taxcreditrefund.com Open in urlscan Pro
2606:4700:3030::6815:15ca  Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37

• https://app.groovefunnels.com/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD HTTP 302
• https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Request Chain 39

• https://app.groovefunnels.com/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e HTTP 302
• https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Request Chain 125

• https://gum.criteo.com/sid/json?origin=onetag&domain=app.groove.cm&sn=ChromeSyncframe&so=0&topUrl=taxcreditrefund.com&lsw=1 HTTP 302
• https://mug.criteo.com/sid?cpp=SJGOP3xwamJ4U3VzM0FUemRUTWVGbThkYnRNMkd5RGRtVzl6SzNKS04yT2tGV2p2OURUZ2V6RkpZTGF4YWtBcnJBUTRwblg1ZHpLM0pURnBnWXBoRU1jN2FsYUgxYUVaVVNJOWRHVFIyS2greE5tcGdkTWRtb1RydmcyanVxUjBIOE02ZUR2MXRHOHRBWHhQbnRudlNVYmJzY1kzS1NkT1VSRTRWTE1RWFUwL0Q2NzBub0t2WWtDQTdtamNBU0U0WDZSUFU0MHgrdmpPbkM0UVNWbFRHN284dU9TMXBPZytaK0c2dnlFaXJCcWE3MFJSUEZYdlFhbzRzVmZBczY2K0VHdkxDUVA0WWwwQ081WEdKUHJXc1BaWDFxZnJTNVpYanJObWJVcm9zUklJeWVOTT18&cppv=2

Request Chain 126

• https://gum.criteo.com/sid/json?origin=onetag&domain=app.groove.cm&sn=ChromeSyncframe&so=0&topUrl=taxcreditrefund.com&lsw=1 HTTP 302
• https://mug.criteo.com/sid?cpp=X71NkHxrSlYwd0NNcmE5TkpKRkc2bndBR3d3NzB0TFVFUEJOYWZ4STAzSk5ucjU0UmRxUFpBY0tzZlJZYU5vNnBPYWpGN0o3VHgwTnFjdnppT0NZYzhHbEFpMlZZWHZkWlE4Y2FoeGRPTnVta2EwY2tscVNLa29UN3JFckdaNFZtU05MNm1FNDRIR3RCVlJvTlRFNjZTTlZLL1hUZ3Z3bVMvZHRnNFNLMFB5TnlvaEV3VFYyNFBBdEtsS2d3ZitkNE42RlVadDZ4bUJvMG1pbGdaZlhWWUdSdWVtano3UU13NUVqSEhrc0lRZmlFZ01MMFZnMjl3TnM1bkRiRnh4T3g0R2Z3RlR1UjgwYmwyNmxrMGtRdGw5Si9hQ251N2VXeUlJYjVZR29YeS9OMTU4cz18&cppv=2

Request Chain 142

• https://sslwidget.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=rRS2rl9hT1VCTUdJR3BzV0V0QkkwejVzajF5V0dQdnhaTjcwZEJ3UTVIRnl4UzZCWXVqNDZFZzJQJTJCWksxSFZ3cFVWQVk5QjdNOXF0YlI1Uk5JS0NaMVY2Ylgxc0RXYktienpZcjVhM212WmlpJTJGRjdXREpWWjJoYndlUzZiUFpnNUVWaGs5VDYlMkY3bSUyRkhIU1E4OXlvdEszMjVYOTRna0pBdXJyMmpPNGZldThtQUpWbyUzRA&tld=app.groove.cm&dtycbr=65050 HTTP 302
• https://widget.us.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=rRS2rl9hT1VCTUdJR3BzV0V0QkkwejVzajF5V0dQdnhaTjcwZEJ3UTVIRnl4UzZCWXVqNDZFZzJQJTJCWksxSFZ3cFVWQVk5QjdNOXF0YlI1Uk5JS0NaMVY2Ylgxc0RXYktienpZcjVhM212WmlpJTJGRjdXREpWWjJoYndlUzZiUFpnNUVWaGs5VDYlMkY3bSUyRkhIU1E4OXlvdEszMjVYOTRna0pBdXJyMmpPNGZldThtQUpWbyUzRA&tld=app.groove.cm&dtycbr=65050

Request Chain 143

• https://sslwidget.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Ikhybl9PMGxYa0ZSZ0x0Z0FRd2pReWUlMkI2WW1qZ1pSZmtkaUZteUkzTW9qRzNXU0RWUUg3c0p4emNDUlN0enk3UjlsNmg5YjBhQ1NIZnk1OEVudHZpZk9uMnBaa3JUNWVhQ3BCQ1RoWHhUMXNlOCUyQmoxUUI4NWtKVEhNUG80ZHNxME9VRDVDVUNiTHF1V01wbGZGY1NoR1FnWFNYWmlrSE1HUkVtSUc5SlVTUE5tJTJGdmslM0Q&tld=app.groove.cm&dtycbr=17198 HTTP 302
• https://widget.us.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Ikhybl9PMGxYa0ZSZ0x0Z0FRd2pReWUlMkI2WW1qZ1pSZmtkaUZteUkzTW9qRzNXU0RWUUg3c0p4emNDUlN0enk3UjlsNmg5YjBhQ1NIZnk1OEVudHZpZk9uMnBaa3JUNWVhQ3BCQ1RoWHhUMXNlOCUyQmoxUUI4NWtKVEhNUG80ZHNxME9VRDVDVUNiTHF1V01wbGZGY1NoR1FnWFNYWmlrSE1HUkVtSUc5SlVTUE5tJTJGdmslM0Q&tld=app.groove.cm&dtycbr=17198

Request Chain 165

• https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40 HTTP 302
• https://idsync.rlcdn.com/397596.gif?partner_uid=D5gKIhS_sjRKB4C2RGteHGK-BVQgWZNH

Request Chain 166

• https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay04TzdVVkJHZzRzSVBjNldDX0pCZmdndmJQVjFCTXZsYXhZLUVsUQ HTTP 302
• https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

Request Chain 167

• https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&custom=&tag_format=img&tag_action=sync&custom=&cb=265c8c79-168a-491e-84f7-ca90d8ba0440 HTTP 302
• https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=265c8c79-168a-491e-84f7-ca90d8ba0440&final=true&reqid=d795f2e0-52a6-11ec-ae93-55f394c6df86&timestamp=2021-12-01T13%3A01%3A47.662Z

Request Chain 168

• https://cm.mgid.com/m?cdsp=617660&c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ HTTP 307
• https://cm.mgid.com/m?c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&cdsp=617660&sct=1

Request Chain 175

• https://secure.adnxs.com/setuid?entity=52&code=k-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw&seg=95287 HTTP 307
• https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw%26seg%3D95287

Request Chain 176

• https://x.bidswitch.net/sync?dsp_id=46&user_id=k-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw&expires=30&user_group=5 HTTP 302
• https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw&expires=30&user_group=5

Request Chain 178

• https://eb2.3lift.com/xuid?mid=2711&xuid=k-h7IApRGg4sIPc6WC_JBfggvbPV2lsR4P32yLXw&dongle=013b HTTP 302
• https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-h7IApRGg4sIPc6WC_JBfggvbPV2lsR4P32yLXw&dongle=013b&gdpr=1&cmp_cs=&us_privacy=

Request Chain 180

• https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA HTTP 302
• https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA&C=1

Request Chain 187

• https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g HTTP 302
• https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g

Request Chain 188

• https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg HTTP 303
• https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg&_li_chk=true&previous_uuid=2cc523d5ec7d4277a18b9be3037d1219 HTTP 303
• https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg

Request Chain 190

• https://pixel.advertising.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1 HTTP 302
• https://pixel.advertising.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&verify=true HTTP 302
• https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&apid=UPd7b2f0f5-52a6-11ec-8bab-06fe92171bd8

Request Chain 192

• https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-PaEccBGg4sIPc6WC_JBfggvbPV01SNyKmcEbtA&redirectId=69 HTTP 302
• https://cdn.stickyadstv.com/one-shot/empty.gif

Request Chain 196

• https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay04TzdVVkJHZzRzSVBjNldDX0pCZmdndmJQVjFCTXZsYXhZLUVsUQ HTTP 302
• https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

Request Chain 197

• https://cm.mgid.com/m?cdsp=617660&c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ HTTP 307
• https://cm.mgid.com/m?c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&cdsp=617660&sct=1

Request Chain 203

• https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40 HTTP 302
• https://idsync.rlcdn.com/397596.gif?partner_uid=frN8bApzia94PMewIfQXw-I4Mlw6GHdi

Request Chain 207

• https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA HTTP 302
• https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA&C=1

Request Chain 214

• https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g HTTP 302
• https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g

Request Chain 215

• https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg HTTP 303
• https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg&_li_chk=true&previous_uuid=4befd6c1777c411b91cdd10ec3c0ce37 HTTP 303
• https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg

Request Chain 217

• https://pixel.advertising.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1 HTTP 302
• https://pixel.advertising.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&verify=true HTTP 302
• https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&apid=UPd7b2f0f5-52a6-11ec-8bab-06fe92171bd8

Request Chain 219

• https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-PaEccBGg4sIPc6WC_JBfggvbPV01SNyKmcEbtA&redirectId=69 HTTP 302
• https://cdn.stickyadstv.com/one-shot/empty.gif

Request Chain 225

• https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID HTTP 302
• https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
• https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1670073037217269206

Request Chain 227

• https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID HTTP 302
• https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
• https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1670073037217269206

236 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response taxcreditrefund.com/	900 KB 53 KB	294ms 242ms	Document text/html	2606:4700:3030::6815:15ca CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:15ca , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d0d4548a76b1d53555897ed77a476d6143f029dfb0b657ee6cb63be08949c34a Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Wed, 01 Dec 2021 13:01:44 GMT content-type text/html last-modified Wed, 01 Dec 2021 09:01:40 GMT cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=orRlyXTVZnVqEXgtYahIMY%2BMWN6oprQMVuHhX9Ta43bWf%2B2m7VUTkqPDEIANIvdfOIand%2FuZbIHXumcQugjTVrImFstMCnZQ0Jd%2FkUV%2B7jYqVhlRKVQMoc3yGsNUxejQ8h1yoUlaR0%2FXwmCCcyau5SeQ"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6b6c81814be20f86-MXP content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	css2 fonts.googleapis.com/	713 KB 137 KB	66ms 42ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash fbf6766913a0776c720b285251249ef16811cf787821be50e080063ea8987ff9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 01 Dec 2021 13:01:44 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 01 Dec 2021 13:01:44 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 01 Dec 2021 13:01:44 GMT
GET H2	200	inpage_published.css app.groove.cm/groovepages/css/	376 KB 54 KB	90ms 38ms	Stylesheet text/css	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovepages/css/inpage_published.css Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 674c54a80e8101724b4f692785cc009918c079cc7fc313cd3a4e545bb677ebe6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:44 GMT content-encoding br cf-cache-status HIT last-modified Tue, 30 Nov 2021 12:56:42 GMT server cloudflare age 2584 etag W/"61a61f8a-5e17e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IUbA2i5N9NpYGK%2BGM7%2Bgb%2BMDSU2Yc6SDYSYbvKud5kQazMslRGeli%2FDaLMYNvTjNrn7HSkSsufbWaSbnvfiDGiKrHKvDYZe0zYMlwU5LYjnN0mSk1tqAbo6SNFJR4flLsTwte52kzq%2FHIPAY"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c818339a73747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	chunk-vendors.css app.groove.cm/groovepages/css/	0 0	82ms 31ms	Stylesheet text/html	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovepages/css/chunk-vendors.css Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers
GET H2	200	e7647a48d4.js Show response kit.fontawesome.com/	11 KB 4 KB	98ms 54ms	Script text/javascript	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kit.fontawesome.com/e7647a48d4.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7a7249a1f634a0ecfc772e774a158a0ab74c354609558c382b130bf37a91b346 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers Referer https://taxcreditrefund.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:44 GMT content-encoding gzip cf-cache-status MISS server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, accept-encoding, access-control-request-headers, access-control-request-method access-control-allow-methods GET, OPTIONS content-type text/javascript access-control-allow-origin * access-control-max-age 3000 cache-control max-age=60, public, must-revalidate strict-transport-security max-age=31536000; preload cf-ray 6b6c81832fcb0f86-MXP access-control-allow-headers accept, accept-langauge, content-language, content-type, fa-kit-token x-request-id FryjG_DF1LuD_WNub_WC
GET H2	200	css2 fonts.googleapis.com/	694 KB 136 KB	39ms 39ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,700;0,900;1,400&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Requested by Host: app.groove.cm URL: https://app.groove.cm/groovepages/css/inpage_published.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 5ff212b89817b9ba96d01e984ad0bd7d2d5b7ca4b97d77fdea74b51d0b702541 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 01 Dec 2021 13:01:44 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 01 Dec 2021 13:01:44 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 01 Dec 2021 13:01:44 GMT
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	59 KB 13 KB	48ms 28ms	Fetch text/css	2606:4700:3030::6815:5183 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=e7647a48d4 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/e7647a48d4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:5183 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT via 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop FRA2-C1 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3Eq%2BAa4U40FwvYExg29uE%2F0cqmUkOvz6tV2niUTK7JChhp5L0%2FHypy5lnxF9hLzcYtM%2FJ%2BLiGBrrvW3kJqsn9iw%2FZTE0riQ54ipAYtLtYeQmG2LjrROZ4jaLu1rVPc1GInahebVO1nhTlPOCPzaSLRqbMg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 cf-ray 6b6c81842b6205ed-FRA access-control-allow-headers fa-kit-token x-amz-cf-id bMcWv1VDCdPcYj4CwkqcY6NGKnk-8zpkYpGRkZBbF97PPFYyTtZDsA==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	26 KB 4 KB	60ms 41ms	Fetch text/css	2606:4700:3030::6815:5183 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=e7647a48d4 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/e7647a48d4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:5183 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT via 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop FRA2-C1 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"76f34b71fc9fb641507ff6a822cc07f5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HMr7tE2ilfcU26zEgqQ2aSM9xQRe3RFXB2Jw%2BnmD9I2%2FZkaiHvhoTSolOL%2BkXQEUuv8%2FFj5FpjQfAEbYKzUGqpelRyKBq0jPXB0XW1qwJAAuCPDBii7B7cB2t5MjjExWFzDYiCLhI2sdCuqUTtgZ8guwfg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 cf-ray 6b6c81842b6505ed-FRA access-control-allow-headers fa-kit-token x-amz-cf-id H41zTp5sKk7Vz0CoXfH-N1YFyNLT2VP_I_DLdAQhDF3hlTMNuBYxng==
GET H2	200	free-v4-font-face.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	3 KB 1 KB	49ms 30ms	Fetch text/css	2606:4700:3030::6815:5183 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-font-face.min.css?token=e7647a48d4 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/e7647a48d4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:5183 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT via 1.1 34f50889bc574f1edeb41dd758962a5b.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop FRA2-C1 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"f2e0b2680d9b0bcb6e0039c4424e5a59" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ho3GBmIpBOmBvLMLG0Exetb%2BiHFTJxUm0ljnpPzn3hG%2F3PfW2j9Cq1XiWZ7QYUok%2F7XniyO%2Br9oo2cI3jU8jOxnyM1UOAQup01YTup7BttbvT2rj6WUO382t818j7h%2BTbuo6pW9bfSSSpahmM8XhSllOSQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 cf-ray 6b6c81842b6605ed-FRA access-control-allow-headers fa-kit-token x-amz-cf-id 12pDuPboQkhlkAZd7ZAliFgBD09uf08n1rxbLSQyaAzp-duUOdV2DA==
GET H/1.1	200 OK	matomo.js Show response matomo.groovetech.io/	100 KB 32 KB	351ms 115ms	Script application/javascript	51.161.92.183 OVH
General Check archive.org Show headers Download Go to Full URL https://matomo.groovetech.io/matomo.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.92.183 Laval, Canada, ASN16276 (OVH, FR), Reverse DNS ip183.ip-51-161-92.net Software nginx/1.19.2 / Resource Hash 68fed142b211b51c4d2e9b610dd4d09bc4812739b5beaa63535d88e38e90a946 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip last-modified Tue, 21 Jul 2020 21:11:02 GMT server nginx/1.19.2 etag "19167-5aafa0f820d0f-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 32444
GET H2	200	1638320988_f-230-51-21358450_AZZ6z1CM_Logo.png assets.grooveapps.com/images/8b10e164-ed5b-42fc-9807-0086b27e997e/	376 KB 376 KB	478ms 423ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/8b10e164-ed5b-42fc-9807-0086b27e997e/1638320988_f-230-51-21358450_AZZ6z1CM_Logo.png?update=3 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a1a018b0d4ceb6779618261844a811d33e26df5db0277e7457aa09a387a1f045 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdtjp1FJyP7SaRhTt99EU7upIfq3IwUYtD94XDuY6guNx_eICiNr6n3ij9qWPj6XH--x5_9Axy5GjH_3e0DMxx7BTSaTZw x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 384655 last-modified Wed, 01 Dec 2021 01:10:08 GMT server cloudflare etag "26a24748dc294dbdce6b02b54df852ba" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=/mYplg==, md5=JqJHSNwpTb3OawK1TfhSug== x-goog-generation 1638321008550735 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 384655 accept-ranges bytes cf-ray 6b6c81865eb33742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	app.js Show response widget.groovevideo.com/widget/	308 KB 308 KB	94ms 20ms	Script application/javascript	2600:9000:2156:e00:b:d801:7900:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://widget.groovevideo.com/widget/app.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:e00:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 85a2384595926a0d1306834e955dceff74b539d22f78e06a276c3c6c5d8a09cc Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 30 Nov 2021 15:14:32 GMT via 1.1 f7b7cf90592cf6a380fd34cc45e9c4b5.cloudfront.net (CloudFront) last-modified Tue, 23 Nov 2021 13:48:27 GMT server AmazonS3 age 78434 etag "c720b112e41afb0ce50f2715cd52d83b" x-cache Hit from cloudfront content-type application/javascript x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 315185 x-amz-cf-id pOnF4lRlXCNwWBfiEj52Sm2lncsbgx3NoVKk5jIpWHfwp7gk5yQnCw==
GET H2	200	1636760017_AM_ERC%20Today%20(FF).png assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/	26 KB 26 KB	230ms 177ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/1636760017_AM_ERC%20Today%20(FF).png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5cc5e1dac9fa2dddafa9a605b7dfae70898427bfbb6684ba2e81f5b69f6cc492 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdsZrW1rkuH_kF7R1kPniMncG8rP6wVzvkgE9isoxnZJFQ992wnB9WoAx9pPUxjwieC8wJGdro5yXVoxJjnyYo8kFoOLnQ x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 26396 last-modified Fri, 12 Nov 2021 23:33:38 GMT server cloudflare etag "7419532d64ff26c2dfaed02b316912a0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=lLT0lw==, md5=dBlTLWT/JsLfrtArMWkSoA== x-goog-generation 1636760018319448 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 26396 accept-ranges bytes cf-ray 6b6c81865eb73742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1597718141_diagram.png assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/	3 KB 4 KB	345ms 292ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/1597718141_diagram.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51f1ce6a509d26c957259cd2159a104fc59b1a883aef49071c57e04a9d157c28 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycduPkx4YShBM3Q-nypuwA5bHLVL4agK_2d5_UkbpaGg7zOpIE60mXiwb4HfTlDDCdQUK2gqdvQm38YQjop5Ua5TDsuWhnA x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 3482 last-modified Tue, 18 Aug 2020 02:35:41 GMT server cloudflare etag "465d676f542e1fed0d38a67589dc766a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=KuB+dQ==, md5=Rl1nb1QuH+0NOKZ1idx2ag== x-goog-generation 1597718141588225 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 3482 accept-ranges bytes cf-ray 6b6c81865eba3742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1597717671_deadline.png assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/	3 KB 3 KB	341ms 288ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/1597717671_deadline.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c9d651549b9d5dc23529782ecf688fe172f39a95cdc38e9f1cca9c7900d1ce7f Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdvSpsw47rgZXYmgP3qmLz8sglS7WKJwC1Ec5Mnt0jVj0OKJV8FsS8YE_-LQNRUdh_RWvE3XR1UWZAcap8_noy23vvVF5w x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 2675 last-modified Tue, 18 Aug 2020 02:27:51 GMT server cloudflare etag "d6359770e28354b12c3872173e1ae8c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=Kwa5dQ==, md5=1jWXcOKDVLEsOHIXPhrowA== x-goog-generation 1597717671974940 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 2675 accept-ranges bytes cf-ray 6b6c81865ebb3742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1597718121_hashtag.png assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/	4 KB 4 KB	329ms 277ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/1597718121_hashtag.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e37d59b7044541ba860d2d14e952b26813b9acd57be49b335638091e2c849167 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdt1ElH-LKlWyFmV4H_wbUkearI4GYUMUZLRAkt9Oq7hOOHGFsbvCqgvruJNR202W2KSFJcVUJJLu86oIiOAe2KPP3pqTg x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 4243 last-modified Tue, 18 Aug 2020 02:35:21 GMT server cloudflare etag "f70336704c1fd9b920a99a9aa2643a52" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=WW8kbQ==, md5=9wM2cEwf2bkgqZqaomQ6Ug== x-goog-generation 1597718121346867 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 4243 accept-ranges bytes cf-ray 6b6c81865ebe3742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1636764264_1636484892rItGZ4vquWk.jpg assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/	1 MB 1 MB	211ms 159ms	Image image/jpeg	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/1636764264_1636484892rItGZ4vquWk.jpg Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 98a18f1c035996d2d0befe9d545c097cd405e47d86f45bb76ab5ea3a8fefe749 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdtwKWaKQ_yVibXiJD-vpbl86JqfLNKJuDD5krmJSnAyGYzPF8_V82bVcVDu69fxKmi_KS9mlwK5y1IQQhXCINpDJp0KjQ x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/jpeg content-length 1545579 last-modified Sat, 13 Nov 2021 00:44:49 GMT server cloudflare etag "58cff4d7002c5b05cdc8ac66c900954e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=cjdusQ==, md5=WM/01wAsWwXNyKxmyQCVTg== x-goog-generation 1636764289885380 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 1545579 accept-ranges bytes cf-ray 6b6c81865ebc3742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1636821952_salon1.jpg assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/	78 KB 79 KB	189ms 187ms	Image image/jpeg	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/1636821952_salon1.jpg Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c753ec2d20288173731c2cc25fb922481d47999060c1747c5f9b3a7f4cda6ba Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycduGKSv2Bf1KEFDQmoOq3vqBRM9krzIWfGyAGmP07CTJfLNsXq1CvEn5x_MI6i4B7an2RLeqMLfghwoIm4Oy9ZkdywuT8Q x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/jpeg content-length 80052 last-modified Sat, 13 Nov 2021 16:45:53 GMT server cloudflare etag "41320baf34832999fc9fa5afa08a9d76" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=3QSzfw==, md5=QTILrzSDKZn8n6WvoIqddg== x-goog-generation 1636821953137827 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 80052 accept-ranges bytes cf-ray 6b6c81866ee13742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1605594338_AdobeStock_232955923-scaled.jpeg assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/	593 KB 594 KB	188ms 186ms	Image image/jpeg	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/1605594338_AdobeStock_232955923-scaled.jpeg Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e39c0ef7e9bd78d076e41737aa3bef507c7b09c4b6f12143b26ded2b91eb7125 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdvJq1aT5lnxNBOB5oWS8klNx-q3k4WM68HuZ1dMDRujmoaU7GslDCdnRmiGjmEWj0yU1IWGTszlgi-XVMNCr7dIFMOOdQ x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/jpeg content-length 606821 last-modified Tue, 17 Nov 2020 06:25:39 GMT server cloudflare etag "2fc539f47bdf3f6aa1ed0d03966db744" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=mZ7Nug==, md5=L8U59HvfP2qh7Q0Dlm23RA== x-goog-generation 1605594339161447 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 606821 accept-ranges bytes cf-ray 6b6c81866ee23742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1636821807_pizza%20maker.jpg assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/	48 KB 48 KB	177ms 175ms	Image image/jpeg	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/1636821807_pizza%20maker.jpg Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1bfbb39c9ce26192d0c1d4cbba84a8a608e356eff0cd323d09a0d810a8897f8d Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdsxYwNYZvRwE-WnzM6NZyRH5Z3MJwenpfRdmxzLJWYzT-xvjrhOxLtXFciWN_7SRcpQjb6RSBP9Uk7tDhqaCzFHMqf7Pw x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/jpeg content-length 48844 last-modified Sat, 13 Nov 2021 16:43:28 GMT server cloudflare etag "d78fdb31f953e78b8a59ae19747a8631" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=L4dLYQ==, md5=14/bMflT54uKWa4ZdHqGMQ== x-goog-generation 1636821808037187 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 48844 accept-ranges bytes cf-ray 6b6c81866ee43742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1602495767_Tree%20Removal%20AdobeStock_141600960-min.jpeg assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/	35 KB 35 KB	187ms 186ms	Image image/jpeg	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/1602495767_Tree%20Removal%20AdobeStock_141600960-min.jpeg Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 10d173f34026544a5963fb8a02314f52b1bdb7370e114bf57e1b2ac261541640 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycduNuQtZSyxry-qhG22dISRQQtbSd2J97Z2k30LHkUFMeaXhkmozCHxJyVvhp-V47-7DEjPmyqLYfl0MQ0GuXmnAg6kLzA x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/jpeg content-length 35423 last-modified Mon, 12 Oct 2020 09:42:47 GMT server cloudflare etag "2b95bc80a2a426a9bf88c1f8c08f7be5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=V+q8Jg==, md5=K5W8gKKkJqm/iMH4wI975Q== x-goog-generation 1602495767959076 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 35423 accept-ranges bytes cf-ray 6b6c81866ee63742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1599638309_Screenshot%202020-09-09%20at%201.png assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/	258 KB 259 KB	176ms 175ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1599638309_Screenshot%202020-09-09%20at%201.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 514f8e5d6519274938e2adf1dd5e958abd1d2e9ee8cefa1ee5bbaa9aa1a095f2 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdtMRSI_2beIwImpzySCqNnSof4Jl_2m23CzANTwOk3UZvrRkckv15TJw3bq1ApiIj-6Ugu1kRgGrqn3DntFxzhQO-pzsg x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 264509 last-modified Mon, 16 Aug 2021 12:48:03 GMT server cloudflare etag "deac46339d2a9799a918573ba08a4e30" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=RSd0CA==, md5=3qxGM50ql5mpGFc7oIpOMA== x-goog-generation 1629118083149154 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 264509 accept-ranges bytes cf-ray 6b6c81866ee73742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1594987612_5-stars.png assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/	1 KB 2 KB	168ms 167ms	Image image/webp	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1594987612_5-stars.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b45f5504b077fbe2d545f3b95edd6a1c393d59dd7e65c8a3c0f981658355fb41 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status REVALIDATED cf-polished origFmt=png, origSize=3372 x-guploader-uploadid ADPycdv_3cBNGSdhw-90PG4scSUwoOnPHqxjt2WQckTgfiEz9MUCye60oKNNqh23tG3v2t9m8ZcN38D6OBPtL6uWhDM9J5e6KQ x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename="1594987612_5-stars.webp" content-type image/webp content-length 1270 expires Wed, 01 Dec 2021 17:01:45 GMT last-modified Mon, 16 Aug 2021 12:46:54 GMT server cloudflare etag "8a3da401411e750e78b3a1e5a779aff5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept x-goog-hash crc32c=5vawBw==, md5=ij2kAUEedQ54s6Hlp3mv9Q== x-goog-generation 1629118014545462 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 3372 accept-ranges bytes cf-ray 6b6c81866ee83742-MXP cf-bgj imgq:85,h2pri
GET H2	200	1599638326_Screenshot%202020-09-09%20at%201.png assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/	160 KB 160 KB	168ms 167ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1599638326_Screenshot%202020-09-09%20at%201.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 02c08f7787eaf377aad24fdba5231bce004e7e4463ca3ad7ef3e1a961e50874f Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdthiu6LmR0oy6VMYbFGEDgt3GYfbxSPCRb-n071Z6fmT42WJjGy2VLuLOp4gDmg9IJphzlQY4P1VeuUqe1yXiiwD0DC-w x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 163384 last-modified Mon, 16 Aug 2021 12:48:03 GMT server cloudflare etag "367f5a51df3b5fd726f8a5d96f4ef149" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=mw6NCA==, md5=Nn9aUd87X9cm+KXZb07xSQ== x-goog-generation 1629118083333377 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 163384 accept-ranges bytes cf-ray 6b6c81866eea3742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1599638341_Screenshot%202020-09-09%20at%201.png assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/	143 KB 143 KB	168ms 167ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1599638341_Screenshot%202020-09-09%20at%201.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5638dd97e7ad856a15ed69e4faf65d676f528096d40becc9a62edb7588a07291 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdvOQoLxQrBu7ovuxArZGcqizu6BaR3wxI2LgGU1rmGwgC-22Ai6JtzIlzJ92NCVYGMYNgxErYDThGpKeNngmvn9_GC8hw x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 146342 last-modified Mon, 16 Aug 2021 12:48:03 GMT server cloudflare etag "e41b60d62cd1542f89aa8bd1b728eec5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=edP21A==, md5=5Btg1izRVC+JqovRtyjuxQ== x-goog-generation 1629118083514753 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 146342 accept-ranges bytes cf-ray 6b6c81866eec3742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1600932967_noun_Level%201_480108.png assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/	22 KB 22 KB	186ms 185ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1600932967_noun_Level%201_480108.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 60bececd825bd8b845f6b7e4c133166e267c1313e4d8d7f84ec21a634c5ee0f3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycduOb2OFwtDKHw_iyLIVeIudjpjDCC_96qv0eHoAL-FoC67oe8LIwvRM3_51muzlYslJX4Y_1IKThETtoM_SDDINizbxfg x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 22514 last-modified Mon, 16 Aug 2021 12:48:15 GMT server cloudflare etag "5c49649d511ae0cc6600d9a2e4365e77" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=MTCoSA==, md5=XElknVEa4MxmANmi5DZedw== x-goog-generation 1629118095617334 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 22514 accept-ranges bytes cf-ray 6b6c81866eee3742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1600933000_noun_Level%204_480114.png assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/	21 KB 21 KB	187ms 186ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1600933000_noun_Level%204_480114.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5249ff4aa287466229a396ff5dedbbbb29ae3fc7277b2bf3ebf4714fea57188e Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdvclSaOq97TNrI37M3YW9balHtEtPFb6IRl77F87NdLMyZKiZeQxtzhD61DVF2t27WIAIADQOW14wQcYkOaRdGrWODvTw x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 21680 last-modified Mon, 16 Aug 2021 12:48:15 GMT server cloudflare etag "6681e3379942fe9e42e0caae81a9d49b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=M65Jaw==, md5=ZoHjN5lC/p5C4MquganUmw== x-goog-generation 1629118095786359 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 21680 accept-ranges bytes cf-ray 6b6c81866ef13742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1600933034_noun_Level%206_480107.png assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/	20 KB 21 KB	188ms 187ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1600933034_noun_Level%206_480107.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f6269323116865fdf43161add77825dab01edd86bf607bbf13d972b4e7186615 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdv7i5lAynzf0rkCpuXU52h4AFnWTi3ay_Kh5kYwzmtrHdl7ptINLNPGJtxLptrcSQuCb6vDdkmKAd0XJ6eLXHCs0FCR9g x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 20826 last-modified Mon, 16 Aug 2021 12:48:15 GMT server cloudflare etag "5661c65bb8df198418347af96de18ace" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=OQ0aOQ==, md5=VmHGW7jfGYQYNHr5beGKzg== x-goog-generation 1629118095961057 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 20826 accept-ranges bytes cf-ray 6b6c81866ef23742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	1636579332_Ring%20Dots%20Full.png assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/	6 KB 6 KB	389ms 388ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/1636579332_Ring%20Dots%20Full.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7fdee17af0a67781a2a9d7dd3c1abae40f81ddfa50e3073aed817a87156e7adc Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdtSTs9Exdszfy3MNm0lvMbMIaftsx7JI4RSz9JI9TCgqQ-lgBRA1eCMLKnHfR9zeM4FulPflhzXY4DQjcHXB-RDBTeP_Q x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 5671 last-modified Wed, 10 Nov 2021 21:22:13 GMT server cloudflare etag "6c7617edea8ca8b1802723c3b1a3e9bc" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=LcbNbQ==, md5=bHYX7eqMqLGAJyPDsaPpvA== x-goog-generation 1636579333178844 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 5671 accept-ranges bytes cf-ray 6b6c81866ef43742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H2	200	embedManager.js Show response fs22.formsite.com/include/form/	4 KB 2 KB	338ms 103ms	Script application/javascript	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/embedManager.js?2139323432 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash 9c8d64cbf085d79f198e754889157afbab4bb16da50777158bba9c0070cf2baf Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip last-modified Tue, 14 Sep 2021 14:48:34 GMT server Apache etag "ec1-gzip" vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=604800 accept-ranges bytes content-length 1455 expires Wed, 08 Dec 2021 13:01:45 GMT
GET H2	200	form-validation-lib.web.js Show response assets.grooveapps.com/plugins/	7 KB 3 KB	168ms 166ms	Script application/javascript	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.grooveapps.com/plugins/form-validation-lib.web.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0231a1dca2eeb968e5e4497bdaa6c9ef78a3f7c2db3f5692d661dbc07e022a0c Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br cf-cache-status MISS x-guploader-uploadid ADPycdvamBQK-pZtbUHLPrj6i-2QxlOiC-GNlh-SJbCJxLxY9NsgegpGuy_9f90tLIRdYlCFHuVdoFTz2s1aufcF6zMT-YZ5dQ x-goog-storage-class STANDARD x-goog-metageneration 2 x-goog-stored-content-encoding identity content-type application/javascript last-modified Tue, 30 Nov 2021 01:14:16 GMT server cloudflare etag W/"bc7302d8f62b59c1f750443206b2fd8f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=468QKA==, md5=vHMC2PYrWcH3UEQyBrL9jw== content-language en access-control-allow-origin * x-goog-generation 1638234856433687 access-control-expose-headers Content-Type cache-control public, max-age=31536000 x-goog-stored-content-length 7339 cf-ray 6b6c81866edf3742-MXP expires Thu, 01 Dec 2022 13:01:45 GMT
GET H2	200	1638320988_f-230-51-21358450_AZZ6z1CM_Logo.png assets.grooveapps.com/images/8b10e164-ed5b-42fc-9807-0086b27e997e/	376 KB 376 KB	431ms 430ms	Image image/png	2606:4700::6812:14b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://assets.grooveapps.com/images/8b10e164-ed5b-42fc-9807-0086b27e997e/1638320988_f-230-51-21358450_AZZ6z1CM_Logo.png Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a1a018b0d4ceb6779618261844a811d33e26df5db0277e7457aa09a387a1f045 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cf-cache-status MISS x-guploader-uploadid ADPycdvgJ928i6v_ntOtX7KkANtRKTdhc9QQm2RAFyH0G1rSxGGvjbYqvxTCsyVEM_oe9Tm1cwItbwUt-ludUv5YkV7sQTMzMw x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 384655 last-modified Wed, 01 Dec 2021 01:10:08 GMT server cloudflare etag "26a24748dc294dbdce6b02b54df852ba" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=/mYplg==, md5=JqJHSNwpTb3OawK1TfhSug== x-goog-generation 1638321008550735 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=14400 x-goog-stored-content-length 384655 accept-ranges bytes cf-ray 6b6c81866ef63742-MXP expires Wed, 01 Dec 2021 17:01:45 GMT
GET H3	200	email-decode.min.js Show response taxcreditrefund.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/	1 KB 1 KB	58ms 26ms	Script application/javascript	2606:4700:3030::6815:15ca CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://taxcreditrefund.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:15ca , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 22 Nov 2021 17:32:49 GMT server cloudflare etag W/"619bd441-4d7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-frame-options DENY report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5YgzyajrKP6Y8%2BODSaZjDdzO7BC6iCU3GB4eiIlGNjRwfoyCiKDJWw9UPwObxYlpOsnThhMKMZ7iQXpJEcysnq96PCA3EkOr%2BS0Ako2VNiYDv%2BApoLp%2FTxsZxmw1h1mF1256GNhoLRAvvgbKB6f7V9UE"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=172800, public nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c81863d9de8fb-MXP vary Accept-Encoding expires Fri, 03 Dec 2021 13:01:45 GMT
GET H2	200	inpage_published.js Show response app.groove.cm/groovepages/js/	72 KB 26 KB	58ms 34ms	Script application/javascript	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovepages/js/inpage_published.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1dafe38a8d5cb65e6905339c23812e41f2da0852da79b93b9894fbc1e2bf50ea Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br cf-cache-status HIT last-modified Tue, 30 Nov 2021 12:56:42 GMT server cloudflare age 2585 etag W/"61a61f8a-11f24" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZybjsyM4h7PbbGaCvorq5rA4lkaoyQVlD0glXrhxUYAecqKYDRR%2FuXqgKhdOW4PfCML3YisegQQ6s8ayLBfCXFwmVzJqAeBFr%2FYT7uDbujw1JH8YrOTzlMhtHmhLOn7hlhkQw%2FC4D5pyZnX9"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c81862fb93747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	chunk-vendors.js Show response app.groove.cm/groovepages/js/	0 0	67ms 43ms	Script text/html	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovepages/js/chunk-vendors.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers
GET H2	200	pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2 fonts.gstatic.com/s/poppins/v15/	8 KB 8 KB	33ms 8ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b0b43e548e691662dac85b1dc159d148a273d5cb9139f3fcf457cdeebe7bdf3f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 10:59:22 GMT x-content-type-options nosniff age 7343 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7832 x-xss-protection 0 last-modified Thu, 05 Nov 2020 22:01:48 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 01 Dec 2022 10:59:22 GMT
GET H3	200	free-fa-solid-900.woff2 ka-f.fontawesome.com/releases/v5.15.4/webfonts/	76 KB 77 KB	58ms 36ms	Font font/woff2	2606:4700:3030::6815:5183 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5183 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7 Request headers Referer https://taxcreditrefund.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT via 1.1 5c82476b8faa6db5077c339ee3b64cf0.cloudfront.net (CloudFront) cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-C1 x-cache Hit from cloudfront access-control-max-age 3000 access-control-allow-methods GET alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 78168 last-modified Wed, 04 Aug 2021 18:58:24 GMT server cloudflare etag "a9fd1225fb2cd32320e2b931dca01089" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2Fj54%2BSDG%2BEAt%2BXXNhmlhP%2FLjOJco1e8EVnjLNN6ptx%2BieavBl7cW27cr6cMtYsO3wMuQVKFAUse4%2BIbiThcjYnyPacrgB7cG7TOn%2FDk3Ob8uS4jiJ98YBve3GgM7hx1DqyjUxdfkKcjcqGoC9hYWQdOWQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type font/woff2 access-control-allow-origin * cache-control max-age=31556926 accept-ranges bytes cf-ray 6b6c81863b9d374a-MXP access-control-allow-headers fa-kit-token x-amz-cf-id i4gr0iB2WEX0oEZU-Wz8jtW7HIsH8djCT6o5XhK2nIAY2oxr2i-sJA==
GET H2	200	7KE4VhYEZBAF7a6M9DFD v1.gdapis.com/api/groovevideo/generate-css/75176/	563 B 525 B	428ms 377ms	Stylesheet text/css	2606:4700:3034::6815:2dae CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://v1.gdapis.com/api/groovevideo/generate-css/75176/7KE4VhYEZBAF7a6M9DFD Requested by Host: widget.groovevideo.com URL: https://widget.groovevideo.com/widget/app.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:2dae , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.24 Resource Hash 0cbf470d7b5d4aa1136de5cf78515a965be83022bc741ffb0a56a27692414c0c Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.3.24 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cA35%2BwQXRx2CCAM8uoLHnPVVHHRtmmybAEsYZ1IO4J%2BJYWDl63JQHC0QtS0%2BkHVzM9pgg6kmx5WVuJucpewuxbPih%2FcEiSTHsgHV51LcOJ4Ot9H%2ByN51mYxZJ2whJtXL6QIWtpk%2FpY%2Fi3N3w"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=UTF-8 x-ratelimit-remaining 598 cache-control no-cache, private x-ratelimit-limit 600 cf-ray 6b6c8187497f375c-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	7KE4VhYEZBAF7a6M9DFD Show response app.groove.cm/groovevideo/video/75176/ Frame CDF7 Redirect Chain https://app.groovefunnels.com/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD	5 KB 2 KB	238ms 238ms	Document text/html	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Requested by Host: widget.groovevideo.com URL: https://widget.groovevideo.com/widget/app.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7eba1e09edee721f18ac760660ebeb768e99237dedcc9cffa9ea171ad2b0beb Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-type text/html vary Accept-Encoding last-modified Tue, 30 Nov 2021 13:06:02 GMT cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VdQj73p6YXzm8ZUesBp8a4jL4G3XBJ2huwmHzw0fz97Q4a4KilUghmqZQxrQ1W92DmdcHMN7SQp%2B7yhwEwdmAJr6xo5V3HimCIzj4bhz7BEy1EQ42PN%2BLwJzCCJJQP54760kXamiUnOlhs%2Fk"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6b6c81876a323747-MXP content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Redirect headers date Wed, 01 Dec 2021 13:01:45 GMT cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 expires Thu, 01 Jan 1970 00:00:01 GMT location https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3BcyNXPPtKoOCTldwCNOownZVaJdj73LL9RpXkFXL3FAISHMn45NVhpxuDHOrevqTwyBR1iv%2FmQVQAWeV%2BbNdDZAh%2F8HIfh0xBWIvNTd8zihKMuxsfmuD0ER5tRl0dS97eKeLPmJdvN6kA1xfwI3meIQjN0%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary Accept-Encoding server cloudflare cf-ray 6b6c818739144e49-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	u1kHEnHT9wSJ2kyJJs0e v1.gdapis.com/api/groovevideo/generate-css/75215/	563 B 893 B	413ms 374ms	Stylesheet text/css	2606:4700:3034::6815:2dae CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://v1.gdapis.com/api/groovevideo/generate-css/75215/u1kHEnHT9wSJ2kyJJs0e Requested by Host: widget.groovevideo.com URL: https://widget.groovevideo.com/widget/app.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:2dae , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.24 Resource Hash 1eff7b7cd26420f2843c2427d5f8fc24c423827818b0f2d457e9cc32193cea77 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.3.24 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z0d3kvujRCKHP8K%2BIE3eMPSu1y1KqgCzP4ZAy%2BfqTEB1nYGBa3akhNXSX8bLb%2FqhOELSiB%2BMNcS40tKUzUwGRL%2BRDYRPdv4%2B6Z6gMV7bXVEkyw8uVheMR1Jjh2EU7WZsn2Rm47MU6aBchF67"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=UTF-8 x-ratelimit-remaining 598 cache-control no-cache, private x-ratelimit-limit 600 cf-ray 6b6c81874980375c-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	u1kHEnHT9wSJ2kyJJs0e Show response app.groove.cm/groovevideo/video/75215/ Frame D7C8 Redirect Chain https://app.groovefunnels.com/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e	5 KB 2 KB	227ms 227ms	Document text/html	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Requested by Host: widget.groovevideo.com URL: https://widget.groovevideo.com/widget/app.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7eba1e09edee721f18ac760660ebeb768e99237dedcc9cffa9ea171ad2b0beb Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-type text/html vary Accept-Encoding last-modified Tue, 30 Nov 2021 13:06:02 GMT cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xi7p6sGkjOx0jMgoW2pE3AO2kn3vQRSofV9ScMepbX9l9%2FsGM94fw5WjQTG1zRG8RMk4KCBPhc4dtxbj0ZNZHpF8vm%2BoMIf%2FSkMBesftDZh2p2dBH4s6YxheOMcNdf6c0bYU%2F%2Bg231AP9i%2F7"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6b6c81877a4a3747-MXP content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Redirect headers date Wed, 01 Dec 2021 13:01:45 GMT cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 expires Thu, 01 Jan 1970 00:00:01 GMT location https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iHE7QMU37fk3biBwBhyYxGQU4sM9tp2oGLVhPMHBK3pQUS5wKv80n69h8jg%2FyGuO07FUH5RGw7%2BSrHP2BQ5H0hPc%2FKhlJYxglqqpiu%2FS93sZd5RL1bUgzhs3h6%2Bibh1mzJa36tmfd8puewp5%2Figojt%2FolwM%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary Accept-Encoding server cloudflare cf-ray 6b6c818739174e49-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	showFormEmbed Show response fs22.formsite.com/res/ Frame 5FCB	11 KB 3 KB	260ms 196ms	Document text/html	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash cbe643991838c31c11b9e949a3e6d799eb0c1a854463726d9da0e125c90d4695 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-type text/html;charset=UTF-8 content-length 2673 server Apache vary Accept-Encoding,User-Agent content-encoding gzip
GET H3	200	6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2 fonts.gstatic.com/s/sourcesanspro/v18/	13 KB 13 KB	42ms 27ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7209c26bc245ae1b293f4b9622201b1dc97282229a2e8fcae555f36caa8650e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 05:43:33 GMT x-content-type-options nosniff age 26292 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13008 x-xss-protection 0 last-modified Wed, 10 Nov 2021 18:10:28 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 01 Dec 2022 05:43:33 GMT
GET H3	200	6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 fonts.gstatic.com/s/sourcesanspro/v18/	13 KB 13 KB	39ms 24ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 428f1eb7935944229430ac0fdce0033f05d9b8c1c020b87c681dd7a78ab4dd19 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 11:22:37 GMT x-content-type-options nosniff age 5948 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13080 x-xss-protection 0 last-modified Wed, 10 Nov 2021 18:10:26 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 01 Dec 2022 11:22:37 GMT
GET H3	200	S6uyw4BMUTPHjx4wXg.woff2 fonts.gstatic.com/s/lato/v20/	23 KB 23 KB	26ms 11ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v20/S6uyw4BMUTPHjx4wXg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 20:12:18 GMT x-content-type-options nosniff age 578967 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 23484 x-xss-protection 0 last-modified Tue, 10 Aug 2021 00:19:01 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 24 Nov 2022 20:12:18 GMT
GET H3	200	6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2 fonts.gstatic.com/s/sourcesanspro/v18/	12 KB 12 KB	43ms 28ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d28cd8034256b93e060711ff9357b555b0d55af2c9aa4640311c1d41dcab3e13 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 15:53:38 GMT x-content-type-options nosniff age 594487 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 12440 x-xss-protection 0 last-modified Wed, 10 Nov 2021 18:17:37 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 24 Nov 2022 15:53:38 GMT
GET H3	200	TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 fonts.gstatic.com/s/oswald/v40/	24 KB 24 KB	29ms 15ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/oswald/v40/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9c21b3dbf862e916d2689453d7f27dcc0539a0239bf323e5f2db397fca0e5d21 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 11:24:21 GMT x-content-type-options nosniff age 5844 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 24080 x-xss-protection 0 last-modified Tue, 10 Aug 2021 00:16:47 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 01 Dec 2022 11:24:21 GMT
GET H3	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v29/	15 KB 15 KB	21ms 7ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 15:45:42 GMT x-content-type-options nosniff age 594963 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15688 x-xss-protection 0 last-modified Wed, 22 Sep 2021 16:13:19 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 24 Nov 2022 15:45:42 GMT
GET H3	200	BngRUXNadjH0qYEzV7ab-oWlsbCGwR0.woff2 fonts.gstatic.com/s/ptsansnarrow/v12/	35 KB 35 KB	43ms 29ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/ptsansnarrow/v12/BngRUXNadjH0qYEzV7ab-oWlsbCGwR0.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5818f55583b8a82745bf0b1d9cbc07c0411088fb5a837ff5a15b5a745ccdcd58 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 30 Nov 2021 20:12:20 GMT x-content-type-options nosniff age 60565 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36268 x-xss-protection 0 last-modified Thu, 10 Sep 2020 17:08:52 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 30 Nov 2022 20:12:20 GMT
GET H3	200	free-fa-regular-400.woff2 ka-f.fontawesome.com/releases/v5.15.4/webfonts/	13 KB 14 KB	40ms 39ms	Font font/woff2	2606:4700:3030::6815:5183 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-regular-400.woff2 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5183 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 48fb6f0d8ac464d95cbc2df3ffa7bf5066950898c5581f5133d0565abb7f706b Request headers Referer https://taxcreditrefund.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT via 1.1 7a06a73d3c4d9b2940678fa230525001.cloudfront.net (CloudFront) cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-C1 x-cache Hit from cloudfront access-control-max-age 3000 access-control-allow-methods GET alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 13216 last-modified Wed, 04 Aug 2021 18:58:24 GMT server cloudflare etag "b8f1c6a3a94d42b082c29f0b1db8ba95" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GMmTxAIN7cqheuz3SIT4Vah2kF5%2FHWonSVVawv0kDLWqMdE9y1VrIPx8de10awIuwA9aFFiW27BoGkko9Mz3JUQI2Yhg0jt%2FSYK81u07axiJlbn4Wdcidas49qIGhPdRtk7nogvpvQy6mx5v7VCqpyeGzA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type font/woff2 access-control-allow-origin * cache-control max-age=31556926 accept-ranges bytes cf-ray 6b6c81873e38374a-MXP access-control-allow-headers fa-kit-token x-amz-cf-id ekDPZpXTIax25DDBDFlAJclHnwbjinfDfp6gvvFyEsOZXJ_8Lj1Wgw==
GET H3	200	KFOlCnqEu92Fr1MmSU5fBBc4.woff2 fonts.gstatic.com/s/roboto/v29/	15 KB 15 KB	35ms 21ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 11:22:37 GMT x-content-type-options nosniff age 5948 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15732 x-xss-protection 0 last-modified Wed, 22 Sep 2021 16:13:20 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 01 Dec 2022 11:22:37 GMT
GET H/1.1	200 OK	matomo.php matomo.groovetech.io/	43 B 217 B	142ms 142ms	Image image/gif	51.161.92.183 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://matomo.groovetech.io/matomo.php?action_name=taxcreditrefund.com%2FERC%20Application&idsite=4&rec=1&r=064416&h=13&m=1&s=45&url=https%3A%2F%2Ftaxcreditrefund.com%2F&_id=f531cfd432f5b5de&_idts=1638363706&_idvc=1&_idn=0&_refts=0&_viewts=1638363706&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&dimension1=486359&dimension2=wq08ZLnQc&gt_ms=831&pv_id=IulPx3 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.92.183 Laval, Canada, ASN16276 (OVH, FR), Reverse DNS ip183.ip-51-161-92.net Software nginx/1.19.2 / PHP/7.4.16 Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT cache-control no-store server nginx/1.19.2 x-powered-by PHP/7.4.16 content-length 43 content-type image/gif
GET H2	200	showFormEmbed Show response fs22.formsite.com/res/ Frame B5ED	11 KB 3 KB	306ms 306ms	Document text/html	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/include/form/embedManager.js?2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash aa182a5a37ff98c4df030d1d77ffa8be704ebfb38722e1cb7bb02cef1a954cf1 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://taxcreditrefund.com/ Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-type text/html;charset=UTF-8 content-length 2671 server Apache vary Accept-Encoding,User-Agent content-encoding gzip
GET H3	200	-F62fjtqLzI2JPCgQBnw7HFow2oe2EcP5pp0erwTqsSWs9Jezazjcb4.118.woff2 fonts.gstatic.com/s/notosansjp/v36/	13 KB 13 KB	8ms 7ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/notosansjp/v36/-F62fjtqLzI2JPCgQBnw7HFow2oe2EcP5pp0erwTqsSWs9Jezazjcb4.118.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 78b47eff227018b83bf54e4cf548a86a4d42d3a6c200d0d35f4c56896957f0e1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 06:30:39 GMT x-content-type-options nosniff age 455466 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13468 x-xss-protection 0 last-modified Tue, 14 Sep 2021 16:37:06 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Sat, 26 Nov 2022 06:30:39 GMT
GET H3	200	-F62fjtqLzI2JPCgQBnw7HFow2oe2EcP5pp0erwTqsSWs9Jezazjcb4.119.woff2 fonts.gstatic.com/s/notosansjp/v36/	50 KB 50 KB	8ms 8ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/notosansjp/v36/-F62fjtqLzI2JPCgQBnw7HFow2oe2EcP5pp0erwTqsSWs9Jezazjcb4.119.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5467d5cbb90e7f10aa11fb3901d959080123fb09f94d9064f5099d5c7a4b95c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://taxcreditrefund.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 30 Nov 2021 23:19:36 GMT x-content-type-options nosniff age 49329 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51120 x-xss-protection 0 last-modified Tue, 14 Sep 2021 16:36:58 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 30 Nov 2022 23:19:36 GMT
GET H2	200	jquery-ui.css ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/ Frame 5FCB	36 KB 9 KB	37ms 11ms	Stylesheet text/css	2a00:1450:4001:812::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 30 Nov 2021 01:40:51 GMT content-encoding gzip x-content-type-options nosniff age 127254 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8422 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/css; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 30 Nov 2022 01:40:51 GMT
GET H2	200	fonts8.css fs22.formsite.com/include/form/ Frame 5FCB	20 KB 5 KB	106ms 103ms	Stylesheet text/css	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/fonts8.css?3771515384018 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash 9221b2c07e1ad6a168982f0fbb342131b2e96c0ebe5902d98653d3a546a34632 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip last-modified Thu, 21 Oct 2021 13:46:26 GMT server Apache etag "4e63-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 4202 expires Wed, 08 Dec 2021 13:01:45 GMT
GET H2	200	screen8.css fs22.formsite.com/include/form/ Frame 5FCB	20 KB 9 KB	107ms 104ms	Stylesheet text/css	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/screen8.css?3771515384018 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash 6b223bb6c3fb8210034350b25e704c74c30d87756cdda5432b4649483e366e78 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip last-modified Wed, 10 Nov 2021 15:07:12 GMT server Apache etag "4f2f-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 8161 expires Wed, 08 Dec 2021 13:01:45 GMT
GET H2	200	responsive8.css fs22.formsite.com/include/form/ Frame 5FCB	3 KB 1 KB	105ms 102ms	Stylesheet text/css	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/responsive8.css?3771515384018 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash faa7999a9bc916746448d20ba389c7360faea9bc01a9e53fc08275e565cbf399 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip last-modified Wed, 10 Nov 2021 15:07:12 GMT server Apache etag "bb2-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 876 expires Wed, 08 Dec 2021 13:01:45 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/ Frame 5FCB	87 KB 30 KB	37ms 12ms	Script text/javascript	2a00:1450:4001:812::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 29 Nov 2021 11:53:02 GMT content-encoding gzip x-content-type-options nosniff age 176923 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 29 Nov 2022 11:53:02 GMT
GET H2	200	jquery-ui.min.js Show response ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ Frame 5FCB	248 KB 66 KB	49ms 24ms	Script text/javascript	2a00:1450:4001:812::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 29 Nov 2021 11:53:02 GMT content-encoding gzip x-content-type-options nosniff age 176923 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 67948 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 29 Nov 2022 11:53:02 GMT
GET H2	200	form8.js Show response fs22.formsite.com/include/form/ Frame 5FCB	27 KB 8 KB	200ms 198ms	Script application/javascript	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/form8.js?3771515384018 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash 7b47ae80afa3203ba35b6f17e9a9c0641ac3f8f5d37b3ae9f01f06730b1e7ae6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip last-modified Wed, 10 Nov 2021 15:07:12 GMT server Apache etag "6c5c-gzip" vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=604800 accept-ranges bytes content-length 7457 expires Wed, 08 Dec 2021 13:01:45 GMT
GET H2	200	embed.js Show response fs22.formsite.com/include/form/ Frame 5FCB	2 KB 1 KB	106ms 105ms	Script application/javascript	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/embed.js Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash 9bf76c0981f3d7cb30be16f19b1419bad27dbccc3c5c5496cd1c84982e756dd8 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip last-modified Mon, 30 Mar 2020 16:25:53 GMT server Apache etag "8fe-gzip" vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=604800 accept-ranges bytes content-length 855 expires Wed, 08 Dec 2021 13:01:45 GMT
GET H2	200	print8.css fs22.formsite.com/include/form/ Frame 5FCB	375 B 764 B	103ms 103ms	Stylesheet text/css	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/print8.css?3771515384018 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash fe096c1a1b3636490559c3e3d5c51dedcfed669ef95394071a765d922937dc6d Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip last-modified Mon, 01 Apr 2019 18:07:07 GMT server Apache etag "177-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 200 expires Wed, 08 Dec 2021 13:01:45 GMT
GET H2	200	video-js.min.css cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/ Frame D7C8	39 KB 9 KB	46ms 18ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/video-js.min.css Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 91f94a3c7e05d1c1afd01260e88ebea5be6720ed3514c7a82bba96a33d4d6b21 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 2392599 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 9046 timing-allow-origin * last-modified Mon, 04 May 2020 16:17:35 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb0401f-9c5c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O98xEp1c3Bg1IPoMqiglsqd7vwnyqihGznCbCEdHi6UvdmvgVACPPt%2Bt%2B3IeSfkYyTNW%2FHTctP9NrNPr26hGdfGZqSJUpAnOgVb5EvIPn6SQqXjJfzYMgBR%2F7TXXp8FpcUCQvs4h%2Fexq%2BowMvYrkTUO%2B"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b6c81892d1d4e49-FRA expires Mon, 21 Nov 2022 13:01:45 GMT
GET H2	200	video.min.js Show response cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/ Frame D7C8	470 KB 106 KB	63ms 35ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/video.min.js Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19bd09a46cd5735572bec1a138df1d0c1d408767e59c890581a417bdfcd29b25 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 760421 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 107564 timing-allow-origin * last-modified Mon, 04 May 2020 16:17:35 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb0401f-757c4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7UQExiBIgT%2BF7h6j4n%2BQqcKZ%2F7MskjzkQ3bBmzfiRGlgfGHYAt5%2B0nzXHgafRhKulxVTqwuCmI85UXOSyDRKMxNvi7EehYiJ5z%2FinuczupCczYo39u94zZH2eLTFeiqmeZETN4DE0xAy%2FTXVYTs0CBpp"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b6c81892d244e49-FRA expires Mon, 21 Nov 2022 13:01:45 GMT
GET H2	200	videojs-ie8.min.js Show response cdnjs.cloudflare.com/ajax/libs/video.js/5.2.2/ie8/ Frame D7C8	19 KB 6 KB	59ms 31ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/video.js/5.2.2/ie8/videojs-ie8.min.js Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6cdefb09aa8ed6fcfcb5ee50239a85d38f1a700653ce9f0420878508c07925ea Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 4791169 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 5911 timing-allow-origin * last-modified Mon, 04 May 2020 16:17:34 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb0401e-4a99" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=37SOXDGysHnZYWEcQvNuM1VmutbhsrOjP3mPpoH9ymnD2U4BVve9NxHS3wkoR5Ocvts5Y9MK%2BGPu9R7NcG1Imy26QQx5ATEFzVW2qP0a1USKVbfPF%2FGUMIjoXClN4%2FtxLL%2FmyI0agvDWPCcoN1FKl9w9"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b6c81892d254e49-FRA expires Mon, 21 Nov 2022 13:01:45 GMT
GET H3	200	css2 fonts.googleapis.com/ Frame D7C8	12 KB 791 B	22ms 20ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;0,900;1,400&display=swap Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 135ddf3be68cbef0e9cceae5236cc19c7d000626bfb1eeb22f2848b16bc956d5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 01 Dec 2021 13:01:45 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 01 Dec 2021 13:01:45 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 01 Dec 2021 13:01:45 GMT
GET H2	200	animate.min.css cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/ Frame D7C8	70 KB 4 KB	48ms 21ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1185826 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 4216 timing-allow-origin * last-modified Mon, 07 Sep 2020 12:33:38 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5f5628a2-11846" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cAF7u2E08o9KpXzxy2cGed99IKZbLBc1UzSzV1YN87DbPg0higUBJRwmd%2FovCwQzFAnkCdTzi9IMtTYJKkFYYs0%2FD0d6ndyHyD5YRLcvJyEcZKl6w%2FO2kbOueo%2BVeQb3c47VOFMyesmXb9FToYv2HUq3"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b6c81892d214e49-FRA expires Mon, 21 Nov 2022 13:01:45 GMT
GET H2	200	app.83fff398.css app.groove.cm/groovevideo/css/ Frame D7C8	43 KB 8 KB	245ms 238ms	Stylesheet text/css	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovevideo/css/app.83fff398.css Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7470e23afe8b590dbe5a5350a2ebd6593b4d652f5b49399b94eae371bd9d8264 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br cf-cache-status REVALIDATED last-modified Tue, 30 Nov 2021 13:06:02 GMT server cloudflare etag W/"61a621ba-acdc" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rpMyFgz7YxU3AC4l247ljcb3g4X79oP5dwAvX6h4jdNqQFAc8Jf8pCWnCLIpGLB9bT55P1XKtHvhVHg6u4qlp2bHfXyeWTGmFDoahiNr4DYxAO6qdK1Wb4GYoBxwUe%2BjcZm2iKP62Hv1zjnG"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c81891d983747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	chunk-vendors.ebe8269c.css app.groove.cm/groovevideo/css/ Frame D7C8	2 MB 210 KB	257ms 251ms	Stylesheet text/css	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovevideo/css/chunk-vendors.ebe8269c.css Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash db3d7cca43f18907ca60fbe5e15a2c8ef50942f78e8cff7db3c4ff296137d89a Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br cf-cache-status REVALIDATED last-modified Tue, 30 Nov 2021 13:06:02 GMT server cloudflare etag W/"61a621ba-1e274a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jFnh0ZqG5CI3vuqNlVfLguZ8lZ97B0Lvd1%2B91vbnQFlwfQfTLomviucXh60TYYKXRVYv5z39kZJWVocHs2gbwER7q5LuhvC%2FBz2ks99OtY%2FQGBFh%2BgS2ehRE2zttXnwOkddlf0XbhI0GbrhA"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c81891d9a3747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	app.5eab0795.js Show response app.groove.cm/groovevideo/js/ Frame D7C8	1 MB 253 KB	556ms 550ms	Script application/javascript	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovevideo/js/app.5eab0795.js Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 047d3f8cea730c46f16e881494cdb95f19b769ad36214ccd6042a90820a51d5d Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding br cf-cache-status MISS last-modified Tue, 30 Nov 2021 13:06:02 GMT server cloudflare etag W/"61a621ba-1583bc" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5LqvHcS4BqPnuQFVZPNYE3boVCcs5uaC1VKWwM8Knd1V9SWm0qPPgal3cGuDj7sxuRYbJ9mC82BBnWvItxbCzfV1NBLLUN6ofAyWN4PPvSh%2BYrY12tKEY5SvsIUssUOevRiRaKWPtHisyDfP"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c81891d9c3747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	chunk-vendors.b283e084.js Show response app.groove.cm/groovevideo/js/ Frame D7C8	7 MB 2 MB	265ms 259ms	Script application/javascript	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovevideo/js/chunk-vendors.b283e084.js Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8bf8909f6c9578e547506d389496554be0dbcb2307aa9dad4d257039fa3c1499 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding br cf-cache-status REVALIDATED last-modified Tue, 30 Nov 2021 13:06:02 GMT server cloudflare etag W/"61a621ba-6c21c8" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eWO3iOUC8G2q3B9kPKpzK7Cyy087JfC%2FasbQfoRRy6ReFnGyUBrlrohPpeBM%2BMm32%2FBiG0Mn3TIF3nzYcMyCzwZ9L0rQjJRtLOk7xuTOF3CWF7JNp81R1bboT8lZqSzZm2trHBMq78EMFZIP"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c81891d9d3747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	widget.min.js Show response cdn.productstash.io/js/ Frame D7C8	23 KB 6 KB	21ms 8ms	Script application/javascript	89.187.169.47 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://cdn.productstash.io/js/widget.min.js?v=0.8 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS unn-89-187-169-47.cdn77.com Software BunnyCDN-DE1-756 / Resource Hash 8796e1b1f79080cbb8112a0cf3d1d6cb6ff8dd4b096a323b1486d1702f41020d Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT via 1.1 vegur x-content-type-options nosniff cdn-edgestorageid 756 x-dns-prefetch-control off cdn-cachedat 09/06/2021 12:25:53 cdn-pullzone 173232 content-encoding br vary Accept-Encoding, Accept-Encoding x-xss-protection 1; mode=block server BunnyCDN-DE1-756 last-modified Mon, 06 Sep 2021 09:41:06 GMT cdn-proxyver 1.0 cdn-requestpullcode 200 x-frame-options SAMEORIGIN x-download-options noopen strict-transport-security max-age=15552000; includeSubDomains content-type application/javascript; charset=UTF-8 cdn-cache HIT cdn-uid 48a72dd7-1732-4103-a906-fc257bffa1c1 cache-control public, max-age=31536000 cdn-requestid 831f240d0e59df56bf57a940f8cfaf6c cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
GET H2	200	video-js.min.css cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/ Frame CDF7	39 KB 10 KB	42ms 16ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/video-js.min.css Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 91f94a3c7e05d1c1afd01260e88ebea5be6720ed3514c7a82bba96a33d4d6b21 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 2392599 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 9046 timing-allow-origin * last-modified Mon, 04 May 2020 16:17:35 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb0401f-9c5c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B78Jp5QV6GgTu5pofcE0CafnyXm%2BZmw3wSQ0jiGw8iHKGnpDfjPDV78zVkgX8Ku58GdyJtU2YTbH9lS1IVyPQrtrR8yjw3M7U92b1NoTa5YNRxvITkFggULMW7Q66aeeZZEyI9Qt1o93Wj300yM1Y92l"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b6c81892d234e49-FRA expires Mon, 21 Nov 2022 13:01:45 GMT
GET H2	200	video.min.js Show response cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/ Frame CDF7	470 KB 105 KB	49ms 24ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/video.min.js Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19bd09a46cd5735572bec1a138df1d0c1d408767e59c890581a417bdfcd29b25 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 760421 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 107564 timing-allow-origin * last-modified Mon, 04 May 2020 16:17:35 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb0401f-757c4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YsntfmZNPtETxBBxUtGAoPgdxHqe%2F2A%2B8990mYODWbPo3PGNYyTxxU6iJHj%2FxDvfVu98hZy9pYxOJ%2FEzWILNilvTGBC1hUj4OF0rTrtrbLKlVrC9vZrShmlQ65j%2FQpa502264H3NsjtdgiCp4F31SUzL"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b6c81892d284e49-FRA expires Mon, 21 Nov 2022 13:01:45 GMT
GET H2	200	videojs-ie8.min.js Show response cdnjs.cloudflare.com/ajax/libs/video.js/5.2.2/ie8/ Frame CDF7	19 KB 6 KB	47ms 23ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/video.js/5.2.2/ie8/videojs-ie8.min.js Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6cdefb09aa8ed6fcfcb5ee50239a85d38f1a700653ce9f0420878508c07925ea Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 4791169 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 5911 timing-allow-origin * last-modified Mon, 04 May 2020 16:17:34 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb0401e-4a99" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u%2FkKLBZxIiRIH8QeZH9hi3UHAJjmMK3zwNJ6HrgCeVq5THWFFPPy0G0dXn%2BcwQmgIoHk17Hw4XijONue%2BZGBZkobUm6wwzejivXF7quOuM39G4isz3n%2FojOoyEty2ZNtqNeq44I%2BUe3dwTvzVp8mM4zk"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b6c81892d264e49-FRA expires Mon, 21 Nov 2022 13:01:45 GMT
GET H3	200	css2 fonts.googleapis.com/ Frame CDF7	12 KB 791 B	23ms 20ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;0,900;1,400&display=swap Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 135ddf3be68cbef0e9cceae5236cc19c7d000626bfb1eeb22f2848b16bc956d5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 01 Dec 2021 13:01:45 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 01 Dec 2021 13:01:45 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 01 Dec 2021 13:01:45 GMT
GET H2	200	animate.min.css cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/ Frame CDF7	70 KB 4 KB	64ms 40ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1185826 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 4216 timing-allow-origin * last-modified Mon, 07 Sep 2020 12:33:38 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5f5628a2-11846" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UQGmqnIHHq9a4zbi8%2FNYbTZq4421msPsrm%2FXNwlJDTREFQtaxeeRlNuoNeNPdXsxLtW%2FlZZIRhUyNPX77GlvyRFYdMhBK7%2FQVrB4yT6WbMASVFE0hSIZtjaarZR%2BYDYZRAZs2M1vLNKEtXPRdRYiYKiE"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b6c81892d1e4e49-FRA expires Mon, 21 Nov 2022 13:01:45 GMT
GET H2	200	app.83fff398.css app.groove.cm/groovevideo/css/ Frame CDF7	43 KB 8 KB	253ms 249ms	Stylesheet text/css	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovevideo/css/app.83fff398.css Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7470e23afe8b590dbe5a5350a2ebd6593b4d652f5b49399b94eae371bd9d8264 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br cf-cache-status REVALIDATED last-modified Tue, 30 Nov 2021 13:06:02 GMT server cloudflare etag W/"61a621ba-acdc" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oMZpusVrwS%2BzVwx53lBlusE5%2FEYRnu7EEye0OHZ2bA8Z4bqQnhHLQeaWp1fg7zcnnHIPbD4fyYKGLdRbmwPu6NDyNKbzo%2FDMUCGLB7txCfncbl1S30QJjl%2BHIj4Endpa2ewSR%2BXET25HK8Iv"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c81891d9f3747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	chunk-vendors.ebe8269c.css app.groove.cm/groovevideo/css/ Frame CDF7	2 MB 210 KB	246ms 242ms	Stylesheet text/css	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovevideo/css/chunk-vendors.ebe8269c.css Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash db3d7cca43f18907ca60fbe5e15a2c8ef50942f78e8cff7db3c4ff296137d89a Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br cf-cache-status REVALIDATED last-modified Tue, 30 Nov 2021 13:06:02 GMT server cloudflare etag W/"61a621ba-1e274a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15hRDfMDwoWCCmw4hHyY%2Bkns7ut0MXqPFsSSYVRAnjPHN4VW89BbFZN0besqjKmq5DYeyTvYatcOKPk%2Fc6qy8MavsTf%2F72RKNo6TyPL28w3w5Bwa4ldBFsCr5QdgBnweERJ1Yro4NCiaSsjk"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c81891da03747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	app.5eab0795.js Show response app.groove.cm/groovevideo/js/ Frame CDF7	1 MB 253 KB	1140ms 1136ms	Script application/javascript	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovevideo/js/app.5eab0795.js Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 047d3f8cea730c46f16e881494cdb95f19b769ad36214ccd6042a90820a51d5d Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding br cf-cache-status HIT last-modified Tue, 30 Nov 2021 13:06:02 GMT server cloudflare age 1 etag W/"61a621ba-1583bc" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=biLCQkqgK0CgqUHPew1BXklidT8h1TlA0JG0xUKLzoQh8%2Fv3fyO8F2tlHTxNHFFgQ2avCeBlgI0duF%2B6I5dSeyE6nNRS%2FFkczDZwiW1JRp3kx4few9dJBD%2FN0Yx9MOLNcFI%2B4zwKh5zz3pwS"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c81891da13747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	chunk-vendors.b283e084.js Show response app.groove.cm/groovevideo/js/ Frame CDF7	7 MB 2 MB	289ms 285ms	Script application/javascript	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/groovevideo/js/chunk-vendors.b283e084.js Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8bf8909f6c9578e547506d389496554be0dbcb2307aa9dad4d257039fa3c1499 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding br cf-cache-status REVALIDATED last-modified Tue, 30 Nov 2021 13:06:02 GMT server cloudflare etag W/"61a621ba-6c21c8" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HwygyF6q6Ux8PKi0CLSRuD1YVq7zTJf6%2BijtUlHkXJCDpi61%2BXtAc0IaglmRdjSZBkHXOzraT6YEhASEnojs7z9JWAzYUFXP6a%2Bqh0rfDqS%2Fq7EgzpRhMMf5UBiPFWuRK4374o4McVQ%2FJtHE"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c81891da33747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	widget.min.js Show response cdn.productstash.io/js/ Frame CDF7	23 KB 6 KB	42ms 10ms	Script application/javascript	89.187.169.47 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://cdn.productstash.io/js/widget.min.js?v=0.8 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_256_GCM Server 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS unn-89-187-169-47.cdn77.com Software BunnyCDN-DE1-756 / Resource Hash 8796e1b1f79080cbb8112a0cf3d1d6cb6ff8dd4b096a323b1486d1702f41020d Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT via 1.1 vegur x-content-type-options nosniff cdn-edgestorageid 756 x-dns-prefetch-control off cdn-cachedat 09/06/2021 12:25:53 cdn-pullzone 173232 content-encoding br vary Accept-Encoding, Accept-Encoding x-xss-protection 1; mode=block server BunnyCDN-DE1-756 last-modified Mon, 06 Sep 2021 09:41:06 GMT cdn-proxyver 1.0 cdn-requestpullcode 200 x-frame-options SAMEORIGIN x-download-options noopen strict-transport-security max-age=15552000; includeSubDomains content-type application/javascript; charset=UTF-8 cdn-cache HIT cdn-uid 48a72dd7-1732-4103-a906-fc257bffa1c1 cache-control public, max-age=31536000 cdn-requestid b0b4e2d71365e7efe889579501177e8d cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
GET H2	200	gtm.js Show response www.googletagmanager.com/ Frame CDF7	197 KB 69 KB	49ms 26ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 11db56c10838ad0fc752606a7f6b142ffe3b125665b97507849bef34e7d9d6b5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 69803 x-xss-protection 0 last-modified Wed, 01 Dec 2021 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 01 Dec 2021 13:01:45 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/ Frame D7C8	197 KB 68 KB	42ms 39ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 11db56c10838ad0fc752606a7f6b142ffe3b125665b97507849bef34e7d9d6b5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 69803 x-xss-protection 0 last-modified Wed, 01 Dec 2021 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 01 Dec 2021 13:01:45 GMT
GET BLOB	200 OK	593f0b58-b31e-4405-bef8-549e6bb72612 https://app.groove.cm/ Frame CDF7	31 B 0		Other application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://app.groove.cm/593f0b58-b31e-4405-bef8-549e6bb72612 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 31 Content-Type application/javascript
GET BLOB	200 OK	7ec3ff41-9410-466c-8971-d2fe34b8ecb6 https://app.groove.cm/ Frame D7C8	31 B 0		Other application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://app.groove.cm/7ec3ff41-9410-466c-8971-d2fe34b8ecb6 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 31 Content-Type application/javascript
GET H3	200	jquery-ui.css ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/ Frame B5ED	36 KB 8 KB	26ms 11ms	Stylesheet text/css	2a00:1450:4001:812::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 30 Nov 2021 01:40:51 GMT content-encoding gzip x-content-type-options nosniff age 127254 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8422 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/css; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 30 Nov 2022 01:40:51 GMT
GET H2	200	fonts8.css fs22.formsite.com/include/form/ Frame B5ED	20 KB 5 KB	104ms 103ms	Stylesheet text/css	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/fonts8.css?9432765894338 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash 9221b2c07e1ad6a168982f0fbb342131b2e96c0ebe5902d98653d3a546a34632 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip last-modified Thu, 21 Oct 2021 13:46:26 GMT server Apache etag "4e63-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 4202 expires Wed, 08 Dec 2021 13:01:46 GMT
GET H2	200	screen8.css fs22.formsite.com/include/form/ Frame B5ED	20 KB 9 KB	105ms 104ms	Stylesheet text/css	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/screen8.css?9432765894338 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash 6b223bb6c3fb8210034350b25e704c74c30d87756cdda5432b4649483e366e78 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip last-modified Wed, 10 Nov 2021 15:07:12 GMT server Apache etag "4f2f-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 8161 expires Wed, 08 Dec 2021 13:01:46 GMT
GET H2	200	responsive8.css fs22.formsite.com/include/form/ Frame B5ED	3 KB 1 KB	106ms 105ms	Stylesheet text/css	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/responsive8.css?9432765894338 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash faa7999a9bc916746448d20ba389c7360faea9bc01a9e53fc08275e565cbf399 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip last-modified Wed, 10 Nov 2021 15:07:12 GMT server Apache etag "bb2-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 876 expires Wed, 08 Dec 2021 13:01:46 GMT
GET H3	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/ Frame B5ED	87 KB 30 KB	22ms 7ms	Script text/javascript	2a00:1450:4001:812::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 29 Nov 2021 11:53:02 GMT content-encoding gzip x-content-type-options nosniff age 176923 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 29 Nov 2022 11:53:02 GMT
GET H3	200	jquery-ui.min.js Show response ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ Frame B5ED	248 KB 66 KB	26ms 12ms	Script text/javascript	2a00:1450:4001:812::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 29 Nov 2021 11:53:02 GMT content-encoding gzip x-content-type-options nosniff age 176923 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 67948 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 29 Nov 2022 11:53:02 GMT
GET H2	200	form8.js Show response fs22.formsite.com/include/form/ Frame B5ED	27 KB 8 KB	106ms 105ms	Script application/javascript	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/form8.js?9432765894338 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash 7b47ae80afa3203ba35b6f17e9a9c0641ac3f8f5d37b3ae9f01f06730b1e7ae6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip last-modified Wed, 10 Nov 2021 15:07:12 GMT server Apache etag "6c5c-gzip" vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=604800 accept-ranges bytes content-length 7457 expires Wed, 08 Dec 2021 13:01:46 GMT
GET H2	200	embed.js Show response fs22.formsite.com/include/form/ Frame B5ED	2 KB 1 KB	105ms 104ms	Script application/javascript	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/embed.js Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash 9bf76c0981f3d7cb30be16f19b1419bad27dbccc3c5c5496cd1c84982e756dd8 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip last-modified Mon, 30 Mar 2020 16:25:53 GMT server Apache etag "8fe-gzip" vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=604800 accept-ranges bytes content-length 855 expires Wed, 08 Dec 2021 13:01:46 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/ Frame CDF7	163 KB 60 KB	42ms 26ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-VQKC5VQTH1&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 15092d597b1016387b636f1524741aefc3fd65725891487444a446fe25bed5b7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 61786 x-xss-protection 0 expires Wed, 01 Dec 2021 13:01:46 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/ Frame CDF7	49 KB 20 KB	39ms 8ms	Script text/javascript	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 02 Nov 2021 17:39:06 GMT server Golfe2 age 39 date Wed, 01 Dec 2021 13:01:07 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Wed, 01 Dec 2021 15:01:07 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/ Frame CDF7	37 KB 15 KB	57ms 27ms	Script text/javascript	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software cafe / Resource Hash 2e8548e063ae8b8f6225ac344af4bb535397ebd3003665e27e8d4b2716770db9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14378 x-xss-protection 0 server cafe etag 684346926396516684 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Wed, 01 Dec 2021 13:01:46 GMT
GET H2	200	ytc.js Show response s.yimg.com/wi/ Frame CDF7	15 KB 6 KB	74ms 22ms	Script application/javascript	2a00:1288:80:800::7001 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wi/ytc.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 759d6f0c1292d86d24d7abe7ad9a2cd1d86df0041260f98186ccfa26c7daab62 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers ats-carp-promotion 1 date Wed, 01 Dec 2021 12:32:57 GMT content-encoding gzip x-content-type-options nosniff age 1730 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding content-length 5652 x-amz-id-2 DZGJlP/uN5zxaGahE1vf02Gc7PaxjwaTOBdcuNiQaayHe6Bl28XfcKnTGsutAiN1XiuEdbDKNGU= referrer-policy no-referrer-when-downgrade x-amz-expiration expiry-date="Sat, 10 Dec 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle" last-modified Thu, 04 Nov 2021 15:26:13 GMT server ATS etag "146f99405588b7446958a732612c901d-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 x-amz-request-id WES89MS6FABT9SF2 x-xss-protection 1; mode=block cache-control public,max-age=3600 x-amz-version-id pCmRUUjnQE9zqMEfVdrNnyYpaPAyW8Do accept-ranges bytes content-type application/javascript
GET H2	200	bat.js Show response bat.bing.com/ Frame CDF7	36 KB 11 KB	58ms 31ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 9223e6eb171099c0a8d26458e61a9219ebacc0107853337cac5a69dd821d819b Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip last-modified Sat, 13 Nov 2021 03:55:41 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: C2FE5AFF9981412488CCBB8AA1D6391C Ref B: FRAEDGE1314 Ref C: 2021-12-01T13:01:46Z etag "80dc6f5342d8d71:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 10442
GET H2	200	ld.js Show response static.criteo.net/js/ld/ Frame CDF7	41 KB 14 KB	74ms 26ms	Script text/javascript	2a02:2638:1::3 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://static.criteo.net/js/ld/ld.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software nginx / Resource Hash a1fddf4d5fec5f577b977db5c16c6582c1768324262382650fce903a37d73ab6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip last-modified Tue, 05 Oct 2021 08:29:00 GMT server nginx etag W/"615c0ccc-a373" content-type text/javascript access-control-allow-origin * cache-control max-age=86400, public cross-origin-resource-policy cross-origin timing-allow-origin * expires Thu, 02 Dec 2021 13:01:46 GMT
GET H2	200	universal-script Show response 175592.tracking.hyros.com/v1/lst/ Frame CDF7	17 KB 17 KB	435ms 200ms	Script text/plain	52.70.96.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-96-75.compute-1.amazonaws.com Software Jetty(9.4.41.v20210516) / Resource Hash b452fccc57d10811f082f096bd027f684db299530d51ce06438b6abe8da7d976 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT access-control-allow-credentials true server Jetty(9.4.41.v20210516) access-control-expose-headers Session-ID access-control-max-age 86400 access-control-allow-methods GET, PUT, POST, OPTIONS, DELETE content-type text/plain;charset=utf-8
GET H2	200	print8.css fs22.formsite.com/include/form/ Frame B5ED	375 B 767 B	104ms 101ms	Stylesheet text/css	34.234.21.110 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fs22.formsite.com/include/form/print8.css?9432765894338 Requested by Host: fs22.formsite.com URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.234.21.110 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-234-21-110.compute-1.amazonaws.com Software Apache / Resource Hash fe096c1a1b3636490559c3e3d5c51dedcfed669ef95394071a765d922937dc6d Request headers Accept-Language de-DE,de;q=0.9 Referer https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip last-modified Mon, 01 Apr 2019 18:07:07 GMT server Apache etag "177-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 200 expires Wed, 08 Dec 2021 13:01:46 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/ Frame D7C8	163 KB 60 KB	57ms 51ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-VQKC5VQTH1&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8bcac8375d9f2e972f2641c1101f779c2b3ddf3eb3be1e8ca4abaddccdfa0928 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 61792 x-xss-protection 0 expires Wed, 01 Dec 2021 13:01:46 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/ Frame D7C8	49 KB 20 KB	38ms 16ms	Script text/javascript	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 02 Nov 2021 17:39:06 GMT server Golfe2 age 39 date Wed, 01 Dec 2021 13:01:07 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Wed, 01 Dec 2021 15:01:07 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/ Frame D7C8	37 KB 14 KB	81ms 59ms	Script text/javascript	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software cafe / Resource Hash 2e8548e063ae8b8f6225ac344af4bb535397ebd3003665e27e8d4b2716770db9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14378 x-xss-protection 0 server cafe etag 684346926396516684 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Wed, 01 Dec 2021 13:01:46 GMT
GET H2	200	ytc.js Show response s.yimg.com/wi/ Frame D7C8	15 KB 6 KB	80ms 34ms	Script application/javascript	2a00:1288:80:800::7001 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wi/ytc.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 759d6f0c1292d86d24d7abe7ad9a2cd1d86df0041260f98186ccfa26c7daab62 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers ats-carp-promotion 1 date Wed, 01 Dec 2021 12:32:57 GMT content-encoding gzip x-content-type-options nosniff age 1730 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding content-length 5652 x-amz-id-2 DZGJlP/uN5zxaGahE1vf02Gc7PaxjwaTOBdcuNiQaayHe6Bl28XfcKnTGsutAiN1XiuEdbDKNGU= referrer-policy no-referrer-when-downgrade x-amz-expiration expiry-date="Sat, 10 Dec 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle" last-modified Thu, 04 Nov 2021 15:26:13 GMT server ATS etag "146f99405588b7446958a732612c901d-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 x-amz-request-id WES89MS6FABT9SF2 x-xss-protection 1; mode=block cache-control public,max-age=3600 x-amz-version-id pCmRUUjnQE9zqMEfVdrNnyYpaPAyW8Do accept-ranges bytes content-type application/javascript
GET H2	200	bat.js Show response bat.bing.com/ Frame D7C8	36 KB 10 KB	503ms 481ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 9223e6eb171099c0a8d26458e61a9219ebacc0107853337cac5a69dd821d819b Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:45 GMT content-encoding gzip last-modified Sat, 13 Nov 2021 03:55:41 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 3E43161F5A624C1E821A550CBC43DC09 Ref B: FRAEDGE1314 Ref C: 2021-12-01T13:01:46Z etag "80dc6f5342d8d71:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 10442
GET H2	200	ld.js Show response static.criteo.net/js/ld/ Frame D7C8	41 KB 14 KB	68ms 26ms	Script text/javascript	2a02:2638:1::3 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://static.criteo.net/js/ld/ld.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software nginx / Resource Hash a1fddf4d5fec5f577b977db5c16c6582c1768324262382650fce903a37d73ab6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip last-modified Tue, 05 Oct 2021 08:29:00 GMT server nginx etag W/"615c0ccc-a373" content-type text/javascript access-control-allow-origin * cache-control max-age=86400, public cross-origin-resource-policy cross-origin timing-allow-origin * expires Thu, 02 Dec 2021 13:01:46 GMT
GET H2	200	universal-script Show response 175592.tracking.hyros.com/v1/lst/ Frame D7C8	17 KB 17 KB	441ms 212ms	Script text/plain	52.70.96.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-96-75.compute-1.amazonaws.com Software Jetty(9.4.41.v20210516) / Resource Hash b452fccc57d10811f082f096bd027f684db299530d51ce06438b6abe8da7d976 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT access-control-allow-credentials true server Jetty(9.4.41.v20210516) access-control-expose-headers Session-ID access-control-max-age 86400 access-control-allow-methods GET, PUT, POST, OPTIONS, DELETE content-type text/plain;charset=utf-8
GET H2	204	17533112.js Show response bat.bing.com/p/action/ Frame CDF7	0 93 B	32ms 32ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/17533112.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers access-control-allow-origin * date Wed, 01 Dec 2021 13:01:45 GMT cache-control private,max-age=1800 accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 7D5516DC98644F50972B9B92107B563D Ref B: FRAEDGE1314 Ref C: 2021-12-01T13:01:46Z x-cache CONFIG_NOCACHE
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/ Frame CDF7	2 KB 2 KB	58ms 23ms	Script text/javascript	2a00:1450:4001:82f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/?random=1638363706111&cv=9&fst=1638363706111&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&ref=https%3A%2F%2Ftaxcreditrefund.com%2F&tiba=GrooveFunnels&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 5e70f75bdfb026dd9d77bb6d7f882ab9e0caa9536e62ed0c09ecb448c63cc33a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1049 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	10139345.json Show response s.yimg.com/wi/config/ Frame CDF7	2 B 452 B	82ms 24ms	XHR application/json	2a00:1288:80:800::7001 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wi/config/10139345.json Requested by Host: s.yimg.com URL: https://s.yimg.com/wi/ytc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 12:25:17 GMT x-content-type-options nosniff age 2189 vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method x-amz-request-id DAF0VP7YDKCGZ289 x-amz-id-2 NVqU5BWHf84E6VCmwfDXPS51+C3VCWNevCMRH+m65P+Hi5WSHbioR8sv5UKimthJHBrpbMVO3nM= referrer-policy no-referrer-when-downgrade server ATS expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 access-control-allow-methods GET content-type application/json access-control-allow-origin * x-xss-protection 1; mode=block cache-control public,max-age=3600 content-length 2
GET H2	200	10139345.json Show response s.yimg.com/wi/config/ Frame D7C8	2 B 37 B	139ms 82ms	XHR application/json	2a00:1288:80:800::7001 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wi/config/10139345.json Requested by Host: s.yimg.com URL: https://s.yimg.com/wi/ytc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 12:25:17 GMT x-content-type-options nosniff age 2189 vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method x-amz-request-id DAF0VP7YDKCGZ289 x-amz-id-2 NVqU5BWHf84E6VCmwfDXPS51+C3VCWNevCMRH+m65P+Hi5WSHbioR8sv5UKimthJHBrpbMVO3nM= referrer-policy no-referrer-when-downgrade server ATS expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 access-control-allow-methods GET content-type application/json access-control-allow-origin * x-xss-protection 1; mode=block cache-control public,max-age=3600 content-length 2
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/ Frame D7C8	2 KB 1 KB	24ms 24ms	Script text/javascript	2a00:1450:4001:82f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/?random=1638363706153&cv=9&fst=1638363706153&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Ftaxcreditrefund.com%2F&tiba=GrooveFunnels&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash d8eb57951d2aae239d9cb780953a9b76934180e473f5ecc68c536ee18841b8dd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1046 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	syncframe Show response gum.criteo.com/ Frame FF3F	11 KB 5 KB	73ms 21ms	Document text/html	2a02:2638:1::13 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://gum.criteo.com/syncframe?topUrl=taxcreditrefund.com&origin=onetag Requested by Host: static.criteo.net URL: https://static.criteo.net/js/ld/ld.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software / Resource Hash 9413ac70f0dfa293eae8e934799be6a1cde8cd96db876ce9bd127c41630847ee Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ Response headers cache-control private, max-age=3600 content-type text/html; charset=utf-8 content-encoding gzip vary Accept-Encoding strict-transport-security max-age=31536000 cross-origin-resource-policy cross-origin cross-origin-embedder-policy require-corp server-processing-duration-in-ticks 1882 date Wed, 01 Dec 2021 13:01:46 GMT content-length 4683
GET H2	200	syncframe Show response gum.criteo.com/ Frame 67B7	11 KB 5 KB	73ms 22ms	Document text/html	2a02:2638:1::13 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://gum.criteo.com/syncframe?topUrl=taxcreditrefund.com&origin=onetag Requested by Host: static.criteo.net URL: https://static.criteo.net/js/ld/ld.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software / Resource Hash 9413ac70f0dfa293eae8e934799be6a1cde8cd96db876ce9bd127c41630847ee Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ Response headers cache-control private, max-age=3600 content-type text/html; charset=utf-8 content-encoding gzip vary Accept-Encoding strict-transport-security max-age=31536000 cross-origin-resource-policy cross-origin cross-origin-embedder-policy require-corp server-processing-duration-in-ticks 2140 date Wed, 01 Dec 2021 13:01:45 GMT content-length 4683
GET H2	200	/ www.google.com/pagead/1p-user-list/646915355/ Frame CDF7	42 B 548 B	50ms 17ms	Image image/gif	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/646915355/?random=1638363706111&cv=9&fst=1638363600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&ref=https%3A%2F%2Ftaxcreditrefund.com%2F&tiba=GrooveFunnels&async=1&fmt=3&is_vtc=1&random=1881487855&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/646915355/ Frame CDF7	42 B 108 B	54ms 22ms	Image image/gif	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/646915355/?random=1638363706111&cv=9&fst=1638363600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&ref=https%3A%2F%2Ftaxcreditrefund.com%2F&tiba=GrooveFunnels&async=1&fmt=3&is_vtc=1&random=1881487855&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/646915355/ Frame D7C8	42 B 108 B	49ms 19ms	Image image/gif	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/646915355/?random=1638363706153&cv=9&fst=1638363600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Ftaxcreditrefund.com%2F&tiba=GrooveFunnels&async=1&fmt=3&is_vtc=1&random=2862178162&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/646915355/ Frame D7C8	42 B 548 B	49ms 20ms	Image image/gif	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/646915355/?random=1638363706153&cv=9&fst=1638363600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Ftaxcreditrefund.com%2F&tiba=GrooveFunnels&async=1&fmt=3&is_vtc=1&random=2862178162&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	css2 fonts.googleapis.com/ Frame CDF7	713 KB 136 KB	45ms 45ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/css/chunk-vendors.ebe8269c.css Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash fbf6766913a0776c720b285251249ef16811cf787821be50e080063ea8987ff9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 01 Dec 2021 13:01:46 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 01 Dec 2021 13:01:46 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 01 Dec 2021 13:01:46 GMT
GET H3	200	css2 fonts.googleapis.com/ Frame D7C8	713 KB 136 KB	51ms 51ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/css/chunk-vendors.ebe8269c.css Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash fbf6766913a0776c720b285251249ef16811cf787821be50e080063ea8987ff9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 01 Dec 2021 13:01:46 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 01 Dec 2021 13:01:46 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 01 Dec 2021 13:01:46 GMT
GET H2	200	sp.pl sp.analytics.yahoo.com/ Frame CDF7	43 B 327 B	118ms 36ms	Image image/gif	212.82.100.181 YAHOO-IRD
General Check archive.org Show headers Download Go to Show image Full URL https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Wed%2C%2001%20Dec%202021%2013%3A01%3A46%20GMT&n=0&b=GrooveFunnels&.yp=10139345&f=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&e=https%3A%2F%2Ftaxcreditrefund.com%2F&enc=UTF-8&yv=1.10.2&isIframe=1&tagmgr=gtm Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB), Reverse DNS spdc.pbp.vip.ir2.yahoo.com Software ATS / Resource Hash 0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39 Security Headers Name Value Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT x-content-type-options nosniff server ATS age 0 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-frame-options DENY content-type image/gif cache-control no-cache, private, must-revalidate content-security-policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic strict-transport-security max-age=31536000 accept-ranges bytes content-length 43 referrer-policy strict-origin-when-cross-origin expires Wed, 01 Dec 2021 13:01:46 GMT
GET H2	200	sp.pl sp.analytics.yahoo.com/ Frame D7C8	43 B 716 B	77ms 34ms	Image image/gif	212.82.100.181 YAHOO-IRD
General Check archive.org Show headers Download Go to Show image Full URL https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Wed%2C%2001%20Dec%202021%2013%3A01%3A46%20GMT&n=0&b=GrooveFunnels&.yp=10139345&f=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&e=https%3A%2F%2Ftaxcreditrefund.com%2F&enc=UTF-8&yv=1.10.2&isIframe=1&tagmgr=gtm Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB), Reverse DNS spdc.pbp.vip.ir2.yahoo.com Software ATS / Resource Hash 0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39 Security Headers Name Value Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT x-content-type-options nosniff server ATS age 0 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-frame-options DENY content-type image/gif cache-control no-cache, private, must-revalidate content-security-policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic strict-transport-security max-age=31536000 accept-ranges bytes content-length 43 referrer-policy strict-origin-when-cross-origin expires Wed, 01 Dec 2021 13:01:46 GMT
GET H2	200	sid Show response mug.criteo.com/ Frame FF3F Redirect Chain https://gum.criteo.com/sid/json?origin=onetag&domain=app.groove.cm&sn=ChromeSyncframe&so=0&topUrl=taxcreditrefund.com&lsw=1 https://mug.criteo.com/sid?cpp=SJGOP3xwamJ4U3VzM0FUemRUTWVGbThkYnRNMkd5RGRtVzl6SzNKS04yT2tGV2p2OURUZ2V6RkpZTGF4YWtBcnJBUTRwblg1ZHpLM0pURnBnWXBoRU1jN2FsYUgxYUVaVVNJOWRHVFIyS2greE5tcGdkTWRtb1Rydmcyan...	452 B 643 B	64ms 21ms	Fetch application/json	178.250.0.157 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://mug.criteo.com/sid?cpp=SJGOP3xwamJ4U3VzM0FUemRUTWVGbThkYnRNMkd5RGRtVzl6SzNKS04yT2tGV2p2OURUZ2V6RkpZTGF4YWtBcnJBUTRwblg1ZHpLM0pURnBnWXBoRU1jN2FsYUgxYUVaVVNJOWRHVFIyS2greE5tcGdkTWRtb1RydmcyanVxUjBIOE02ZUR2MXRHOHRBWHhQbnRudlNVYmJzY1kzS1NkT1VSRTRWTE1RWFUwL0Q2NzBub0t2WWtDQTdtamNBU0U0WDZSUFU0MHgrdmpPbkM0UVNWbFRHN284dU9TMXBPZytaK0c2dnlFaXJCcWE3MFJSUEZYdlFhbzRzVmZBczY2K0VHdkxDUVA0WWwwQ081WEdKUHJXc1BaWDFxZnJTNVpYanJObWJVcm9zUklJeWVOTT18&cppv=2 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Server 178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software / Resource Hash a2fc9e9a4e7b7a32163fff19f8bdc5334fe1b532d0a674384a20a0247b69c838 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://gum.criteo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000 content-encoding gzip date Wed, 01 Dec 2021 13:01:45 GMT vary Accept-Encoding access-control-allow-methods GET content-type application/json; charset=utf-8 access-control-allow-origin https://gum.criteo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true server-processing-duration-in-ticks 4037 expires 0 Redirect headers pragma no-cache strict-transport-security max-age=31536000 date Wed, 01 Dec 2021 13:01:46 GMT content-type text/html; charset=utf-8 location https://mug.criteo.com/sid?cpp=SJGOP3xwamJ4U3VzM0FUemRUTWVGbThkYnRNMkd5RGRtVzl6SzNKS04yT2tGV2p2OURUZ2V6RkpZTGF4YWtBcnJBUTRwblg1ZHpLM0pURnBnWXBoRU1jN2FsYUgxYUVaVVNJOWRHVFIyS2greE5tcGdkTWRtb1RydmcyanVxUjBIOE02ZUR2MXRHOHRBWHhQbnRudlNVYmJzY1kzS1NkT1VSRTRWTE1RWFUwL0Q2NzBub0t2WWtDQTdtamNBU0U0WDZSUFU0MHgrdmpPbkM0UVNWbFRHN284dU9TMXBPZytaK0c2dnlFaXJCcWE3MFJSUEZYdlFhbzRzVmZBczY2K0VHdkxDUVA0WWwwQ081WEdKUHJXc1BaWDFxZnJTNVpYanJObWJVcm9zUklJeWVOTT18&cppv=2 cache-control no-cache, no-store, must-revalidate server-processing-duration-in-ticks 1918 content-length 567 expires 0
GET H2	200	sid Show response mug.criteo.com/ Frame 67B7 Redirect Chain https://gum.criteo.com/sid/json?origin=onetag&domain=app.groove.cm&sn=ChromeSyncframe&so=0&topUrl=taxcreditrefund.com&lsw=1 https://mug.criteo.com/sid?cpp=X71NkHxrSlYwd0NNcmE5TkpKRkc2bndBR3d3NzB0TFVFUEJOYWZ4STAzSk5ucjU0UmRxUFpBY0tzZlJZYU5vNnBPYWpGN0o3VHgwTnFjdnppT0NZYzhHbEFpMlZZWHZkWlE4Y2FoeGRPTnVta2EwY2tscVNLa29UN3JFck...	452 B 644 B	65ms 23ms	Fetch application/json	178.250.0.157 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://mug.criteo.com/sid?cpp=X71NkHxrSlYwd0NNcmE5TkpKRkc2bndBR3d3NzB0TFVFUEJOYWZ4STAzSk5ucjU0UmRxUFpBY0tzZlJZYU5vNnBPYWpGN0o3VHgwTnFjdnppT0NZYzhHbEFpMlZZWHZkWlE4Y2FoeGRPTnVta2EwY2tscVNLa29UN3JFckdaNFZtU05MNm1FNDRIR3RCVlJvTlRFNjZTTlZLL1hUZ3Z3bVMvZHRnNFNLMFB5TnlvaEV3VFYyNFBBdEtsS2d3ZitkNE42RlVadDZ4bUJvMG1pbGdaZlhWWUdSdWVtano3UU13NUVqSEhrc0lRZmlFZ01MMFZnMjl3TnM1bkRiRnh4T3g0R2Z3RlR1UjgwYmwyNmxrMGtRdGw5Si9hQ251N2VXeUlJYjVZR29YeS9OMTU4cz18&cppv=2 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Server 178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software / Resource Hash 93ec67de7f7e42fc80329dd7f284f78d0b67f119d8bd4a542194cf77cc4e44aa Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://gum.criteo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000 content-encoding gzip date Wed, 01 Dec 2021 13:01:45 GMT vary Accept-Encoding access-control-allow-methods GET content-type application/json; charset=utf-8 access-control-allow-origin https://gum.criteo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true server-processing-duration-in-ticks 4613 expires 0 Redirect headers pragma no-cache strict-transport-security max-age=31536000 date Wed, 01 Dec 2021 13:01:45 GMT content-type text/html; charset=utf-8 location https://mug.criteo.com/sid?cpp=X71NkHxrSlYwd0NNcmE5TkpKRkc2bndBR3d3NzB0TFVFUEJOYWZ4STAzSk5ucjU0UmRxUFpBY0tzZlJZYU5vNnBPYWpGN0o3VHgwTnFjdnppT0NZYzhHbEFpMlZZWHZkWlE4Y2FoeGRPTnVta2EwY2tscVNLa29UN3JFckdaNFZtU05MNm1FNDRIR3RCVlJvTlRFNjZTTlZLL1hUZ3Z3bVMvZHRnNFNLMFB5TnlvaEV3VFYyNFBBdEtsS2d3ZitkNE42RlVadDZ4bUJvMG1pbGdaZlhWWUdSdWVtano3UU13NUVqSEhrc0lRZmlFZ01MMFZnMjl3TnM1bkRiRnh4T3g0R2Z3RlR1UjgwYmwyNmxrMGtRdGw5Si9hQ251N2VXeUlJYjVZR29YeS9OMTU4cz18&cppv=2 cache-control no-cache, no-store, must-revalidate server-processing-duration-in-ticks 2539 content-length 567 expires 0
OPTIONS H/1.1	204 No Content	ping api.loopedin.io/v1/users/ Frame	0 0	159ms 32ms	Preflight	54.73.26.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.loopedin.io/v1/users/ping Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.73.26.109 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-73-26-109.eu-west-1.compute.amazonaws.com Software Cowboy / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://app.groove.cm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers Server Cowboy Connection keep-alive Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests X-Dns-Prefetch-Control off Expect-Ct max-age=0 X-Frame-Options SAMEORIGIN Strict-Transport-Security max-age=15552000; includeSubDomains X-Download-Options noopen X-Content-Type-Options nosniff X-Permitted-Cross-Domain-Policies none Referrer-Policy no-referrer X-Xss-Protection 0 Access-Control-Allow-Origin * Access-Control-Allow-Methods GET,POST Access-Control-Allow-Headers Content-Type,Authorization Content-Length 0 Date Wed, 01 Dec 2021 13:01:47 GMT Via 1.1 vegur
GET H2	200	iframe_api Show response www.youtube.com/ Frame D7C8	980 B 1 KB	54ms 29ms	Script text/javascript	2a00:1450:4001:831::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/iframe_api Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/js/chunk-vendors.b283e084.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 31d6060a5464abf6ac8703dd385b044c553e59ae032ee50a0ea0bbae193238e7 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:46 GMT content-encoding br x-content-type-options nosniff p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info." cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 server ESF x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 report-to {"group":"AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"}]} content-type text/javascript; charset=utf-8 cache-control private, max-age=0 permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=* cross-origin-opener-policy-report-only same-origin; report-to="AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA" expires Wed, 01 Dec 2021 13:01:46 GMT
GET H/1.1	200 OK	matomo.js Show response matomo.groovetech.io/ Frame D7C8	100 KB 32 KB	121ms 120ms	Script application/javascript	51.161.92.183 OVH
General Check archive.org Show headers Download Go to Full URL https://matomo.groovetech.io/matomo.js Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/js/chunk-vendors.b283e084.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.92.183 Laval, Canada, ASN16276 (OVH, FR), Reverse DNS ip183.ip-51-161-92.net Software nginx/1.19.2 / Resource Hash 68fed142b211b51c4d2e9b610dd4d09bc4812739b5beaa63535d88e38e90a946 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-encoding gzip last-modified Tue, 21 Jul 2020 21:11:02 GMT server nginx/1.19.2 etag "19167-5aafa0f820d0f-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 32444
GET BLOB	200 OK	4e2b1946-532f-46c2-a303-15343323cd68 Show response https://app.groove.cm/ Frame D7C8	98 B 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://app.groove.cm/4e2b1946-532f-46c2-a303-15343323cd68 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/js/chunk-vendors.b283e084.js Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 3a89b023d4c08946557bed6b8bad7ad94e45136cc7624f22179fdddf89d1e41d Request headers Referer Origin https://app.groove.cm Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 98 Content-Type text/javascript
POST H/1.1	200 OK	ping Show response api.loopedin.io/v1/users/ Frame D7C8	3 B 1 KB	66ms 32ms	Fetch application/json	54.73.26.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.loopedin.io/v1/users/ping Requested by Host: cdn.productstash.io URL: https://cdn.productstash.io/js/widget.min.js?v=0.8 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.73.26.109 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-73-26-109.eu-west-1.compute.amazonaws.com Software Cowboy / Resource Hash 27badc983df1780b60c2b3fa9d3a19a00e46aac798451f0febdca52920faaddf Security Headers Name Value Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept application/json, text/plain, */* Referer https://app.groove.cm/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type application/json Response headers Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Via 1.1 vegur X-Content-Type-Options nosniff X-Permitted-Cross-Domain-Policies none X-Dns-Prefetch-Control off Date Wed, 01 Dec 2021 13:01:47 GMT Connection keep-alive Vary Accept-Encoding Content-Length 3 X-Xss-Protection 0 Referrer-Policy no-referrer Server Cowboy X-Frame-Options SAMEORIGIN Etag W/"3-n5rwKVhboBTgfNORDKl2z1YWBhY" Expect-Ct max-age=0 X-Ratelimit-Remaining 47 Strict-Transport-Security max-age=15552000; includeSubDomains X-Download-Options noopen Access-Control-Allow-Origin * Cache-Control no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0 X-Ratelimit-Reset 1638363719 X-Ratelimit-Limit 50 Content-Type application/json; charset=utf-8
GET H/1.1	200 OK	app-config Show response api.loopedin.io/ Frame D7C8	525 B 2 KB	161ms 33ms	XHR application/json	54.73.26.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.loopedin.io/app-config?product_id=f634edf5-70e7-429d-8c94-c26dfaeaee26&timestamp=0&public=true&user=public&domain=app.groove.cm Requested by Host: cdn.productstash.io URL: https://cdn.productstash.io/js/widget.min.js?v=0.8 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.73.26.109 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-73-26-109.eu-west-1.compute.amazonaws.com Software Cowboy / Resource Hash 838d943b0017d512c3dcbc9d57f51a6a019e20cc0e25dad7523eb607de0f13f3 Security Headers Name Value Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Via 1.1 vegur X-Content-Type-Options nosniff X-Permitted-Cross-Domain-Policies none X-Dns-Prefetch-Control off Date Wed, 01 Dec 2021 13:01:47 GMT Connection keep-alive Strict-Transport-Security max-age=15552000; includeSubDomains Vary Accept-Encoding Content-Length 525 X-Xss-Protection 0 Referrer-Policy no-referrer Server Cowboy Etag W/"20d-5ErZAot5R6rtmThWqb28ocxnBsQ" Expect-Ct max-age=0 X-Ratelimit-Remaining 49 Access-Control-Allow-Methods GET X-Download-Options noopen Access-Control-Allow-Origin * Cache-Control no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0 X-Ratelimit-Reset 1638363719 X-Ratelimit-Limit 50 Content-Type application/json; charset=utf-8
GET H2	200	notification.png cdn.productstash.io/images/ Frame D7C8	1 KB 2 KB	9ms 9ms	Image image/png	89.187.169.47 CDN77 ^_^
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.productstash.io/images/notification.png Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS unn-89-187-169-47.cdn77.com Software BunnyCDN-DE1-756 / Resource Hash 87608a8dea58460e4b38f3445a737f999eb6a62dee361be55e06625d505c4e5c Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT via 1.1 vegur x-content-type-options nosniff cdn-edgestorageid 756 x-dns-prefetch-control off cdn-cachedat 08/11/2021 08:30:54 cdn-pullzone 173232 content-length 1156 x-xss-protection 1; mode=block server BunnyCDN-DE1-756 last-modified Mon, 09 Aug 2021 16:46:09 GMT cdn-proxyver 1.0 cdn-requestpullcode 200 x-frame-options SAMEORIGIN x-download-options noopen strict-transport-security max-age=15552000; includeSubDomains content-type image/png cdn-cache HIT cdn-uid 48a72dd7-1732-4103-a906-fc257bffa1c1 cache-control public, max-age=31536000 cdn-requestid 8818cd3b7320107f9d150b1e964bb480 accept-ranges bytes cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
GET H2	200	gusid Show response 175592.tracking.hyros.com/v1/lst/ Frame CDF7	0 524 B	112ms 111ms	XHR text/plain	52.70.96.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://175592.tracking.hyros.com/v1/lst/gusid? Requested by Host: 175592.tracking.hyros.com URL: https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-96-75.compute-1.amazonaws.com Software Jetty(9.4.41.v20210516) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Referer https://app.groove.cm/ Accept-Language de-DE,de;q=0.9 Product-ID 175592 Response headers date Wed, 01 Dec 2021 13:01:47 GMT session-id HB-ET_30dcbf8cfddfbd34e158c366595d9cd81b18be77273ce7945ffc03ff1e7234cd etag HB-ET_30dcbf8cfddfbd34e158c366595d9cd81b18be77273ce7945ffc03ff1e7234cd access-control-max-age 86400 access-control-allow-methods GET, PUT, POST, OPTIONS, DELETE access-control-allow-origin https://app.groove.cm access-control-expose-headers Session-ID access-control-allow-credentials true content-length 0 server Jetty(9.4.41.v20210516)
OPTIONS H2	200	gusid 175592.tracking.hyros.com/v1/lst/ Frame	0 0	302ms 102ms	Preflight application/vnd.sun.wadl+xml	52.70.96.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://175592.tracking.hyros.com/v1/lst/gusid? Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-96-75.compute-1.amazonaws.com Software Jetty(9.4.41.v20210516) / Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers product-id Origin https://app.groove.cm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-type application/vnd.sun.wadl+xml;charset=utf-8 content-length 1557 access-control-allow-origin https://app.groove.cm access-control-allow-methods GET, PUT, POST, OPTIONS, DELETE access-control-allow-headers product-id access-control-expose-headers Session-ID access-control-max-age 86400 access-control-allow-credentials true allow HEAD,GET,OPTIONS last-modified Wed, 01 Dec 2021 13:01:47 UTC server Jetty(9.4.41.v20210516)
GET H2	200	gusid Show response 175592.tracking.hyros.com/v1/lst/ Frame D7C8	0 524 B	114ms 113ms	XHR text/plain	52.70.96.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://175592.tracking.hyros.com/v1/lst/gusid? Requested by Host: 175592.tracking.hyros.com URL: https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-96-75.compute-1.amazonaws.com Software Jetty(9.4.41.v20210516) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Referer https://app.groove.cm/ Accept-Language de-DE,de;q=0.9 Product-ID 175592 Response headers date Wed, 01 Dec 2021 13:01:47 GMT session-id HB-ET_30dcbf8cfddfbd34e158c366595d9cd81b18be77273ce7945ffc03ff1e7234cd etag HB-ET_30dcbf8cfddfbd34e158c366595d9cd81b18be77273ce7945ffc03ff1e7234cd access-control-max-age 86400 access-control-allow-methods GET, PUT, POST, OPTIONS, DELETE access-control-allow-origin https://app.groove.cm access-control-expose-headers Session-ID access-control-allow-credentials true content-length 0 server Jetty(9.4.41.v20210516)
OPTIONS H2	200	gusid 175592.tracking.hyros.com/v1/lst/ Frame	0 0	300ms 101ms	Preflight application/vnd.sun.wadl+xml	52.70.96.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://175592.tracking.hyros.com/v1/lst/gusid? Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-96-75.compute-1.amazonaws.com Software Jetty(9.4.41.v20210516) / Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers product-id Origin https://app.groove.cm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-type application/vnd.sun.wadl+xml;charset=utf-8 content-length 1557 access-control-allow-origin https://app.groove.cm access-control-allow-methods GET, PUT, POST, OPTIONS, DELETE access-control-allow-headers product-id access-control-expose-headers Session-ID access-control-max-age 86400 access-control-allow-credentials true allow HEAD,GET,OPTIONS last-modified Wed, 01 Dec 2021 13:01:47 UTC server Jetty(9.4.41.v20210516)
GET H2	200	config.js Show response app.groove.cm/config/ Frame D7C8	324 B 512 B	28ms 28ms	Script application/javascript	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/config/config.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5d7560c8b33f798d429fa0e84d88e11aff034ec7ab72a758d3ed52fc9b285a18 Request headers Referer Origin https://app.groove.cm Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-encoding br cf-cache-status HIT last-modified Tue, 30 Nov 2021 13:17:52 GMT server cloudflare age 3030 etag W/"61a62480-144" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9cEDoJ2sICe4Qurmu9%2FprAhpL4H0UD7p1IwtIT2GYxdIMddwumUlF5Vlj92qyvjDlTftRHAQ9R7kEvNCUiDfxwMcj4OArVYp6RCwTYWbfKDPzFhqJG%2BgHzC9IWP1ON28HTOemIchBN3cS8v"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c819129503747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	204	17533112.js Show response bat.bing.com/p/action/ Frame D7C8	0 93 B	181ms 180ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/17533112.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers access-control-allow-origin * date Wed, 01 Dec 2021 13:01:46 GMT cache-control private,max-age=1800 accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 3A4368548DC9431CB45DF94610246E27 Ref B: FRAEDGE1314 Ref C: 2021-12-01T13:01:47Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/ Frame D7C8	0 173 B	31ms 31ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=17533112&Ver=2&mid=5fb3844e-66c9-4063-8533-84ee4c9288d3&sid=d73923e052a611ec8c5d836bf920fc92&vid=d739504052a611ecb8fe7196c458dfed&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=GrooveFunnels&p=https%3A%2F%2Ftaxcreditrefund.com%2F&r=&lt=1581&evt=pageLoad&ifm=1&msclkid=N&sv=1&rn=856104 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: D49C6A5DB3624CE2A42EE9DE24C703ED Ref B: FRAEDGE1314 Ref C: 2021-12-01T13:01:47Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	www-widgetapi.js Show response www.youtube.com/s/player/3ce4f9b8/www-widgetapi.vflset/ Frame D7C8	147 KB 48 KB	23ms 7ms	Script text/javascript	2a00:1450:4001:831::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/3ce4f9b8/www-widgetapi.vflset/www-widgetapi.js Requested by Host: www.youtube.com URL: https://www.youtube.com/iframe_api Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2a499c62bd4a1555dc2be24483a7de1cb92605c2dee544ce0435a7add53b52c4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 12:16:34 GMT content-encoding br x-content-type-options nosniff age 2713 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 49040 x-xss-protection 0 last-modified Mon, 29 Nov 2021 01:17:55 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 01 Dec 2022 12:16:34 GMT
GET H2	200	event Show response widget.us.criteo.com/ Frame D7C8 Redirect Chain https://sslwidget.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=rRS2rl9hT1VCTUdJR3BzV0V0Q... https://widget.us.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=rRS2rl9hT1VCTUdJR3BzV0V0Q...	7 KB 8 KB	366ms 174ms	Script application/x-javascript	74.119.119.150 AS-CRITEO
General Check archive.org Show headers Download Go to Full URL https://widget.us.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=rRS2rl9hT1VCTUdJR3BzV0V0QkkwejVzajF5V0dQdnhaTjcwZEJ3UTVIRnl4UzZCWXVqNDZFZzJQJTJCWksxSFZ3cFVWQVk5QjdNOXF0YlI1Uk5JS0NaMVY2Ylgxc0RXYktienpZcjVhM212WmlpJTJGRjdXREpWWjJoYndlUzZiUFpnNUVWaGs5VDYlMkY3bSUyRkhIU1E4OXlvdEszMjVYOTRna0pBdXJyMmpPNGZldThtQUpWbyUzRA&tld=app.groove.cm&dtycbr=65050 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Server 74.119.119.150 , United States, ASN19750 (AS-CRITEO, US), Reverse DNS Software Kestrel / Resource Hash c19de272d7b450ea86d5d19127942bd79b65aecc194f9a81f08a9bd316586a6a Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT content-type application/x-javascript server Kestrel p3p NON DSP COR CURa PSA PSD OUR BUS NAV STA cache-control no-cache cross-origin-resource-policy cross-origin server-processing-duration-in-ticks 13357411 timing-allow-origin * expires 0 Redirect headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT server Kestrel location https://widget.us.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=rRS2rl9hT1VCTUdJR3BzV0V0QkkwejVzajF5V0dQdnhaTjcwZEJ3UTVIRnl4UzZCWXVqNDZFZzJQJTJCWksxSFZ3cFVWQVk5QjdNOXF0YlI1Uk5JS0NaMVY2Ylgxc0RXYktienpZcjVhM212WmlpJTJGRjdXREpWWjJoYndlUzZiUFpnNUVWaGs5VDYlMkY3bSUyRkhIU1E4OXlvdEszMjVYOTRna0pBdXJyMmpPNGZldThtQUpWbyUzRA&tld=app.groove.cm&dtycbr=65050 cache-control no-cache cross-origin-resource-policy cross-origin server-processing-duration-in-ticks 2987978 timing-allow-origin * content-length 0 expires 0
GET H2	200	event Show response widget.us.criteo.com/ Frame CDF7 Redirect Chain https://sslwidget.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Ikhybl9PMGxYa0ZSZ0x0Z0FRd... https://widget.us.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Ikhybl9PMGxYa0ZSZ0x0Z0FRd...	7 KB 8 KB	298ms 107ms	Script application/x-javascript	74.119.119.150 AS-CRITEO
General Check archive.org Show headers Download Go to Full URL https://widget.us.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Ikhybl9PMGxYa0ZSZ0x0Z0FRd2pReWUlMkI2WW1qZ1pSZmtkaUZteUkzTW9qRzNXU0RWUUg3c0p4emNDUlN0enk3UjlsNmg5YjBhQ1NIZnk1OEVudHZpZk9uMnBaa3JUNWVhQ3BCQ1RoWHhUMXNlOCUyQmoxUUI4NWtKVEhNUG80ZHNxME9VRDVDVUNiTHF1V01wbGZGY1NoR1FnWFNYWmlrSE1HUkVtSUc5SlVTUE5tJTJGdmslM0Q&tld=app.groove.cm&dtycbr=17198 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Server 74.119.119.150 , United States, ASN19750 (AS-CRITEO, US), Reverse DNS Software Kestrel / Resource Hash d508ec1c21dc9b7502e2207662910ab2cc597e790f9b121e1047ab3d397e6427 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT content-type application/x-javascript server Kestrel p3p NON DSP COR CURa PSA PSD OUR BUS NAV STA cache-control no-cache cross-origin-resource-policy cross-origin server-processing-duration-in-ticks 14083718 timing-allow-origin * expires 0 Redirect headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT server Kestrel location https://widget.us.criteo.com/event?a=81296&v=5.8.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Ftaxcreditrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Ikhybl9PMGxYa0ZSZ0x0Z0FRd2pReWUlMkI2WW1qZ1pSZmtkaUZteUkzTW9qRzNXU0RWUUg3c0p4emNDUlN0enk3UjlsNmg5YjBhQ1NIZnk1OEVudHZpZk9uMnBaa3JUNWVhQ3BCQ1RoWHhUMXNlOCUyQmoxUUI4NWtKVEhNUG80ZHNxME9VRDVDVUNiTHF1V01wbGZGY1NoR1FnWFNYWmlrSE1HUkVtSUc5SlVTUE5tJTJGdmslM0Q&tld=app.groove.cm&dtycbr=17198 cache-control no-cache cross-origin-resource-policy cross-origin server-processing-duration-in-ticks 2391584 timing-allow-origin * content-length 0 expires 0
OPTIONS H/1.1	204 No Content	ping api.loopedin.io/v1/users/ Frame	0 0	56ms 32ms	Preflight	54.73.26.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.loopedin.io/v1/users/ping Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.73.26.109 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-73-26-109.eu-west-1.compute.amazonaws.com Software Cowboy / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://app.groove.cm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers Server Cowboy Connection keep-alive Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests X-Dns-Prefetch-Control off Expect-Ct max-age=0 X-Frame-Options SAMEORIGIN Strict-Transport-Security max-age=15552000; includeSubDomains X-Download-Options noopen X-Content-Type-Options nosniff X-Permitted-Cross-Domain-Policies none Referrer-Policy no-referrer X-Xss-Protection 0 Access-Control-Allow-Origin * Access-Control-Allow-Methods GET,POST Access-Control-Allow-Headers Content-Type,Authorization Content-Length 0 Date Wed, 01 Dec 2021 13:01:47 GMT Via 1.1 vegur
GET H3	200	iframe_api Show response www.youtube.com/ Frame CDF7	980 B 512 B	22ms 22ms	Script text/javascript	2a00:1450:4001:831::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/iframe_api Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/js/chunk-vendors.b283e084.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 31d6060a5464abf6ac8703dd385b044c553e59ae032ee50a0ea0bbae193238e7 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-encoding br x-content-type-options nosniff p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 server ESF x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 report-to {"group":"AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"}]} content-type text/javascript; charset=utf-8 cache-control private, max-age=0 permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=* cross-origin-opener-policy-report-only same-origin; report-to="AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA" expires Wed, 01 Dec 2021 13:01:47 GMT
GET H/1.1	200 OK	matomo.js Show response matomo.groovetech.io/ Frame CDF7	100 KB 32 KB	153ms 100ms	Script application/javascript	51.161.92.183 OVH
General Check archive.org Show headers Download Go to Full URL https://matomo.groovetech.io/matomo.js Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/js/chunk-vendors.b283e084.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.92.183 Laval, Canada, ASN16276 (OVH, FR), Reverse DNS ip183.ip-51-161-92.net Software nginx/1.19.2 / Resource Hash 68fed142b211b51c4d2e9b610dd4d09bc4812739b5beaa63535d88e38e90a946 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-encoding gzip last-modified Tue, 21 Jul 2020 21:11:02 GMT server nginx/1.19.2 etag "19167-5aafa0f820d0f-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 32444
GET BLOB	200 OK	8eec712b-72f2-46e8-8963-6aed73536572 Show response https://app.groove.cm/ Frame CDF7	98 B 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://app.groove.cm/8eec712b-72f2-46e8-8963-6aed73536572 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/js/chunk-vendors.b283e084.js Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 85a9702e439f5dba39c89aac13b010a42ab279a0948f37fecc75e9011703a182 Request headers Referer Origin https://app.groove.cm Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 98 Content-Type text/javascript
GET H2	200	notification.png cdn.productstash.io/images/ Frame CDF7	1 KB 2 KB	10ms 10ms	Image image/png	89.187.169.47 CDN77 ^_^
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.productstash.io/images/notification.png Requested by Host: cdn.productstash.io URL: https://cdn.productstash.io/js/widget.min.js?v=0.8 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS unn-89-187-169-47.cdn77.com Software BunnyCDN-DE1-756 / Resource Hash 87608a8dea58460e4b38f3445a737f999eb6a62dee361be55e06625d505c4e5c Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT via 1.1 vegur x-content-type-options nosniff cdn-edgestorageid 756 x-dns-prefetch-control off cdn-cachedat 08/11/2021 08:30:54 cdn-pullzone 173232 content-length 1156 x-xss-protection 1; mode=block server BunnyCDN-DE1-756 last-modified Mon, 09 Aug 2021 16:46:09 GMT cdn-proxyver 1.0 cdn-requestpullcode 200 x-frame-options SAMEORIGIN x-download-options noopen strict-transport-security max-age=15552000; includeSubDomains content-type image/png cdn-cache HIT cdn-uid 48a72dd7-1732-4103-a906-fc257bffa1c1 cache-control public, max-age=31536000 cdn-requestid d77a57196b7a7f497388c9f9399b86bb accept-ranges bytes cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
POST H/1.1	200 OK	ping Show response api.loopedin.io/v1/users/ Frame CDF7	3 B 1 KB	35ms 31ms	Fetch application/json	54.73.26.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.loopedin.io/v1/users/ping Requested by Host: cdn.productstash.io URL: https://cdn.productstash.io/js/widget.min.js?v=0.8 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.73.26.109 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-73-26-109.eu-west-1.compute.amazonaws.com Software Cowboy / Resource Hash 27badc983df1780b60c2b3fa9d3a19a00e46aac798451f0febdca52920faaddf Security Headers Name Value Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept application/json, text/plain, */* Referer https://app.groove.cm/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type application/json Response headers Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Via 1.1 vegur X-Content-Type-Options nosniff X-Permitted-Cross-Domain-Policies none X-Dns-Prefetch-Control off Date Wed, 01 Dec 2021 13:01:47 GMT Connection keep-alive Vary Accept-Encoding Content-Length 3 X-Xss-Protection 0 Referrer-Policy no-referrer Server Cowboy X-Frame-Options SAMEORIGIN Etag W/"3-n5rwKVhboBTgfNORDKl2z1YWBhY" Expect-Ct max-age=0 X-Ratelimit-Remaining 46 Strict-Transport-Security max-age=15552000; includeSubDomains X-Download-Options noopen Access-Control-Allow-Origin * Cache-Control no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0 X-Ratelimit-Reset 1638363719 X-Ratelimit-Limit 50 Content-Type application/json; charset=utf-8
GET H/1.1	200 OK	app-config Show response api.loopedin.io/ Frame CDF7	525 B 2 KB	63ms 38ms	XHR application/json	54.73.26.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.loopedin.io/app-config?product_id=f634edf5-70e7-429d-8c94-c26dfaeaee26&timestamp=0&public=true&user=public&domain=app.groove.cm Requested by Host: cdn.productstash.io URL: https://cdn.productstash.io/js/widget.min.js?v=0.8 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.73.26.109 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-73-26-109.eu-west-1.compute.amazonaws.com Software Cowboy / Resource Hash 838d943b0017d512c3dcbc9d57f51a6a019e20cc0e25dad7523eb607de0f13f3 Security Headers Name Value Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Via 1.1 vegur X-Content-Type-Options nosniff X-Permitted-Cross-Domain-Policies none X-Dns-Prefetch-Control off Date Wed, 01 Dec 2021 13:01:47 GMT Connection keep-alive Strict-Transport-Security max-age=15552000; includeSubDomains Vary Accept-Encoding Content-Length 525 X-Xss-Protection 0 Referrer-Policy no-referrer Server Cowboy Etag W/"20d-5ErZAot5R6rtmThWqb28ocxnBsQ" Expect-Ct max-age=0 X-Ratelimit-Remaining 48 Access-Control-Allow-Methods GET X-Download-Options noopen Access-Control-Allow-Origin * Cache-Control no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0 X-Ratelimit-Reset 1638363719 X-Ratelimit-Limit 50 Content-Type application/json; charset=utf-8
GET H2	204	0 bat.bing.com/action/ Frame CDF7	0 95 B	32ms 32ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=17533112&Ver=2&mid=ab4a3b9d-8471-4824-adfa-44c18bcb3f63&sid=d73923e052a611ec8c5d836bf920fc92&vid=d739504052a611ecb8fe7196c458dfed&vids=0&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=GrooveFunnels&p=https%3A%2F%2Ftaxcreditrefund.com%2F&r=&lt=1720&evt=pageLoad&ifm=1&msclkid=N&sv=1&rn=463911 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: ECE30E9875F847328B6C8951DFFF85B9 Ref B: FRAEDGE1314 Ref C: 2021-12-01T13:01:47Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	config.js Show response app.groove.cm/config/ Frame CDF7	324 B 448 B	26ms 26ms	Script application/javascript	2606:4700:3035::6815:856 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.groove.cm/config/config.js Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:856 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5d7560c8b33f798d429fa0e84d88e11aff034ec7ab72a758d3ed52fc9b285a18 Request headers Referer Origin https://app.groove.cm Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-encoding br cf-cache-status HIT last-modified Tue, 30 Nov 2021 13:17:52 GMT server cloudflare age 3030 etag W/"61a62480-144" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z2cJh6aQvEMPGXYV6wug8yY9BT9dE2FrLmnbQeR0MWDkeivSyk%2FrQA2Pld8MFs77phoUbb1AOrwh6XKN35ln378uEqMC%2FQ9EAVKdoGHC1RdggWUjXukII5OEsKPNebaN%2FHfO0IArD4jpl9Mp"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b6c8191daf93747-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
OPTIONS H3	204	fetch-with-permalink v1.gdapis.com/api/groovevideo/ Frame	0 0	345ms 331ms	Preflight text/html	2606:4700:3034::6815:2dae CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=u1kHEnHT9wSJ2kyJJs0e&id=75215 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:2dae , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.24 Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers x-auth-provider Origin https://app.groove.cm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.3.24 cache-control no-cache, private access-control-allow-methods POST, GET, OPTIONS, PUT, PATCH, DELETE access-control-allow-headers Content-Type, X-Auth-Token, Origin, Authorization, * access-control-allow-origin * access-control-max-age 86400 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=caxNzvP%2FXmgu3ejlh7bHDv2i2k%2BvCz0LtAxyyD%2F2mFUtpF%2FUmVx2Hs2VZPHwe92%2BKnBHtbStIzUWV9Zpm4TLoQDUNt%2FpnItxx6a5%2FMpCbdWHlpONt43a6SbWNFi7132lYzXcLfFLXZxGKJlM"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6b6c81921ddce00b-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H3	200	fetch-with-permalink Show response v1.gdapis.com/api/groovevideo/ Frame D7C8	2 KB 2 KB	210ms 210ms	XHR application/json	2606:4700:3034::6815:2dae CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=u1kHEnHT9wSJ2kyJJs0e&id=75215 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/js/chunk-vendors.b283e084.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:2dae , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.24 Resource Hash e55c9600ed0fac35efad2d38ba1d0ecf5e56e9a50014fac56d137ece7e7ee5e3 Request headers Accept application/json, text/plain, */* Referer https://app.groove.cm/ x-auth-provider auth0 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-encoding br vary Accept-Encoding cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-powered-by PHP/7.3.24 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-ratelimit-remaining 598 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=miG08ZrAr2f1TBnmvo27LfZ0u9TsAqg%2B6Hp3%2BXDew2KFOxrumzmmDcOimNAIYjWwRUGhsWh%2FGV35lyApc18HcBD9qjOoUlvQO8MkMIgvZ55jRVC7%2BIklFu39CvAV2YFwOV0jl0oiwEJ%2BzHNc"}],"group":"cf-nel","max_age":604800} content-type application/json access-control-allow-origin * access-control-expose-headers Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma cache-control no-cache, private x-ratelimit-limit 600 cf-ray 6b6c81942938e00b-FRA
GET H3	200	www-widgetapi.js Show response www.youtube.com/s/player/3ce4f9b8/www-widgetapi.vflset/ Frame CDF7	147 KB 48 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:831::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/3ce4f9b8/www-widgetapi.vflset/www-widgetapi.js Requested by Host: www.youtube.com URL: https://www.youtube.com/iframe_api Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2a499c62bd4a1555dc2be24483a7de1cb92605c2dee544ce0435a7add53b52c4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 12:16:34 GMT content-encoding br x-content-type-options nosniff age 2713 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 49040 x-xss-protection 0 last-modified Mon, 29 Nov 2021 01:17:55 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 01 Dec 2022 12:16:34 GMT
GET H3	200	fetch-with-permalink Show response v1.gdapis.com/api/groovevideo/ Frame CDF7	2 KB 1 KB	182ms 181ms	XHR application/json	2606:4700:3034::6815:2dae CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=7KE4VhYEZBAF7a6M9DFD&id=75176 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/js/chunk-vendors.b283e084.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:2dae , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.24 Resource Hash 2f0af20bb7bbd5d9134c6505f6741cbbdbfda41f65ea004af27827b72827b507 Request headers Accept application/json, text/plain, */* Referer https://app.groove.cm/ x-auth-provider auth0 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-encoding br vary Accept-Encoding cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-powered-by PHP/7.3.24 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-ratelimit-remaining 599 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EGtyxbfsxtARushYZGVRlKWblGFOTVsnP1DlP7FH%2F3UoBdI%2Fi0OkB2jq%2FZ7LeLBxTuD%2F545%2BMAj6wLKkJdwVQlBhXEFmxkbvDpDp17nA9xHM%2FUChgNgKXNps3vhqRaHDmexg8hW1K1%2FRQA9T"}],"group":"cf-nel","max_age":604800} content-type application/json access-control-allow-origin * access-control-expose-headers Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma cache-control no-cache, private x-ratelimit-limit 600 cf-ray 6b6c81943950e00b-FRA
OPTIONS H3	204	fetch-with-permalink v1.gdapis.com/api/groovevideo/ Frame	0 0	324ms 324ms	Preflight text/html	2606:4700:3034::6815:2dae CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=7KE4VhYEZBAF7a6M9DFD&id=75176 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:2dae , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.24 Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers x-auth-provider Origin https://app.groove.cm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.3.24 cache-control no-cache, private access-control-allow-methods POST, GET, OPTIONS, PUT, PATCH, DELETE access-control-allow-headers Content-Type, X-Auth-Token, Origin, Authorization, * access-control-allow-origin * access-control-max-age 86400 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NN5WCjY0LXklyM7%2FIWMzoq9sEARRc29Q47gPoFGLBR%2FqaN6gMjZzWQ2uAl5Fgvvio1tSwpoKCW9iVydr0kkfP9sW2ECJGiIp5XHSCEGnWKmM7DX%2BcuyBywsLVybHl6%2BK97Bzccx9T%2BZfhhSL"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6b6c81922e0ae00b-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H/1.1	200 OK	matomo.php matomo.groovetech.io/ Frame D7C8	43 B 217 B	198ms 168ms	Image image/gif	51.161.92.183 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://matomo.groovetech.io/matomo.php?action_name=Groovevideo%20%C2%B7%20Groovevideo&idsite=5&rec=1&r=777116&h=13&m=1&s=47&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&urlref=https%3A%2F%2Ftaxcreditrefund.com%2F&_id=79f8fa57a3347c47&_idts=1638363707&_idvc=1&_idn=1&_refts=1638363707&_viewts=1638363707&_ref=https%3A%2F%2Ftaxcreditrefund.com%2F&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=228&pv_id=66wp45 Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.92.183 Laval, Canada, ASN16276 (OVH, FR), Reverse DNS ip183.ip-51-161-92.net Software nginx/1.19.2 / PHP/7.4.16 Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT cache-control no-store server nginx/1.19.2 x-powered-by PHP/7.4.16 content-length 43 content-type image/gif
GET H/1.1	200 OK	matomo.php matomo.groovetech.io/ Frame CDF7	43 B 217 B	155ms 155ms	Image image/gif	51.161.92.183 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://matomo.groovetech.io/matomo.php?action_name=Groovevideo%20%C2%B7%20Groovevideo&idsite=5&rec=1&r=733607&h=13&m=1&s=47&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&urlref=https%3A%2F%2Ftaxcreditrefund.com%2F&_id=733e866ac2a94dbc&_idts=1638363707&_idvc=1&_idn=1&_refts=1638363707&_viewts=1638363707&_ref=https%3A%2F%2Ftaxcreditrefund.com%2F&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=238&pv_id=NT5ocl Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.92.183 Laval, Canada, ASN16276 (OVH, FR), Reverse DNS ip183.ip-51-161-92.net Software nginx/1.19.2 / PHP/7.4.16 Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT cache-control no-store server nginx/1.19.2 x-powered-by PHP/7.4.16 content-length 43 content-type image/gif
GET H2	200	pc Show response 175592.tracking.hyros.com/v1/lst/ Frame CDF7	117 B 392 B	113ms 112ms	XHR application/json	52.70.96.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://175592.tracking.hyros.com/v1/lst/pc?prev_url=https%3A%2F%2Ftaxcreditrefund.com%2F&ref_url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&u_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F96.0.4664.45+Safari%2F537.36 Requested by Host: 175592.tracking.hyros.com URL: https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-96-75.compute-1.amazonaws.com Software Jetty(9.4.41.v20210516) / Resource Hash 8cc0698419c7fc88c55bdb427942f4bc0bda634e534d98f4fb2961b7664d9ea6 Request headers Session-ID HB-ET_30dcbf8cfddfbd34e158c366595d9cd81b18be77273ce7945ffc03ff1e7234cd Product-ID 175592 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-type application/json; charset=utf-8 Access-Control-Allow-Origin * Referer https://app.groove.cm/ Accept-Language de-DE,de;q=0.9 Access-Control-Allow-Headers * Response headers date Wed, 01 Dec 2021 13:01:47 GMT server Jetty(9.4.41.v20210516) access-control-max-age 86400 access-control-allow-methods GET, PUT, POST, OPTIONS, DELETE content-type application/json;charset=utf-8 access-control-allow-origin https://app.groove.cm access-control-expose-headers Session-ID access-control-allow-credentials true content-length 117
OPTIONS H2	200	pc 175592.tracking.hyros.com/v1/lst/ Frame	0 0	101ms 101ms	Preflight application/vnd.sun.wadl+xml	52.70.96.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://175592.tracking.hyros.com/v1/lst/pc?prev_url=https%3A%2F%2Ftaxcreditrefund.com%2F&ref_url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&u_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F96.0.4664.45+Safari%2F537.36 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-96-75.compute-1.amazonaws.com Software Jetty(9.4.41.v20210516) / Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers access-control-allow-headers,access-control-allow-origin,content-type,product-id,session-id Origin https://app.groove.cm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-type application/vnd.sun.wadl+xml;charset=utf-8 content-length 2985 access-control-allow-origin https://app.groove.cm access-control-allow-methods GET, PUT, POST, OPTIONS, DELETE access-control-allow-headers access-control-allow-headers,access-control-allow-origin,content-type,product-id,session-id access-control-expose-headers Session-ID access-control-max-age 86400 access-control-allow-credentials true allow HEAD,GET,OPTIONS last-modified Wed, 01 Dec 2021 13:01:47 UTC server Jetty(9.4.41.v20210516)
GET H2	200	pc Show response 175592.tracking.hyros.com/v1/lst/ Frame D7C8	117 B 392 B	111ms 110ms	XHR application/json	52.70.96.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://175592.tracking.hyros.com/v1/lst/pc?prev_url=https%3A%2F%2Ftaxcreditrefund.com%2F&ref_url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&u_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F96.0.4664.45+Safari%2F537.36 Requested by Host: 175592.tracking.hyros.com URL: https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-96-75.compute-1.amazonaws.com Software Jetty(9.4.41.v20210516) / Resource Hash 19f689a80fb1a8474fdefbf1b2c2cab3d1b14f3dcc9450170e46fb45cdfe431b Request headers Session-ID HB-ET_30dcbf8cfddfbd34e158c366595d9cd81b18be77273ce7945ffc03ff1e7234cd Product-ID 175592 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-type application/json; charset=utf-8 Access-Control-Allow-Origin * Referer https://app.groove.cm/ Accept-Language de-DE,de;q=0.9 Access-Control-Allow-Headers * Response headers date Wed, 01 Dec 2021 13:01:47 GMT server Jetty(9.4.41.v20210516) access-control-max-age 86400 access-control-allow-methods GET, PUT, POST, OPTIONS, DELETE content-type application/json;charset=utf-8 access-control-allow-origin https://app.groove.cm access-control-expose-headers Session-ID access-control-allow-credentials true content-length 117
OPTIONS H2	200	pc 175592.tracking.hyros.com/v1/lst/ Frame	0 0	101ms 100ms	Preflight application/vnd.sun.wadl+xml	52.70.96.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://175592.tracking.hyros.com/v1/lst/pc?prev_url=https%3A%2F%2Ftaxcreditrefund.com%2F&ref_url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&u_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F96.0.4664.45+Safari%2F537.36 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-96-75.compute-1.amazonaws.com Software Jetty(9.4.41.v20210516) / Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers access-control-allow-headers,access-control-allow-origin,content-type,product-id,session-id Origin https://app.groove.cm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-type application/vnd.sun.wadl+xml;charset=utf-8 content-length 2985 access-control-allow-origin https://app.groove.cm access-control-allow-methods GET, PUT, POST, OPTIONS, DELETE access-control-allow-headers access-control-allow-headers,access-control-allow-origin,content-type,product-id,session-id access-control-expose-headers Session-ID access-control-max-age 86400 access-control-allow-credentials true allow HEAD,GET,OPTIONS last-modified Wed, 01 Dec 2021 13:01:47 UTC server Jetty(9.4.41.v20210516)
GET H2	200	/ Show response beacon-v2.helpscout.net/ Frame CDF7	293 B 622 B	44ms 7ms	Script application/javascript	143.204.98.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://beacon-v2.helpscout.net/ Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-38.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 3e43cc1d04dd927b53e589be9261549e529ad72cb5c14241bad2c7a234345d7c Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:00:22 GMT content-encoding gzip last-modified Wed, 01 Dec 2021 11:53:15 GMT server AmazonS3 age 86 etag "6f853bef4da88a5c8d02f79526bf5bdb" x-cache Hit from cloudfront content-type application/javascript via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) cache-control max-age=120, s-maxage=120, public x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 243 x-amz-cf-id GXIPzQyHAAiH9Z3ZKFxXjXq16f-KUaPjx0bA4InIb8oDXqXJzDAaTQ==
GET H2	200	397596.gif idsync.rlcdn.com/ Frame F5EC Redirect Chain https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40 https://idsync.rlcdn.com/397596.gif?partner_uid=D5gKIhS_sjRKB4C2RGteHGK-BVQgWZNH	42 B 417 B	42ms 17ms	Image image/gif	35.244.174.68 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://idsync.rlcdn.com/397596.gif?partner_uid=D5gKIhS_sjRKB4C2RGteHGK-BVQgWZNH Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Server 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 68.174.244.35.bc.googleusercontent.com Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Wed, 01 Dec 2021 13:01:47 GMT via 1.1 google p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" cache-control no-cache, no-store content-type image/gif alt-svc clear content-length 42 Redirect headers location https://idsync.rlcdn.com/397596.gif?partner_uid=D5gKIhS_sjRKB4C2RGteHGK-BVQgWZNH strict-transport-security max-age=31536000 cache-control private, max-age=0, no-cache, no-store, must-revalidate server-processing-duration-in-ticks 2987 date Wed, 01 Dec 2021 13:01:46 GMT content-length 197 content-type text/html; charset=utf-8
GET H2	200	cookiematch.aspx dis.criteo.com/dis/rtb/google/ Frame F5EC Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay04TzdVVkJHZzRzSVBjNldDX0pCZmdndmJQVjFCTXZsYXhZLUVsUQ https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0	43 B 341 B	54ms 16ms	Image image/gif	178.250.0.163 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Show image Full URL https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Server 178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software Kestrel / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT content-type image/gif server Kestrel p3p CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA' cache-control no-cache cross-origin-resource-policy cross-origin server-processing-duration-in-ticks 297700 timing-allow-origin * expires Mon, 26 Jul 1997 05:00:00 GMT Redirect headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 279 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	204 No Content	/ partner.mediawallahscript.com/ Frame F5EC Redirect Chain https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&custom=&tag_format=img&tag_action=sync&custom=&cb=265c8c79-168a-491e-84f7-ca90d8b... https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=265c8c79-168a-491...	0 638 B	33ms 32ms	Image text/plain	52.16.203.61 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=265c8c79-168a-491e-84f7-ca90d8ba0440&final=true&reqid=d795f2e0-52a6-11ec-ae93-55f394c6df86&timestamp=2021-12-01T13%3A01%3A47.662Z Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Server 52.16.203.61 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-16-203-61.eu-west-1.compute.amazonaws.com Software nginx/1.18.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:47 GMT Cache-Control private, no-cache, must-revalidate, no-store, max-age=0 Server nginx/1.18.0 Connection keep-alive P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Expires Sat, 26 Jul 1997 05:00:00 GMT Redirect headers Date Wed, 01 Dec 2021 13:01:47 GMT Server nginx/1.18.0 Vary Accept, Accept-Encoding P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Location /?account_id=1043&partner_id=1048&uid=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=265c8c79-168a-491e-84f7-ca90d8ba0440&final=true&reqid=d795f2e0-52a6-11ec-ae93-55f394c6df86&timestamp=2021-12-01T13%3A01%3A47.662Z Cache-Control private, no-cache, must-revalidate, no-store, max-age=0 Connection keep-alive Content-Type text/plain; charset=utf-8 Content-Length 294 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H3	200	m cm.mgid.com/ Frame F5EC Redirect Chain https://cm.mgid.com/m?cdsp=617660&c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ https://cm.mgid.com/m?c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&cdsp=617660&sct=1	43 B 500 B	308ms 152ms	Image image/gif	104.19.135.78 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cm.mgid.com/m?c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&cdsp=617660&sct=1 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H3 Server 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT cf-cache-status DYNAMIC server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" p3p CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" content-type image/gif cache-control no-store, no-cache, must-revalidate, max-age=0 access-control-allow-credentials true cf-ray 6b6c8195e8f7dff7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Redirect headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT cf-cache-status DYNAMIC server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" p3p CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" location https://cm.mgid.com/m?c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&cdsp=617660&sct=1 cache-control max-age=0, no-cache, no-store, must-revalidate access-control-allow-credentials true cf-ray 6b6c81946f033b13-CDG alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	204	v1 ads.yahoo.com/cms/ Frame F5EC	0 297 B	27ms 22ms	Image text/plain	2a00:1288:80:800::7001 YAHOO-DEB
General Check archive.org Show headers Download Go to Show image Full URL https://ads.yahoo.com/cms/v1?esig=1~7315a025058f3128185459bfaf16e164414683fc&nwid=10000545908&sigv=1 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT cache-control no-store x-content-type-options nosniff server ATS strict-transport-security max-age=15552000 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-xss-protection 1; mode=block
GET H2	200	spp.pl sp.analytics.yahoo.com/ Frame F5EC	43 B 373 B	39ms 35ms	Image image/gif	212.82.100.181 YAHOO-IRD
General Check archive.org Show headers Download Go to Show image Full URL https://sp.analytics.yahoo.com/spp.pl?a=10001287818027&.yp=10028862&js=no Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB), Reverse DNS spdc.pbp.vip.ir2.yahoo.com Software ATS / Resource Hash 0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39 Security Headers Name Value Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT x-content-type-options nosniff server ATS age 0 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-frame-options DENY content-type image/gif cache-control no-cache, private, must-revalidate content-security-policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic strict-transport-security max-age=31536000 accept-ranges bytes content-length 43 referrer-policy strict-origin-when-cross-origin expires Wed, 01 Dec 2021 13:01:47 GMT
GET H2	204	sync ups.analytics.yahoo.com/ups/58301/ Frame F5EC	0 478 B	38ms 11ms	Image text/plain	3.126.56.137 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-rKN4lRGg4sIPc6WC_JBfggvbPV0OCzdbLpWUrQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-126-56-137.eu-central-1.compute.amazonaws.com Software ATS/9.1.0.33 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT server ATS/9.1.0.33 age 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H/1.1	200 OK	cookie-sync sync.outbrain.com/ Frame F5EC	0 476 B	468ms 91ms	Image text/plain	70.42.32.31 INTERNAP-BLK3
General Check archive.org Show headers Download Go to Show image Full URL https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-IayCVhGg4sIPc6WC_JBfggvbPV1o1T-ua44eXQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 70.42.32.31 , United States, ASN13789 (INTERNAP-BLK3, US), Reverse DNS ny.outbrain.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:47 GMT Cache-Control no-cache X-TraceId ff6cdce2bc427ff31c28631287b2581f Content-Length 0
GET H2	204	t.gif cw.addthis.com/ Frame F5EC	0 426 B	165ms 144ms	Image text/plain	104.75.88.126 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cw.addthis.com/t.gif?pid=113&pdid=k-4MFAORGg4sIPc6WC_JBfggvbPV3qKc2mpULBJQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-75-88-126.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT cache-control max-age=0, no-cache, no-store expires Wed, 01 Dec 2021 13:01:47 GMT
GET H/1.1	204 No Content	tap.php pixel.rubiconproject.com/ Frame F5EC	0 239 B	36ms 9ms	Image image/gif	69.173.144.138 RUBICONPROJECT
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-4MFAORGg4sIPc6WC_JBfggvbPV3qKc2mpULBJQ&expires=30 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Expires 0 Cache-Control no-cache,no-store,must-revalidate P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" X-RPHost a66cbf3142c6ef39e3614b84a34262cf Content-Type image/gif
GET H/1.1	200 OK	bounce secure.adnxs.com/ Frame F5EC Redirect Chain https://secure.adnxs.com/setuid?entity=52&code=k-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw&seg=95287 https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw%26seg%3D95287	43 B 1 KB	37ms 15ms	Image image/gif	185.33.221.11 ASN-APPNEX
General Check archive.org Show headers Download Go to Show image Full URL https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw%26seg%3D95287 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Server 185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.17.9 / Resource Hash 4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:47 GMT X-Proxy-Origin 194.36.108.22; 194.36.108.22; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com AN-X-Request-Uuid ae3fea19-fb4f-4a98-be11-fe9b58d05678 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin * Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type image/gif Content-Length 43 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT Redirect headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:47 GMT X-Proxy-Origin 194.36.108.22; 194.36.108.22; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com AN-X-Request-Uuid 80f21f67-545c-47c1-8955-f3609fbc643f Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw%26seg%3D95287 Cache-Control no-store, no-cache, private Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	sync x.bidswitch.net/ul_cb/ Frame F5EC Redirect Chain https://x.bidswitch.net/sync?dsp_id=46&user_id=k-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw&expires=30&user_group=5 https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw&expires=30&user_group=5	43 B 495 B	24ms 9ms	Image image/gif	3.120.56.129 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw&expires=30&user_group=5 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Server 3.120.56.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-120-56-129.eu-central-1.compute.amazonaws.com Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:47 GMT Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Length 43 Content-Type image/gif Redirect headers Location https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw&expires=30&user_group=5 Date Wed, 01 Dec 2021 13:01:47 GMT Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Length 0
GET H2	200	Pug simage2.pubmatic.com/AdServer/ Frame F5EC	42 B 674 B	284ms 18ms	Image image/gif	185.64.190.80 AS-PUBMATIC
General Check archive.org Show headers Download Go to Show image Full URL https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-NtJ9phGg4sIPc6WC_JBfggvbPV37PZ2EhhTeVA Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US), Reverse DNS Software nginx / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT cache-control no-store, no-cache, private x-lat lhrpug004:0:431 server nginx content-type image/gif; charset=utf-8 content-length 42 p3p CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
GET H2	200	xuid eb2.3lift.com/ Frame F5EC Redirect Chain https://eb2.3lift.com/xuid?mid=2711&xuid=k-h7IApRGg4sIPc6WC_JBfggvbPV2lsR4P32yLXw&dongle=013b https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-h7IApRGg4sIPc6WC_JBfggvbPV2lsR4P32yLXw&dongle=013b&gdpr=1&cmp_cs=&us_privacy=	37 B 352 B	12ms 10ms	Image image/gif	13.248.245.213 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-h7IApRGg4sIPc6WC_JBfggvbPV2lsR4P32yLXw&dongle=013b&gdpr=1&cmp_cs=&us_privacy= Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Server 13.248.245.213 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a0f671730127a0812.awsglobalaccelerator.com Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT cache-control no-cache, no-store, must-revalidate content-type image/gif content-length 37 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Redirect headers location /xuid?ld=1&mid=2711&xuid=k-h7IApRGg4sIPc6WC_JBfggvbPV2lsR4P32yLXw&dongle=013b&gdpr=1&cmp_cs=&us_privacy= date Wed, 01 Dec 2021 13:01:47 GMT cache-control no-cache, no-store, must-revalidate content-length 0 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	cksync.php contextual.media.net/ Frame F5EC	45 B 784 B	112ms 67ms	Image image/gif	104.108.144.24 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-hx4nlxGg4sIPc6WC_JBfggvbPV26OZLEdT53CQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-144-24.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43 Security Headers Name Value Strict-Transport-Security max-age=604800 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=604800 server Apache date Wed, 01 Dec 2021 13:01:47 GMT p3p CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA cache-control max-age=0, no-cache, no-store content-type image/gif content-length 45 x-mnet-hl2 E expires Wed, 01 Dec 2021 13:01:47 GMT
GET H/1.1	200 OK	rum r.casalemedia.com/ Frame F5EC Redirect Chain https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA&C=1	43 B 1 KB	26ms 26ms	Image image/gif	2.18.234.21 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA&C=1 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Server 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-234-21.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:47 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Wed, 01 Dec 2021 13:01:47 GMT Redirect headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:47 GMT Server Apache P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Location https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA&C=1 Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type text/html; charset=iso-8859-1 Content-Length 296 Expires Wed, 01 Dec 2021 13:01:47 GMT
GET H2	204	/ s.ad.smaato.net/c/ Frame F5EC	0 241 B	10ms 10ms	Image text/plain	2600:9000:2156:9200:1b:5138:8a40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s.ad.smaato.net/c/?dspInit=1001851&dspCookie=k-nwvxEhGg4sIPc6WC_JBfggvbPV2G3AxDej2xCQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:9200:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) server CloudFront cache-control no-cache, must-revalidate x-amz-cf-pop FRA50-C1 x-amz-cf-id CqXI68z1vifLJhsPWYmPIiUXK2QwQ-RGBg6iXQS-5hVmkG60ZLNpBw== x-cache FunctionGeneratedResponse from cloudfront
GET H2	200	pixel_sync trends.revcontent.com/cm/ Frame F5EC	35 B 336 B	229ms 34ms	Image image/gif	99.80.164.0 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k-qerEJBGg4sIPc6WC_JBfggvbPV1r5Olyb9BDSg Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.80.164.0 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-80-164-0.eu-west-1.compute.amazonaws.com Software / Express Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT x-powered-by Express content-length 35 content-type image/gif
GET H2	200	um criteo-sync.teads.tv/ Frame F5EC	23 B 172 B	255ms 72ms	Image image/gif	104.111.242.245 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://criteo-sync.teads.tv/um?eid=80&uid=k-xm8BPBGg4sIPc6WC_JBfggvbPV0aUdg23R1eXg Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-242-245.deploy.static.akamaitechnologies.com Software akka-http/10.2.6 / Resource Hash 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT cache-control max-age=0, no-cache, no-store expires Wed, 01 Dec 2021 13:01:47 GMT server akka-http/10.2.6 content-length 23 content-type image/gif
GET H2	200	/ sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame F5EC	0 228 B	16ms 15ms	Image text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-o0QIjRGg4sIPc6WC_JBfggvbPV3p2v96nKHODQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT access-control-allow-credentials true server nginx x-fastly-to-nlb-rtt 9117
GET H/1.1	200 OK	/ rtb-csync.smartadserver.com/redir/ Frame F5EC	43 B 163 B	191ms 16ms	Image image/gif	185.86.137.131 SMARTADSERVER
General Check archive.org Show headers Download Go to Show image Full URL https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-Y9Xn7BGg4sIPc6WC_JBfggvbPV2LcIIcAsF0CA Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 185.86.137.131 , France, ASN201081 (SMARTADSERVER, FR), Reverse DNS Software / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT transfer-encoding chunked content-type image/gif
GET H2	200	v1 match.sharethrough.com/sync/ Frame F5EC	68 B 261 B	151ms 8ms	Image image/png	3.124.175.167 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-EbW8CBGg4sIPc6WC_JBfggvbPV0hKWh46QPRlw Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.175.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-175-167.eu-central-1.compute.amazonaws.com Software / Resource Hash 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-length 68 content-type image/png
GET H2	200	match ad.360yield.com/ul_cb/ Frame F5EC Redirect Chain https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g	43 B 447 B	32ms 32ms	Image image/gif	34.246.169.106 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Server 34.246.169.106 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-246-169-106.eu-west-1.compute.amazonaws.com Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers access-control-allow-origin * date Wed, 01 Dec 2021 13:01:47 GMT content-type image/gif content-length 43 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Redirect headers location https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g date Wed, 01 Dec 2021 13:01:47 GMT content-type text/plain content-length 0 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
GET H/1.1	200 OK	28292 i6.liadm.com/s/ Frame F5EC Redirect Chain https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg&_li_chk=true&previous_uuid=2cc523d5ec7d4277a18b9be3037d1219 https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg	43 B 447 B	293ms 95ms	Image image/gif	2600:1f18:444a:4602:2c20:3113:5c28:1366 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg Protocol HTTP/1.1 Server 2600:1f18:444a:4602:2c20:3113:5c28:1366 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:48 GMT Cache-Control no-store Connection keep-alive trace-id 874bafcc3c895743 Content-Length 43 Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type image/gif Redirect headers Location https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg Date Wed, 01 Dec 2021 13:01:47 GMT Connection keep-alive trace-id 99d1242e939b04ad Content-Length 0 Strict-Transport-Security max-age=31536000; includeSubDomains
GET H2	200	1017 jadserve.postrelease.com/suid/ Frame F5EC	43 B 426 B	179ms 104ms	Image image/gif	18.209.200.15 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://jadserve.postrelease.com/suid/1017?vk=k-oCDv7BGg4sIPc6WC_JBfggvbPV0H18lZYlE61A Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.209.200.15 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-209-200-15.compute-1.amazonaws.com Software nginx/1.12.1 / Resource Hash a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT server nginx/1.12.1 p3p CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-type image/gif content-length 43 expires Mon, 1 Jan 1990 12:00:00 GMT
GET H2	204	sync ups.analytics.yahoo.com/ups/55945/ Frame F5EC Redirect Chain https://pixel.advertising.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1 https://pixel.advertising.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&verify=true https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&apid=UPd7b2f0f5-52a6-11ec-8bab-06fe92171bd8	0 20 B	23ms 23ms	Image text/plain	3.126.56.137 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&apid=UPd7b2f0f5-52a6-11ec-8bab-06fe92171bd8 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Server 3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-126-56-137.eu-central-1.compute.amazonaws.com Software ATS/9.1.0.33 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT server ATS/9.1.0.33 age 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Redirect headers location https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&apid=UPd7b2f0f5-52a6-11ec-8bab-06fe92171bd8 date Wed, 01 Dec 2021 13:01:47 GMT content-length 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H2	200	sync criteo-partners.tremorhub.com/ Frame F5EC	43 B 182 B	295ms 93ms	Image image/gif	2600:1f18:612b:4232:5007:e458:edcf:dd38 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://criteo-partners.tremorhub.com/sync?UICR=k-3BXtbxGg4sIPc6WC_JBfggvbPV1RTMJUQ2iiZw Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4232:5007:e458:edcf:dd38 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:48 GMT server Apache-Coyote/1.1 p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' content-type image/gif
GET H/1.1	200 OK	empty.gif cdn.stickyadstv.com/one-shot/ Frame F5EC Redirect Chain https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-PaEccBGg4sIPc6WC_JBfggvbPV01SNyKmcEbtA&redirectId=69 https://cdn.stickyadstv.com/one-shot/empty.gif?	43 B 438 B	88ms 7ms	Image image/gif	2001:4de0:ac19::1:b:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.stickyadstv.com/one-shot/empty.gif? Protocol HTTP/1.1 Server 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:48 GMT Last-Modified Thu, 28 Feb 2013 15:45:35 GMT ETag "1362066335" X-HW 1638363708.dop123.fr8.t,1638363708.cds263.fr8.shn,1638363708.cds263.fr8.c Content-Type image/gif Access-Control-Allow-Origin * Cache-Control max-age=7200 Access-Control-Allow-Credentials true Connection Keep-Alive Accept-Ranges bytes Content-Length 43 Redirect headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:47 GMT Server nginx Access-Control-Allow-Origin * Location https://cdn.stickyadstv.com/one-shot/empty.gif? Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 0 x-sticky-vk 1638363707937079-589 Expires Wed, 01 Dec 2021 13:01:47 GMT
GET H2	200	vendor.00021bae.js Show response beacon-v2.helpscout.net/static/js/ Frame CDF7	702 KB 196 KB	11ms 11ms	Script application/javascript	143.204.98.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://beacon-v2.helpscout.net/static/js/vendor.00021bae.js Requested by Host: beacon-v2.helpscout.net URL: https://beacon-v2.helpscout.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-38.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 3a2ef7f9d5e2367c3eab4c00d3176681ce5cb08165c93b923ae1af79dd338ca0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 11:54:22 GMT content-encoding gzip last-modified Wed, 01 Dec 2021 11:53:15 GMT server AmazonS3 age 4046 etag "562f9cf4d7301f22473859322a0284d1" x-cache Hit from cloudfront content-type application/javascript via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) cache-control max-age=315360000, s-maxage=7200, public x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 199788 x-amz-cf-id ZyqmhGi2sPYurATmQgzXKrdjiTtPg7zQ_OYG-PvxRYiLnvJqeZLXaQ==
GET H2	200	main.73fbc42b.js Show response beacon-v2.helpscout.net/static/js/ Frame CDF7	256 KB 64 KB	31ms 31ms	Script application/javascript	143.204.98.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://beacon-v2.helpscout.net/static/js/main.73fbc42b.js Requested by Host: beacon-v2.helpscout.net URL: https://beacon-v2.helpscout.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-38.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 485c6f41a2d2496161238f7ecdfc07355e14f46798febe3919537c7ef735919a Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 11:53:32 GMT content-encoding gzip last-modified Wed, 01 Dec 2021 11:53:15 GMT server AmazonS3 age 4096 etag "f0a424815d531ddbefbe5765d5d2d1c7" x-cache Hit from cloudfront content-type application/javascript via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) cache-control max-age=315360000, s-maxage=7200, public x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 65368 x-amz-cf-id EqoEJN-Z1l1UQwi899U_GKZvtrFgH7tQGUyZyJazg4jDIVUP8GPPMw==
GET H2	200	/ Show response beacon-v2.helpscout.net/ Frame D7C8	293 B 621 B	35ms 35ms	Script application/javascript	143.204.98.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://beacon-v2.helpscout.net/ Requested by Host: app.groove.cm URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-38.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 3e43cc1d04dd927b53e589be9261549e529ad72cb5c14241bad2c7a234345d7c Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:00:22 GMT content-encoding gzip last-modified Wed, 01 Dec 2021 11:53:15 GMT server AmazonS3 age 86 etag "6f853bef4da88a5c8d02f79526bf5bdb" x-cache Hit from cloudfront content-type application/javascript via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) cache-control max-age=120, s-maxage=120, public x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 243 x-amz-cf-id ncSRvov8EFUKzGvC2OE-6o8PfNAwy8u6pqjms4j9RdBj4DNXkrVthw==
GET H2	200	cookiematch.aspx dis.criteo.com/dis/rtb/google/ Frame 477D Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay04TzdVVkJHZzRzSVBjNldDX0pCZmdndmJQVjFCTXZsYXhZLUVsUQ https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0	43 B 341 B	16ms 16ms	Image image/gif	178.250.0.163 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Show image Full URL https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Server 178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software Kestrel / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:46 GMT content-type image/gif server Kestrel p3p CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA' cache-control no-cache cross-origin-resource-policy cross-origin server-processing-duration-in-ticks 281229 timing-allow-origin * expires Mon, 26 Jul 1997 05:00:00 GMT Redirect headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 279 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	m cm.mgid.com/ Frame 477D Redirect Chain https://cm.mgid.com/m?cdsp=617660&c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ https://cm.mgid.com/m?c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&cdsp=617660&sct=1	43 B 464 B	262ms 157ms	Image image/gif	104.19.135.78 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cm.mgid.com/m?c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&cdsp=617660&sct=1 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H3 Server 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT cf-cache-status DYNAMIC server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" p3p CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" content-type image/gif cache-control no-store, no-cache, must-revalidate, max-age=0 access-control-allow-credentials true cf-ray 6b6c8195e8f8dff7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Redirect headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT cf-cache-status DYNAMIC server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" p3p CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" location https://cm.mgid.com/m?c=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&cdsp=617660&sct=1 cache-control max-age=0, no-cache, no-store, must-revalidate access-control-allow-credentials true cf-ray 6b6c81948f5f3b13-CDG alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	spp.pl sp.analytics.yahoo.com/ Frame 477D	43 B 79 B	40ms 34ms	Image image/gif	212.82.100.181 YAHOO-IRD
General Check archive.org Show headers Download Go to Show image Full URL https://sp.analytics.yahoo.com/spp.pl?a=10001287818027&.yp=10028862&js=no Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB), Reverse DNS spdc.pbp.vip.ir2.yahoo.com Software ATS / Resource Hash 0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39 Security Headers Name Value Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT x-content-type-options nosniff server ATS age 0 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-frame-options DENY content-type image/gif cache-control no-cache, private, must-revalidate content-security-policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic strict-transport-security max-age=31536000 accept-ranges bytes content-length 43 referrer-policy strict-origin-when-cross-origin expires Wed, 01 Dec 2021 13:01:47 GMT
GET H/1.1	200 OK	cookie-sync sync.outbrain.com/ Frame 477D	0 476 B	408ms 97ms	Image text/plain	70.42.32.31 INTERNAP-BLK3
General Check archive.org Show headers Download Go to Show image Full URL https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-IayCVhGg4sIPc6WC_JBfggvbPV1o1T-ua44eXQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 70.42.32.31 , United States, ASN13789 (INTERNAP-BLK3, US), Reverse DNS ny.outbrain.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:47 GMT Cache-Control no-cache X-TraceId d8900516db62adefdf961124ceb73b8e Content-Length 0
GET H2	204	t.gif cw.addthis.com/ Frame 477D	0 426 B	166ms 161ms	Image text/plain	104.75.88.126 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cw.addthis.com/t.gif?pid=113&pdid=k-4MFAORGg4sIPc6WC_JBfggvbPV3qKc2mpULBJQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-75-88-126.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT cache-control max-age=0, no-cache, no-store expires Wed, 01 Dec 2021 13:01:47 GMT
GET H/1.1	200 OK	setuid secure.adnxs.com/ Frame 477D	43 B 1019 B	23ms 17ms	Image image/gif	185.33.221.11 ASN-APPNEX
General Check archive.org Show headers Download Go to Show image Full URL https://secure.adnxs.com/setuid?entity=52&code=k-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw&seg=95287 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.17.9 / Resource Hash 4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:47 GMT X-Proxy-Origin 194.36.108.22; 194.36.108.22; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com AN-X-Request-Uuid 90d03d06-5ba1-4433-a337-90756832d192 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Cache-Control no-store, no-cache, private Connection keep-alive Content-Type image/gif Content-Length 43 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	sync x.bidswitch.net/ Frame 477D	43 B 220 B	18ms 11ms	Image image/gif	3.120.56.129 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://x.bidswitch.net/sync?dsp_id=46&user_id=k-O8557xGg4sIPc6WC_JBfggvbPV1vjgx3iir5Bw&expires=30&user_group=5 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.120.56.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-120-56-129.eu-central-1.compute.amazonaws.com Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:47 GMT Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Length 43 Content-Type image/gif
GET H2	200	397596.gif idsync.rlcdn.com/ Frame 477D Redirect Chain https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40 https://idsync.rlcdn.com/397596.gif?partner_uid=frN8bApzia94PMewIfQXw-I4Mlw6GHdi	42 B 287 B	14ms 14ms	Image image/gif	35.244.174.68 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://idsync.rlcdn.com/397596.gif?partner_uid=frN8bApzia94PMewIfQXw-I4Mlw6GHdi Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Server 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 68.174.244.35.bc.googleusercontent.com Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Wed, 01 Dec 2021 13:01:47 GMT via 1.1 google p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" cache-control no-cache, no-store content-type image/gif alt-svc clear content-length 42 Redirect headers location https://idsync.rlcdn.com/397596.gif?partner_uid=frN8bApzia94PMewIfQXw-I4Mlw6GHdi strict-transport-security max-age=31536000 cache-control private, max-age=0, no-cache, no-store, must-revalidate server-processing-duration-in-ticks 2803 date Wed, 01 Dec 2021 13:01:47 GMT content-length 197 content-type text/html; charset=utf-8
GET H2	200	Pug simage2.pubmatic.com/AdServer/ Frame 477D	42 B 444 B	242ms 18ms	Image image/gif	185.64.190.80 AS-PUBMATIC
General Check archive.org Show headers Download Go to Show image Full URL https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-NtJ9phGg4sIPc6WC_JBfggvbPV37PZ2EhhTeVA Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US), Reverse DNS Software nginx / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT cache-control no-store, no-cache, private x-lat lhrpug001:0:703 server nginx content-type image/gif; charset=utf-8 content-length 42 p3p CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
GET H2	200	xuid eb2.3lift.com/ Frame 477D	37 B 352 B	16ms 11ms	Image image/gif	13.248.245.213 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://eb2.3lift.com/xuid?mid=2711&xuid=k-h7IApRGg4sIPc6WC_JBfggvbPV2lsR4P32yLXw&dongle=013b Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.248.245.213 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a0f671730127a0812.awsglobalaccelerator.com Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT cache-control no-cache, no-store, must-revalidate content-type image/gif content-length 37 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	cksync.php contextual.media.net/ Frame 477D	45 B 784 B	89ms 76ms	Image image/gif	104.108.144.24 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-hx4nlxGg4sIPc6WC_JBfggvbPV26OZLEdT53CQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-144-24.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43 Security Headers Name Value Strict-Transport-Security max-age=604800 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=604800 server Apache date Wed, 01 Dec 2021 13:01:47 GMT p3p CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA cache-control max-age=0, no-cache, no-store content-type image/gif content-length 45 x-mnet-hl2 E expires Wed, 01 Dec 2021 13:01:47 GMT
GET H/1.1	200 OK	rum r.casalemedia.com/ Frame 477D Redirect Chain https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA&C=1	43 B 1 KB	26ms 26ms	Image image/gif	2.18.234.21 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA&C=1 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Server 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-234-21.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:47 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Wed, 01 Dec 2021 13:01:47 GMT Redirect headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:47 GMT Server Apache P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Location https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-bSNf1BGg4sIPc6WC_JBfggvbPV13IGfio8jHqA&C=1 Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type text/html; charset=iso-8859-1 Content-Length 296 Expires Wed, 01 Dec 2021 13:01:47 GMT
GET H2	204	/ s.ad.smaato.net/c/ Frame 477D	0 240 B	34ms 8ms	Image text/plain	2600:9000:2156:9200:1b:5138:8a40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s.ad.smaato.net/c/?dspInit=1001851&dspCookie=k-nwvxEhGg4sIPc6WC_JBfggvbPV2G3AxDej2xCQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:9200:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) server CloudFront cache-control no-cache, must-revalidate x-amz-cf-pop FRA50-C1 x-amz-cf-id sW6tnOrA2wxkVlUGmG8eP-mGs8p97RX0L3gFUnHDhd3tWVVJU4vwvQ== x-cache FunctionGeneratedResponse from cloudfront
GET H2	200	pixel_sync trends.revcontent.com/cm/ Frame 477D	35 B 337 B	255ms 32ms	Image image/gif	99.80.164.0 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k-qerEJBGg4sIPc6WC_JBfggvbPV1r5Olyb9BDSg Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.80.164.0 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-80-164-0.eu-west-1.compute.amazonaws.com Software / Express Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT x-powered-by Express content-length 35 content-type image/gif
GET H2	200	um criteo-sync.teads.tv/ Frame 477D	23 B 172 B	294ms 70ms	Image image/gif	104.111.242.245 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://criteo-sync.teads.tv/um?eid=80&uid=k-xm8BPBGg4sIPc6WC_JBfggvbPV0aUdg23R1eXg Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-242-245.deploy.static.akamaitechnologies.com Software akka-http/10.2.6 / Resource Hash 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT cache-control max-age=0, no-cache, no-store expires Wed, 01 Dec 2021 13:01:47 GMT server akka-http/10.2.6 content-length 23 content-type image/gif
GET H2	200	/ sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 477D	0 230 B	58ms 16ms	Image text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-o0QIjRGg4sIPc6WC_JBfggvbPV3p2v96nKHODQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT access-control-allow-credentials true server nginx x-fastly-to-nlb-rtt 9117
GET H/1.1	200 OK	/ rtb-csync.smartadserver.com/redir/ Frame 477D	43 B 163 B	221ms 17ms	Image image/gif	185.86.137.131 SMARTADSERVER
General Check archive.org Show headers Download Go to Show image Full URL https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-Y9Xn7BGg4sIPc6WC_JBfggvbPV2LcIIcAsF0CA Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 185.86.137.131 , France, ASN201081 (SMARTADSERVER, FR), Reverse DNS Software / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT transfer-encoding chunked content-type image/gif
GET H2	200	v1 match.sharethrough.com/sync/ Frame 477D	68 B 263 B	207ms 7ms	Image image/png	3.124.175.167 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-EbW8CBGg4sIPc6WC_JBfggvbPV0hKWh46QPRlw Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.175.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-175-167.eu-central-1.compute.amazonaws.com Software / Resource Hash 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT content-length 68 content-type image/png
GET H2	200	match ad.360yield.com/ul_cb/ Frame 477D Redirect Chain https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g	43 B 448 B	33ms 32ms	Image image/gif	34.246.169.106 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Server 34.246.169.106 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-246-169-106.eu-west-1.compute.amazonaws.com Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers access-control-allow-origin * date Wed, 01 Dec 2021 13:01:47 GMT content-type image/gif content-length 43 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Redirect headers location https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G1DRLhGg4sIPc6WC_JBfggvbPV1AOq5rAZHp0g date Wed, 01 Dec 2021 13:01:47 GMT content-type text/plain content-length 0 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
GET H/1.1	200 OK	28292 i6.liadm.com/s/ Frame 477D Redirect Chain https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg&_li_chk=true&previous_uuid=4befd6c1777c411b91cdd10ec3c0ce37 https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg	43 B 447 B	394ms 98ms	Image image/gif	2600:1f18:444a:4602:2c20:3113:5c28:1366 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg Protocol HTTP/1.1 Server 2600:1f18:444a:4602:2c20:3113:5c28:1366 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:48 GMT Cache-Control no-store Connection keep-alive trace-id 8ec16e660f427d3c Content-Length 43 Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type image/gif Redirect headers Location https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-u5r5cxGg4sIPc6WC_JBfggvbPV1Y2DNgksR_Wg Date Wed, 01 Dec 2021 13:01:47 GMT Connection keep-alive trace-id 2f60529e7bb466f0 Content-Length 0 Strict-Transport-Security max-age=31536000; includeSubDomains
GET H2	200	1017 jadserve.postrelease.com/suid/ Frame 477D	43 B 427 B	321ms 103ms	Image image/gif	18.209.200.15 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://jadserve.postrelease.com/suid/1017?vk=k-oCDv7BGg4sIPc6WC_JBfggvbPV0H18lZYlE61A Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.209.200.15 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-209-200-15.compute-1.amazonaws.com Software nginx/1.12.1 / Resource Hash a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT server nginx/1.12.1 p3p CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-type image/gif content-length 43 expires Mon, 1 Jan 1990 12:00:00 GMT
GET H2	204	sync ups.analytics.yahoo.com/ups/55945/ Frame 477D Redirect Chain https://pixel.advertising.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1 https://pixel.advertising.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&verify=true https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&apid=UPd7b2f0f5-52a6-11ec-8bab-06fe92171bd8	0 342 B	11ms 10ms	Image text/plain	3.126.56.137 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&apid=UPd7b2f0f5-52a6-11ec-8bab-06fe92171bd8 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Server 3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-126-56-137.eu-central-1.compute.amazonaws.com Software ATS/9.1.0.33 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT server ATS/9.1.0.33 age 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Redirect headers location https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-lsB_2xGg4sIPc6WC_JBfggvbPV15IDPHnl5P3w&_origin=1&apid=UPd7b2f0f5-52a6-11ec-8bab-06fe92171bd8 date Wed, 01 Dec 2021 13:01:47 GMT content-length 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H2	200	sync criteo-partners.tremorhub.com/ Frame 477D	43 B 183 B	295ms 93ms	Image image/gif	2600:1f18:612b:4232:5007:e458:edcf:dd38 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://criteo-partners.tremorhub.com/sync?UICR=k-3BXtbxGg4sIPc6WC_JBfggvbPV1RTMJUQ2iiZw Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4232:5007:e458:edcf:dd38 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:48 GMT server Apache-Coyote/1.1 p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' content-type image/gif
GET H/1.1	200 OK	empty.gif cdn.stickyadstv.com/one-shot/ Frame 477D Redirect Chain https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-PaEccBGg4sIPc6WC_JBfggvbPV01SNyKmcEbtA&redirectId=69 https://cdn.stickyadstv.com/one-shot/empty.gif?	43 B 438 B	84ms 7ms	Image image/gif	2001:4de0:ac19::1:b:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.stickyadstv.com/one-shot/empty.gif? Protocol HTTP/1.1 Server 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:48 GMT Last-Modified Thu, 28 Feb 2013 15:45:35 GMT ETag "1362066335" X-HW 1638363708.dop123.fr8.t,1638363708.cds263.fr8.shn,1638363708.cds263.fr8.c Content-Type image/gif Access-Control-Allow-Origin * Cache-Control max-age=7200 Access-Control-Allow-Credentials true Connection Keep-Alive Accept-Ranges bytes Content-Length 43 Redirect headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:47 GMT Server nginx Access-Control-Allow-Origin * Location https://cdn.stickyadstv.com/one-shot/empty.gif? Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 0 x-sticky-vk 1638363707955085-408 Expires Wed, 01 Dec 2021 13:01:47 GMT
GET H/1.1	204 No Content	/ partner.mediawallahscript.com/ Frame 477D	0 638 B	31ms 31ms	Image text/plain	52.16.203.61 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-8O7UVBGg4sIPc6WC_JBfggvbPV1BMvlaxY-ElQ&custom=&tag_format=img&tag_action=sync&custom=&cb=6a352bca-3986-42e6-bba9-2bf4ad862648 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.16.203.61 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-16-203-61.eu-west-1.compute.amazonaws.com Software nginx/1.18.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:47 GMT Cache-Control private, no-cache, must-revalidate, no-store, max-age=0 Server nginx/1.18.0 Connection keep-alive P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H2	204	v1 ads.yahoo.com/cms/ Frame 477D	0 19 B	40ms 39ms	Image text/plain	2a00:1288:80:800::7001 YAHOO-DEB
General Check archive.org Show headers Download Go to Show image Full URL https://ads.yahoo.com/cms/v1?esig=1~7315a025058f3128185459bfaf16e164414683fc&nwid=10000545908&sigv=1 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT cache-control no-store x-content-type-options nosniff server ATS strict-transport-security max-age=15552000 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-xss-protection 1; mode=block
GET H2	204	sync ups.analytics.yahoo.com/ups/58301/ Frame 477D	0 18 B	14ms 11ms	Image text/plain	3.126.56.137 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-rKN4lRGg4sIPc6WC_JBfggvbPV0OCzdbLpWUrQ Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-126-56-137.eu-central-1.compute.amazonaws.com Software ATS/9.1.0.33 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:47 GMT server ATS/9.1.0.33 age 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H/1.1	204 No Content	tap.php pixel.rubiconproject.com/ Frame 477D	0 239 B	8ms 8ms	Image image/gif	69.173.144.138 RUBICONPROJECT
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-4MFAORGg4sIPc6WC_JBfggvbPV3qKc2mpULBJQ&expires=30 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Expires 0 Cache-Control no-cache,no-store,must-revalidate P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" X-RPHost a66cbf3142c6ef39e3614b84a34262cf Content-Type image/gif
GET H/1.1	200 OK	sync x.bidswitch.net/ Frame 477D	43 B 220 B	11ms 9ms	Image image/gif	3.120.56.129 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://x.bidswitch.net/sync?dsp_id=46&user_id=k-QxMoexGg4sIPc6WC_JBfggvbPV1nFZzAVlgyYA&expires=30&user_group=5 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.120.56.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-120-56-129.eu-central-1.compute.amazonaws.com Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:47 GMT Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Length 43 Content-Type image/gif
GET H2	200	cookiematch.aspx dis.criteo.com/dis/rtb/appnexus/ Frame 477D Redirect Chain https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1670073037217269206	43 B 342 B	37ms 37ms	Image image/gif	178.250.0.163 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Show image Full URL https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1670073037217269206 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Server 178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software Kestrel / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT content-type image/gif server Kestrel p3p CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA' cache-control no-cache cross-origin-resource-policy cross-origin server-processing-duration-in-ticks 2432776 timing-allow-origin * expires Mon, 26 Jul 1997 05:00:00 GMT Redirect headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:47 GMT X-Proxy-Origin 194.36.108.22; 194.36.108.22; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com AN-X-Request-Uuid 7d3317d1-35b3-44c4-a8d8-8693dcfd488f Server nginx/1.17.9 Access-Control-Allow-Origin * P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1670073037217269206 Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	sync x.bidswitch.net/ Frame F5EC	43 B 220 B	10ms 10ms	Image image/gif	3.120.56.129 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://x.bidswitch.net/sync?dsp_id=46&user_id=k-QxMoexGg4sIPc6WC_JBfggvbPV1nFZzAVlgyYA&expires=30&user_group=5 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.120.56.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-120-56-129.eu-central-1.compute.amazonaws.com Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 01 Dec 2021 13:01:47 GMT Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Length 43 Content-Type image/gif
GET H2	200	cookiematch.aspx dis.criteo.com/dis/rtb/appnexus/ Frame F5EC Redirect Chain https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1670073037217269206	43 B 342 B	24ms 24ms	Image image/gif	178.250.0.163 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Show image Full URL https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1670073037217269206 Protocol H2 Server 178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software Kestrel / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 13:01:47 GMT content-type image/gif server Kestrel p3p CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA' cache-control no-cache cross-origin-resource-policy cross-origin server-processing-duration-in-ticks 2524959 timing-allow-origin * expires Mon, 26 Jul 1997 05:00:00 GMT Redirect headers Pragma no-cache Date Wed, 01 Dec 2021 13:01:48 GMT X-Proxy-Origin 194.36.108.22; 194.36.108.22; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com AN-X-Request-Uuid 7d18ee2f-758e-40ae-adbe-eff79e6e443e Server nginx/1.17.9 Access-Control-Allow-Origin * P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1670073037217269206 Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	vendor.00021bae.js Show response beacon-v2.helpscout.net/static/js/ Frame D7C8	702 KB 196 KB	8ms 8ms	Script application/javascript	143.204.98.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://beacon-v2.helpscout.net/static/js/vendor.00021bae.js Requested by Host: beacon-v2.helpscout.net URL: https://beacon-v2.helpscout.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-38.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 3a2ef7f9d5e2367c3eab4c00d3176681ce5cb08165c93b923ae1af79dd338ca0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 11:54:22 GMT content-encoding gzip last-modified Wed, 01 Dec 2021 11:53:15 GMT server AmazonS3 age 4046 etag "562f9cf4d7301f22473859322a0284d1" x-cache Hit from cloudfront content-type application/javascript via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) cache-control max-age=315360000, s-maxage=7200, public x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 199788 x-amz-cf-id wainV1nxp23GFXBxS3nrKCYpfORY5HmMdDkRUiK1kjCvnaaLY5knRw==
GET H2	200	main.73fbc42b.js Show response beacon-v2.helpscout.net/static/js/ Frame D7C8	256 KB 64 KB	19ms 19ms	Script application/javascript	143.204.98.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://beacon-v2.helpscout.net/static/js/main.73fbc42b.js Requested by Host: beacon-v2.helpscout.net URL: https://beacon-v2.helpscout.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-38.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 485c6f41a2d2496161238f7ecdfc07355e14f46798febe3919537c7ef735919a Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 11:53:32 GMT content-encoding gzip last-modified Wed, 01 Dec 2021 11:53:15 GMT server AmazonS3 age 4096 etag "f0a424815d531ddbefbe5765d5d2d1c7" x-cache Hit from cloudfront content-type application/javascript via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) cache-control max-age=315360000, s-maxage=7200, public x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 65368 x-amz-cf-id COaqEYxavnuySMZ5XVSchhx0ohy2tqyeph2f32cKLWWrJ7v1GT56Gg==
GET DATA	200 OK	truncated / Frame CDF7	4 KB 4 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash aef991b2e0b693a95d41986576dd3901ea7ac03b379501b1caba966058753308 Request headers Referer Origin https://app.groove.cm Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type application/font-woff;charset=utf-8
GET H2	206	groovevideo-8d2985e0fd35262fe8daa16a82295540.mp4 videos.groovevideo.com/5dd590f1c586100f1285ee7a/ Frame CDF7	247 KB 0	492ms 475ms	Media video/mp4	2600:9000:2156:e00:b:d801:7900:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://videos.groovevideo.com/5dd590f1c586100f1285ee7a/groovevideo-8d2985e0fd35262fe8daa16a82295540.mp4 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:e00:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers Referer https://app.groove.cm/ Accept-Encoding identity;q=1, *;q=0 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Range bytes=0- Response headers date Wed, 01 Dec 2021 13:01:49 GMT via 1.1 f7b7cf90592cf6a380fd34cc45e9c4b5.cloudfront.net (CloudFront) last-modified Fri, 12 Nov 2021 16:18:22 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "d01b8de36dff0efab6b88f31a7dbeabc" x-cache Miss from cloudfront content-type video/mp4 Content-Range bytes 0-20764396/20764397 accept-ranges bytes Content-Length 20764397 x-amz-cf-id fCB3xUGCik1TmQaGoLpv1kUf-neuX8eZIjrhwdxuAOkpBB-jJs8DrA==
GET H2	206	groovevideo-213d95e6b4b4fcf88270eebb4d673595.mp4 videos.groovevideo.com/5dd590f1c586100f1285ee7a/ Frame D7C8	2 MB 0	39ms 22ms	Media video/mp4	2600:9000:2156:e00:b:d801:7900:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://videos.groovevideo.com/5dd590f1c586100f1285ee7a/groovevideo-213d95e6b4b4fcf88270eebb4d673595.mp4 Requested by Host: taxcreditrefund.com URL: https://taxcreditrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:e00:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers Referer https://app.groove.cm/ Accept-Encoding identity;q=1, *;q=0 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Range bytes=0- Response headers date Wed, 01 Dec 2021 03:28:53 GMT via 1.1 f7b7cf90592cf6a380fd34cc45e9c4b5.cloudfront.net (CloudFront) last-modified Fri, 12 Nov 2021 21:33:10 GMT server AmazonS3 age 34375 etag "f0a1f3fafedb3b07b52afe73134ecc80" x-cache Hit from cloudfront content-type video/mp4 Content-Range bytes 0-2626605/2626606 x-amz-cf-pop FRA50-C1 accept-ranges bytes Content-Length 2626606 x-amz-cf-id Y6J6JCYr4vxm8xyQaGZ2Uy7kVVMZSdM8oYcGmanG8mNm3DVURXPedQ==
GET H/1.1	200 OK	matomo.php matomo.groovetech.io/ Frame D7C8	43 B 217 B	111ms 111ms	Image image/gif	51.161.92.183 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://matomo.groovetech.io/matomo.php?action_name=Groovevideo%20%C2%B7%20Groovevideo&idsite=5&rec=1&r=549974&h=13&m=1&s=47&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&urlref=https%3A%2F%2Ftaxcreditrefund.com%2F&_id=f9f09c06ead6295b&_idts=1638363708&_idvc=1&_idn=1&_refts=1638363708&_viewts=1638363708&_ref=https%3A%2F%2Ftaxcreditrefund.com%2F&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=228&pv_id=lm4Lzm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.92.183 Laval, Canada, ASN16276 (OVH, FR), Reverse DNS ip183.ip-51-161-92.net Software nginx/1.19.2 / PHP/7.4.24 Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:48 GMT cache-control no-store server nginx/1.19.2 x-powered-by PHP/7.4.24 content-length 43 content-type image/gif
GET H/1.1	200 OK	matomo.php matomo.groovetech.io/ Frame CDF7	43 B 217 B	140ms 140ms	Image image/gif	51.161.92.183 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://matomo.groovetech.io/matomo.php?action_name=Groovevideo%20%C2%B7%20Groovevideo&idsite=5&rec=1&r=149436&h=13&m=1&s=47&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&urlref=https%3A%2F%2Ftaxcreditrefund.com%2F&_id=f9203b4f250b63f6&_idts=1638363708&_idvc=1&_idn=1&_refts=1638363708&_viewts=1638363708&_ref=https%3A%2F%2Ftaxcreditrefund.com%2F&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=238&pv_id=XaRYB9 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.92.183 Laval, Canada, ASN16276 (OVH, FR), Reverse DNS ip183.ip-51-161-92.net Software nginx/1.19.2 / PHP/7.4.16 Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer https://app.groove.cm/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 13:01:48 GMT cache-control no-store server nginx/1.19.2 x-powered-by PHP/7.4.16 content-length 43 content-type image/gif
GET H2	206	groovevideo-8d2985e0fd35262fe8daa16a82295540.mp4 videos.groovevideo.com/5dd590f1c586100f1285ee7a/ Frame CDF7	175 KB 0	782ms 782ms	Media video/mp4	2600:9000:2156:e00:b:d801:7900:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://videos.groovevideo.com/5dd590f1c586100f1285ee7a/groovevideo-8d2985e0fd35262fe8daa16a82295540.mp4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:e00:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers Referer https://app.groove.cm/ Accept-Encoding identity;q=1, *;q=0 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Range bytes=229376- Response headers date Wed, 01 Dec 2021 13:01:50 GMT via 1.1 f7b7cf90592cf6a380fd34cc45e9c4b5.cloudfront.net (CloudFront) last-modified Fri, 12 Nov 2021 16:18:22 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "d01b8de36dff0efab6b88f31a7dbeabc" x-cache Miss from cloudfront content-type video/mp4 Content-Range bytes 229376-20764396/20764397 accept-ranges bytes Content-Length 20535021 x-amz-cf-id cEyusUtVoK9aksVMD3U691ZqgARIirMkWSHDq0oXFQXlbQrt5rLZuQ==