crm.airrefund.com Open in urlscan Pro
2600:9000:21f3:b800:6:181f:8f00:93a1  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://crm.airrefund.com/ Page URL
2. https://crm.airrefund.com/login Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response crm.airrefund.com/	552 B 870 B	102ms 52ms	Document text/html	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://crm.airrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 0e604a37396574fcac26104c3679ec6b26a376ce3571d971948f3cdfe34b8844 Request headers :method GET :authority crm.airrefund.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-type text/html content-length 552 date Mon, 01 Feb 2021 01:42:43 GMT last-modified Mon, 18 Jan 2021 20:26:37 GMT etag "c407ced2a7006837ce5c513bb014d4a8" accept-ranges bytes server AmazonS3 x-cache Error from cloudfront via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C2 x-amz-cf-id Gv4TqFGxH1L3W58Kff37SgMz5IIWzLBE5BO7Uxhy2B7pP96Lum-1_A==
GET H2	200	main.6114e684.css crm.airrefund.com/static/css/	601 KB 602 KB	94ms 93ms	Stylesheet text/css	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://crm.airrefund.com/static/css/main.6114e684.css Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 1a6e10ae2de9dd0dcd8fdf55a46ef4e82eed1dfb84e6bb7412643a49a269346e Request headers Referer https://crm.airrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Feb 2021 01:42:43 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) last-modified Mon, 18 Jan 2021 20:26:37 GMT server AmazonS3 x-amz-cf-pop FRA2-C2 etag "71d4254811637da3aff6b7bec6f5cdc2" x-cache Miss from cloudfront content-type text/css accept-ranges bytes content-length 615487 x-amz-cf-id UNar0LA0IO-G--tRk1s6RVevzK66HkKCbQQUR5YOftnhimFlUgh8yw==
GET H2	200	main.992545b8.js Show response crm.airrefund.com/static/js/	3 MB 3 MB	147ms 146ms	Script application/javascript	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://crm.airrefund.com/static/js/main.992545b8.js Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 3e2233bf8ddc2089099f897c56b8ea6e2366f63ddd9757a9b67748969182cdd8 Request headers Referer https://crm.airrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Feb 2021 01:42:43 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) last-modified Mon, 18 Jan 2021 20:26:37 GMT server AmazonS3 x-amz-cf-pop FRA2-C2 etag "4e3499ae74bc745432fb8649cfa7e2ed" x-cache Miss from cloudfront content-type application/javascript accept-ranges bytes content-length 2983193 x-amz-cf-id bv_1QrBY-Ys3PNWkpDPeA7O1iHs_7pJNAqvjxRMAKmDGiDYFRShtuQ==
GET H2	200	css fonts.googleapis.com/	3 KB 577 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:829::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/static/css/main.6114e684.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash a44bbd41a152df40ae99043e510a51da8ad97dadd3f28d1c21be248a4bd98942 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://crm.airrefund.com/static/css/main.6114e684.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 01 Feb 2021 00:06:17 GMT server ESF date Mon, 01 Feb 2021 01:42:42 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 01 Feb 2021 01:42:42 GMT
OPTIONS H2	200	graphql app.p.ar.besidethepark.com/crm/	0 0	273ms 62ms	Other text/plain	52.17.35.30 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.p.ar.besidethepark.com/crm/graphql Protocol H2 Server 52.17.35.30 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-17-35-30.eu-west-1.compute.amazonaws.com Software nginx/1.14.0 + Phusion Passenger 5.3.4 / Phusion Passenger 5.3.4 Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://crm.airrefund.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 01 Feb 2021 01:42:43 GMT content-type text/plain content-length 0 status 200 OK access-control-allow-origin https://crm.airrefund.com access-control-max-age 3600 access-control-allow-credentials true access-control-allow-headers authorization,content-type access-control-allow-methods GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD x-powered-by Phusion Passenger 5.3.4 server nginx/1.14.0 + Phusion Passenger 5.3.4
GET H2	200	login-bg.8ca3eb2e.jpeg crm.airrefund.com/static/media/	734 KB 735 KB	70ms 70ms	Image image/jpeg	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://crm.airrefund.com/static/media/login-bg.8ca3eb2e.jpeg Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/static/css/main.6114e684.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers Referer https://crm.airrefund.com/static/css/main.6114e684.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Feb 2021 01:42:43 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) last-modified Mon, 18 Jan 2021 20:26:37 GMT server AmazonS3 x-amz-cf-pop FRA2-C2 etag "8ca3eb2ef2e95f3b807c8b3e939a068f" x-cache Miss from cloudfront content-type image/jpeg accept-ranges bytes content-length 751150 x-amz-cf-id yxDkK3KcGTHzSnyiEfQNOIGgxYQjPuiSly4PXuzjxMUY7frDaJP1eQ==
GET H2	200	S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://crm.airrefund.com Referer https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 06:05:54 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:25 GMT server sffe age 416208 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14176 x-xss-protection 0 expires Thu, 27 Jan 2022 06:05:54 GMT
GET H3-Q050	200	S6uyw4BMUTPHjx4wXiWtFCc.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXiWtFCc.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://crm.airrefund.com Referer https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 30 Jan 2021 06:30:25 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:59 GMT server sffe age 155537 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14044 x-xss-protection 0 expires Sun, 30 Jan 2022 06:30:25 GMT
GET H2	200	logo.8ca92857.png crm.airrefund.com/static/media/	63 KB 64 KB	41ms 41ms	Image image/png	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://crm.airrefund.com/static/media/logo.8ca92857.png Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers Referer https://crm.airrefund.com/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Feb 2021 01:42:43 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) last-modified Mon, 18 Jan 2021 20:26:37 GMT server AmazonS3 x-amz-cf-pop FRA2-C2 etag "8ca92857033fc8343c5519b203c850ea" x-cache Miss from cloudfront content-type image/png accept-ranges bytes content-length 64851 x-amz-cf-id esgrR7FnadsI1XClkcZ-Xrbnvt9EmMr15rl20WyBvduu9gOxf67tRA==
POST H2	401	graphql app.p.ar.besidethepark.com/crm/	81 B 620 B	72ms 72ms	Fetch application/json	52.17.35.30 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.p.ar.besidethepark.com/crm/graphql Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/static/js/main.992545b8.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.17.35.30 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-17-35-30.eu-west-1.compute.amazonaws.com Software nginx/1.14.0 + Phusion Passenger 5.3.4 / Phusion Passenger 5.3.4 Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept */* Referer https://crm.airrefund.com/login Authorization null User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 content-type application/json Response headers date Mon, 01 Feb 2021 01:42:43 GMT x-content-type-options nosniff x-powered-by Phusion Passenger 5.3.4 status 401 Unauthorized strict-transport-security max-age=31536000 vary Origin x-xss-protection 1; mode=block x-request-id b3e7786b-3bac-4318-80fe-d5f8a8eaf832 x-runtime 0.010234 server nginx/1.14.0 + Phusion Passenger 5.3.4 x-frame-options SAMEORIGIN access-control-max-age 3600 access-control-allow-methods GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD content-type application/json; charset=utf-8 access-control-allow-origin https://crm.airrefund.com cache-control no-cache access-control-allow-credentials true
GET H2	200	Primary Request login Show response crm.airrefund.com/	552 B 875 B	19ms 19ms	Document text/html	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://crm.airrefund.com/login Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/static/js/main.992545b8.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 0e604a37396574fcac26104c3679ec6b26a376ce3571d971948f3cdfe34b8844 Request headers :method GET :authority crm.airrefund.com :scheme https :path /login pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest document referer https://crm.airrefund.com/login accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://crm.airrefund.com/login Response headers content-type text/html content-length 552 date Mon, 01 Feb 2021 01:42:43 GMT last-modified Mon, 18 Jan 2021 20:26:37 GMT etag "c407ced2a7006837ce5c513bb014d4a8" accept-ranges bytes server AmazonS3 x-cache Error from cloudfront via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C2 x-amz-cf-id XSKQSwknrwAo0gYbka4aAw0kYyFn61TJULmHTqVicEulR-yc7RFXsw== age 1
GET H2	200	icons.af7ae505.woff2 crm.airrefund.com/static/media/	75 KB 76 KB	7ms 7ms	Font font/woff2	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://crm.airrefund.com/static/media/icons.af7ae505.woff2 Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/static/css/main.6114e684.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers Origin https://crm.airrefund.com Referer https://crm.airrefund.com/static/css/main.6114e684.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Feb 2021 01:42:43 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) last-modified Mon, 18 Jan 2021 20:26:37 GMT server AmazonS3 age 1 etag "af7ae505a9eed503f8b8e6982036873e" x-cache Hit from cloudfront content-type font/woff2 x-amz-cf-pop FRA2-C2 accept-ranges bytes content-length 77160 x-amz-cf-id pDT3jv8k_Nu5DAVYHdKZVQlEbOCywBBS0vrKuZ1NZOoS8_qG3qdYtQ==
GET DATA	200 OK	truncated /	1 KB 1 KB		Font application/x-font-ttf
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash Request headers Origin https://crm.airrefund.com Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type application/x-font-ttf;charset=utf-8
GET H2	200	main.6114e684.css crm.airrefund.com/static/css/	601 KB 602 KB	9ms 8ms	Stylesheet text/css	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://crm.airrefund.com/static/css/main.6114e684.css Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 1a6e10ae2de9dd0dcd8fdf55a46ef4e82eed1dfb84e6bb7412643a49a269346e Request headers Referer https://crm.airrefund.com/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Feb 2021 01:42:43 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) last-modified Mon, 18 Jan 2021 20:26:37 GMT server AmazonS3 age 1 etag "71d4254811637da3aff6b7bec6f5cdc2" x-cache Hit from cloudfront content-type text/css x-amz-cf-pop FRA2-C2 accept-ranges bytes content-length 615487 x-amz-cf-id VZGrGK4cDtk4d_QSacL0DCKCcwJl__kaAKPqzTGNkU4YM2rkl8i-pA==
GET H2	200	main.992545b8.js Show response crm.airrefund.com/static/js/	3 MB 3 MB	8ms 8ms	Script application/javascript	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://crm.airrefund.com/static/js/main.992545b8.js Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 3e2233bf8ddc2089099f897c56b8ea6e2366f63ddd9757a9b67748969182cdd8 Request headers Referer https://crm.airrefund.com/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Feb 2021 01:42:43 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) last-modified Mon, 18 Jan 2021 20:26:37 GMT server AmazonS3 age 1 etag "4e3499ae74bc745432fb8649cfa7e2ed" x-cache Hit from cloudfront content-type application/javascript x-amz-cf-pop FRA2-C2 accept-ranges bytes content-length 2983193 x-amz-cf-id lPBv79PeY13livVxfQUx7qaNJ2IZrtFlnIPhBGdZ0GnQBItr47-Azw==
GET H3-Q050	200	css fonts.googleapis.com/	3 KB 549 B	22ms 21ms	Stylesheet text/css	2a00:1450:4001:829::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/static/css/main.6114e684.css Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash a44bbd41a152df40ae99043e510a51da8ad97dadd3f28d1c21be248a4bd98942 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://crm.airrefund.com/static/css/main.6114e684.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 01 Feb 2021 00:05:59 GMT server ESF date Mon, 01 Feb 2021 01:42:43 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 01 Feb 2021 01:42:43 GMT
GET H2	200	login-bg.8ca3eb2e.jpeg crm.airrefund.com/static/media/	734 KB 735 KB	8ms 7ms	Image image/jpeg	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://crm.airrefund.com/static/media/login-bg.8ca3eb2e.jpeg Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/static/css/main.6114e684.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 2b7ed8b863aa772349a260a71c2e874593a363981122c2405bf8f45d8ca7c48c Request headers Referer https://crm.airrefund.com/static/css/main.6114e684.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Feb 2021 01:42:43 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) last-modified Mon, 18 Jan 2021 20:26:37 GMT server AmazonS3 age 1 etag "8ca3eb2ef2e95f3b807c8b3e939a068f" x-cache Hit from cloudfront content-type image/jpeg x-amz-cf-pop FRA2-C2 accept-ranges bytes content-length 751150 x-amz-cf-id qXN9l55n1s-2S6XL0mRLKBjijwMG4kwh0IPSQp2hQSz9hJoyA6cirg==
GET H3-Q050	200	S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://crm.airrefund.com Referer https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 06:05:54 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:25 GMT server sffe age 416209 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14176 x-xss-protection 0 expires Thu, 27 Jan 2022 06:05:54 GMT
GET H3-Q050	200	S6uyw4BMUTPHjx4wXiWtFCc.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXiWtFCc.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://crm.airrefund.com Referer https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 30 Jan 2021 06:30:25 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:59 GMT server sffe age 155538 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14044 x-xss-protection 0 expires Sun, 30 Jan 2022 06:30:25 GMT
GET H2	200	logo.8ca92857.png crm.airrefund.com/static/media/	63 KB 64 KB	7ms 7ms	Image image/png	2600:9000:21f3:b800:6:181f:8f00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://crm.airrefund.com/static/media/logo.8ca92857.png Requested by Host: crm.airrefund.com URL: https://crm.airrefund.com/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:b800:6:181f:8f00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 80f13faa4e1a72da55619b5850298c13ac40ad54a5291f903b632030db1fc502 Request headers Referer https://crm.airrefund.com/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Feb 2021 01:42:43 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) last-modified Mon, 18 Jan 2021 20:26:37 GMT server AmazonS3 age 1 etag "8ca92857033fc8343c5519b203c850ea" x-cache Hit from cloudfront content-type image/png x-amz-cf-pop FRA2-C2 accept-ranges bytes content-length 64851 x-amz-cf-id G70hxgWHWDzdRONrZL5--j6GW9YwbB5nb2wyKm3HGcbXR0r6FBPiDQ==

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| __core-js_shared__ function| _ object| PDFJS function| setImmediate function| clearImmediate function| Mousetrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: Content is cached for offline use.
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: %c action %cSET_NETWORK_ERROR %c@ 02:42:43.129 color: gray; font-weight: lighter; color: inherit; color: gray; font-weight: lighter;
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: %c prev state color: #9E9E9E; font-weight: bold [object Object]
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: %c action color: #03A9F4; font-weight: bold [object Object]
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: %c next state color: #4CAF50; font-weight: bold [object Object]
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: console.groupEnd
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: %c action %cCLEAR_TOKEN %c@ 02:42:43.135 color: gray; font-weight: lighter; color: inherit; color: gray; font-weight: lighter;
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: %c prev state color: #9E9E9E; font-weight: bold [object Object]
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: %c action color: #03A9F4; font-weight: bold [object Object]
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: %c next state color: #4CAF50; font-weight: bold [object Object]
console-api	log	URL: https://crm.airrefund.com/static/js/main.992545b8.js(Line 1) Message: console.groupEnd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.p.ar.besidethepark.com
crm.airrefund.com
fonts.googleapis.com
fonts.gstatic.com
2600:9000:21f3:b800:6:181f:8f00:93a1
2a00:1450:4001:801::2003
2a00:1450:4001:829::200a
52.17.35.30
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0e604a37396574fcac26104c3679ec6b26a376ce3571d971948f3cdfe34b8844
1a6e10ae2de9dd0dcd8fdf55a46ef4e82eed1dfb84e6bb7412643a49a269346e
2b7ed8b863aa772349a260a71c2e874593a363981122c2405bf8f45d8ca7c48c
3e2233bf8ddc2089099f897c56b8ea6e2366f63ddd9757a9b67748969182cdd8
80f13faa4e1a72da55619b5850298c13ac40ad54a5291f903b632030db1fc502
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
a44bbd41a152df40ae99043e510a51da8ad97dadd3f28d1c21be248a4bd98942