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:400d:802::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.185.134 142.250.185.134	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:402... 2a00:1450:4025:401::9a	15169 (GOOGLE) (GOOGLE)
1	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
5 10	142.250.186.70 142.250.186.70	15169 (GOOGLE) (GOOGLE)
2	162.247.241.14 162.247.241.14	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
5	2a00:1450:400... 2a00:1450:400d:804::2002	15169 (GOOGLE) (GOOGLE)
3	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
12	209.15.211.147 209.15.211.147	13768 (COGECO-PEER1) (COGECO-PEER1)
169	29

1 128.199.65.28 (Singapore) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

eurox.co.th	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

40 45.60.65.34 (United States)

ASN19551 (INCAPSULA, US)

www.tdrewards.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.224.189.76 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-76.fra2.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 52.17.115.124 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2a00:1450:400d:80e::2008 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.254.165.240 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-165-240.eu-west-1.compute.amazonaws.com

td.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.36.162.211 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-162-211.deploy.static.akamaitechnologies.com

smetrics.td.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 18.203.152.154 (Dublin, Ireland) 8 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-203-152-154.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.80.163.253 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-80-163-253.eu-west-1.compute.amazonaws.com

tdbankfinancialgroup.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.200.120.46 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-200-120-46.eu-west-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.134.248 (United Kingdom) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.180 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:400d:80c::2004 (Ireland) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.248.159 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.105.24 (Palos Park, United States)

ASN32748 (STEADFAST, US)
PTR: ip24.67-202-105.static.steadfastdns.net

dp2.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.251.39.2 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: bud02s37-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 52.213.165.255 (Dublin, Ireland) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-165-255.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:de2e:c7b3:55c0:d5a0 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:18ad (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.234.236 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 236.234.111.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.182 (Dublin, Ireland) 1 redirects

ASN34010 (YAHOO-IRD, GB)
PTR: spcms.pbp.vip.ir2.yahoo.com

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:8eee:: (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 95.100.68.200 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-68-200.deploy.static.akamaitechnologies.com

px.owneriq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.5.150.215 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-150-215.compute-1.amazonaws.com

exchange.adstanding.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:80:807::2 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.46.151.131 (Ashburn, United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:400d:802::200e (Ireland)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.134 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4025:401::9a (Den Helder, Netherlands)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.250.186.70 (United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net

6835781.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
6868519.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
5322602.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
5967600.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
10393945.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.247.241.14 (Apex, United States)

ASN23467 (NEWRELIC-AS-1, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:400d:804::2002 (Ireland)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 209.15.211.147 (Toronto, Canada)

ASN13768 (COGECO-PEER1, CA)
PTR: news.updatefrom.com

assets.tdrewards.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
52	tdrewards.com www.tdrewards.com assets.tdrewards.com	6 MB
28	doubleclick.net 13 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 29 cm.g.doubleclick.net — Cisco Umbrella Rank: 211 ad.doubleclick.net — Cisco Umbrella Rank: 175 stats.g.doubleclick.net — Cisco Umbrella Rank: 78 6835781.fls.doubleclick.net 6868519.fls.doubleclick.net — Cisco Umbrella Rank: 815984 5322602.fls.doubleclick.net 5967600.fls.doubleclick.net 10393945.fls.doubleclick.net	15 KB
23	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 41	1 MB
20	everesttech.net 14 redirects cm.everesttech.net — Cisco Umbrella Rank: 1049 pixel.everesttech.net — Cisco Umbrella Rank: 4508	9 KB
17	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 206 td.demdex.net — Cisco Umbrella Rank: 39406	19 KB
15	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 72	2 KB
10	google.de www.google.de — Cisco Umbrella Rank: 6186	1 KB
6	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2956	131 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 24	22 KB
4	bing.com 1 redirects c.bing.com — Cisco Umbrella Rank: 241 bat.bing.com — Cisco Umbrella Rank: 370	12 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 152	92 KB
3	amazon-adsystem.com 2 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 277	2 KB
3	owneriq.net 2 redirects px.owneriq.net — Cisco Umbrella Rank: 1199	1 KB
3	td.com smetrics.td.com — Cisco Umbrella Rank: 41725	5 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 110	216 B
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 167	18 KB
2	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 216	1 KB
2	yahoo.com 1 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 879 ads.yahoo.com — Cisco Umbrella Rank: 2654	869 B
2	tribalfusion.com 2 redirects a.tribalfusion.com — Cisco Umbrella Rank: 750 s.tribalfusion.com — Cisco Umbrella Rank: 1812	938 B
2	tapad.com 2 redirects pixel.tapad.com — Cisco Umbrella Rank: 449	1 KB
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 209	2 KB
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 334	9 KB
1	adstanding.com 1 redirects exchange.adstanding.com — Cisco Umbrella Rank: 148041	169 B
1	pro-market.net 1 redirects fei.pro-market.net — Cisco Umbrella Rank: 2193	323 B
1	ml314.com 1 redirects ml314.com — Cisco Umbrella Rank: 1732	343 B
1	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 646	489 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 612	394 B
1	33across.com dp2.33across.com — Cisco Umbrella Rank: 9939	69 B
1	rubiconproject.com token.rubiconproject.com — Cisco Umbrella Rank: 541	214 B
1	mathtag.com 1 redirects sync.mathtag.com — Cisco Umbrella Rank: 462	684 B
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 495	477 B
1	omtrdc.net tdbankfinancialgroup.tt.omtrdc.net — Cisco Umbrella Rank: 84066	726 B
1	eurox.co.th 1 redirects eurox.co.th	282 B
169	33

	Domain	Requested by
40	www.tdrewards.com	www.tdrewards.com
23	www.googletagmanager.com	nexus.ensighten.com www.googletagmanager.com
16	dpm.demdex.net	2 redirects www.tdrewards.com
12	assets.tdrewards.com	www.tdrewards.com
12	pixel.everesttech.net	6 redirects www.tdrewards.com
10	www.google.de	www.tdrewards.com 5967600.fls.doubleclick.net
10	www.google.com	1 redirects www.tdrewards.com
9	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
8	cm.everesttech.net	8 redirects
7	cm.g.doubleclick.net	7 redirects
6	nexus.ensighten.com	www.tdrewards.com nexus.ensighten.com
5	adservice.google.com	6868519.fls.doubleclick.net 6835781.fls.doubleclick.net 5322602.fls.doubleclick.net 5967600.fls.doubleclick.net 10393945.fls.doubleclick.net
5	www.google-analytics.com	www.tdrewards.com www.google-analytics.com
3	connect.facebook.net	6835781.fls.doubleclick.net connect.facebook.net
3	bat.bing.com	nexus.ensighten.com bat.bing.com www.tdrewards.com
3	s.amazon-adsystem.com	2 redirects
3	px.owneriq.net	2 redirects www.tdrewards.com
3	smetrics.td.com	www.tdrewards.com
2	www.facebook.com	6835781.fls.doubleclick.net
2	www.googleadservices.com	5967600.fls.doubleclick.net www.googleadservices.com
2	10393945.fls.doubleclick.net	1 redirects 6835781.fls.doubleclick.net
2	5967600.fls.doubleclick.net	1 redirects 6835781.fls.doubleclick.net
2	bam.nr-data.net	js-agent.newrelic.com www.tdrewards.com
2	5322602.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	6868519.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	6835781.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	pixel.tapad.com	2 redirects
2	ib.adnxs.com	2 redirects
1	js-agent.newrelic.com	www.tdrewards.com
1	stats.g.doubleclick.net	www.tdrewards.com
1	ad.doubleclick.net	nexus.ensighten.com
1	ads.yahoo.com	www.tdrewards.com
1	exchange.adstanding.com	1 redirects
1	fei.pro-market.net	1 redirects
1	cms.analytics.yahoo.com	1 redirects
1	ml314.com	1 redirects
1	s.tribalfusion.com	1 redirects
1	a.tribalfusion.com	1 redirects
1	c.bing.com	1 redirects
1	cms.quantserve.com	1 redirects
1	analytics.twitter.com	www.tdrewards.com
1	dp2.33across.com	www.tdrewards.com
1	token.rubiconproject.com	www.tdrewards.com
1	sync.mathtag.com	1 redirects
1	aa.agkn.com	1 redirects
1	tdbankfinancialgroup.tt.omtrdc.net	www.tdrewards.com
1	td.demdex.net	nexus.ensighten.com
1	eurox.co.th	1 redirects
169	48

This site contains links to these domains. Also see Links.

Domain
www.expediafortd.com
www.amazon.ca
www.td.com
www.tdcanadatrust.com

Subject Issuer	Validity	Valid
imperva.com GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-13` - `2023-06-11`	6 months	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-07` - `2023-10-14`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
smetrics.td.com Entrust Certification Authority - L1M	`2022-10-12` - `2023-10-12`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-09-01`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.google.de GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
*.33across.com Sectigo RSA Domain Validation Secure Server CA	`2022-09-06` - `2023-09-30`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2022-11-25` - `2023-05-25`	6 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2022 Q2	`2022-07-10` - `2023-08-11`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
*.nr-data.net DigiCert TLS RSA SHA256 2020 CA1	`2022-11-18` - `2023-12-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-11-22` - `2023-02-20`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
assets.tdrewards.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-24` - `2023-08-24`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://www.tdrewards.com/home-page
Frame ID: 61452543B902125957C637B37274A00F
Requests: 126 HTTP requests in this frame

Frame: https://td.demdex.net/dest5.html?d_nsid=0
Frame ID: 928074DF01135C2F1FE932B6CE11A9F3
Requests: 25 HTTP requests in this frame

Frame: https://6835781.fls.doubleclick.net/activityi;dc_pre=CPb78q_4kf0CFQvrmgod_jkGuw;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page
Frame ID: 45CCF2F9360EEED83A9038CF678AD176
Requests: 7 HTTP requests in this frame

Frame: https://6868519.fls.doubleclick.net/activityi;dc_pre=COP78q_4kf0CFcSmmgodAIIAEw;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=538859098.1676272146;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page
Frame ID: C2AD428FD5CCF578543B863052321D51
Requests: 2 HTTP requests in this frame

Frame: https://5322602.fls.doubleclick.net/activityi;dc_pre=CImagLD4kf0CFffMOwIdsToApQ;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page
Frame ID: 3B7000DEFA050EF3C814D0BE7132B6DC
Requests: 2 HTTP requests in this frame

Frame: https://5967600.fls.doubleclick.net/activityi;dc_pre=CIqXibD4kf0CFbnNOwIdIlEIpg;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=9219360071325.633
Frame ID: 2036BCFDB375760148C92419768AFACA
Requests: 5 HTTP requests in this frame

Frame: https://10393945.fls.doubleclick.net/activityi;dc_pre=CPnUi7D4kf0CFZDJOwIdAZoEIQ;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=712779301428.0836
Frame ID: 2DCCF93CEDA74A16ACC1D375CB7B27ED
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

TD RewardsTD Rewards

Page URL History Show full URLs

https://eurox.co.th/api-keys/logon.php?ttt=1673897298?idlogin=12de2235c74639cef8009f55c3f27005 HTTP 302
https://www.tdrewards.com/home-page Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Imperva (Security) Expand

Overall confidence: 100%
Detected patterns

/_Incapsula_Resource

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

169
Requests

86 %
HTTPS

33 %
IPv6

33
Domains

48
Subdomains

29
IPs

7
Countries

7919 kB
Transfer

10693 kB
Size

45
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.expediafortd.com/lp/b/open-luxury-stays?langid=4105&MDPCID=TD_Bank-CA.RotatingBanner.LuxuryStays.Hotels
Title: Learn more

Search URL Search Domain Scan URL

URL: https://www.amazon.ca/b?language=en_CA&node=21423340011
Title: Amazon.ca Shop with Points

Search URL Search Domain Scan URL

URL: https://www.td.com/about-tdbfg/our-business/index.jsp
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.td.com/privacy-and-security/privacy-and-security/index.jsp
Title: Privacy & Security

Search URL Search Domain Scan URL

URL: https://www.td.com/to-our-customers/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.tdcanadatrust.com/products-services/banking/index-banking.jsp
Title: TD Canada Trust

Search URL Search Domain Scan URL

URL: https://www.tdcanadatrust.com/customer-service/accessibility/accessibility-at-td/index.jsp
Title: Accessibility

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://eurox.co.th/api-keys/logon.php?ttt=1673897298?idlogin=12de2235c74639cef8009f55c3f27005 HTTP 302
https://www.tdrewards.com/home-page Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A783776A5245B1E50A490D44%40AdobeOrg&d_nsid=0&ts=1676272145344 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A783776A5245B1E50A490D44%40AdobeOrg&d_nsid=0&ts=1676272145344

Request Chain 16

https://cm.everesttech.net/cm/dd?d_uuid=49846337969849803952906196764197117418 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y_niEQAAADciYQOY

Request Chain 18

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=49846337969849803952906196764197117418 HTTP 302
https://dpm.demdex.net/ibs:dpid=21&dpuuid=220033204426000497019

Request Chain 43

https://sync.mathtag.com/sync/img?mt_exid=10004&mt_exuid=49846337969849803952906196764197117418&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D269%26dpuuid%3D[MM_UUID]%26ddsuuid%3d49846337969849803952906196764197117418 HTTP 302
https://dpm.demdex.net/ibs:dpid=269&dpuuid=530e63e9-e211-4b00-875c-811634f901cf&ddsuuid=49846337969849803952906196764197117418

Request Chain 46

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP 302
https://dpm.demdex.net/ibs:dpid=358&dpuuid=1374673175657876562

Request Chain 65

https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D540%26dpuuid%3D%24%7BTA_DEVICE_ID%7D&partner_device_id=49846337969849803952906196764197117418 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=ADB&partner_url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D540%26dpuuid%3D%24%7BTA_DEVICE_ID%7D&partner_device_id=49846337969849803952906196764197117418 HTTP 302
https://dpm.demdex.net/ibs:dpid=540&dpuuid=fd5fac82-ad96-4455-b1e8-5f5ec97ef066

Request Chain 71

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NDk4NDYzMzc5Njk4NDk4MDM5NTI5MDYxOTY3NjQxOTcxMTc0MTg= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEOVpKkQyzPOj5IrElIYMSWg&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 73

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEK_-zGERFqYCvu6YjxC6mvQ&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 74

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEK_-zGERFqYCvu6YjxC6mvQ&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 75

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060&google_gid=CAESEK_-zGERFqYCvu6YjxC6mvQ&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 76

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782&google_gid=CAESEK_-zGERFqYCvu6YjxC6mvQ&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 77

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEK_-zGERFqYCvu6YjxC6mvQ&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 78

https://cms.quantserve.com/pixel/p-vj4AYjBqd6VJ2.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=1175&&dpuuid=ihma09kYztmRHpnaiRjS3I8bnNuRTszTjEsqEMve

Request Chain 79

https://c.bing.com/c.gif?uid=49846337969849803952906196764197117418&Red3=MSAdobe_pd&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=2648FB3AAE9E6F48352DE98DAF4C6EF3

Request Chain 80

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEK_-zGERFqYCvu6YjxC6mvQ&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 81

https://a.tribalfusion.com/i.match?p=b13&u=49846337969849803952906196764197117418&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP 302
https://s.tribalfusion.com/z/i.match?p=b13&u=49846337969849803952906196764197117418&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP 302
https://dpm.demdex.net/ibs:dpid=22054

Request Chain 82

https://ml314.com/utsync.ashx?eid=50112&et=0&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D[PersonID] HTTP 302
https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3633570718661738639

Request Chain 83

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=49846337969849803952906196764197117418&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-.V4G4YdE2pExVIO3oUivc9SDvqXiipNd2SA-~A

Request Chain 84

https://fei.pro-market.net/engine?site=141472;size=1x1;mimetype=img;du=67;csync=49846337969849803952906196764197117418 HTTP 302
https://dpm.demdex.net/ibs:dpid=575&dpuuid=-3132858143554780900

Request Chain 85

https://px.owneriq.net/eucm/p/adpq?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D53196%26dpuuid%3D(OIQ_UUID) HTTP 302
https://px.owneriq.net/ecc?redir=https%3a%2f%2fdpm.demdex.net%2fibs%3adpid%3d53196%26dpuuid%3dQ7295585481422872386&uid=Q7295585481422872386&ref=%2Feucm%2Fp%2Fadpq HTTP 302
https://px.owneriq.net/noop?ct=image%2Fgif

Request Chain 86

https://exchange.adstanding.com/partners/aam/sync.php HTTP 302
https://dpm.demdex.net/ibs:dpid=59982&dpuuid=

Request Chain 87

https://cm.everesttech.net/cm/yh HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y_niEQAAADciYQOY&sigv=1&esig=1~6aee2435500ffa8ef5a9644d168326d6ea56660d

Request Chain 88

https://s.amazon-adsystem.com/dcm?pid=5c420d2b-f139-4fee-b0c0-89a7b8ce9433 HTTP 302
https://s.amazon-adsystem.com/dcm?pid=5c420d2b-f139-4fee-b0c0-89a7b8ce9433&dcc=t HTTP 302
https://dpm.demdex.net/ibs:dpid=139200&dpuuid=UnDUVJHATdeo0VeE6iqIDw&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dadobe.com%26id%3D%24%7BDD_UUID%7D HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=adobe.com&id=49846337969849803952906196764197117418

Request Chain 101

https://6835781.fls.doubleclick.net/activityi;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page HTTP 302
https://6835781.fls.doubleclick.net/activityi;dc_pre=CPb78q_4kf0CFQvrmgod_jkGuw;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page

Request Chain 102

https://6868519.fls.doubleclick.net/activityi;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=538859098.1676272146;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page HTTP 302
https://6868519.fls.doubleclick.net/activityi;dc_pre=COP78q_4kf0CFcSmmgodAIIAEw;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=538859098.1676272146;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page

Request Chain 103

https://5322602.fls.doubleclick.net/activityi;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page HTTP 302
https://5322602.fls.doubleclick.net/activityi;dc_pre=CImagLD4kf0CFffMOwIdsToApQ;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page

Request Chain 116

https://5967600.fls.doubleclick.net/activityi;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=9219360071325.633 HTTP 302
https://5967600.fls.doubleclick.net/activityi;dc_pre=CIqXibD4kf0CFbnNOwIdIlEIpg;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=9219360071325.633

Request Chain 117

https://10393945.fls.doubleclick.net/activityi;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=712779301428.0836 HTTP 302
https://10393945.fls.doubleclick.net/activityi;dc_pre=CPnUi7D4kf0CFZDJOwIdAZoEIQ;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=712779301428.0836

Request Chain 126

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/875695358/?random=1281826204&cv=9&fst=1676272149653&num=1&npa=1&label=Yk5PCMaLxYYYEP6ZyKED&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F5967600.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIqXibD4kf0CFbnNOwIdIlEIpg%3Bsrc%3D5967600%3Btype%3Dinvmedia%3Bcat%3Dtdrew000%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bnpa%3D%3Bgdpr%3D%3Bgdpr_consent%3D%3Bord%3D9219360071325.633%3F&ref=https%3A%2F%2F6835781.fls.doubleclick.net%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=FeLpY_maKYnDmLAPkcmu8As&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-conversion/875695358/?random=1281826204&cv=9&fst=1676272149653&num=1&npa=1&label=Yk5PCMaLxYYYEP6ZyKED&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F5967600.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIqXibD4kf0CFbnNOwIdIlEIpg%3Bsrc%3D5967600%3Btype%3Dinvmedia%3Bcat%3Dtdrew000%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bnpa%3D%3Bgdpr%3D%3Bgdpr_consent%3D%3Bord%3D9219360071325.633%3F&ref=https%3A%2F%2F6835781.fls.doubleclick.net%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=FeLpY_maKYnDmLAPkcmu8As&cid=CAQSKQDUE5ymfN6Fk2VUK_NfeQEFllo2mb55U0tCDrwsksAEA-d8GbRp6aDV&random=1717107616&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/875695358/?random=1281826204&cv=9&fst=1676272149653&num=1&npa=1&label=Yk5PCMaLxYYYEP6ZyKED&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F5967600.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIqXibD4kf0CFbnNOwIdIlEIpg%3Bsrc%3D5967600%3Btype%3Dinvmedia%3Bcat%3Dtdrew000%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bnpa%3D%3Bgdpr%3D%3Bgdpr_consent%3D%3Bord%3D9219360071325.633%3F&ref=https%3A%2F%2F6835781.fls.doubleclick.net%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=FeLpY_maKYnDmLAPkcmu8As&cid=CAQSKQDUE5ymfN6Fk2VUK_NfeQEFllo2mb55U0tCDrwsksAEA-d8GbRp6aDV&random=1717107616&resp=GooglemKTybQhCsO&ipr=y&prhg=0

169 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request home-page Show response
www.tdrewards.com/
Redirect Chain

https://eurox.co.th/api-keys/logon.php?ttt=1673897298?idlogin=12de2235c74639cef8009f55c3f27005
https://www.tdrewards.com/home-page

17 KB
17 KB

526ms
459ms

Document
text/html

45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

c8559a82bbdfc9448f6a4d6c145ff63b13b73df73e726cc9c7da87534c2d4edd

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-type: text/html; charset=utf-8
date: Mon, 13 Feb 2023 07:09:05 GMT
etag: W/"4302-gx7nVphYspmjzt3bLVKO/qY4P0A"
strict-transport-security: max-age=157680000
x-cdn: Imperva
x-iinfo: 2-14737121-14737132 NNNN CT(111 216 0) RT(1676272144446 22) q(0 0 4 2) r(5 5) U5
x-powered-by: Express

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html; charset=UTF-8
date: Mon, 13 Feb 2023 07:09:04 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://www.tdrewards.com/home-page
pragma: no-cache
server: nginx
x-powered-by: PHP/7.4.33 PleskLin
x-ua-compatible: IE=edge

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/tdb/public-ca/ 335 KB
91 KB 59ms
8ms Script
application/javascript 13.224.189.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/tdb/public-ca/Bootstrap.js
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-76.fra2.r.cloudfront.net
Software: CloudFront /
Resource Hash: 9f8315d9a3ac8497d0d3eee3467a75e8cb5fcdda48d13788d65e0affae95aeb0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Thu, 09 Feb 2023 21:47:45 GMT
x-amz-version-id: 9EB_lhFawcckbBJ1bon7.sP0tu3J.jT9
content-encoding: br
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 292881
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 09 Feb 2023 21:47:05 GMT
server: CloudFront
etag: W/"ec1b6263d2e6ab9d3558a5d504c60a43"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: ATfqVmk0eWRtaINldiMyQ6oKRl5vk-fGW-710KIBxqnbd7s2XgQ5Rg==

GET
H2 200 style.css
www.tdrewards.com/templates/active/static/ 255 KB
256 KB 125ms
124ms Stylesheet
text/css 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/templates/active/static/style.css

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

c89295f4cf9f044cc628d03fcdfde1d1d4a9d9398f86d20167e1f9bd90ff571b

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
strict-transport-security: max-age=157680000
last-modified: Mon, 13 Feb 2023 06:40:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"3fc1b-1864980e882"
content-type: text/css; charset=UTF-8
x-iinfo: 2-14737121-14737132 PNNN RT(1676272144446 494) q(0 0 0 -1) r(1 1) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 261147

GET
H2 200 vendors.js Show response
www.tdrewards.com/ 1 MB
1 MB 125ms
124ms Script
application/javascript 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/vendors.js

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

8430e365f8defac031dcde01850e7c9fbf4d4108b991dba7c7bb411cab7a0cff

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"13f64f-1863e185ef0"
content-type: application/javascript; charset=UTF-8
x-iinfo: 2-14737121-14737224 NNNY CT(110 222 0) RT(1676272144446 497) q(0 0 0 -1) r(1 1) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 1308239

GET
H2 200 bundle.js Show response
www.tdrewards.com/ 1 MB
1 MB 131ms
131ms Script
application/javascript 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/bundle.js

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

ef02361cfc918950f2432a3eba916b540437375242bd255cd3d33cd7e252fd7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"15ab28-1863e185ef0"
content-type: application/javascript; charset=UTF-8
x-iinfo: 2-14737121-14737226 NNNY CT(109 221 0) RT(1676272144446 500) q(0 0 0 -1) r(1 1) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 1420072

GET
H2 200 templateCacheHtml.js Show response
www.tdrewards.com/templates/active/static/ 336 B
453 B 132ms
132ms Script
application/javascript 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/templates/active/static/templateCacheHtml.js

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

e54d3f4ad5c3c66a747f2a7f62e7ca28abfd2db5c57b3ba53721ee02e7e11b29

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"150-1863e185ef0"
content-type: application/javascript; charset=UTF-8
x-iinfo: 2-14737121-14737228 NNNY CT(109 220 0) RT(1676272144446 503) q(0 0 0 -1) r(1 1) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 336

GET
H2 200 _Incapsula_Resource Show response
www.tdrewards.com/ 150 KB
21 KB 17ms
17ms Script
application/javascript 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tdrewards.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1736913037
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.65.34 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 80e56da8f26f97e7d70598aa93804cfb402f56e5c7aa070f82ad5107d3dd9a4a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
x-robots-tag: noindex
content-length: 21545
content-type: application/javascript

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A783776A5245B1E50A490D44%40AdobeOrg&d_nsid=0&ts=1676272145344
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A783776A5245B1E50A490D44%40AdobeOrg&d_nsid=0&ts=1676272145344

5 KB
2 KB

35ms
35ms

XHR
application/json

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A783776A5245B1E50A490D44%40AdobeOrg&d_nsid=0&ts=1676272145344

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

3a09085c9857f591164d6b2b632d4d06b07ffc4161a3e81caba1a47293bcdb8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v046-017db7cbf.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: BmhXmoi4Tv0=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.tdrewards.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1553
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v046-0f8f2f033.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: P61OSyxmSL0=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.tdrewards.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A783776A5245B1E50A490D44%40AdobeOrg&d_nsid=0&ts=1676272145344
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/tdb/public-ca/ 599 B
905 B 27ms
26ms Script
text/javascript 13.224.189.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/tdb/public-ca/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/tdb/public-ca/code/&publishedOn=Thu%20Feb%2009%2021:47:01%20GMT%202023&ClientID=822&PageID=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/tdb/public-ca/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-76.fra2.r.cloudfront.net
Software: CloudFront /
Resource Hash: bc8b87d5d14b711102dae7fcb77d9889ea5dcfcd9bd6182db8201a3e074aad60

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA2-C1
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
content-length: 599
x-amz-cf-id: Ent08woajgnBIDiJpD7JgPz_F3esaVxVYyjE0EWF5TmtazOw2G3hEA==
expires: Mon, 13 Feb 2023 07:09:04 GMT

GET
H2 200 21d670707824fc8bcc8207d207cfc0fa.js Show response
nexus.ensighten.com/tdb/public-ca/code/ 114 KB
36 KB 9ms
8ms Script
application/javascript 13.224.189.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/tdb/public-ca/code/21d670707824fc8bcc8207d207cfc0fa.js?conditionId0=423140
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/tdb/public-ca/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-76.fra2.r.cloudfront.net
Software: CloudFront /
Resource Hash: 3419780f825800a9a73c6afd5a23ce681cdb40c853973df484cfbe562d615cd1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Thu, 09 Feb 2023 21:47:46 GMT
x-amz-version-id: CZtZCGgUnIbh89k5KNxDQXqdZN5SaAn3
content-encoding: br
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 292880
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 09 Feb 2023 21:47:05 GMT
server: CloudFront
etag: W/"a88bd8c1710c24d4c562c17f0f91eec1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: ZNom8wOkfo-xcbHgUPMqL75zSV8sqV3X7Y0fbzMcTgSUEgvbTd1dSg==

GET
H2 200 53806121fbcecf081a714e6527577c95.js Show response
nexus.ensighten.com/tdb/public-ca/code/ 2 KB
824 B 10ms
10ms Script
application/javascript 13.224.189.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/tdb/public-ca/code/53806121fbcecf081a714e6527577c95.js?conditionId0=4841570
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/tdb/public-ca/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-76.fra2.r.cloudfront.net
Software: CloudFront /
Resource Hash: 3b30c57fee08b8710ae3ec4a4f44cab038c7c238fbef21adf60791b6af5d3190

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 12:23:31 GMT
x-amz-version-id: nc.xF8GSNlB.1f8m0QghLrowiumo0LJk
content-encoding: br
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 1709135
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 07 Dec 2022 18:16:52 GMT
server: CloudFront
etag: W/"e9606fc127291df4b34091477c116c44"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: tDXWNV5v3QPwhfO04kLvUhhtfgo6jL3S2iV9fyDykh68k591YnleZQ==

GET
H2 200 e5276288d948078f4ec1dc417fdf0e2b.js Show response
nexus.ensighten.com/tdb/public-ca/code/ 3 KB
1 KB 9ms
9ms Script
application/javascript 13.224.189.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/tdb/public-ca/code/e5276288d948078f4ec1dc417fdf0e2b.js?conditionId0=505813
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/tdb/public-ca/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-76.fra2.r.cloudfront.net
Software: CloudFront /
Resource Hash: bde0dcec69fee23a4d9549a2c5a935a8a831c8f8d5019576b7047ce5d7214064

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 01:06:46 GMT
x-amz-version-id: pyKMxTyKEGvgy7OmAcU_nIJaWSBQVguQ
content-encoding: br
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 972140
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 29 Jul 2021 20:32:17 GMT
server: CloudFront
etag: W/"65bc8d3a30a05124edd12469e8a3a745"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: At8dNMhXq0tBYEiDLbX_LL1BOceHWSFJvPo5OFxhljb-QbrSOfg4kA==

GET
H2 200 132b94a24d0c2c50efae315c8d66deb4.js Show response
nexus.ensighten.com/tdb/public-ca/code/ 687 B
1 KB 12ms
12ms Script
application/javascript 13.224.189.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/tdb/public-ca/code/132b94a24d0c2c50efae315c8d66deb4.js?conditionId0=1218305
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/tdb/public-ca/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-76.fra2.r.cloudfront.net
Software: CloudFront /
Resource Hash: dc4c8b4269817a4028f65fb34d0cf7410050c6e58aeb82aa9fb067e7d85b3f65

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 19:32:30 GMT
x-amz-version-id: qJZnEEBmjCokGtURZx0GHfXGqM7E8Fr5
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 1510596
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 687
last-modified: Wed, 07 Dec 2022 18:16:52 GMT
server: CloudFront
etag: "ee74c5f299abbb748fff1fa82a992117"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: Q4RlRu2ex2u-0WjpZeNpriy-g1YwhxWfaC2t5uVt86QC7MIjKdWJHw==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
44 KB 186ms
70ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6974241

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/tdb/public-ca/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

be9b409faf65ddea5a700e15efbd932935b07bd25a8451137a9cfc780f17fd77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44311
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 191 KB
67 KB 249ms
134ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1029090628

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/tdb/public-ca/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

253602b1c8c1b23def7e1c796ccf950177c74e2e624e07cf0a928466cd489494

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68886
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H/1.1 200
OK dest5.html Show response
td.demdex.net/ Frame 9280 7 KB
3 KB 137ms
33ms Document
text/html 34.254.165.240
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://td.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/tdb/public-ca/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.254.165.240 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-254-165-240.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.tdrewards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-1-v046-0d6a26255.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: geF63XKWS4o=
content-encoding: gzip
date: Mon, 13 Feb 2023 07:09:05 GMT
last-modified: Wed, 8 Feb 2023 11:26:58 GMT
vary: accept-encoding

GET
H2 200 id Show response
smetrics.td.com/ 48 B
467 B 231ms
135ms XHR
application/x-javascript 23.36.162.211
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.td.com/id?d_visid_ver=5.0.1&d_fieldgroup=A&mcorgid=A783776A5245B1E50A490D44%40AdobeOrg&mid=49944462317964384252898012392840121304&ts=1676272145531

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-211.deploy.static.akamaitechnologies.com

Software

jag /

Resource Hash

243140c5d7c0dcd13b4e24be92602464d26b85fba96daab461ce972c83d2e5bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.tdrewards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:05 GMT
strict-transport-security: max-age=86400
x-content-type-options: nosniff
server: jag
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://www.tdrewards.com
p3p: CP="This is not a P3P policy"
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Y_niEQAAADciYQOY
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=49846337969849803952906196764197117418
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y_niEQAAADciYQOY

42 B
942 B

33ms
33ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y_niEQAAADciYQOY

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-0c9e579d2.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: GuuEPReOT5k=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y_niEQAAADciYQOY
Date: Mon, 13 Feb 2023 07:09:05 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 delivery Show response
tdbankfinancialgroup.tt.omtrdc.net/rest/v1/ 363 B
726 B 120ms
44ms XHR
application/json 99.80.163.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tdbankfinancialgroup.tt.omtrdc.net/rest/v1/delivery?client=tdbankfinancialgroup&sessionId=230c089bf9524c009305d2a0db4d30be&version=2.3.1
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.163.253 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-163-253.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: b05498f10c03b49707e65cfe46580fe080b75d02f39a149a11311b7d11006d23

Request headers

Referer: https://www.tdrewards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.tdrewards.com
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: ec2e9f32d538a0fd9f0fb3d20009a430

GET
H/1.1

200
OK

ibs:dpid=21&dpuuid=220033204426000497019
dpm.demdex.net/ Frame 9280
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=49846337969849803952906196764197117418
https://dpm.demdex.net/ibs:dpid=21&dpuuid=220033204426000497019

42 B
942 B

40ms
35ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=21&dpuuid=220033204426000497019

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-074cac5f7.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: staQFBcPRDY=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:05 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://dpm.demdex.net/ibs:dpid=21&dpuuid=220033204426000497019
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
expires: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 85ms
73ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6868520&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

533ec63f095866597c0680ccba0a28f86832b9ad41d4889a6358d698f484fc26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44355
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 103ms
88ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6835781&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bc12babb1d7612735f45a11f2c0881dd461fe1bffb92f178be22ac7969adbe21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44335
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 115ms
100ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6868312&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

98c487d0b4ab182f5dbdfb676951d930f26fd9cbf9450ed873e6952789db89c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44333
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 94ms
80ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6868519&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

61098793767a49e77f8d8870a39657144e1b81565c20fe9a0f54e4d0c89ccef9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44334
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 194ms
179ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6867344&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

282cea3a75c97b7516c674217858439d26f59152ba64eb84094a40bec19b2dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44335
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 173ms
158ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6868105&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

81d40d49d0f4b685f70768d5821f161d9dcdda03fe290af35d24b68331b8edf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44333
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 131ms
117ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6868503&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c09a362c1f4879616a16f8ccbfec64993350e3decb6b421bab88822e48d0707f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44337
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 106ms
92ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6871112&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1dee3a2ae44773dbafb14cfdc730fd5492e92e97b9ffa15339d0238d63cbc31e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44336
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 139ms
125ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6868104&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3ba75050ef3b59e77f96d7e53342e0aaee6a91fd234c139d990d36fbbc55ac7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44333
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 211ms
198ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6868106&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5e53b674cbc77be63887073a1a6974503fb153996e497316e2cbf817d0d7d459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44337
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 186ms
172ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6871114&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

77ca19f0c30e80c6d78b18712bd7550b1003aa0fb6ae334fdc0bed4159a772df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44334
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 185ms
173ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6868309&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

82f8a203b066da23f3e0f3df8a3b43797dfd3bd414b16ffebe1cd02f5c55ff6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44335
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 210ms
198ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6102339&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a4d0d37a8ed18ac64e6a3722b68e5c84342826288497d1315a04db49c6666f4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44335
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 176ms
164ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-5322602&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

da1a1dc9a5e96fd04d7bf444502aec1623a2859f2ee67e6f3c3373c7514e6664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44342
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
64 KB 224ms
213ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-973175160&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e29828c5cc2f7c8d46335b7482d37d77443ec72ef632eb55f638aa9d0b9b001b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65905
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 173 KB
63 KB 180ms
169ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-986405607&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8d746ab0c2e4452756281f18dcda5ad3d657ab79f3981f385fcedcefabad6987

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64740
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 173 KB
63 KB 182ms
172ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1028536181&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f05eab346335cf492c0635c78cf298602bd292d59f8830afbb3456acd81dcc26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64739
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 174 KB
64 KB 186ms
176ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-980723526&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9db85e2cc2748f3f3bb275b4f94594b65c4bc09e418b20922e1dee11b96f4109

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65132
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 191 KB
67 KB 261ms
250ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-707912219&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6d4678a6b01ce1b3fb3c2f45611c2dfc78ee2315cf99f81e5a6c46eb8f311601

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68788
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 191 KB
67 KB 223ms
214ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1029090628&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1f255241ca918d98b094a1881e128e0ee7f0db6bf033068308ad4f550c5d2433

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68897
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
64 KB 180ms
171ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-624489921&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6974241

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2d080ef216a4fcdba054538240ffaa0d86c6eac8ee96cff70e65bc9c4ddfb6fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65901
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Feb 2023 07:09:05 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/707912219/ 2 KB
1 KB 190ms
84ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/707912219/?random=1676272145767&cv=11&fst=1676272145767&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&auid=538859098.1676272146&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1029090628

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6db59e08f766f2fee2483831e41cdf1f9112c3314378a40ccf2dfbf37a060ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 874
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/449593252/ 2 KB
1 KB 176ms
85ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/449593252/?random=1676272145780&cv=11&fst=1676272145780&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&auid=538859098.1676272146&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1029090628

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c254b89b5a4bd3162e895387fda860b2abd5468398b9a6503bed0d6e6f59220

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 873
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1029090628/ 2 KB
1 KB 139ms
53ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1029090628/?random=1676272145795&cv=11&fst=1676272145795&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&auid=538859098.1676272146&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1029090628

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d68dfaa7f071a98bf0adabe7a3e71f57a646be542c523bc7b49838eb574080f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 875
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=269&dpuuid=530e63e9-e211-4b00-875c-811634f901cf&ddsuuid=49846337969849803952906196764197117418
dpm.demdex.net/ Frame 9280
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=10004&mt_exuid=49846337969849803952906196764197117418&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D269%26dpuuid%3D[MM_UUID]%26ddsuuid%3d49846337969849...
https://dpm.demdex.net/ibs:dpid=269&dpuuid=530e63e9-e211-4b00-875c-811634f901cf&ddsuuid=49846337969849803952906196764197117418

42 B
943 B

64ms
48ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=269&dpuuid=530e63e9-e211-4b00-875c-811634f901cf&ddsuuid=49846337969849803952906196764197117418

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-02d41f003.edge-irl1.demdex.com 11 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: w4E10KGkQrU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Date: Mon, 13 Feb 2023 07:09:05 GMT
Server: MT3 457 2362390 master cdg-pixel-x30 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://dpm.demdex.net/ibs:dpid=269&dpuuid=530e63e9-e211-4b00-875c-811634f901cf&ddsuuid=49846337969849803952906196764197117418
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 13 Feb 2023 07:09:04 GMT

GET
H2 200 s03985209950598 Show response
smetrics.td.com/b/ss/tdtdct,tdglobal/10/JS-2.20.0/ 5 KB
2 KB 244ms
243ms Script
application/x-javascript 23.36.162.211
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.td.com/b/ss/tdtdct,tdglobal/10/JS-2.20.0/s03985209950598?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=13%2F1%2F2023%207%3A9%3A5%201%200&d.&nsid=0&jsonv=1&.d&sdid=63092313CC94D546-3ED54D22C6713962&mid=49944462317964384252898012392840121304&aamlh=6&ce=UTF-8&ns=tdbank&pageName=%2Fwww.tdrewards.com%2Fhome-page&g=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&server=www.tdrewards.com&events=event1&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=D%3DpageName&v3=1&c4=3%3A00AM&v4=1&c5=Monday&v5=1&c6=Weekday&c12=not-authenticated&c13=New&v18=D%3Dc4&v19=D%3Dc5&c20=D%3Ds_vi&v20=D%3Dc6&c21=D%3DUser-Agent&v32=D%3Dc12&v33=D%3Dc13&v39=D%3Ds_vi&v68=D%3Dc21&c70=tdtdct%2Ctdglobal&c71=49944462317964384252898012392840121304&c74=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&c75=AppMeasurement%20-%202.20.0&v94=49944462317964384252898012392840121304&v151=D%3Dmid&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=A783776A5245B1E50A490D44%40AdobeOrg&AQE=1

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-211.deploy.static.akamaitechnologies.com

Software

jag /

Resource Hash

4cc60fa92ccabf4f00b053b08547eef38f058d7091eb14a609ae23fec2a8f266

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-aam-tid: iPjeMv74Tig=
date: Mon, 13 Feb 2023 07:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=86400
p3p: CP="This is not a P3P policy"
content-length: 1544
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-2-v046-006ebecd7.edge-irl1.demdex.com 4 ms
pragma: no-cache
last-modified: Tue, 14 Feb 2023 07:09:05 GMT
server: jag
etag: 3599767021335707648-4619790626175398671
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
expires: Mon, 13 Feb 2023 07:09:06 GMT

GET
H2 200 weblysleekuisl-webfont.woff2
www.tdrewards.com/templates/active/static/fonts/ 21 KB
21 KB 280ms
277ms Font
font/woff2 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/templates/active/static/fonts/weblysleekuisl-webfont.woff2

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/templates/active/static/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

8adf7be5e4b8e09896eb13e9eaa409a3bcf7d35a096c858127816cd520d8b13f

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

Referer: https://www.tdrewards.com/templates/active/static/style.css
Origin: https://www.tdrewards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:06 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"53e0-1863e185ef0"
content-type: font/woff2
x-iinfo: 2-14737121-14737132 PNNN RT(1676272144446 1298) q(0 0 0 -1) r(1 1) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 21472

GET
H/1.1

200
OK

ibs:dpid=358&dpuuid=1374673175657876562
dpm.demdex.net/ Frame 9280
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID
https://dpm.demdex.net/ibs:dpid=358&dpuuid=1374673175657876562

42 B
942 B

37ms
35ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=358&dpuuid=1374673175657876562

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-01546fed3.edge-irl1.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: G8JKXh/0QZo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Date: Mon, 13 Feb 2023 07:09:06 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.165; 185.213.155.165; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: a319548c-ecfc-4fbb-a527-efed2764e3ab
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dpm.demdex.net/ibs:dpid=358&dpuuid=1374673175657876562
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/624489921/ 2 KB
1 KB 119ms
118ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/624489921/?random=1676272146108&cv=11&fst=1676272146108&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&auid=538859098.1676272146&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-624489921&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03eeeb4cdd5eadabe9af6b56b66ba07a8c9aae2d597de50e7cf5cffea73a226b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 876
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/980723526/ 2 KB
1 KB 87ms
83ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/980723526/?random=1676272146172&cv=11&fst=1676272146172&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&auid=538859098.1676272146&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-980723526&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ce9ce4d4c46c7bda6dc10845c39e7baaee82e959408c8772e9bdf7f0ca026f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 874
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1029090628/ 42 B
455 B 196ms
77ms Image
image/gif 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1029090628/?random=1676272145795&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1897552032&rmt_tld=0&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1029090628/ 42 B
108 B 134ms
51ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1029090628/?random=1676272145795&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1897552032&rmt_tld=1&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/986405607/ 2 KB
902 B 86ms
86ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/986405607/?random=1676272146207&cv=11&fst=1676272146207&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&auid=538859098.1676272146&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-986405607&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f71a66712a6a95432443e5a69102ac1a96ef8e157b5207386501931eef3bea44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 876
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/707912219/ 42 B
108 B 135ms
79ms Image
image/gif 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/707912219/?random=1676272145767&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1501453040&rmt_tld=0&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/707912219/ 42 B
108 B 71ms
50ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/707912219/?random=1676272145767&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1501453040&rmt_tld=1&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/449593252/ 42 B
108 B 133ms
78ms Image
image/gif 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/449593252/?random=1676272145780&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=173249236&rmt_tld=0&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/449593252/ 42 B
455 B 69ms
50ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/449593252/?random=1676272145780&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=173249236&rmt_tld=1&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content token
token.rubiconproject.com/ Frame 9280 0
214 B 46ms
10ms Image
text/plain 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=6404&puid=49846337969849803952906196764197117418&gdpr=0&gdpr_consent=
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1028536181/ 2 KB
897 B 83ms
83ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1028536181/?random=1676272146276&cv=11&fst=1676272146276&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&auid=538859098.1676272146&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1028536181&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36bf20a78569d4d055aabd5d7cd47ddd757855f0865ee4af0413e1f1bce9bf15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 873
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/973175160/ 2 KB
900 B 98ms
97ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973175160/?random=1676272146298&cv=11&fst=1676272146298&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&auid=538859098.1676272146&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-973175160&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f8091c59053fa79cff36371a69d058b158ee4aedeb3ae3a2da32bf5f62a7c99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 876
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/624489921/ 42 B
108 B 76ms
70ms Image
image/gif 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/624489921/?random=1676272146108&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=623462478&rmt_tld=0&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/624489921/ 42 B
108 B 54ms
48ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/624489921/?random=1676272146108&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=623462478&rmt_tld=1&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/980723526/ 42 B
108 B 75ms
70ms Image
image/gif 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/980723526/?random=1676272146172&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3355397192&rmt_tld=0&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/980723526/ 42 B
108 B 52ms
48ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/980723526/?random=1676272146172&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3355397192&rmt_tld=1&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/986405607/ 42 B
108 B 76ms
71ms Image
image/gif 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/986405607/?random=1676272146207&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1887895538&rmt_tld=0&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/986405607/ 42 B
108 B 51ms
47ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/986405607/?random=1676272146207&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1887895538&rmt_tld=1&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=540&dpuuid=fd5fac82-ad96-4455-b1e8-5f5ec97ef066
dpm.demdex.net/ Frame 9280
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D540%26dpuuid%3D%24%7BTA_DEVICE_ID%7D&partner_device_id=49846337969849803952906196764...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=ADB&partner_url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D540%26dpuuid%3D%24%7BTA_DEVICE_ID%7D&partner_device_id=49846337969849803952906...
https://dpm.demdex.net/ibs:dpid=540&dpuuid=fd5fac82-ad96-4455-b1e8-5f5ec97ef066

42 B
942 B

36ms
34ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=540&dpuuid=fd5fac82-ad96-4455-b1e8-5f5ec97ef066

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-0c9e579d2.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: O4PqISj7Rxc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Mon, 13 Feb 2023 07:09:06 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://dpm.demdex.net/ibs:dpid=540&dpuuid=fd5fac82-ad96-4455-b1e8-5f5ec97ef066
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/1028536181/ 42 B
108 B 86ms
85ms Image
image/gif 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1028536181/?random=1676272146276&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1729543129&rmt_tld=0&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1028536181/ 42 B
108 B 48ms
47ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1028536181/?random=1676272146276&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1729543129&rmt_tld=1&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/973175160/ 42 B
108 B 79ms
72ms Image
image/gif 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/973175160/?random=1676272146298&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3621260319&rmt_tld=0&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/973175160/ 42 B
64 B 67ms
63ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/973175160/?random=1676272146298&cv=11&fst=1676271600000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&tiba=TD%20Rewards&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3621260319&rmt_tld=1&ipr=y

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 /
dp2.33across.com/ps/ Frame 9280 0
69 B 386ms
113ms Image
text/plain 67.202.105.24
STEADFAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dp2.33across.com/ps/?pid=897&random=1914920929
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.24 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-105.static.steadfastdns.net
Software: 33XP020 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-33x-status: 208
date: Mon, 13 Feb 2023 07:09:05 GMT
server: 33XP020

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEOVpKkQyzPOj5IrElIYMSWg&google_cver=1
dpm.demdex.net/ Frame 9280
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NDk4NDYzMzc5Njk4NDk4MDM5NTI5MDYxOTY3NjQxOTcxMTc0MTg=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEOVpKkQyzPOj5IrElIYMSWg&google_cver=1?gdpr=0&gdpr_consent=

42 B
942 B

34ms
33ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEOVpKkQyzPOj5IrElIYMSWg&google_cver=1?gdpr=0&gdpr_consent=

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-0b57eb040.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: uqbPSvq/RlI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEOVpKkQyzPOj5IrElIYMSWg&google_cver=1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
analytics.twitter.com/i/ Frame 9280 43 B
394 B 155ms
108ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?p_user_id=49846337969849803952906196764197117418&p_id=38594

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-response-time: 102
date: Mon, 13 Feb 2023 07:09:06 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: ab5ef5a4e1b7282c
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 4cb5697550e711112d4715494c12fb0176f9fb1e13cdbe81116fe573d22651fc
content-length: 43

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 9280
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEK_-zGERFqYCvu6YjxC6mvQ&google_cver=1
https://pixel.everesttech.net/1x1

128 B
796 B

36ms
28ms

Image
image/png

52.213.165.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: HTTP/1.1
Server: 52.213.165.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-165-255.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:07 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 13 Feb 2023 07:09:06 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 9280
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEK...
https://pixel.everesttech.net/1x1

128 B
691 B

33ms
33ms

Image
image/png

52.213.165.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: HTTP/1.1
Server: 52.213.165.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-165-255.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:07 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 13 Feb 2023 07:09:07 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 9280
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%25...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D26...
https://pixel.everesttech.net/1x1

128 B
691 B

28ms
28ms

Image
image/png

52.213.165.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: HTTP/1.1
Server: 52.213.165.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-165-255.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:07 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "36b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 13 Feb 2023 07:09:07 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 9280
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpir...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2...
https://pixel.everesttech.net/1x1

128 B
691 B

29ms
29ms

Image
image/png

52.213.165.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: HTTP/1.1
Server: 52.213.165.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-165-255.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:07 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 13 Feb 2023 07:09:07 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 9280
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fv...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggyb...
https://pixel.everesttech.net/1x1

128 B
691 B

29ms
28ms

Image
image/png

52.213.165.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: HTTP/1.1
Server: 52.213.165.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-165-255.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:07 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "36b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 13 Feb 2023 07:09:07 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

ibs:dpid=1175&&dpuuid=ihma09kYztmRHpnaiRjS3I8bnNuRTszTjEsqEMve
dpm.demdex.net/ Frame 9280
Redirect Chain

https://cms.quantserve.com/pixel/p-vj4AYjBqd6VJ2.gif?idmatch=0&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=1175&&dpuuid=ihma09kYztmRHpnaiRjS3I8bnNuRTszTjEsqEMve

42 B
942 B

36ms
34ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=1175&&dpuuid=ihma09kYztmRHpnaiRjS3I8bnNuRTszTjEsqEMve

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-04caab9e7.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: gr42a4X7TNw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:07 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dpm.demdex.net/ibs:dpid=1175&&dpuuid=ihma09kYztmRHpnaiRjS3I8bnNuRTszTjEsqEMve
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=1957&dpuuid=2648FB3AAE9E6F48352DE98DAF4C6EF3
dpm.demdex.net/ Frame 9280
Redirect Chain

https://c.bing.com/c.gif?uid=49846337969849803952906196764197117418&Red3=MSAdobe_pd&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=2648FB3AAE9E6F48352DE98DAF4C6EF3

42 B
942 B

33ms
33ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=1957&dpuuid=2648FB3AAE9E6F48352DE98DAF4C6EF3

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-0f6cf9230.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: O4d0YJPQTc8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 77BC0E2FC47A4434839F2C6C1D861151 Ref B: FRAEDGE2008 Ref C: 2023-02-13T07:09:07Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://dpm.demdex.net/ibs:dpid=1957&dpuuid=2648FB3AAE9E6F48352DE98DAF4C6EF3
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 9280
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WV9uaUVRQUFBRGNpWVFPWQ&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_...
https://pixel.everesttech.net/1x1

128 B
691 B

28ms
28ms

Image
image/png

52.213.165.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: HTTP/1.1
Server: 52.213.165.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-165-255.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:07 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 13 Feb 2023 07:09:07 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

ibs:dpid=22054
dpm.demdex.net/ Frame 9280
Redirect Chain

https://a.tribalfusion.com/i.match?p=b13&u=49846337969849803952906196764197117418&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$
https://s.tribalfusion.com/z/i.match?p=b13&u=49846337969849803952906196764197117418&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$
https://dpm.demdex.net/ibs:dpid=22054

42 B
956 B

36ms
30ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22054

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-0a5fb53d3.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: wck2Hns3RLo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
X-Error: 300
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:07 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 15
content-type: text/html
location: https://dpm.demdex.net/ibs:dpid=22054
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 798bbc9bda819c01-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=22052&dpuuid=3633570718661738639
dpm.demdex.net/ Frame 9280
Redirect Chain

https://ml314.com/utsync.ashx?eid=50112&et=0&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D[PersonID]
https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3633570718661738639

42 B
942 B

34ms
34ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3633570718661738639

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-074cac5f7.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: v45wsHEVQtA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:07 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: text/html; charset=utf-8
location: https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3633570718661738639
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 185
expires: 0,Tue, 14 Feb 2023 02:09:07 GMT

GET
H/1.1

200
OK

ibs:dpid=30646
dpm.demdex.net/ Frame 9280
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=49846337969849803952906196764197117418&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-.V4G4YdE2pExVIO3oUivc9SDvqXiipNd2SA-~A

42 B
942 B

35ms
34ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-.V4G4YdE2pExVIO3oUivc9SDvqXiipNd2SA-~A

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-0dc39c7af.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: sBFDhq3AQ3U=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Mon, 13 Feb 2023 07:09:07 GMT
strict-transport-security: max-age=31536000
via: http/1.1 spdc0108.pbp.ir2.yahoo.com (ApacheTrafficServer)
server: ATS
age: 0
content-type: text/html;charset=utf-8
location: https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-.V4G4YdE2pExVIO3oUivc9SDvqXiipNd2SA-~A
content-length: 0

GET
H/1.1

200
OK

ibs:dpid=575&dpuuid=-3132858143554780900
dpm.demdex.net/ Frame 9280
Redirect Chain

https://fei.pro-market.net/engine?site=141472;size=1x1;mimetype=img;du=67;csync=49846337969849803952906196764197117418
https://dpm.demdex.net/ibs:dpid=575&dpuuid=-3132858143554780900

42 B
942 B

37ms
36ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=575&dpuuid=-3132858143554780900

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v046-0d62fe975.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: ekGYZ9xiTYo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:07 GMT
via: 1.1 google
server: Apache-Coyote/1.1
anserver: gapp-eu-4.c.datonics-gcp-01.internal
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
access-control-allow-origin: *
location: https://dpm.demdex.net/ibs:dpid=575&dpuuid=-3132858143554780900
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
expires: Mon, 1 Jan 1990 0:0:0 GMT

GET
H/1.1

200
OK

noop
px.owneriq.net/ Frame 9280
Redirect Chain

https://px.owneriq.net/eucm/p/adpq?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D53196%26dpuuid%3D(OIQ_UUID)
https://px.owneriq.net/ecc?redir=https%3a%2f%2fdpm.demdex.net%2fibs%3adpid%3d53196%26dpuuid%3dQ7295585481422872386&uid=Q7295585481422872386&ref=%2Feucm%2Fp%2Fadpq
https://px.owneriq.net/noop?ct=image%2Fgif

0
287 B

8ms
7ms

Image
image/gif

95.100.68.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.owneriq.net/noop?ct=image%2Fgif
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: HTTP/1.1
Server: 95.100.68.200 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-68-200.deploy.static.akamaitechnologies.com
Software: Apache/2.4.6 (CentOS) / PHP/7.3.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Mon, 13 Feb 2023 07:09:08 GMT
Server: Apache/2.4.6 (CentOS)
Connection: keep-alive
X-Powered-By: PHP/7.3.33
Content-Length: 0
Content-Type: image/gif

Redirect headers

Location: https://px.owneriq.net/noop?ct=image%2Fgif
Date: Mon, 13 Feb 2023 07:09:08 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

ibs:dpid=59982&dpuuid=
dpm.demdex.net/ Frame 9280
Redirect Chain

https://exchange.adstanding.com/partners/aam/sync.php
https://dpm.demdex.net/ibs:dpid=59982&dpuuid=

42 B
960 B

30ms
28ms

Image
image/gif

52.17.115.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=59982&dpuuid=

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

HTTP/1.1

Server

52.17.115.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-115-124.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-03617f131.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: UT72ZJL+R34=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
X-Error: 104,300
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Mon, 13 Feb 2023 07:09:08 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=59982&dpuuid=
cache-control: no-store
expires: 0

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 9280
Redirect Chain

https://cm.everesttech.net/cm/yh
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y_niEQAAADciYQOY&sigv=1&esig=1~6aee2435500ffa8ef5a9644d168326d6ea56660d

0
194 B

178ms
20ms

Image
text/plain

2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y_niEQAAADciYQOY&sigv=1&esig=1~6aee2435500ffa8ef5a9644d168326d6ea56660d

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:08 GMT
strict-transport-security: max-age=15552000
cache-control: no-store
x-content-type-options: nosniff
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y_niEQAAADciYQOY&sigv=1&esig=1~6aee2435500ffa8ef5a9644d168326d6ea56660d
Date: Mon, 13 Feb 2023 07:09:08 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9280
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=5c420d2b-f139-4fee-b0c0-89a7b8ce9433
https://s.amazon-adsystem.com/dcm?pid=5c420d2b-f139-4fee-b0c0-89a7b8ce9433&dcc=t
https://dpm.demdex.net/ibs:dpid=139200&dpuuid=UnDUVJHATdeo0VeE6iqIDw&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dadobe.com%26id%3D%24%7BDD_UUID%7D
https://s.amazon-adsystem.com/ecm3?ex=adobe.com&id=49846337969849803952906196764197117418

43 B
479 B

116ms
116ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=adobe.com&id=49846337969849803952906196764197117418

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://td.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 13 Feb 2023 07:09:09 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: MSBGYAGVKKRMPTCMD6A8
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

DCS: dcs-prod-irl1-2-v046-04caab9e7.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: zX5tgqruTPI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://s.amazon-adsystem.com/ecm3?ex=adobe.com&id=49846337969849803952906196764197117418
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 _Incapsula_Resource
www.tdrewards.com/ 1 B
35 B 39ms
35ms Image
text/plain 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tdrewards.com/_Incapsula_Resource?SWKMTFSR=1&e=0.333179499418766
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.65.34 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 1
content-type: text/plain

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 164ms
47ms Script
text/javascript 2a00:1450:400d:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:802::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 13 Feb 2023 05:12:06 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 7022
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Mon, 13 Feb 2023 07:12:06 GMT

POST
H2 200 login Show response
www.tdrewards.com/api/userManagement/guestUser/ 489 B
1 KB 400ms
399ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/userManagement/guestUser/login

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

489ee3166ff370d28c59848b8e9732c12975f18cdd0c953c8fcd5c040d31f9fc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
X-Frame-Options: DENY
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:08 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14737226 PNNy RT(1676272144446 3753) q(0 1 1 -1) r(4 4) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 36ms
30ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/tdb/public-ca/code/21d670707824fc8bcc8207d207cfc0fa.js?conditionId0=423140

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

1d26490f083b209ef29e08d092649725edf15ac2b33ad62fdeaafd37f7d79d6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Mon, 13 Feb 2023 07:09:07 GMT
last-modified: Mon, 23 Jan 2023 19:59:24 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8058D26363B84D4B880C8F3C9E644081 Ref B: FRAEDGE2008 Ref C: 2023-02-13T07:09:08Z
etag: "076bc30652fd91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 11552

GET
H2 200 B10862916.145035458;sz=1x2;ord=548982555002 Show response
ad.doubleclick.net/ddm/adj/N307601.197812NSO.CODESRV/ 11 B
454 B 154ms
47ms Script
text/javascript 142.250.185.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N307601.197812NSO.CODESRV/B10862916.145035458;sz=1x2;ord=548982555002?

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/tdb/public-ca/code/21d670707824fc8bcc8207d207cfc0fa.js?conditionId0=423140

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f6.1e100.net

Software

cafe /

Resource Hash

f1e945400c04241ef089d71de3b0cf7e202431ac4685ada318714fe07ee9dcb0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:08 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 5188219.js Show response
bat.bing.com/p/action/ 0
117 B 100ms
100ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5188219.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Mon, 13 Feb 2023 07:09:08 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A8D41C5A24FD4F139EF46F9EE0432339 Ref B: FRAEDGE2008 Ref C: 2023-02-13T07:09:08Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
164 B 35ms
33ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5188219&Ver=2&mid=73727393-fa61-4905-978d-ce7792a83614&sid=4f24c470ab6d11ed9df4e19d3b9b5a20&vid=4f24e160ab6d11edb0b4cbbe268ea13e&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=TD%20Rewards&kw=TD%20Rewards,%09Points,%09Loyalty,%09Expedia,%09Redeem,%09Gift%20Cards,%09Travel,%09Apple,%09FitBit&p=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&r=&lt=4992&evt=pageLoad&sv=1&rn=99668

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 13 Feb 2023 07:09:08 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DB8FCEAA14814591951921DE4F3F7123 Ref B: FRAEDGE2008 Ref C: 2023-02-13T07:09:08Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ecommerce.js Show response
www.google-analytics.com/plugins/ua/ 1 KB
1 KB 51ms
49ms Script
text/javascript 2a00:1450:400d:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ecommerce.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:802::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 06:24:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2708
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 13 Feb 2023 07:24:00 GMT

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
950 B 52ms
50ms Script
text/javascript 2a00:1450:400d:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:802::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 06:40:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1712
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 859
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 13 Feb 2023 07:40:36 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
351 B 54ms
18ms XHR
text/plain 2a00:1450:4025:401::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-7284910-1&cid=1013736276.1676272149&jid=1983118128&gjid=1014853099&_gid=1362390987.1676272149&_u=aGBAiQIxBAAAAEAAs~&z=1803209282

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4025:401::9a Den Helder, Netherlands, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.tdrewards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 13 Feb 2023 07:09:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 48ms
48ms Image
image/gif 2a00:1450:400d:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=1070814117&t=pageview&_s=1&dl=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&dp=%2Fhome-page&ul=en-us&de=UTF-8&dt=TD%20Rewards&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAiQIxBAAAAAAAs~&jid=1983118128&gjid=1014853099&cid=1013736276.1676272149&tid=UA-7284910-1&_gid=1362390987.1676272149&z=1617496915

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:802::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Feb 2023 21:34:36 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 34472
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 nr-1026.min.js Show response
js-agent.newrelic.com/ 22 KB
9 KB 42ms
6ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1026.min.js
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2d10816bada4d94734c1cb7e191ffb89ea7d9bb5c11b3e680f6b00c3a28d4e41

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 varnish
date: Mon, 13 Feb 2023 07:09:08 GMT
x-amz-request-id: QF0N1HTF6GRFV3Q2
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 8844
x-amz-id-2: 0Sp/nPhBpPfQLh8BYAtsERPha9rYvSJ7oXUtECH35JA+gI59W+UJehdyim82SWgiGNoHI/lrFTY=
x-served-by: cache-hhn-etou8220053-HHN
last-modified: Wed, 28 Feb 2018 23:33:30 GMT
server: AmazonS3
x-timer: S1676272149.816905,VS0,VE0
etag: "230c916aaa9194e21891a639a9c2b8eb"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 5

GET
H2

200

activityi;dc_pre=CPb78q_4kf0CFQvrmgod_jkGuw;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https... Show response
6835781.fls.doubleclick.net/ Frame 45CC
Redirect Chain

https://6835781.fls.doubleclick.net/activityi;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=htt...
https://6835781.fls.doubleclick.net/activityi;dc_pre=CPb78q_4kf0CFQvrmgod_jkGuw;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964...

4 KB
1 KB

88ms
84ms

Document
text/html

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6835781.fls.doubleclick.net/activityi;dc_pre=CPb78q_4kf0CFQvrmgod_jkGuw;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6835781&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

0f64cf00969fd83994bb5d7d10d40c8b0b4e1f821b0ed06de9fe5c21e585c059

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.tdrewards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 1004
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 13 Feb 2023 07:09:09 GMT
expires: Mon, 13 Feb 2023 07:09:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 13 Feb 2023 07:09:08 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6835781.fls.doubleclick.net/activityi;dc_pre=CPb78q_4kf0CFQvrmgod_jkGuw;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

activityi;dc_pre=COP78q_4kf0CFcSmmgodAIIAEw;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=538859098.1676272146;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page Show response
6868519.fls.doubleclick.net/ Frame C2AD
Redirect Chain

https://6868519.fls.doubleclick.net/activityi;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=538859098.1676272146;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page?
https://6868519.fls.doubleclick.net/activityi;dc_pre=COP78q_4kf0CFcSmmgodAIIAEw;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=538859098.1676272146;~oref=https%3A%...

412 B
349 B

81ms
78ms

Document
text/html

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6868519.fls.doubleclick.net/activityi;dc_pre=COP78q_4kf0CFcSmmgodAIIAEw;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=538859098.1676272146;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6868519&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

9954e03c388d2b28690553227631e76c0235e99c85b2e2069ddc7193619688fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.tdrewards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 239
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 13 Feb 2023 07:09:09 GMT
expires: Mon, 13 Feb 2023 07:09:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 13 Feb 2023 07:09:08 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6868519.fls.doubleclick.net/activityi;dc_pre=COP78q_4kf0CFcSmmgodAIIAEw;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=538859098.1676272146;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

activityi;dc_pre=CImagLD4kf0CFffMOwIdsToApQ;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=htt... Show response
5322602.fls.doubleclick.net/ Frame 3B70
Redirect Chain

https://5322602.fls.doubleclick.net/activityi;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=h...
https://5322602.fls.doubleclick.net/activityi;dc_pre=CImagLD4kf0CFffMOwIdsToApQ;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=538859098.1676272146;u1=499444623179...

454 B
297 B

80ms
80ms

Document
text/html

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5322602.fls.doubleclick.net/activityi;dc_pre=CImagLD4kf0CFffMOwIdsToApQ;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-5322602&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

0b253374a5ebbf5c9c02de1c8fee6427d64e5fd1e60f18d379853bc3e6605db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.tdrewards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 274
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 13 Feb 2023 07:09:09 GMT
expires: Mon, 13 Feb 2023 07:09:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 13 Feb 2023 07:09:09 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5322602.fls.doubleclick.net/activityi;dc_pre=CImagLD4kf0CFffMOwIdsToApQ;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 79ms
78ms Image
image/gif 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-7284910-1&cid=1013736276.1676272149&jid=1983118128&_u=aGBAiQIxBAAAAEAAs~&z=1930338631

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 61ms
61ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-7284910-1&cid=1013736276.1676272149&jid=1983118128&_u=aGBAiQIxBAAAAEAAs~&z=1930338631

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK c099ced574 Show response
bam.nr-data.net/1/ 49 B
621 B 318ms
242ms Script
text/javascript 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/c099ced574?a=9185954&sa=1&v=1026.7a27a3e&t=Unnamed%20Transaction&rst=5340&ref=https://www.tdrewards.com/home-page&be=1737&fe=5262&dc=4912&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1676272143515,%22n%22:0,%22f%22:1185,%22dn%22:1185,%22dne%22:1234,%22c%22:1234,%22s%22:1240,%22ce%22:1252,%22rq%22:1252,%22rp%22:1711,%22rpe%22:1723,%22dl%22:1713,%22di%22:4910,%22ds%22:4911,%22de%22:4992,%22dc%22:5262,%22l%22:5262,%22le%22:5328%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1026.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Apex, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a83848cf5c3d96caefe490c19e41659609b3691dd4c531cf925016c084d8e1b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:09 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Transfer-Encoding: chunked
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Vary: Accept-Encoding
access-control-allow-credentials: true
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
CF-Ray: 798bbca2dc989c0c-FRA

GET
H2 200 angular-locale_en-ca.js Show response
www.tdrewards.com/templates/active/static/i18n/ 3 KB
3 KB 165ms
164ms Script
application/javascript 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/templates/active/static/i18n/angular-locale_en-ca.js

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

67563318f781475915e443fef24576ea64e5de5a80e7ab3fd6b967de15538dcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:09 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"a9a-1863e185ef0"
content-type: application/javascript; charset=UTF-8
x-iinfo: 2-14737121-14737224 PNNy RT(1676272144446 4214) q(0 0 0 -1) r(1 1) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 2714

GET
H2 200 product Show response
www.tdrewards.com/api/productManagement/ 8 KB
8 KB 324ms
324ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/productManagement/product?name=$250+Education+Credit

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

e927dcebecb2c550da9428ce3ef949d06bd75ec8116b3a9df83dc7ab63c1f04c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:09 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14737132 PNNN RT(1676272144446 4236) q(0 0 0 -1) r(3 3) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 catalog Show response
www.tdrewards.com/api/productManagement/ 434 B
539 B 322ms
322ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/productManagement/catalog?program_id=1

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

c40b0b8b73b6b119800fdbdcb3446d2b8de94b8259ae69aba87bae0eebf1c971

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:09 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14737228 PNNy RT(1676272144446 4267) q(0 0 0 -1) r(2 2) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 getRoutesLastUpdatedAt Show response
www.tdrewards.com/api/utilityManagement/ 549 B
665 B 614ms
613ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/utilityManagement/getRoutesLastUpdatedAt

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

e72492a74544c6585edf6669a2775ffad8eb11421ff56cde018e7663fc758f15

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:09 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14737588 NNNY CT(107 215 0) RT(1676272144446 4273) q(0 0 0 -1) r(5 5) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

POST
H/1.1 200
OK c099ced574 Show response
bam.nr-data.net/resources/1/ 36 B
418 B 243ms
242ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/resources/1/c099ced574?a=9185954&sa=1&v=1026.7a27a3e&t=Unnamed%20Transaction&rst=5665&ref=https://www.tdrewards.com/home-page&st=1676272143515
Requested by: Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Apex, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d79e37bccdf3dccb78a1ea9acf63fde85066f8bb72dc9ece08a4efbae09b18fd

Request headers

Referer: https://www.tdrewards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 13 Feb 2023 07:09:09 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.tdrewards.com
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 798bbca46e309c0c-FRA
Content-Length: 36

GET
H2 200 dc_pre=COP78q_4kf0CFcSmmgodAIIAEw;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=*;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page
adservice.google.com/ddm/fls/z/ Frame C2AD 42 B
401 B 201ms
82ms Image
image/gif 2a00:1450:400d:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=COP78q_4kf0CFcSmmgodAIIAEw;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=*;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page

Requested by

Host: 6868519.fls.doubleclick.net
URL: https://6868519.fls.doubleclick.net/activityi;dc_pre=COP78q_4kf0CFcSmmgodAIIAEw;src=6868519;type=credi0;cat=tdrew00-;ord=1;num=5063209535038;gtm=45fe3280;auiddc=538859098.1676272146;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:804::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6868519.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 category Show response
www.tdrewards.com/api/productManagement/ 918 B
1023 B 257ms
256ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/productManagement/category?catalog_id=1&category_id=&name=Gift+Cards

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

515a9ee3f253bf3ca15329846bca313504ad63c4d3e9fe6a27cd96a9d1dbd555

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:09 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14737224 PNNy RT(1676272144446 4534) q(0 0 0 -1) r(3 3) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 6820 Show response
www.tdrewards.com/api/productManagement/product/ 266 KB
267 KB 1211ms
1210ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/productManagement/product/6820

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

666dc840fd0f10b4db7c072b562f7eae9f393407892539666245e5ded32e123b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:10 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14737663 NNNN CT(120 227 0) RT(1676272144446 4536) q(0 0 4 -1) r(12 12) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 dc_pre=CPb78q_4kf0CFQvrmgod_jkGuw;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=*;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2F...
adservice.google.com/ddm/fls/z/ Frame 45CC 42 B
107 B 177ms
83ms Image
image/gif 2a00:1450:400d:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPb78q_4kf0CFQvrmgod_jkGuw;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=*;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page

Requested by

Host: 6835781.fls.doubleclick.net
URL: https://6835781.fls.doubleclick.net/activityi;dc_pre=CPb78q_4kf0CFQvrmgod_jkGuw;src=6835781;type=tdrew0;cat=tdrew0;ord=1;num=8448928003775;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:804::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6835781.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

activityi;dc_pre=CIqXibD4kf0CFbnNOwIdIlEIpg;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=9219360071325.633 Show response
5967600.fls.doubleclick.net/ Frame 2036
Redirect Chain

https://5967600.fls.doubleclick.net/activityi;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=9219360071325.633?
https://5967600.fls.doubleclick.net/activityi;dc_pre=CIqXibD4kf0CFbnNOwIdIlEIpg;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_conse...

1 KB
511 B

78ms
77ms

Document
text/html

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5967600.fls.doubleclick.net/activityi;dc_pre=CIqXibD4kf0CFbnNOwIdIlEIpg;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=9219360071325.633?

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

0aaff08b2236ed951d0a468d4b20f28a9da97f370239baae6ade6eaa01cc6240

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6835781.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 488
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 13 Feb 2023 07:09:09 GMT
expires: Mon, 13 Feb 2023 07:09:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 13 Feb 2023 07:09:09 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5967600.fls.doubleclick.net/activityi;dc_pre=CIqXibD4kf0CFbnNOwIdIlEIpg;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=9219360071325.633?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

activityi;dc_pre=CPnUi7D4kf0CFZDJOwIdAZoEIQ;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=712779301428.0836 Show response
10393945.fls.doubleclick.net/ Frame 2DCC
Redirect Chain

https://10393945.fls.doubleclick.net/activityi;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=712779301428.0836?
https://10393945.fls.doubleclick.net/activityi;dc_pre=CPnUi7D4kf0CFZDJOwIdAZoEIQ;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_con...

423 B
260 B

78ms
78ms

Document
text/html

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10393945.fls.doubleclick.net/activityi;dc_pre=CPnUi7D4kf0CFZDJOwIdAZoEIQ;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=712779301428.0836?

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

ccbf0bf9419658413d6f4052ff2db5b76fd2720460968b91f99c5596ac686512

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6835781.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 237
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 13 Feb 2023 07:09:09 GMT
expires: Mon, 13 Feb 2023 07:09:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 13 Feb 2023 07:09:09 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10393945.fls.doubleclick.net/activityi;dc_pre=CPnUi7D4kf0CFZDJOwIdAZoEIQ;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=712779301428.0836?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 45CC 106 KB
28 KB 41ms
20ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c1e56ad863615fc191d80d7807852db95e57579f6535186d83d04ecdebef5236

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6835781.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 13 Feb 2023 07:09:09 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27843
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 5vg6FfdO25eGQ0Rq1IaVyiN7cytBLOXBc/4UlpbIobFkk+WW59WhpO3GzOv9uzvHy7rG9RfSQ5PqZG3OfdM9rA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 2050670934
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 dc_pre=CImagLD4kf0CFffMOwIdsToApQ;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=*;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%...
adservice.google.com/ddm/fls/z/ Frame 3B70 42 B
107 B 113ms
82ms Image
image/gif 2a00:1450:400d:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CImagLD4kf0CFffMOwIdsToApQ;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=*;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page

Requested by

Host: 5322602.fls.doubleclick.net
URL: https://5322602.fls.doubleclick.net/activityi;dc_pre=CImagLD4kf0CFffMOwIdsToApQ;src=5322602;type=rewar0;cat=tdrew002;ord=1;num=1983025036282;gtm=45fe3280;auiddc=538859098.1676272146;u1=49944462317964384252898012392840121304;~oref=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:804::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5322602.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 2368582946583330 Show response
connect.facebook.net/signals/config/ Frame 45CC 150 KB
42 KB 355ms
354ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2368582946583330?v=2.9.95&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7bc954af5c2c5f341874056b0e2bae37868b044ad67d9c292f9fa5817ba00efc

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6835781.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 13 Feb 2023 07:09:09 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: hcW/jL4w3KkNg4FfEufv8NR9MZDTO6hRfPG+Aj43ziN3AmN1kF15TJ4CiOnVku1QTwew7KVQX1yJVuqsl4WZ3A==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 2050670934
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ Frame 2036 45 KB
17 KB 152ms
54ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: 5967600.fls.doubleclick.net
URL: https://5967600.fls.doubleclick.net/activityi;dc_pre=CIqXibD4kf0CFbnNOwIdIlEIpg;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=9219360071325.633?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

5aa93e7401f9a3344d1f891eacfb0cf698bf56cc5d7cb2586bfe0d82d1c8c4b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5967600.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16813
x-xss-protection: 0
server: cafe
etag: 6388606791587927312
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 13 Feb 2023 07:09:09 GMT

GET
H2 200 dc_pre=CIqXibD4kf0CFbnNOwIdIlEIpg;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=9219360071325.633
adservice.google.com/ddm/fls/z/ Frame 2036 42 B
107 B 83ms
82ms Image
image/gif 2a00:1450:400d:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CIqXibD4kf0CFbnNOwIdIlEIpg;src=5967600;type=invmedia;cat=tdrew000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=9219360071325.633

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:804::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5967600.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CPnUi7D4kf0CFZDJOwIdAZoEIQ;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=712779301428.0836
adservice.google.com/ddm/fls/z/ Frame 2DCC 42 B
107 B 82ms
82ms Image
image/gif 2a00:1450:400d:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPnUi7D4kf0CFZDJOwIdAZoEIQ;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=712779301428.0836

Requested by

Host: 10393945.fls.doubleclick.net
URL: https://10393945.fls.doubleclick.net/activityi;dc_pre=CPnUi7D4kf0CFZDJOwIdAZoEIQ;src=10393945;type=invmedia;cat=tdban02l;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=712779301428.0836?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:804::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://10393945.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 getAppComponents Show response
www.tdrewards.com/api/utilityManagement/ 1 MB
1 MB 1320ms
1320ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/utilityManagement/getAppComponents

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

e4cc034f3b3a979ead9a490a6f37021b3e5fed1452045136cc06daab3242db75

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:10 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14737757 NNNN CT(118 240 0) RT(1676272144446 4817) q(0 0 4 -1) r(13 13) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/875695358/ Frame 2036 2 KB
1 KB 50ms
49ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/875695358/?random=1676272149653&cv=9&fst=1676272149653&num=1&npa=1&label=Yk5PCMaLxYYYEP6ZyKED&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F5967600.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIqXibD4kf0CFbnNOwIdIlEIpg%3Bsrc%3D5967600%3Btype%3Dinvmedia%3Bcat%3Dtdrew000%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bnpa%3D%3Bgdpr%3D%3Bgdpr_consent%3D%3Bord%3D9219360071325.633%3F&ref=https%3A%2F%2F6835781.fls.doubleclick.net%2F&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

4025e211c7fe1ba931fe68201e70720a686d43d37300b3b4006c6577d445fc42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5967600.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1182
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.de/pagead/1p-conversion/875695358/ Frame 2036
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/875695358/?random=1281826204&cv=9&fst=1676272149653&num=1&npa=1&label=Yk5PCMaLxYYYEP6ZyKED&guid=ON&resp=GooglemKTybQhCsO&eid=3756032...
https://www.google.com/pagead/1p-conversion/875695358/?random=1281826204&cv=9&fst=1676272149653&num=1&npa=1&label=Yk5PCMaLxYYYEP6ZyKED&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465925&u_h=12...
https://www.google.de/pagead/1p-conversion/875695358/?random=1281826204&cv=9&fst=1676272149653&num=1&npa=1&label=Yk5PCMaLxYYYEP6ZyKED&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465925&u_h=120...

42 B
64 B

53ms
53ms

Image
image/gif

2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/875695358/?random=1281826204&cv=9&fst=1676272149653&num=1&npa=1&label=Yk5PCMaLxYYYEP6ZyKED&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F5967600.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIqXibD4kf0CFbnNOwIdIlEIpg%3Bsrc%3D5967600%3Btype%3Dinvmedia%3Bcat%3Dtdrew000%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bnpa%3D%3Bgdpr%3D%3Bgdpr_consent%3D%3Bord%3D9219360071325.633%3F&ref=https%3A%2F%2F6835781.fls.doubleclick.net%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=FeLpY_maKYnDmLAPkcmu8As&cid=CAQSKQDUE5ymfN6Fk2VUK_NfeQEFllo2mb55U0tCDrwsksAEA-d8GbRp6aDV&random=1717107616&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Requested by

Protocol

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5967600.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:09 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 13 Feb 2023 07:09:09 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/875695358/?random=1281826204&cv=9&fst=1676272149653&num=1&npa=1&label=Yk5PCMaLxYYYEP6ZyKED&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F5967600.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIqXibD4kf0CFbnNOwIdIlEIpg%3Bsrc%3D5967600%3Btype%3Dinvmedia%3Bcat%3Dtdrew000%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bnpa%3D%3Bgdpr%3D%3Bgdpr_consent%3D%3Bord%3D9219360071325.633%3F&ref=https%3A%2F%2F6835781.fls.doubleclick.net%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=FeLpY_maKYnDmLAPkcmu8As&cid=CAQSKQDUE5ymfN6Fk2VUK_NfeQEFllo2mb55U0tCDrwsksAEA-d8GbRp6aDV&random=1717107616&resp=GooglemKTybQhCsO&ipr=y&prhg=0
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 inferredevents.js Show response
connect.facebook.net/signals/plugins/ Frame 45CC 72 KB
22 KB 8ms
8ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/inferredevents.js?v=2.9.95

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5849e07d0d6cbb144829b98da75fda4a8eb3fc2b5749d48cc94bb170db54859a

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6835781.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 13 Feb 2023 07:09:09 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 21972
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: hFBOpBeMxyTvIbs0o9mgn6JFVFPrF1P6mNyRNfAMyxgw8CEhyenqU3pIopGDoBm6SLetmTmK+74bro8c+iD7vg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ Frame 45CC 0
185 B 26ms
7ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2368582946583330&ev=RewardsLandingPageENFR&dl=https%3A%2F%2F6835781.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCPb78q_4kf0CFQvrmgod_jkGuw%3Bsrc%3D6835781%3Btype%3Dtdrew0%3Bcat%3Dtdrew0%3Bord%3D1%3Bnum%3D8448928003775%3Bgtm%3D45fe3280%3Bauiddc%3D538859098.1676272146%3Bu1%3D49944462317964384252898012392840121304%3B~oref%3Dhttps%253A%252F%252Fwww.tdrewards.com%252Fhome-page%3F&rl=https%3A%2F%2Fwww.tdrewards.com%2F&if=true&ts=1676272149761&sw=1600&sh=1200&v=2.9.95&r=stable&ec=0&o=28&it=1676272149367&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6835781.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 13 Feb 2023 07:09:09 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ Frame 45CC 0
31 B 26ms
8ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2368582946583330&ev=PageView&dl=https%3A%2F%2F6835781.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCPb78q_4kf0CFQvrmgod_jkGuw%3Bsrc%3D6835781%3Btype%3Dtdrew0%3Bcat%3Dtdrew0%3Bord%3D1%3Bnum%3D8448928003775%3Bgtm%3D45fe3280%3Bauiddc%3D538859098.1676272146%3Bu1%3D49944462317964384252898012392840121304%3B~oref%3Dhttps%253A%252F%252Fwww.tdrewards.com%252Fhome-page%3F&rl=https%3A%2F%2Fwww.tdrewards.com%2F&if=true&ts=1676272149765&sw=1600&sh=1200&v=2.9.95&r=stable&ec=1&o=28&cs_est=true&it=1676272149367&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6835781.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 13 Feb 2023 07:09:09 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 category Show response
www.tdrewards.com/api/productManagement/ 920 B
1 KB 275ms
275ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/productManagement/category?catalog_id=1&category_id=&name=eGift+Cards

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

e0298f839cf9048d891da8e67de3de20cf6e4d3bf20c190a97a4e90423719084

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14738204 NNNY CT(109 219 0) RT(1676272144446 7512) q(0 0 0 -1) r(3 3) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 category Show response
www.tdrewards.com/api/productManagement/ 910 B
1 KB 279ms
279ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/productManagement/category?catalog_id=1&category_id=&name=Weekly+Specials

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

02015cec9e1fd264aa0bbd121406cb92be4b1c58c9206f6f2397697e5793c243

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14738208 NNNY CT(108 218 0) RT(1676272144446 7527) q(0 0 0 -1) r(3 3) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 category Show response
www.tdrewards.com/api/productManagement/ 910 B
1 KB 275ms
275ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/productManagement/category?catalog_id=2&category_id=&name=Weekly+Specials

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

349d1d1ce1fc06e440c712fb997de2458af8fca4ba165032e341d124d94c9c64

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14738210 NNNY CT(107 215 0) RT(1676272144446 7532) q(0 0 0 -1) r(3 3) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 category Show response
www.tdrewards.com/api/productManagement/ 910 B
1 KB 274ms
274ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/productManagement/category?catalog_id=1&category_id=&name=New+on+TD+Rewards

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

1aec5e1e4e9a306eb67dddf81346016f1666a40597d1992de6510dbb5bdcea1e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14738213 NNNY CT(106 214 0) RT(1676272144446 7539) q(0 0 0 -1) r(3 3) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 category Show response
www.tdrewards.com/api/productManagement/ 908 B
1 KB 277ms
277ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/productManagement/category?catalog_id=2&category_id=&name=New+on+TD+Rewards

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

db74150f68e355924963a98183bc9e6d4dd06f619e34b56134a26a30c9b9a94c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14738215 NNNY CT(113 225 0) RT(1676272144446 7543) q(0 0 0 -1) r(3 3) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 td_shield_nowhitespace.png
www.tdrewards.com/templates/active/static/images/ 1 KB
2 KB 201ms
201ms Image
image/png 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/td_shield_nowhitespace.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

a01050f120544b659a5b01dd168b7416224587780616e22d71c1d223e7a6d92b

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"569-1863e185ef0"
content-type: image/png
x-iinfo: 2-14737121-14738217 NNNY CT(111 222 0) RT(1676272144446 7546) q(0 0 0 -1) r(2 2) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 1385

GET
H2 200 weblysleekuil-webfont.woff2
www.tdrewards.com/templates/active/static/fonts/ 18 KB
19 KB 338ms
338ms Font
font/woff2 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/templates/active/static/fonts/weblysleekuil-webfont.woff2

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/templates/active/static/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

7f8f92a1913474ebb54f27bb9a908eb8006c76665ed14ed7ebea958b661b4b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

Referer: https://www.tdrewards.com/templates/active/static/style.css
Origin: https://www.tdrewards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"49e4-1863e185ef0"
content-type: font/woff2
x-iinfo: 2-14737121-14738217 PNNy RT(1676272144446 7548) q(0 2 2 -1) r(4 4) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 18916

GET
H2 200 td-font.ttf
www.tdrewards.com/templates/active/static/fonts/ 5 KB
5 KB 384ms
383ms Font
font/ttf 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/templates/active/static/fonts/td-font.ttf?j0pn85

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/templates/active/static/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

c39cd074b33a0348246ff987044c7650533c69afc4727bac852f8e02722d6d67

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

Referer: https://www.tdrewards.com/templates/active/static/style.css
Origin: https://www.tdrewards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"12c4-1863e185ef0"
content-type: font/ttf
x-iinfo: 2-14737121-14738247 NNNY CT(111 220 0) RT(1676272144446 7550) q(0 3 3 -1) r(4 4) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 4804

GET
H2 200 e6cf7c6ec7c2d6f670ae9d762604cb0b.woff2
www.tdrewards.com/ 70 KB
71 KB 306ms
305ms Font
font/woff2 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/e6cf7c6ec7c2d6f670ae9d762604cb0b.woff2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

Referer: https://www.tdrewards.com/home-page
Origin: https://www.tdrewards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"118d8-1863e185ef0"
content-type: font/woff2
x-iinfo: 2-14737121-14738248 NNNY CT(107 214 0) RT(1676272144446 7640) q(0 2 2 -1) r(3 3) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 71896

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 47ms
47ms Image
image/gif 2a00:1450:400d:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=1070814117&t=pageview&_s=2&dl=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&dp=%2Fhome-page&ul=en-us&de=UTF-8&dt=TD%20Rewards&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAiQIxBAAAAEACs~&jid=&gjid=&cid=1013736276.1676272149&tid=UA-7284910-1&_gid=1362390987.1676272149&z=1202195953

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:802::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Feb 2023 08:29:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 81587
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 expedia_logo.svg
www.tdrewards.com/templates/active/static/images/ 5 KB
5 KB 663ms
661ms Image
image/svg+xml 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/expedia_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

e2f5114f1b78eea5212a2aa1a74bf3c57ed7c2e8c64b4881bf5bbb266c758f1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"1335-1863e185ef0"
content-type: image/svg+xml
x-iinfo: 2-14737121-14738249 NNNN CT(139 241 0) RT(1676272144446 7683) q(0 1 4 -1) r(6 6) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 4917

GET
H2 200 amazon_logo.jpg
www.tdrewards.com/templates/active/static/images/ 9 KB
9 KB 724ms
721ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/amazon_logo.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

1de90302505bf3cdb1bfce7f2d1e76a850e3097030b79cd83e2c8a119e899aaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"2365-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738251 NNNN CT(171 251 0) RT(1676272144446 7714) q(0 1 5 -1) r(6 6) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 9061

GET
H2 200 gift_six.jpg
www.tdrewards.com/templates/active/static/images/gift/home_one/ 25 KB
26 KB 737ms
734ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/gift/home_one/gift_six.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

8cd9dee34cd96472a5fd5de618fd4420fb9814517b51176314d1136d27c01364

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"65c6-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738252 NNNN CT(176 249 0) RT(1676272144446 7727) q(0 1 5 -1) r(6 6) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 26054

GET
H2 200 gift_seven.jpg
www.tdrewards.com/templates/active/static/images/gift/home_one/ 14 KB
14 KB 617ms
615ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/gift/home_one/gift_seven.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

8183f487fa94a19fb2816dca3ab186a70e2475c48e8743d56f9953b9eeabb53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"3790-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738248 PNNy RT(1676272144446 7735) q(0 4 4 -1) r(5 5) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 14224

GET
H2 200 gift_eight.jpg
www.tdrewards.com/templates/active/static/images/gift/home_one/ 21 KB
21 KB 774ms
772ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/gift/home_one/gift_eight.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

2c3af664cd131d6c3ec4d824edea7425264bc8461e31b51afba285782735320f

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"531c-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738247 PNNy RT(1676272144446 7755) q(0 5 5 -1) r(6 6) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 21276

GET
H2 200 gift_nine.jpg
www.tdrewards.com/templates/active/static/images/gift/home_one/ 16 KB
16 KB 777ms
776ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/gift/home_one/gift_nine.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

7274e17a34226a2c73e8f8d81ddeb16ee2e364982b97b0d21ee34cccce010bb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"3fe9-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738248 PNNy RT(1676272144446 7761) q(0 5 5 -1) r(6 6) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 16361

GET
H2 200 gift_ten.jpg
www.tdrewards.com/templates/active/static/images/gift/home_one/ 21 KB
21 KB 779ms
777ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/gift/home_one/gift_ten.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

d333b91ec038474abd149162888f378fdd803d5190f15bda93d45566d5b03af6

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"54d5-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738249 PNNN RT(1676272144446 7767) q(0 5 5 -1) r(6 6) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 21717

GET
H/1.1 200
OK costco_banner_en_small.jpg
assets.tdrewards.com/img/ 92 KB
92 KB 431ms
101ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/costco_banner_en_small.jpg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

c8229d15724f0676dd350d16c3f9bd4ff187d30c05e0bb9724d685b6f3dda9a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:12 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Thu, 26 Jan 2023 21:12:21 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63d2ecb5-16fda"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 94170

GET
H/1.1 200
OK costco_banner_en_large_001.jpg
assets.tdrewards.com/img/ 120 KB
120 KB 432ms
102ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/costco_banner_en_large_001.jpg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

b431134355745303c022637468741f6aae1bfff793ad84517d5d25d47b187f9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:12 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Thu, 26 Jan 2023 21:12:32 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63d2ecc0-1debb"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 122555

GET
H/1.1 200
OK cr-1707_expedia_luxury_listings_small_opt1.jpg
assets.tdrewards.com/img/ 203 KB
203 KB 434ms
101ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/cr-1707_expedia_luxury_listings_small_opt1.jpg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

08f8b040ee30061c83265a81c2c00cf096d4e8669de3e4cbaa669cdd4cce763f

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:12 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Tue, 20 Dec 2022 16:50:40 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63a1e7e0-32c17"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 207895

GET
H/1.1 200
OK cr-1707_expedia_luxury_listings_large.jpg
assets.tdrewards.com/img/ 228 KB
228 KB 434ms
102ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/cr-1707_expedia_luxury_listings_large.jpg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

47aae9ce4b8ad9b2911f635e273b753e51fdf4f8a6aad5fe1bcd44d49d1ab00f

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:12 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Tue, 20 Dec 2022 16:50:30 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63a1e7d6-38f67"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 233319

GET
H/1.1 200
OK cr-1331_egift_card_banner_small_003.jpg
assets.tdrewards.com/img/ 87 KB
87 KB 435ms
102ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/cr-1331_egift_card_banner_small_003.jpg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

b1e6fa50f60420fef9a2489bf847c308641c38b0080515debc5fcb25958e470a

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:12 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Fri, 11 Mar 2022 16:32:24 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "622b7998-15b21"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 88865

GET
H/1.1 200
OK cr-1331_egift_card_banner_large_004.jpg
assets.tdrewards.com/img/ 127 KB
128 KB 438ms
105ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/cr-1331_egift_card_banner_large_004.jpg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

28f4dd52de8ad78ccfd9c8d10e6f1d8cad3d85df5963ad079f363049e7f1fe86

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:12 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Fri, 11 Mar 2022 16:32:12 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "622b798c-1fddc"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 130524

GET
H2 200 c5cd7f5300576ab4c88202b42f6ded62.gif
www.tdrewards.com/ 4 KB
4 KB 862ms
862ms Image
image/gif 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/c5cd7f5300576ab4c88202b42f6ded62.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"1052-1863e185ef0"
content-type: image/gif
x-iinfo: 2-14737121-14738251 PNNN RT(1676272144446 7793) q(0 5 5 -1) r(7 7) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 4178

GET
H2 200 icons.ttf
www.tdrewards.com/templates/active/static/images/icons/ 35 KB
35 KB 465ms
465ms Font
font/ttf 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/templates/active/static/images/icons/icons.ttf?qta720

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/templates/active/static/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

0b2a1aee7a62edd2f0edcadf59fd2e1c5635e5eb1c807b10e64c06176c9eb077

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

Referer: https://www.tdrewards.com/templates/active/static/style.css
Origin: https://www.tdrewards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:12 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"8a7c-1863e185ef0"
content-type: font/ttf
x-iinfo: 2-14737121-14738247 PNNy RT(1676272144446 7815) q(0 2 2 -1) r(3 3) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 35452

GET
H2 200 s09178141175291 Show response
smetrics.td.com/b/ss/tdtdct,tdglobal/10/JS-2.20.0/ 5 KB
2 KB 220ms
220ms Script
application/x-javascript 23.36.162.211
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.td.com/b/ss/tdtdct,tdglobal/10/JS-2.20.0/s09178141175291?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=13%2F1%2F2023%207%3A9%3A12%201%200&d.&nsid=0&jsonv=1&.d&mid=49944462317964384252898012392840121304&aamlh=6&ce=UTF-8&ns=tdbank&pageName=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&g=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&ch=ca-en&server=www.tdrewards.com&events=event1&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=D%3DpageName&v3=1&c4=3%3A00AM&v4=1&c5=Monday&v5=1&c6=Weekday&c12=not-authenticated&c13=New&v18=D%3Dc4&v19=D%3Dc5&c20=D%3Ds_vi&v20=D%3Dc6&c21=D%3DUser-Agent&v32=D%3Dc12&v33=D%3Dc13&v39=D%3Ds_vi&v68=D%3Dc21&c70=tdtdct%2Ctdglobal&c71=49944462317964384252898012392840121304&c74=https%3A%2F%2Fwww.tdrewards.com%2Fhome-page&c75=AppMeasurement%20-%202.20.0&v94=49944462317964384252898012392840121304&v151=D%3Dmid&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=A783776A5245B1E50A490D44%40AdobeOrg&lrt=439&AQE=1

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-211.deploy.static.akamaitechnologies.com

Software

jag /

Resource Hash

eebaa0d729d5b4d076e6b814a6546963b94373aa67694cf88bbd5384fa1eb851

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-aam-tid: YJ4piodPSQY=
date: Mon, 13 Feb 2023 07:09:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=86400
p3p: CP="This is not a P3P policy"
content-length: 1545
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-1-v046-0ff8ba6d7.edge-irl1.demdex.com 5 ms
pragma: no-cache
last-modified: Tue, 14 Feb 2023 07:09:12 GMT
server: jag
etag: 3599767037494624256-4619863321718282803
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
expires: Mon, 13 Feb 2023 07:09:12 GMT

GET
H2 200 1
www.tdrewards.com/api/productManagement/catalog/ 57 KB
0 836ms
836ms XHR
application/json 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tdrewards.com/api/productManagement/catalog/1?category_id=323&per_page=10

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/home-page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) / Express

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
X-Content-Security-Policy	default-src 'self'
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, DENY
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Accept-Language: de-DE,de;q=0.9
Authorization: 9YO3en5u7rwzPfjqabv6drsq3UGLZL2dr9yqVpdSodFf7AxOcKsgFLVr1JVEDxRaGwV4f2TktX7lqGwOqqTg9Ytdu3Hlc8OF51TntnvC5PdzmrVgziaYWdFCdbPCKKAZ
X-Frame-Options: DENY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Referer: https://www.tdrewards.com/home-page
X-XSS-Protection: 1

Response headers

expires: -1
date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000, max-age=157680000, max-age=157680000
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'
x-permitted-cross-domain-policies: master-only
x-cdn: Imperva
x-powered-by: Express
x-iinfo: 2-14737121-14738217 PNNy RT(1676272144446 7990) q(0 0 0 -1) r(6 6) U5
x-xss-protection: 1; mode=block, 1; mode=block
pragma: no-cache
server: nginx/1.18.0 (Ubuntu)
x-download-options: noopen
x-frame-options: SAMEORIGIN, SAMEORIGIN, DENY
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: https://www.tdrewards.com
cache-control: no-cache, private, max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, Authentication, Authorization, X-Requested-With, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Origin, Auth
x-content-security-policy: default-src 'self'

GET
H2 200 gift_seven.jpg
www.tdrewards.com/templates/active/static/images/gift/home_one/ 14 KB
14 KB 364ms
363ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/gift/home_one/gift_seven.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

8183f487fa94a19fb2816dca3ab186a70e2475c48e8743d56f9953b9eeabb53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"3790-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738248 PNNy RT(1676272144446 8271) q(0 1 1 -1) r(3 3) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 14224

GET
H/1.1 200
OK cr-1331_egift_card_banner_small_003.jpg
assets.tdrewards.com/img/ 87 KB
87 KB 102ms
102ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/cr-1331_egift_card_banner_small_003.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

b1e6fa50f60420fef9a2489bf847c308641c38b0080515debc5fcb25958e470a

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:13 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Fri, 11 Mar 2022 16:32:24 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "622b7998-15b21"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 88865

GET
H/1.1 200
OK costco_banner_en_small.jpg
assets.tdrewards.com/img/ 92 KB
92 KB 102ms
101ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/costco_banner_en_small.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

c8229d15724f0676dd350d16c3f9bd4ff187d30c05e0bb9724d685b6f3dda9a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:13 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Thu, 26 Jan 2023 21:12:21 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63d2ecb5-16fda"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 94170

GET
H/1.1 200
OK costco_banner_en_large_001.jpg
assets.tdrewards.com/img/ 120 KB
120 KB 105ms
104ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/costco_banner_en_large_001.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

b431134355745303c022637468741f6aae1bfff793ad84517d5d25d47b187f9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:13 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Thu, 26 Jan 2023 21:12:32 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63d2ecc0-1debb"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 122555

GET
H/1.1 200
OK cr-1707_expedia_luxury_listings_small_opt1.jpg
assets.tdrewards.com/img/ 203 KB
203 KB 103ms
103ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/cr-1707_expedia_luxury_listings_small_opt1.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

08f8b040ee30061c83265a81c2c00cf096d4e8669de3e4cbaa669cdd4cce763f

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:13 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Tue, 20 Dec 2022 16:50:40 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63a1e7e0-32c17"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 207895

GET
H/1.1 200
OK cr-1331_egift_card_banner_large_004.jpg
assets.tdrewards.com/img/ 127 KB
128 KB 102ms
101ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/cr-1331_egift_card_banner_large_004.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

28f4dd52de8ad78ccfd9c8d10e6f1d8cad3d85df5963ad079f363049e7f1fe86

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:13 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Fri, 11 Mar 2022 16:32:12 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "622b798c-1fddc"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 130524

GET
H2 200 gift_nine.jpg
www.tdrewards.com/templates/active/static/images/gift/home_one/ 16 KB
16 KB 351ms
350ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/gift/home_one/gift_nine.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

7274e17a34226a2c73e8f8d81ddeb16ee2e364982b97b0d21ee34cccce010bb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"3fe9-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738249 PNNN RT(1676272144446 8486) q(0 0 0 -1) r(2 2) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 16361

GET
H/1.1 200
OK cr-1707_expedia_luxury_listings_large.jpg
assets.tdrewards.com/img/ 228 KB
228 KB 101ms
101ms Image
image/jpeg 209.15.211.147
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.tdrewards.com/img/cr-1707_expedia_luxury_listings_large.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

209.15.211.147 Toronto, Canada, ASN13768 (COGECO-PEER1, CA),

Reverse DNS

news.updatefrom.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

47aae9ce4b8ad9b2911f635e273b753e51fdf4f8a6aad5fe1bcd44d49d1ab00f

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 07:09:13 GMT
Strict-Transport-Security: max-age=157680000
Last-Modified: Tue, 20 Dec 2022 16:50:30 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63a1e7d6-38f67"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 233319

GET
H2 200 gift_eight.jpg
www.tdrewards.com/templates/active/static/images/gift/home_one/ 21 KB
21 KB 266ms
266ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/gift/home_one/gift_eight.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

2c3af664cd131d6c3ec4d824edea7425264bc8461e31b51afba285782735320f

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"531c-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738247 PNNy RT(1676272144446 8502) q(0 0 0 -1) r(2 2) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 21276

GET
H2 200 gift_ten.jpg
www.tdrewards.com/templates/active/static/images/gift/home_one/ 21 KB
21 KB 312ms
312ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/gift/home_one/gift_ten.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

d333b91ec038474abd149162888f378fdd803d5190f15bda93d45566d5b03af6

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"54d5-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738251 PNNN RT(1676272144446 8559) q(0 0 0 -1) r(2 2) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 21717

GET
H2 200 gift_six.jpg
www.tdrewards.com/templates/active/static/images/gift/home_one/ 25 KB
26 KB 295ms
293ms Image
image/jpeg 45.60.65.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tdrewards.com/templates/active/static/images/gift/home_one/gift_six.jpg

Requested by

Host: www.tdrewards.com
URL: https://www.tdrewards.com/vendors.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.65.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

/ Express

Resource Hash

8cd9dee34cd96472a5fd5de618fd4420fb9814517b51176314d1136d27c01364

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tdrewards.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 07:09:13 GMT
strict-transport-security: max-age=157680000
last-modified: Sat, 11 Feb 2023 01:30:30 GMT
x-cdn: Imperva
x-powered-by: Express
etag: W/"65c6-1863e185ef0"
content-type: image/jpeg
x-iinfo: 2-14737121-14738252 PNNN RT(1676272144446 8782) q(0 0 0 -1) r(1 1) U5
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 26054

Verdicts & Comments Add Verdict or Comment

109 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

45 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
eurox.co.th/	1969-12-31 23:59:59	Name: PHPSESSID Value: asc2ilncdv7hcjo8h1k3rco031
.tdrewards.com/	1970-01-20 18:22:31	Name: visid_incap_2714874 Value: 1m6BRSrrS/O52VdBfdKM7xDi6WMAAAAAQUIPAAAAAACMAHIeCzFe/Qg6afFMTolT
.tdrewards.com/	1969-12-31 23:59:59	Name: incap_ses_184_2714874 Value: JhGvS+q/dXy5VE0JdLONAhDi6WMAAAAApVq0s1UXHtwJNQxtKvkxiA==
.tdrewards.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-20 13:57:04	Name: demdex Value: 49846337969849803952906196764197117418
.tdrewards.com/	1969-12-31 23:59:59	Name: AMCVS_A783776A5245B1E50A490D44%40AdobeOrg Value: 1
.everesttech.net/	1970-01-20 18:23:28	Name: everest_g_v2 Value: g_surferid~Y_niEQAAADciYQOY
.tdrewards.com/	1970-01-20 19:13:52	Name: mbox Value: session#230c089bf9524c009305d2a0db4d30be#1676274006\|PC#230c089bf9524c009305d2a0db4d30be.37_0#1739516946
.tdrewards.com/	1970-01-20 09:37:54	Name: mboxEdgeCluster Value: 37
.dpm.demdex.net/	1970-01-20 13:57:04	Name: dpm Value: 49846337969849803952906196764197117418
.tdrewards.com/	1970-01-20 11:47:28	Name: _gcl_au Value: 1.1.538859098.1676272146
.td.com/	1970-01-20 19:13:52	Name: s_ecid Value: MCMID%7C49944462317964384252898012392840121304
.tdrewards.com/	1970-01-20 19:13:52	Name: AMCV_A783776A5245B1E50A490D44%40AdobeOrg Value: 359503849%7CMCIDTS%7C19402%7CMCMID%7C49944462317964384252898012392840121304%7CMCAAMLH-1676876945%7C6%7CMCAAMB-1676876945%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1676279345s%7CNONE%7CMCSYNCSOP%7C411-19409%7CMCAID%7CNONE%7CvVersion%7C5.0.1
.agkn.com/	1970-01-20 18:23:28	Name: ab Value: 0001%3A1X9YdtCxmIxRhjre53DFZVZUlzkYxGgJ
.tdrewards.com/	1969-12-31 23:59:59	Name: s_sess Value: %20s_cc%3Dtrue%3B
.mathtag.com/	1970-01-20 19:03:47	Name: uuid Value: 530e63e9-e211-4b00-875c-811634f901cf
.adnxs.com/	1970-01-20 11:47:28	Name: uuid2 Value: 1374673175657876562
.doubleclick.net/	1970-01-20 18:59:28	Name: IDE Value: AHWqTUmlc1MfcmfGF31Dm5c2TKkYCQ4e9HqmoHVOe1sTcEbEOXpzbft25N5nWXTI
.tdrewards.com/	1970-01-20 13:57:04	Name: AAMC_td_0 Value: REGION%7C6
.tdrewards.com/	1970-01-20 10:21:04	Name: aam_uuid Value: 49846337969849803952906196764197117418
.tapad.com/	1970-01-20 11:04:16	Name: TapAd_TS Value: 1676272146502
.tapad.com/	1970-01-20 11:04:16	Name: TapAd_DID Value: fd5fac82-ad96-4455-b1e8-5f5ec97ef066
.tapad.com/	1970-01-20 11:04:16	Name: TapAd_3WAY_SYNCS Value:
.twitter.com/	1970-01-20 19:13:52	Name: personalization_id Value: "v1_5+jBiXzWlLoFRySFWMRMLA=="
.everesttech.net/	1970-01-20 10:22:30	Name: ev_sync_ax Value: 20230213
.everesttech.net/	1969-12-31 23:59:59	Name: everest_session_v2 Value: Y@niEwAABXeuSjQ8
.quantserve.com/	1970-01-20 11:47:28	Name: d Value: EOYBDAGkKLmvYA
.quantserve.com/	1970-01-20 19:08:06	Name: mc Value: 63e9e213-4f052-631c1-d390a
.bing.com/	1970-01-20 18:59:28	Name: MUID Value: 2648FB3AAE9E6F48352DE98DAF4C6EF3
.c.bing.com/	1970-01-20 09:47:56	Name: MR Value: 0
.yahoo.com/	1970-01-20 18:23:49	Name: A3 Value: d=AQABBBPi6WMCEFhZ2JrX7GEX0DpHDIm69EA&S=AQAAAo0Bv4_JcGde_wrnWiNRr4E
.tribalfusion.com/	1970-01-20 11:47:28	Name: ANON_ID Value: aknr6itlix88qyTAZbCquiC4ZcUkHlLia1Vv0tK5FHZd01BxjLikCRgh44dULQNDFS5eF22ZdjtG
.owneriq.net/	1970-01-20 19:13:52	Name: si Value: Q7295585481422872386
.owneriq.net/	1970-01-20 09:52:16	Name: p2 Value: adpq
.everesttech.net/	1970-01-20 10:22:30	Name: ev_sync_yh Value: 20230213
.demdex.net/	1970-01-20 13:57:04	Name: dextp Value: 21-1-1676272145691\|269-1-1676272145831\|358-1-1676272146000\|481-1-1676272146267\|540-1-1676272146368\|601-1-1676272146473\|771-1-1676272146577\|1123-1-1676272146678\|1083-1-1676272146779\|1085-1-1676272146881\|1086-1-1676272146981\|1087-1-1676272147083\|1088-1-1676272147185\|1175-1-1676272147285\|1957-1-1676272147386\|19913-1-1676272147487\|22054-1-1676272147588\|22052-1-1676272147694\|30646-1-1676272147794\|575-1-1676272147895\|53196-1-1676272147996\|59982-1-1676272148098\|83349-1-1676272148199\|139200-1-1676272148387
.tdrewards.com/	1970-01-20 09:39:18	Name: _uetsid Value: 4f24c470ab6d11ed9df4e19d3b9b5a20
.tdrewards.com/	1970-01-20 18:59:28	Name: _uetvid Value: 4f24e160ab6d11edb0b4cbbe268ea13e
.tdrewards.com/	1970-01-20 09:38:12	Name: myNewName Value: GA1.2.1013736276.1676272149
.tdrewards.com/	1970-01-20 09:39:18	Name: myNewName_gid Value: GA1.2.1362390987.1676272149
.tdrewards.com/	1970-01-20 09:37:52	Name: _gat Value: 1
.amazon-adsystem.com/	1970-01-20 15:09:04	Name: ad-id Value: A6AzVLxhv0Jqra-jl1ibII0
.amazon-adsystem.com/	1970-01-20 19:13:52	Name: ad-privacy Value: 0
.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: 9189b707f14de727
.tdrewards.com/	1970-01-20 10:21:04	Name: s_pers Value: %20s_vnum%3D1676332800719%2526vn%253D1%7C1676332800719%3B%20s_invisit%3Dtrue%7C1676273952422%3B%20s_nr%3D1676272152424-New%7C1678864152424%3B

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	info	URL: https://www.tdrewards.com/home-page Message: Autofocus processing was blocked because a document already has a focused element.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=157680000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10393945.fls.doubleclick.net
5322602.fls.doubleclick.net
5967600.fls.doubleclick.net
6835781.fls.doubleclick.net
6868519.fls.doubleclick.net
a.tribalfusion.com
aa.agkn.com
ad.doubleclick.net
ads.yahoo.com
adservice.google.com
analytics.twitter.com
assets.tdrewards.com
bam.nr-data.net
bat.bing.com
c.bing.com
cm.everesttech.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
cms.quantserve.com
connect.facebook.net
dp2.33across.com
dpm.demdex.net
eurox.co.th
exchange.adstanding.com
fei.pro-market.net
googleads.g.doubleclick.net
ib.adnxs.com
js-agent.newrelic.com
ml314.com
nexus.ensighten.com
pixel.everesttech.net
pixel.tapad.com
px.owneriq.net
s.amazon-adsystem.com
s.tribalfusion.com
smetrics.td.com
stats.g.doubleclick.net
sync.mathtag.com
td.demdex.net
tdbankfinancialgroup.tt.omtrdc.net
token.rubiconproject.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.tdrewards.com
104.244.42.131
128.199.65.28
13.224.189.76
142.250.185.134
142.250.186.70
142.250.186.98
142.251.39.2
151.101.66.137
162.247.241.14
18.200.120.46
18.203.152.154
185.29.134.248
185.89.210.180
209.15.211.147
212.82.100.182
23.36.162.211
2600:1901:0:8eee::
2606:4700::6812:18ad
2620:116:800d:21:de2e:c7b3:55c0:d5a0
2620:1ec:c11::200
2a00:1288:80:807::2
2a00:1450:4001:811::2002
2a00:1450:4001:829::2003
2a00:1450:400d:802::200e
2a00:1450:400d:804::2002
2a00:1450:400d:80c::2004
2a00:1450:400d:80e::2008
2a00:1450:4025:401::9a
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
34.111.234.236
34.254.165.240
35.227.248.159
45.60.65.34
52.17.115.124
52.213.165.255
52.46.151.131
52.5.150.215
67.202.105.24
69.173.144.165
95.100.68.200
99.80.163.253
02015cec9e1fd264aa0bbd121406cb92be4b1c58c9206f6f2397697e5793c243
03eeeb4cdd5eadabe9af6b56b66ba07a8c9aae2d597de50e7cf5cffea73a226b
08f8b040ee30061c83265a81c2c00cf096d4e8669de3e4cbaa669cdd4cce763f
0aaff08b2236ed951d0a468d4b20f28a9da97f370239baae6ade6eaa01cc6240
0b253374a5ebbf5c9c02de1c8fee6427d64e5fd1e60f18d379853bc3e6605db3
0b2a1aee7a62edd2f0edcadf59fd2e1c5635e5eb1c807b10e64c06176c9eb077
0f64cf00969fd83994bb5d7d10d40c8b0b4e1f821b0ed06de9fe5c21e585c059
1aec5e1e4e9a306eb67dddf81346016f1666a40597d1992de6510dbb5bdcea1e
1d26490f083b209ef29e08d092649725edf15ac2b33ad62fdeaafd37f7d79d6f
1de90302505bf3cdb1bfce7f2d1e76a850e3097030b79cd83e2c8a119e899aaa
1dee3a2ae44773dbafb14cfdc730fd5492e92e97b9ffa15339d0238d63cbc31e
1f255241ca918d98b094a1881e128e0ee7f0db6bf033068308ad4f550c5d2433
243140c5d7c0dcd13b4e24be92602464d26b85fba96daab461ce972c83d2e5bb
253602b1c8c1b23def7e1c796ccf950177c74e2e624e07cf0a928466cd489494
282cea3a75c97b7516c674217858439d26f59152ba64eb84094a40bec19b2dc9
28f4dd52de8ad78ccfd9c8d10e6f1d8cad3d85df5963ad079f363049e7f1fe86
2c3af664cd131d6c3ec4d824edea7425264bc8461e31b51afba285782735320f
2d080ef216a4fcdba054538240ffaa0d86c6eac8ee96cff70e65bc9c4ddfb6fd
2d10816bada4d94734c1cb7e191ffb89ea7d9bb5c11b3e680f6b00c3a28d4e41
3419780f825800a9a73c6afd5a23ce681cdb40c853973df484cfbe562d615cd1
349d1d1ce1fc06e440c712fb997de2458af8fca4ba165032e341d124d94c9c64
36bf20a78569d4d055aabd5d7cd47ddd757855f0865ee4af0413e1f1bce9bf15
3a09085c9857f591164d6b2b632d4d06b07ffc4161a3e81caba1a47293bcdb8b
3b30c57fee08b8710ae3ec4a4f44cab038c7c238fbef21adf60791b6af5d3190
3ba75050ef3b59e77f96d7e53342e0aaee6a91fd234c139d990d36fbbc55ac7d
4025e211c7fe1ba931fe68201e70720a686d43d37300b3b4006c6577d445fc42
47aae9ce4b8ad9b2911f635e273b753e51fdf4f8a6aad5fe1bcd44d49d1ab00f
489ee3166ff370d28c59848b8e9732c12975f18cdd0c953c8fcd5c040d31f9fc
4cc60fa92ccabf4f00b053b08547eef38f058d7091eb14a609ae23fec2a8f266
4ce9ce4d4c46c7bda6dc10845c39e7baaee82e959408c8772e9bdf7f0ca026f2
515a9ee3f253bf3ca15329846bca313504ad63c4d3e9fe6a27cd96a9d1dbd555
533ec63f095866597c0680ccba0a28f86832b9ad41d4889a6358d698f484fc26
5849e07d0d6cbb144829b98da75fda4a8eb3fc2b5749d48cc94bb170db54859a
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5aa93e7401f9a3344d1f891eacfb0cf698bf56cc5d7cb2586bfe0d82d1c8c4b0
5e53b674cbc77be63887073a1a6974503fb153996e497316e2cbf817d0d7d459
5f8091c59053fa79cff36371a69d058b158ee4aedeb3ae3a2da32bf5f62a7c99
61098793767a49e77f8d8870a39657144e1b81565c20fe9a0f54e4d0c89ccef9
666dc840fd0f10b4db7c072b562f7eae9f393407892539666245e5ded32e123b
67563318f781475915e443fef24576ea64e5de5a80e7ab3fd6b967de15538dcc
6c254b89b5a4bd3162e895387fda860b2abd5468398b9a6503bed0d6e6f59220
6d4678a6b01ce1b3fb3c2f45611c2dfc78ee2315cf99f81e5a6c46eb8f311601
7274e17a34226a2c73e8f8d81ddeb16ee2e364982b97b0d21ee34cccce010bb4
77ca19f0c30e80c6d78b18712bd7550b1003aa0fb6ae334fdc0bed4159a772df
7bc954af5c2c5f341874056b0e2bae37868b044ad67d9c292f9fa5817ba00efc
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
7f8f92a1913474ebb54f27bb9a908eb8006c76665ed14ed7ebea958b661b4b7a
80e56da8f26f97e7d70598aa93804cfb402f56e5c7aa070f82ad5107d3dd9a4a
8183f487fa94a19fb2816dca3ab186a70e2475c48e8743d56f9953b9eeabb53a
81d40d49d0f4b685f70768d5821f161d9dcdda03fe290af35d24b68331b8edf0
82f8a203b066da23f3e0f3df8a3b43797dfd3bd414b16ffebe1cd02f5c55ff6c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8430e365f8defac031dcde01850e7c9fbf4d4108b991dba7c7bb411cab7a0cff
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8adf7be5e4b8e09896eb13e9eaa409a3bcf7d35a096c858127816cd520d8b13f
8cd9dee34cd96472a5fd5de618fd4420fb9814517b51176314d1136d27c01364
8d746ab0c2e4452756281f18dcda5ad3d657ab79f3981f385fcedcefabad6987
8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
98c487d0b4ab182f5dbdfb676951d930f26fd9cbf9450ed873e6952789db89c8
9954e03c388d2b28690553227631e76c0235e99c85b2e2069ddc7193619688fe
9db85e2cc2748f3f3bb275b4f94594b65c4bc09e418b20922e1dee11b96f4109
9f8315d9a3ac8497d0d3eee3467a75e8cb5fcdda48d13788d65e0affae95aeb0
a01050f120544b659a5b01dd168b7416224587780616e22d71c1d223e7a6d92b
a4d0d37a8ed18ac64e6a3722b68e5c84342826288497d1315a04db49c6666f4c
a83848cf5c3d96caefe490c19e41659609b3691dd4c531cf925016c084d8e1b0
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b05498f10c03b49707e65cfe46580fe080b75d02f39a149a11311b7d11006d23
b1e6fa50f60420fef9a2489bf847c308641c38b0080515debc5fcb25958e470a
b431134355745303c022637468741f6aae1bfff793ad84517d5d25d47b187f9c
bc12babb1d7612735f45a11f2c0881dd461fe1bffb92f178be22ac7969adbe21
bc8b87d5d14b711102dae7fcb77d9889ea5dcfcd9bd6182db8201a3e074aad60
bde0dcec69fee23a4d9549a2c5a935a8a831c8f8d5019576b7047ce5d7214064
be9b409faf65ddea5a700e15efbd932935b07bd25a8451137a9cfc780f17fd77
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c09a362c1f4879616a16f8ccbfec64993350e3decb6b421bab88822e48d0707f
c1e56ad863615fc191d80d7807852db95e57579f6535186d83d04ecdebef5236
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c39cd074b33a0348246ff987044c7650533c69afc4727bac852f8e02722d6d67
c40b0b8b73b6b119800fdbdcb3446d2b8de94b8259ae69aba87bae0eebf1c971
c8229d15724f0676dd350d16c3f9bd4ff187d30c05e0bb9724d685b6f3dda9a4
c8559a82bbdfc9448f6a4d6c145ff63b13b73df73e726cc9c7da87534c2d4edd
c89295f4cf9f044cc628d03fcdfde1d1d4a9d9398f86d20167e1f9bd90ff571b
ccbf0bf9419658413d6f4052ff2db5b76fd2720460968b91f99c5596ac686512
d333b91ec038474abd149162888f378fdd803d5190f15bda93d45566d5b03af6
d68dfaa7f071a98bf0adabe7a3e71f57a646be542c523bc7b49838eb574080f0
d79e37bccdf3dccb78a1ea9acf63fde85066f8bb72dc9ece08a4efbae09b18fd
da1a1dc9a5e96fd04d7bf444502aec1623a2859f2ee67e6f3c3373c7514e6664
db74150f68e355924963a98183bc9e6d4dd06f619e34b56134a26a30c9b9a94c
dc4c8b4269817a4028f65fb34d0cf7410050c6e58aeb82aa9fb067e7d85b3f65
e0298f839cf9048d891da8e67de3de20cf6e4d3bf20c190a97a4e90423719084
e29828c5cc2f7c8d46335b7482d37d77443ec72ef632eb55f638aa9d0b9b001b
e2f5114f1b78eea5212a2aa1a74bf3c57ed7c2e8c64b4881bf5bbb266c758f1c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4cc034f3b3a979ead9a490a6f37021b3e5fed1452045136cc06daab3242db75
e54d3f4ad5c3c66a747f2a7f62e7ca28abfd2db5c57b3ba53721ee02e7e11b29
e72492a74544c6585edf6669a2775ffad8eb11421ff56cde018e7663fc758f15
e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b
e927dcebecb2c550da9428ce3ef949d06bd75ec8116b3a9df83dc7ab63c1f04c
eebaa0d729d5b4d076e6b814a6546963b94373aa67694cf88bbd5384fa1eb851
ef02361cfc918950f2432a3eba916b540437375242bd255cd3d33cd7e252fd7c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f05eab346335cf492c0635c78cf298602bd292d59f8830afbb3456acd81dcc26
f1e945400c04241ef089d71de3b0cf7e202431ac4685ada318714fe07ee9dcb0
f6db59e08f766f2fee2483831e41cdf1f9112c3314378a40ccf2dfbf37a060ff
f71a66712a6a95432443e5a69102ac1a96ef8e157b5207386501931eef3bea44

www.tdrewards.com Open in urlscan Pro 45.60.65.34 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

169 Requests

86 %HTTPS

33 %IPv6

33 Domains

48 Subdomains

29 IPs

7 Countries

7919 kBTransfer

10693 kBSize

45 Cookies

7 Outgoing links

Page URL History

Redirected requests

169 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.tdrewards.com Open in urlscan Pro
45.60.65.34 Public Scan

Screenshot
Live screenshot

Full Image

169
Requests

86 %
HTTPS

33 %
IPv6

33
Domains

48
Subdomains

29
IPs

7
Countries

7919 kB
Transfer

10693 kB
Size

45
Cookies

169 HTTP transactions
0 data transactions