www.elfcosmetics.com Open in urlscan Pro
204.2.133.49 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cosmeticcriminals.com/
Effective URL:
https://www.elfcosmetics.com/cosmetic-criminals
Submission: On January 01 via api (January 1st 2024, 9:56:46 am UTC) from US — Scanned from US

Summary HTTP 202 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 67 IPs in 3 countries across 54 domains to perform 202 HTTP transactions. The main IP is 204.2.133.49, located in United States and belongs to YOTTAA-AS-1, US. The main domain is www.elfcosmetics.com. The Cisco Umbrella rank of the primary domain is 78022.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 25th 2023. Valid for: a year.

This is the only time www.elfcosmetics.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	204.141.88.73 204.141.88.73	393259 (YOTTAA-AS-1) (YOTTAA-AS-1)
1 12	204.2.133.49 204.2.133.49	393259 (YOTTAA-AS-1) (YOTTAA-AS-1)
6	151.101.2.133 151.101.2.133	54113 (FASTLY) (FASTLY)
5	35.190.10.96 35.190.10.96	15169 (GOOGLE) (GOOGLE)
12	2606:4700::68... 2606:4700::6812:83ec	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2607:f8b0:400... 2607:f8b0:4004:c09::61	15169 (GOOGLE) (GOOGLE)
3	2600:9000:26a... 2600:9000:26a0:4200:a:b89d:a6c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	104.237.62.212 104.237.62.212	18450 (WEBNX) (WEBNX)
6	151.101.194.133 151.101.194.133	54113 (FASTLY) (FASTLY)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2607:f8b0:400... 2607:f8b0:4004:c07::66	15169 (GOOGLE) (GOOGLE)
1	2600:9000:215... 2600:9000:215f:600:11:85b0:d600:93a1	16509 (AMAZON-02) (AMAZON-02)
2 4	2607:f8b0:400... 2607:f8b0:4004:c17::9a	15169 (GOOGLE) (GOOGLE)
5	2607:f8b0:400... 2607:f8b0:4004:c1d::69	15169 (GOOGLE) (GOOGLE)
4 4	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2 3	68.67.160.132 68.67.160.132	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	172.253.63.155 172.253.63.155	15169 (GOOGLE) (GOOGLE)
3 3	34.200.65.202 34.200.65.202	14618 (AMAZON-AES) (AMAZON-AES)
1	23.218.218.25 23.218.218.25	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	34.206.78.39 34.206.78.39	14618 (AMAZON-AES) (AMAZON-AES)
1 2	54.157.127.36 54.157.127.36	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:269... 2600:9000:269f:ae00:15:ad21:c740:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4004:c1d::9b	15169 (GOOGLE) (GOOGLE)
1 2	142.251.163.148 142.251.163.148	15169 (GOOGLE) (GOOGLE)
1 2	142.251.163.149 142.251.163.149	15169 (GOOGLE) (GOOGLE)
1 1	54.192.51.117 54.192.51.117	16509 (AMAZON-02) (AMAZON-02)
1	3.161.213.49 3.161.213.49	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4004:c07::9b	15169 (GOOGLE) (GOOGLE)
6	3.161.213.115 3.161.213.115	16509 (AMAZON-02) (AMAZON-02)
1	52.3.200.153 52.3.200.153	14618 (AMAZON-AES) (AMAZON-AES)
3	2606:4700:440... 2606:4700:4400::6812:2a49	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	204.2.50.198 204.2.50.198	393259 (YOTTAA-AS-1) (YOTTAA-AS-1)
1	184.27.13.189 184.27.13.189	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.102.147.248 34.102.147.248	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
9	151.101.193.21 151.101.193.21	54113 (FASTLY) (FASTLY)
1	2600:1408:c40... 2600:1408:c400:59::17d5:9e04	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2600:9000:269... 2600:9000:269f:4e00:13:d6f4:3240:93a1	16509 (AMAZON-02) (AMAZON-02)
1	142.251.167.155 142.251.167.155	15169 (GOOGLE) (GOOGLE)
2	54.230.48.245 54.230.48.245	16509 (AMAZON-02) (AMAZON-02)
2	2600:1408:c40... 2600:1408:c400:38f::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f07... 2a03:2880:f07d:0:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a04:4e42:600... 2a04:4e42:600::396	54113 (FASTLY) (FASTLY)
9	23.218.216.202 23.218.216.202	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2600:9000:21a... 2600:9000:21a2:5a00:a:7914:b00:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.225.195.64 13.225.195.64	16509 (AMAZON-02) (AMAZON-02)
1	34.120.253.250 34.120.253.250	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	151.101.193.140 151.101.193.140	54113 (FASTLY) (FASTLY)
1	3.220.158.64 3.220.158.64	14618 (AMAZON-AES) (AMAZON-AES)
2	151.101.193.35 151.101.193.35	54113 (FASTLY) (FASTLY)
1 7	35.190.43.134 35.190.43.134	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:34::181	15169 (GOOGLE) (GOOGLE)
3	151.101.192.84 151.101.192.84	54113 (FASTLY) (FASTLY)
2	34.98.67.3 34.98.67.3	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.198.176.45 34.198.176.45	14618 (AMAZON-AES) (AMAZON-AES)
3	107.20.54.57 107.20.54.57	14618 (AMAZON-AES) (AMAZON-AES)
1	2a03:2880:f17... 2a03:2880:f171:81:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	23.222.5.91 23.222.5.91	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	192.229.210.155 192.229.210.155	15133 (EDGECAST) (EDGECAST)
17	34.98.72.95 34.98.72.95	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	3.162.3.47 3.162.3.47	16509 (AMAZON-02) (AMAZON-02)
1	34.117.254.15 34.117.254.15	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.117.86.137 34.117.86.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.149.239.87 34.149.239.87	15169 (GOOGLE) (GOOGLE)
2 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	54.154.97.89 54.154.97.89	16509 (AMAZON-02) (AMAZON-02)
13	192.225.157.157 192.225.157.157	30286 (THM) (THM)
2	192.225.158.1 192.225.158.1	30286 (THM) (THM)
1	192.225.158.3 192.225.158.3	30286 (THM) (THM)
1	2600:1901:0:5... 2600:1901:0:56e0::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	34.149.130.207 34.149.130.207	15169 (GOOGLE) (GOOGLE)
2 2	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
6	34.111.8.32 34.111.8.32	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	34.149.254.212 34.149.254.212	15169 (GOOGLE) (GOOGLE)
1 1	107.178.254.65 107.178.254.65	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
202	67

1 204.141.88.73 (United States) 1 redirects

ASN393259 (YOTTAA-AS-1, US)

cosmeticcriminals.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 204.2.133.49 (United States) 1 redirects

ASN393259 (YOTTAA-AS-1, US)

www.elfcosmetics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.2.133 (United States)

ASN54113 (FASTLY, US)

cdn-fsly.yottaa.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.190.10.96 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 96.10.190.35.bc.googleusercontent.com

collector-pxxt4gy2ig.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6812:83ec (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c09::61 (Ashburn, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:26a0:4200:a:b89d:a6c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.dynamicyield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.237.62.212 (El Segundo, United States)

ASN18450 (WEBNX, US)
PTR: api.ipify.org

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.194.133 (United States)

ASN54113 (FASTLY, US)

sdk.iad-05.braze.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4004:c07::66 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:215f:600:11:85b0:d600:93a1 (United States)

ASN16509 (AMAZON-02, US)

js.cnnx.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c17::9a (Washington, United States) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4004:c1d::69 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.223.40.198 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.67.160.132 (Jersey City, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.63.155 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bi-in-f155.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.200.65.202 (Ashburn, United States) 3 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-65-202.compute-1.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.218.218.25 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-218-218-25.deploy.static.akamaitechnologies.com

hb.yahoo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.206.78.39 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-78-39.compute-1.amazonaws.com

pixel.pointmediatracker.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.157.127.36 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-157-127-36.compute-1.amazonaws.com

cnv.event.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:269f:ae00:15:ad21:c740:93a1 (United States)

ASN16509 (AMAZON-02, US)

st.dynamicyield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1d::9b (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.163.148 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: wv-in-f148.1e100.net

9231397.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.163.149 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: wv-in-f149.1e100.net

10742279.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.51.117 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-54-192-51-117.yul62.r.cloudfront.net

ads.undertone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.161.213.49 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-213-49.yul62.r.cloudfront.net

evt.undertone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c07::9b (Washington, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.161.213.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-213-115.yul62.r.cloudfront.net

async-px.dynamicyield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.3.200.153 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-200-153.compute-1.amazonaws.com

px.dynamicyield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:4400::6812:2a49 (United States)

ASN13335 (CLOUDFLARENET, US)

elfcosmetics.a.bigcontent.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 204.2.50.198 (United States)

ASN393259 (YOTTAA-AS-1, US)

qoe-1.yottaa.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.27.13.189 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-27-13-189.deploy.static.akamaitechnologies.com

static.ordergroove.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.147.248 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 248.147.102.34.bc.googleusercontent.com

tag.rmp.rakuten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 151.101.193.21 (United States)

ASN54113 (FASTLY, US)

www.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:c400:59::17d5:9e04 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

websdk.appsflyer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:269f:4e00:13:d6f4:3240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.usehero.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.167.155 (United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f155.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.230.48.245 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-48-245.yul62.r.cloudfront.net

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1408:c400:38f::1931 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f07d:0:face:b00c:0:3 (Apodaca, Mexico)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.218.216.202 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-218-216-202.deploy.static.akamaitechnologies.com

analytics.tiktok.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:21a2:5a00:a:7914:b00:93a1 (United States)

ASN16509 (AMAZON-02, US)

js.jebbit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.195.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-195-64.yul62.r.cloudfront.net

t.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.253.250 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 250.253.120.34.bc.googleusercontent.com

tag.wknd.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.220.158.64 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-158-64.compute-1.amazonaws.com

api.usehero.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.193.35 (United States)

ASN54113 (FASTLY, US)

t.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 35.190.43.134 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 134.43.190.35.bc.googleusercontent.com

tr.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tr6.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.192.84 (United States)

ASN54113 (FASTLY, US)

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.67.3 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 3.67.98.34.bc.googleusercontent.com

ut.rd.linksynergy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tags.rd.linksynergy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.198.176.45 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-198-176-45.compute-1.amazonaws.com

external-api.jebbit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 107.20.54.57 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-20-54-57.compute-1.amazonaws.com

c.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f171:81:face:b00c:0:25de (Apodaca, Mexico)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.222.5.91 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-222-5-91.deploy.static.akamaitechnologies.com

analytics.pangle-ads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.229.210.155 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 34.98.72.95 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 95.72.98.34.bc.googleusercontent.com

assets.bounceexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.162.3.47 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-162-3-47.yul62.r.cloudfront.net

cdn-scripts.signifyd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.254.15 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 15.254.117.34.bc.googleusercontent.com

data.cdnbasket.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.86.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.86.117.34.bc.googleusercontent.com

page.cdnbasket.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.149.239.87 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 87.239.149.34.bc.googleusercontent.com

view.cdnbasket.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.154.97.89 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-97-89.eu-west-1.compute.amazonaws.com

srm.ba.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 192.225.157.157 (United States)

ASN30286 (THM, US)

imgs.signifyd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.225.158.1 (United States)

ASN30286 (THM, US)
PTR: a-sac.h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.225.158.3 (United States)

ASN30286 (THM, US)
PTR: d.aa.online-metrix.net

w2txo5aamha37dhyt6s4zo3cbugt326k3vkuullxd71637e429220a89sac.d.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:56e0:: (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

ids.cdnwidget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.149.130.207 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 207.130.149.34.bc.googleusercontent.com

pd.cdnwidget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
idr.cdnwidget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.111.8.32 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 32.8.111.34.bc.googleusercontent.com

api.bounceexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
events.bouncex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.149.254.212 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 212.254.149.34.bc.googleusercontent.com

pix.cdnwidget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.178.254.65 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	bounceexchange.com assets.bounceexchange.com — Cisco Umbrella Rank: 2050 api.bounceexchange.com — Cisco Umbrella Rank: 2223	530 KB
15	signifyd.com cdn-scripts.signifyd.com — Cisco Umbrella Rank: 6824 imgs.signifyd.com — Cisco Umbrella Rank: 5865	94 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 324	322 KB
12	elfcosmetics.com 1 redirects www.elfcosmetics.com — Cisco Umbrella Rank: 78022	296 KB
11	paypal.com www.paypal.com — Cisco Umbrella Rank: 2085 t.paypal.com — Cisco Umbrella Rank: 2568	238 KB
11	doubleclick.net 9231397.fls.doubleclick.net — Cisco Umbrella Rank: 188726 Failed 10742279.fls.doubleclick.net — Cisco Umbrella Rank: 192049 Failed googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 cm.g.doubleclick.net — Cisco Umbrella Rank: 219 stats.g.doubleclick.net — Cisco Umbrella Rank: 75	7 KB
11	dynamicyield.com cdn.dynamicyield.com — Cisco Umbrella Rank: 6084 st.dynamicyield.com — Cisco Umbrella Rank: 5745 async-px.dynamicyield.com — Cisco Umbrella Rank: 5840 px.dynamicyield.com — Cisco Umbrella Rank: 23654	227 KB
9	tiktok.com analytics.tiktok.com — Cisco Umbrella Rank: 617	263 KB
9	google.com www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 93 analytics.google.com — Cisco Umbrella Rank: 152	2 KB
7	snapchat.com 1 redirects tr.snapchat.com — Cisco Umbrella Rank: 758 tr6.snapchat.com — Cisco Umbrella Rank: 88800	2 KB
7	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
7	yottaa.net cdn-fsly.yottaa.net — Cisco Umbrella Rank: 13848 Failed qoe-1.yottaa.net — Cisco Umbrella Rank: 6173	1 MB
6	braze.com sdk.iad-05.braze.com — Cisco Umbrella Rank: 3954	1 KB
5	bouncex.net events.bouncex.net — Cisco Umbrella Rank: 1871	512 B
5	cdnwidget.com 1 redirects ids.cdnwidget.com — Cisco Umbrella Rank: 3280 pd.cdnwidget.com — Cisco Umbrella Rank: 3186 pix.cdnwidget.com — Cisco Umbrella Rank: 4293 idr.cdnwidget.com — Cisco Umbrella Rank: 5705	2 KB
5	contentsquare.net t.contentsquare.net — Cisco Umbrella Rank: 3083 c.contentsquare.net — Cisco Umbrella Rank: 3307 srm.ba.contentsquare.net — Cisco Umbrella Rank: 13368	69 KB
5	px-cloud.net collector-pxxt4gy2ig.px-cloud.net — Cisco Umbrella Rank: 167677	2 KB
4	adsrvr.org 4 redirects insight.adsrvr.org — Cisco Umbrella Rank: 557 match.adsrvr.org — Cisco Umbrella Rank: 331	2 KB
3	online-metrix.net h.online-metrix.net — Cisco Umbrella Rank: 2534 w2txo5aamha37dhyt6s4zo3cbugt326k3vkuullxd71637e429220a89sac.d.aa.online-metrix.net	16 KB
3	cdnbasket.net data.cdnbasket.net — Cisco Umbrella Rank: 4140 page.cdnbasket.net — Cisco Umbrella Rank: 4148 view.cdnbasket.net — Cisco Umbrella Rank: 4147	1014 B
3	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 1965	33 KB
3	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 715	1 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 329	14 KB
3	jebbit.com js.jebbit.com — Cisco Umbrella Rank: 33156 external-api.jebbit.com — Cisco Umbrella Rank: 39914	60 KB
3	bigcontent.io elfcosmetics.a.bigcontent.io — Cisco Umbrella Rank: 128663	8 KB
3	yahoo.com 3 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 307	877 B
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 229 secure.adnxs.com — Cisco Umbrella Rank: 478	2 KB
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 408	836 B
2	tapad.com 2 redirects pixel.tapad.com — Cisco Umbrella Rank: 465	1 KB
2	linksynergy.com ut.rd.linksynergy.com — Cisco Umbrella Rank: 6223 tags.rd.linksynergy.com — Cisco Umbrella Rank: 4434	698 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 168	92 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 745	21 KB
2	sc-static.net sc-static.net — Cisco Umbrella Rank: 945	35 KB
2	usehero.com cdn.usehero.com — Cisco Umbrella Rank: 31511 api.usehero.com — Cisco Umbrella Rank: 29821	29 KB
2	undertone.com 1 redirects ads.undertone.com — Cisco Umbrella Rank: 5720 evt.undertone.com — Cisco Umbrella Rank: 5287	1005 B
2	bidr.io 1 redirects cnv.event.prod.bidr.io — Cisco Umbrella Rank: 7763	1 KB
2	ipify.org api.ipify.org — Cisco Umbrella Rank: 2843	444 B
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	211 KB
1	pippio.com 1 redirects pippio.com — Cisco Umbrella Rank: 777	576 B
1	pangle-ads.com analytics.pangle-ads.com — Cisco Umbrella Rank: 2266	821 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	185 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1387	637 B
1	wknd.ai tag.wknd.ai — Cisco Umbrella Rank: 3860	6 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1266	9 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138	2 KB
1	appsflyer.com websdk.appsflyer.com — Cisco Umbrella Rank: 4632	12 KB
1	rakuten.com tag.rmp.rakuten.com — Cisco Umbrella Rank: 5888	15 KB
1	ordergroove.com static.ordergroove.com — Cisco Umbrella Rank: 16302	42 KB
1	pointmediatracker.com 1 redirects pixel.pointmediatracker.com — Cisco Umbrella Rank: 4562	497 B
1	yahoo.net hb.yahoo.net — Cisco Umbrella Rank: 866	663 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 339	916 B
1	cnnx.link js.cnnx.link — Cisco Umbrella Rank: 6403	1 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 548	306 B
1	cosmeticcriminals.com 1 redirects cosmeticcriminals.com	325 B
202	54

	Domain	Requested by
17	assets.bounceexchange.com	www.elfcosmetics.com
13	imgs.signifyd.com	www.elfcosmetics.com imgs.signifyd.com
12	cdn.cookielaw.org	cdn-fsly.yottaa.net cdn.cookielaw.org www.elfcosmetics.com
12	www.elfcosmetics.com	1 redirects www.elfcosmetics.com cdn-fsly.yottaa.net
9	analytics.tiktok.com	www.elfcosmetics.com analytics.tiktok.com
9	www.paypal.com	www.elfcosmetics.com www.paypal.com www.paypalobjects.com
7	www.google-analytics.com	www.elfcosmetics.com www.google-analytics.com
6	tr.snapchat.com	1 redirects www.elfcosmetics.com sc-static.net
6	async-px.dynamicyield.com	cdn.dynamicyield.com
6	sdk.iad-05.braze.com	cdn-fsly.yottaa.net
6	cdn-fsly.yottaa.net	www.elfcosmetics.com
5	events.bouncex.net
5	www.google.com	www.elfcosmetics.com
5	collector-pxxt4gy2ig.px-cloud.net	www.elfcosmetics.com
4	googleads.g.doubleclick.net	2 redirects www.elfcosmetics.com
3	www.paypalobjects.com	www.elfcosmetics.com www.paypalobjects.com
3	c.contentsquare.net
3	ct.pinterest.com	s.pinimg.com www.elfcosmetics.com
3	bat.bing.com	www.elfcosmetics.com
3	elfcosmetics.a.bigcontent.io	www.elfcosmetics.com
3	ups.analytics.yahoo.com	3 redirects
3	match.adsrvr.org	3 redirects
3	cdn.dynamicyield.com	www.elfcosmetics.com
2	pix.cdnwidget.com	1 redirects
2	idsync.rlcdn.com	2 redirects
2	h.online-metrix.net	imgs.signifyd.com
2	pixel.tapad.com	2 redirects
2	cdn-scripts.signifyd.com	www.elfcosmetics.com
2	analytics.google.com	www.googletagmanager.com
2	t.paypal.com
2	js.jebbit.com	www.elfcosmetics.com
2	connect.facebook.net	www.elfcosmetics.com
2	s.pinimg.com	www.elfcosmetics.com
2	sc-static.net	www.elfcosmetics.com tr.snapchat.com
2	adservice.google.com	9231397.fls.doubleclick.net 10742279.fls.doubleclick.net
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	cnv.event.prod.bidr.io	1 redirects www.elfcosmetics.com
2	ib.adnxs.com	2 redirects
2	10742279.fls.doubleclick.net	www.googletagmanager.com cdn.cookielaw.org
2	9231397.fls.doubleclick.net	www.googletagmanager.com cdn.cookielaw.org
2	api.ipify.org	cdn-fsly.yottaa.net
2	www.googletagmanager.com	www.elfcosmetics.com
1	idr.cdnwidget.com
1	pippio.com	1 redirects
1	api.bounceexchange.com	www.elfcosmetics.com
1	tags.rd.linksynergy.com
1	pd.cdnwidget.com	assets.bounceexchange.com
1	ids.cdnwidget.com	assets.bounceexchange.com
1	w2txo5aamha37dhyt6s4zo3cbugt326k3vkuullxd71637e429220a89sac.d.aa.online-metrix.net
1	srm.ba.contentsquare.net	t.contentsquare.net
1	view.cdnbasket.net	assets.bounceexchange.com
1	page.cdnbasket.net	assets.bounceexchange.com
1	data.cdnbasket.net	assets.bounceexchange.com
1	tr6.snapchat.com	sc-static.net
1	analytics.pangle-ads.com	analytics.tiktok.com
1	www.facebook.com
1	external-api.jebbit.com	js.jebbit.com
1	ut.rd.linksynergy.com	www.elfcosmetics.com
1	api.usehero.com	cdn.usehero.com
1	alb.reddit.com
1	tag.wknd.ai	www.elfcosmetics.com
1	t.contentsquare.net	www.elfcosmetics.com
1	www.redditstatic.com	www.elfcosmetics.com
1	www.googleadservices.com	www.elfcosmetics.com
1	cdn.usehero.com	www.elfcosmetics.com
1	websdk.appsflyer.com	www.elfcosmetics.com
1	tag.rmp.rakuten.com	www.elfcosmetics.com
1	static.ordergroove.com	www.elfcosmetics.com
1	qoe-1.yottaa.net	www.elfcosmetics.com
1	px.dynamicyield.com	cdn.dynamicyield.com
1	evt.undertone.com	9231397.fls.doubleclick.net
1	ads.undertone.com	1 redirects
1	secure.adnxs.com	www.elfcosmetics.com
1	st.dynamicyield.com	www.elfcosmetics.com
1	pixel.pointmediatracker.com	1 redirects
1	hb.yahoo.net	www.elfcosmetics.com
1	cm.g.doubleclick.net	1 redirects
1	pixel.rubiconproject.com	1 redirects
1	insight.adsrvr.org	1 redirects
1	js.cnnx.link	www.googletagmanager.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	cosmeticcriminals.com	1 redirects
202	82

This site contains links to these domains. Also see Links.

Domain
cdn.dynamicyield.com
st.dynamicyield.com
rcom.dynamicyield.com
www.tiktok.com
www.instagram.com
www.pinterest.com
www.facebook.com
www.youtube.com
twitter.com
www.snapchat.com
www.linkedin.com
www.elfbeauty.com
elfcosmetics.onelink.me
preferences.elfcosmetics.com
www.onetrust.com

Subject Issuer	Validity	Valid
*.elfcosmetics.com Sectigo RSA Domain Validation Secure Server CA	`2023-09-25` - `2024-10-25`	a year	crt.sh
*.yottaa.net GlobalSign RSA OV SSL CA 2018	`2023-09-13` - `2024-10-14`	a year	crt.sh
*.px-cloud.net Sectigo RSA Domain Validation Secure Server CA	`2023-08-15` - `2024-09-13`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2023-04-01` - `2024-03-31`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.dynamicyield.com Amazon RSA 2048 M02	`2023-09-03` - `2024-10-01`	a year	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh
*.iad-05.braze.com GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-07-27` - `2024-08-27`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh
js.cnnx.link Amazon RSA 2048 M02	`2023-07-11` - `2024-08-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.bigcontent.io GeoTrust TLS RSA CA G1	`2023-03-14` - `2024-04-13`	a year	crt.sh
*.ordergroove.com Go Daddy Secure Certificate Authority - G2	`2023-08-04` - `2024-08-17`	a year	crt.sh
tag.rmp.rakuten.com GTS CA 1D4	`2023-12-02` - `2024-03-01`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2023-10-13` - `2024-08-20`	10 months	crt.sh
*.appsflyer.com DigiCert TLS RSA SHA256 2020 CA1	`2023-07-27` - `2024-07-27`	a year	crt.sh
*.usehero.com Amazon RSA 2048 M02	`2023-08-28` - `2024-09-24`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
sc-static.net Amazon RSA 2048 M03	`2023-12-21` - `2025-01-18`	a year	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-07` - `2024-08-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-10-10` - `2024-01-08`	3 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-25` - `2024-02-21`	6 months	crt.sh
*.tiktok.com RapidSSL ECC CA 2018	`2023-07-14` - `2024-08-13`	a year	crt.sh
*.jebbit.com Amazon RSA 2048 M01	`2023-05-24` - `2024-06-21`	a year	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 01	`2023-10-24` - `2024-04-21`	6 months	crt.sh
t.contentsquare.net Amazon RSA 2048 M01	`2023-09-13` - `2024-10-11`	a year	crt.sh
tag.wknd.ai R3	`2023-11-20` - `2024-02-18`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-09-01` - `2024-02-28`	6 months	crt.sh
api.usehero.com Amazon RSA 2048 M01	`2023-02-05` - `2024-03-05`	a year	crt.sh
t.paypal.com DigiCert SHA2 Extended Validation Server CA	`2023-09-21` - `2024-10-21`	a year	crt.sh
*.snap.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-13` - `2024-04-12`	a year	crt.sh
*.rd.linksynergy.com ZeroSSL RSA Domain Secure Site CA	`2023-02-13` - `2024-02-13`	a year	crt.sh
dep.bf.contentsquare.net Amazon RSA 2048 M01	`2023-03-20` - `2024-04-17`	a year	crt.sh
*.pangle-ads.com RapidSSL TLS ECC CA G1	`2023-08-10` - `2024-09-09`	a year	crt.sh
assets.bounceexchange.com GTS CA 1D4	`2023-11-20` - `2024-02-18`	3 months	crt.sh
cdn-scripts.signifyd.com Amazon RSA 2048 M01	`2023-07-03` - `2024-07-31`	a year	crt.sh
data.cdnbasket.net GTS CA 1D4	`2023-11-12` - `2024-02-10`	3 months	crt.sh
page.cdnbasket.net GTS CA 1D4	`2023-11-15` - `2024-02-13`	3 months	crt.sh
view.cdnbasket.net GTS CA 1D4	`2023-11-20` - `2024-02-18`	3 months	crt.sh
srm.ba.contentsquare.net Amazon RSA 2048 M02	`2023-11-07` - `2024-12-06`	a year	crt.sh
imgs.signifyd.com Go Daddy Secure Certificate Authority - G2	`2023-10-20` - `2024-11-20`	a year	crt.sh
h.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2023-01-09` - `2024-01-23`	a year	crt.sh
*.d.aa.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2023-03-03` - `2024-03-04`	a year	crt.sh
ids.cdnwidget.com R3	`2023-11-13` - `2024-02-11`	3 months	crt.sh
pd.cdnwidget.com R3	`2023-11-13` - `2024-02-11`	3 months	crt.sh
*.wunderkind.co R3	`2023-12-06` - `2024-03-05`	3 months	crt.sh
idr.cdnwidget.com R3	`2023-11-13` - `2024-02-11`	3 months	crt.sh

This page contains 13 frames:

Primary Page: https://www.elfcosmetics.com/cosmetic-criminals
Frame ID: 99F12713EA07A9E23AA11E1E9CD39979
Requests: 166 HTTP requests in this frame

Frame: https://9231397.fls.doubleclick.net/activityi;dc_pre=CNCf4K72u4MDFdQXigMdQoQJcg;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals
Frame ID: 629697A77BE5CA75746A8AB0E829D87B
Requests: 4 HTTP requests in this frame

Frame: https://10742279.fls.doubleclick.net/activityi;dc_pre=CKbW4K72u4MDFb0aigMdV7MMCw;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals
Frame ID: B5553CA22DE5F2E9E2370FA436D2ADBB
Requests: 3 HTTP requests in this frame

Frame: https://www.paypal.com/credit-presentment/experiments/local?uid=uid_numhnacfzmymuvpacsidplhppphjzs&disableSetCookie=true&features=disable-set-cookie&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEtRVFGWUZkbUtOeHRaUkJvUmR2MmNodlFJLV9aUHZMMWpWTjlTRllDVHNlS1Q0T0hQS3JuVDJ5Smx4OGtXS25GSTdKWEVKTV9jVFNkYmYmaW50ZW50PWF1dGhvcml6ZSZjdXJyZW5jeT1VU0QmdmF1bHQ9dHJ1ZSZjb21wb25lbnRzPWJ1dHRvbnMsbWVzc2FnZXMiLCJhdHRycyI6eyJkYXRhLXNkay1pbnRlZ3JhdGlvbi1zb3VyY2UiOiJyZWFjdC1wYXlwYWwtanMiLCJkYXRhLXVpZCI6InVpZF9udW1obmFjZnpteW11dnBhY3NpZHBsaHBwcGhqenMifX0&env=production&scriptUID=uid_numhnacfzmymuvpacsidplhppphjzs&version=1.53.0&integrationType=SDK
Frame ID: 5065A314649A2B5295FBB6C026FC0638
Requests: 4 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=c69c204f-fba0-4685-aea8-ad32f799fa5d&u_scsid=a2c80c5e-ee22-4bd8-8cd2-71487f90a94c&u_sclid=6e99d7bc-4a1f-4c52-adc8-d39149da641c
Frame ID: BC5F0E809744FCCBA60460DF3BF52A5A
Requests: 2 HTTP requests in this frame

Frame: https://www.paypalobjects.com/muse/analytics/index.html
Frame ID: E9D2F1A240F576777969A88E8AC76666
Requests: 3 HTTP requests in this frame

Frame: https://assets.bounceexchange.com/assets/bounce/local_storage_frame17.min.html
Frame ID: 89B8891DFFCD8C77A13DC0460ECD2C5D
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/p?rand=1703024924203&pnid=140&pcid=0b0e1874-2e7f-4930-a78c-7aba836ebedc
Frame ID: BDBF56F37C825313FD49F757D15DABB5
Requests: 1 HTTP requests in this frame

Frame: https://ct.pinterest.com/ct.html
Frame ID: 8724637F4A39EC7C5C119CA01E088990
Requests: 1 HTTP requests in this frame

Frame: https://imgs.signifyd.com/xWu0lyV27fXYkLmF?0490cd7fb95face5=em8IlAO9Cezpci_v1Wnr1MnipKhLsdOZzKwBmB6enUUD7SfoK6jZBkDOABPX8a-cgELpsfijlC1N-oBgHSdGE5jGI-7PxB19VP73j-HF9ZG35JYrY2W9xY_AqgMiVDD-HABAnOLWKlnZ2isTpN0Gmcn8S4S2AJKxwOJWtB1vgsFphS4c-G3GSKkbPEcUWx0DanheQQgT5THETkKb&jb=3d3b2c2e6279657f375763666e6f7d7b2e607165355761646c6d77732f323a333b2c62736a77374b607865676f26607b683d49607a656f6f2d32383b3a32
Frame ID: 3FBCEDAA5DD1950A738107D3DE12E569
Requests: 10 HTTP requests in this frame

Frame: https://imgs.signifyd.com/4qt9Ip9NkewrIrh2?3adb6cf73644d251=RBdMTng1eiQ_pjX3YeLYJ34PS_nccdzPuiRofa0beWbcy54Dnyy7UpSwtg9LwoZms4vGi_JHZ9YM1PmtSsPz5BmiK0j-MleOt9esZxHnxxNVmfNre6a8R0eEmqpQuk25C61lFz_3vi_VYKfwrRT5TJrCFEq60Nvj0L1StzFC2BEgVfNy3BjQ7zOTW6mfK2_-B65eF3vlg-ctPXta7qY
Frame ID: D114DA3105E43B7E731A95BF5D2F014D
Requests: 2 HTTP requests in this frame

Frame: https://h.online-metrix.net/n3TZXCLdqdZz8U45?d3358eee210d6e79=3Pew4pWgXNieedmDTtf2SDgbXcHCmCpC9atyBz3Nu2e3PZvL3YSdq3cYOHy5iw5XzJotGLxhmSHj1l_bImbDAOzn5XPqUS-p8GYsQm0gRQEZVeh5KzxWX7ck3LTvHDcyDRcxsVAQtgsj8MfLJEUZTNnTg1_jzQ3KiGUv2madHkY3Zed8Wv6vh662C_tDbLuhWRsU3c-57pS8ZPLVezDX
Frame ID: 5570C6249744835732DDDF4CED3FC588
Requests: 2 HTTP requests in this frame

Frame: https://imgs.signifyd.com/w9ONHuVRAcbx-Tpd?74a7c4172d6faaf2=lv_LKA-UcO6M-KSFMadTI4pB7t7rDedXoy4up6Wz_Yv-5cyZGxJ8asqu7jPGx3LIDuLqv4P68FIemcccgWNuGCPt3baHdd0gi0kIcWUTTGrLiKDpb8TjsqJrlmWiAD1WuaWLPru6O3RPYKPSPUsGuJ9cyiZeeYidUlp8drdHL-UGScqboOx1mZN0SFeycixZfpSgwuNo5M3o8-kchvfW
Frame ID: D875641BDEACD9750445AD001708E57D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Back ButtonSearch IconFilter Icon

Page URL History Show full URLs

https://cosmeticcriminals.com/ HTTP 301
https://www.elfcosmetics.com/cosmetic-criminals Page URL

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Dynamic Yield (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

cdn\.dynamicyield\.\w+/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

PerimeterX (Security) Expand

Overall confidence: 100%
Detected patterns

Rakuten (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

tag\.rmp\.rakuten\.com

basket.js (JavaScript Libraries) Expand

Overall confidence: 10%
Detected patterns

basket.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

202
Requests

94 %
HTTPS

29 %
IPv6

54
Domains

82
Subdomains

67
IPs

3
Countries

3802 kB
Transfer

13832 kB
Size

92
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://cdn.dynamicyield.com/

Search URL Search Domain Scan URL

URL: https://st.dynamicyield.com/

Search URL Search Domain Scan URL

URL: https://rcom.dynamicyield.com/

Search URL Search Domain Scan URL

URL: https://www.tiktok.com/@elfyeah/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/elfcosmetics/

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/elfcosmetics/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/elfcosmetics/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/eyeslipsfacedotcom

Search URL Search Domain Scan URL

URL: https://twitter.com/elfcosmetics

Search URL Search Domain Scan URL

URL: https://www.snapchat.com/add/elfcosmetics

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/e-l-f-beauty

Search URL Search Domain Scan URL

URL: https://www.elfbeauty.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://elfcosmetics.onelink.me/wTtZ/AcrossSiteCosmetics

Search URL Search Domain Scan URL

URL: https://preferences.elfcosmetics.com/dont_sell
Title: Do Not Sell My Personal Info/Opt Out of Targeted Ads

Search URL Search Domain Scan URL

URL: https://preferences.elfcosmetics.com/privacy
Title: Privacy Rights Request Form

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cosmeticcriminals.com/ HTTP 301
https://www.elfcosmetics.com/cosmetic-criminals Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 19

https://www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/authorize?redirect_uri=https%3A%2F%2Fwww.elfcosmetics.com%2Fcallback&response_type=code&client_id=f9f7052a-f742-4c38-bdf5-1da004e7fb3b&hint=guest&channel_id=elf-us&code_challenge=P804Ohj-Jfu9Rs4h-g-x2uCbKnP51bMR2S43PjRa-JM HTTP 303
https://www.elfcosmetics.com/callback?usid=2eeca965-d19a-4748-8988-73649158393f&code=iLndwgVfWGlYxbSBRWyNkANmI9iP0WrAYoWVQga3Gac

Request Chain 29

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/698270988/?random=1704102997256&cv=11&fst=1704102997256&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&hn=www.googleadservices.com&frm=0&auid=1145590087.1704102997&uamb=0&uaw=0&data=ecomm_prodid%3D%3Becomm_totalvalue%3D HTTP 302
https://www.google.com/pagead/1p-user-list/698270988/?random=1704102997256&cv=11&fst=1704099600000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&frm=0&data=ecomm_prodid%3D%3Becomm_totalvalue%3D&is_vtc=1&cid=CAQSGwAvHhf_SPa_KRwyEMG2zV4l2YnbdELa2ik3QA&random=1553330161

Request Chain 30

https://insight.adsrvr.org/track/pxl/?adv=3ftfnh3&ct=0:8m23e30&fmt=3 HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=0af71ab2-cea5-4d86-a5a8-39b5271f8832 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D0af71ab2-cea5-4d86-a5a8-39b5271f8832 HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5990193701797365675&ttd_tdid=0af71ab2-cea5-4d86-a5a8-39b5271f8832 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0af71ab2-cea5-4d86-a5a8-39b5271f8832&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=MGFmNzFhYjItY2VhNS00ZDg2LWE1YTgtMzliNTI3MWY4ODMy&gdpr=0&gdpr_consent=&ttd_tdid=0af71ab2-cea5-4d86-a5a8-39b5271f8832 HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&google_gid=CAESEIQdvT6yJpcEsN1jxZnyIOU&google_cver=1 HTTP 302
https://ups.analytics.yahoo.com/ups/55953/sync?uid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true HTTP 302
https://ups.analytics.yahoo.com/ups/55953/sync?uid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=55953&ovsid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&gdpr=0&redir=true HTTP 302
https://hb.yahoo.net/cksync?cs=63&axid_e=eS12dDc5UHJsRTJ1SE1ieUR0LkhPbDVCUWFrSjZPOWs1bH5B&gdpr=0&ovsid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&dpid=55953

Request Chain 31

https://pixel.pointmediatracker.com/kpi?c=elfcosmetics&kpi=visit&tag_id=244&fpc=8451e0c1-ecb3-4b73-b4bf-e36d9fb3a53a&user_id=&utm_source=undefined&utm_medium=undefined&utm_campaign=undefined&new=undefined&gtmcb=1195126331 HTTP 302
https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=03bf2c12-fc57-464f-8e5c-9723e630e503.&ord=2351504529137125996 HTTP 303
https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=03bf2c12-fc57-464f-8e5c-9723e630e503.&ord=2351504529137125996&_bee_ppp=1

Request Chain 42

https://9231397.fls.doubleclick.net/activityi;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals HTTP 302
https://9231397.fls.doubleclick.net/activityi;dc_pre=CNCf4K72u4MDFdQXigMdQoQJcg;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals

Request Chain 43

https://10742279.fls.doubleclick.net/activityi;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals HTTP 302
https://10742279.fls.doubleclick.net/activityi;dc_pre=CKbW4K72u4MDFb0aigMdV7MMCw;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals

Request Chain 52

https://ads.undertone.com/t?trackerid=7729&cb=1499990551 HTTP 307
https://evt.undertone.com/t?trackerid=7729&cb=1499990551

Request Chain 101

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/698270988/?random=1906463790&cv=11&fst=1704102997241&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&label=87uyCIuRktcBEIyK-8wC&hn=www.googleadservices.com&frm=0&value=0&auid=1145590087.1704102997&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=V4ySZZLnLISyoPMPgJuzkAE&sscte=1&crd=&eitems=ChEIgOLJrAYQ1tWj2sWOtp_NARIdANJWnmW8oGOv9Wo1e50hLHDlwNMj7hoV0BvIOiU&pscrd=Ek9DaEVJZ09MSnJBWVF6YzdkeXEzUjRfdm9BUkltQUpSUmV6T1NmZm5hemJaam9wYmxYNzNnRE5PSm1nMHBNNnlSU2p5cDBJUmxJbGNmWkRNGlpDaEVJZ09MSnJBWVFvNEhPNVBQaXZ0M1NBUkl1QVBDSGtpUjBvNFViLWZVcFFwQzIzbWV1LTF3V3JLTkwtaVVmVXp3dkFOSDhfMC1Cb1lXeTRwNnBQaE1haEEiEwjS7tav9ruDAxUEGWgIHYDNDBI HTTP 302
https://www.google.com/pagead/1p-conversion/698270988/?random=1906463790&cv=11&fst=1704102997241&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&label=87uyCIuRktcBEIyK-8wC&hn=www.googleadservices.com&frm=0&value=0&auid=1145590087.1704102997&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09MSnJBWVF6YzdkeXEzUjRfdm9BUkltQUpSUmV6T1NmZm5hemJaam9wYmxYNzNnRE5PSm1nMHBNNnlSU2p5cDBJUmxJbGNmWkRNGlpDaEVJZ09MSnJBWVFvNEhPNVBQaXZ0M1NBUkl1QVBDSGtpUjBvNFViLWZVcFFwQzIzbWV1LTF3V3JLTkwtaVVmVXp3dkFOSDhfMC1Cb1lXeTRwNnBQaE1haEEiEwjS7tav9ruDAxUEGWgIHYDNDBI&is_vtc=1&ocp_id=V4ySZZLnLISyoPMPgJuzkAE&cid=CAQSKQAvHhf_ylYBztCissycDXsicojYycL4mPolc3kWikVUP8THCvtX_XYO&eitems=ChEIgOLJrAYQ1tWj2sWOtp_NARIdANJWnmUpO_xZrCumx1xqoH3hgmAkK3R4cUbaQUQ&random=963113123

Request Chain 157

https://tr.snapchat.com/cm/s?bt=1d53c387&pnid=140&cb=1704103000890&u_scsid=d437146e-83a5-4058-aceb-758296bf89e5&u_sclid=db5de9cf-b185-41bf-b06b-67c60938ef0b HTTP 302
https://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1703024924203%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1703024924203%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://tr.snapchat.com/cm/p?rand=1703024924203&pnid=140&pcid=0b0e1874-2e7f-4930-a78c-7aba836ebedc

Request Chain 179

https://idsync.rlcdn.com/458359.gif?partner_uid=387d1e4e-80b5-4c42-bf8d-a15fea4726d9 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CPf8GxIwCiwIARCd5gEaJDM4N2QxZTRlLTgwYjUtNGM0Mi1iZjhkLWExNWZlYTQ3MjZkORAAGg0I2ZjKrAYSBQjoBxAAQgBKAA HTTP 307
https://tags.rd.linksynergy.com/cs?ns=lr&uid3=b4baddee7ca72e6ac2d1efce61f4bd3b5366d3d313129ebda8455967eafeace26ac34734d8e453ee

Request Chain 194

https://pix.cdnwidget.com/redirect?CID=2aLfuQlLOxXJXYkn0pPWL7mu7ir&DID=2aLfuNW9V2ZvgRBpn2VIO8L232h&v=&iv=&deviceid=2489235156514818950&visitid=1704103002154495&wsid=4142&apikey=2^HIykD HTTP 302
https://pippio.com/api/sync?pid=5749 HTTP 307
https://pix.cdnwidget.com/hash.gif?md5=none&sha1=none&sha256=none

202 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request cosmetic-criminals Show response
www.elfcosmetics.com/
Redirect Chain

https://cosmeticcriminals.com/
https://www.elfcosmetics.com/cosmetic-criminals

790 KB
212 KB

1896ms
1696ms

Document
text/html

204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: c1640f64b5396d16334760442e6dbd14d0854f71e34965bac4a690e1a038707d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 0
cache-control: public, must-revalidate, s-maxage=900
content-encoding: gzip
content-length: 216221
content-type: text/html; charset=utf-8
date: Mon, 01 Jan 2024 09:56:34 GMT
etag: W/"a8a4a-YiyyAQNa4Y11dFqQodSKt3Pgke8"
vary: Accept-Encoding
via: 1.1 aca99b28083d8a34e20c40dbd89ecfce.cloudfront.net (CloudFront)
x-amz-apigw-id: Q2rcyE1qCYcEReQ=
x-amz-cf-id: cmEQ2TPKD5Z9xCo5vMod5Vgb0wPF822MlVcVamsRaYh49Py0sYnZAw==
x-amz-cf-pop: SFO53-P2
x-amzn-remapped-connection: close
x-amzn-remapped-content-length: 690762
x-amzn-remapped-date: Mon, 01 Jan 2024 09:56:34 GMT
x-amzn-requestid: 78bfe3c2-6c3b-4b7a-981c-edf15c36472d
x-amzn-trace-id: Root=1-65928c51-72cd4b3267cc004c4ca17731;Sampled=0;lineage=2b75b0e9:0
x-cache: Miss from cloudfront
x-yottaa-metrics: 2521cc028516/[1459,1421,-] 25D1cc028531/[-,1499.861]
x-yottaa-optimizations: ob/1000000100001000 si/25D1cc028531-1703880236-2730629357 tts/1701196602045 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-yottaa-os: 200

Redirect headers

age: 0
content-length: 1198
content-type: text/html; charset=utf-8
date: Mon, 01 Jan 2024 09:56:33 GMT
location: https://www.elfcosmetics.com/cosmetic-criminals
vary: User-Agent
x-yottaa-fw: fb/100000 tid/658dc426d93140973bd487db rid/658dc848d93140973bd496fa stid/5ad7b08e2bb0ac0c5ba3d38c
x-yottaa-metrics: 26D1cc8d5849/[-,0.232]
x-yottaa-optimizations: ob/0 si/26D1cc8d5849-1703880237-5373506586 tts/1704102993193 ti/0 ai/658dc426d93140973bd487db

GET
H2 200 init.js Show response
www.elfcosmetics.com/XT4Gy2ig/ 165 KB
74 KB 237ms
237ms Script
application/javascript 204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: 8bd09a31bc892afc88d1e2fbca71d888ee5beebe1c9aea3342e9e95473794b30

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/cosmetic-criminals
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:35 GMT
content-encoding: gzip
etag: "293b4-fqRf2YiFrP4bpVnO9Jf+OX2/84A"
active-cdn: Akamai
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
cache-control: max-age=600
x-yottaa-metrics: 25D1cc028531/[-,3.162]
x-px-hash: ZWJhMGRlMjRhYzMzYjNjM2NmZWJhMDkxMTdmNDgwMzJiNWNlNzUzYjMyMDE4MWYzODNiNGY1YTBkOGVmY2VjZQ==
x-yottaa-optimizations: ob/0 si/25D1cc028531-1703880236-2730629387 tts/1704102995315 ti/0 ai/5a0c9b7632f01c35d42101b2

GET /
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/ 0
0

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a2b3b5ecaa7d5c67e5e28f9712ebcf28a592c7191e24bcde25cc5bb374cbf7b

Request headers

Referer
Origin: https://www.elfcosmetics.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: application/font-woff2;charset=utf-8

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a33177a1b1a44698bc85bc710dfd4a6aba8bbe329db64dbb0622c894a1c05cbd

Request headers

Referer
Origin: https://www.elfcosmetics.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: application/font-woff2;charset=utf-8

GET
H2 200 vendor.js Show response
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/ 2 MB
619 KB 89ms
33ms Script
application/javascript 151.101.2.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 57e461c9b78558e62478cca713658387eaf54afe6ae0a8128ee38e5846b4d6d8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-amz-version-id: 7DhVfT1FfID7USGHRQIdkAPtGlAbpV1z
via: 1.1 92d95cda7eaeed8a1f0f8b1603cfc362.cloudfront.net (CloudFront), 1.1 varnish
content-encoding: gzip
date: Mon, 01 Jan 2024 09:56:35 GMT
x-amz-cf-pop: ORD53-C3
age: 1482065
x-amz-server-side-encryption: AES256
x-yottaa-optimizations: ob/1001 si/2611cc028372-1700446747-1316965936 tts/1701196602045 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-cache: Hit from cloudfront, HIT
x-amz-meta-deploy: 621192
content-length: 633349
x-amz-meta-bundle: 10314
x-served-by: cache-mia-kmia1760092-MIA
x-yottaa-forcecache: true, true
server: AmazonS3
x-timer: S1704102996.674796,VS0,VE2
vary: Accept-Encoding
content-type: application/javascript; charset=utf8
cache-control: public, max-age=31104000
x-yottaa-metrics: 2621cc028369/[95,27,-] 2611cc028372/[hit]
accept-ranges: bytes
x-amz-cf-id: wWhK6K5Z8ojOY7ZljLOpzCPSDiFjg5WH5PqgmXEeGO0H-2OGA4Eycg==
x-cache-hits: 1

GET
H2 200 main.js Show response
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/ 2 MB
454 KB 135ms
80ms Script
application/javascript 151.101.2.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/main.js?yocs=1u_1y_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4f770b32793546ad41060cc03c06e4a744b10e9ae4af0b2b0522cfcf1fb33285

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-amz-version-id: ee3xb.NTbr4bzXJ3SxfA7qqa0mkCetT8
via: 1.1 2918cacbb3dda2d143059f9b5f341e32.cloudfront.net (CloudFront), 1.1 varnish
content-encoding: gzip
date: Mon, 01 Jan 2024 09:56:35 GMT
x-amz-cf-pop: DFW57-P1
age: 2300047
x-amz-server-side-encryption: AES256
x-yottaa-optimizations: ob/1100 si/3211a5fec6ec-1699966125-827025126 tts/1701196602045 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-cache: Miss from cloudfront, HIT
x-amz-meta-deploy: 621192
content-length: 464645
x-amz-meta-bundle: 10314
x-served-by: cache-mia-kmia1760092-MIA
x-yottaa-forcecache: true, true
server: AmazonS3
x-timer: S1704102996.675074,VS0,VE1
vary: Accept-Encoding
content-type: application/javascript; charset=utf8
cache-control: public, max-age=31104000
x-yottaa-metrics: 3221a5fec61e/[26,-,1701802933184] 3211a5fec6ec/[-,275.841]
accept-ranges: bytes
x-amz-cf-id: bcej1fYMollv8xoIRWQnJA0kLwxsQ3arztu9O3PLVexml-AJwtdehg==
x-cache-hits: 1

GET
H2 200 pages-product-list-product-list-page.js Show response
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/ 40 KB
11 KB 84ms
29ms Script
application/javascript 151.101.2.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/pages-product-list-product-list-page.js?yocs=1u_1y_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cd0b162bc6e5a1dfcdba80c8b12d3f2ec6ac423a1c1ed7d996779d9c6b81f346

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-amz-version-id: 3Wq5BoaKPulOYkW6Fp3r6wFQLlG6RLjA
via: 1.1 71ab92edd02bc8ec941d842529d753d0.cloudfront.net (CloudFront), 1.1 varnish
content-encoding: gzip
date: Mon, 01 Jan 2024 09:56:35 GMT
x-amz-cf-pop: DFW57-P1
age: 2300027
x-amz-server-side-encryption: AES256
x-yottaa-optimizations: ob/1100 si/3211a5fec6ec-1699966125-827026492 tts/1701196602045 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-cache: Miss from cloudfront, HIT
x-amz-meta-deploy: 621192
content-length: 11125
x-amz-meta-bundle: 10314
x-served-by: cache-mia-kmia1760092-MIA
x-yottaa-forcecache: true, true
server: AmazonS3
x-timer: S1704102996.675443,VS0,VE1
vary: Accept-Encoding
content-type: application/javascript; charset=utf8
cache-control: public, max-age=31104000
x-yottaa-metrics: 3221a5fec61b/[4,-,1701802943492] 3211a5fec6ec/[-,10.551]
accept-ranges: bytes
x-amz-cf-id: WJ0m5WXl1NQMk1PoHxOhUFdZgnjAMg_RUPWgNhPNbQa5Zm2wDKS6Bg==
x-cache-hits: 1

GET
H2 200 us.svg
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/static/img/flag-icons/ 9 KB
1 KB 79ms
28ms Image
image/svg+xml 151.101.2.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/static/img/flag-icons/us.svg?yocs=1u_1y_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b1fdabf0bbfde031d2de37b191e0b07576b06d3a4f4bd226d1b674e40d047f22

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-amz-version-id: 9zy6w68xzC0VtboioQSwQDLT607ezHMK
via: 1.1 e11cadb582e1707cafaebffffaca42e0.cloudfront.net (CloudFront), 1.1 varnish
content-encoding: gzip
date: Mon, 01 Jan 2024 09:56:35 GMT
x-amz-cf-pop: EWR50-C1
age: 1940699
x-amz-server-side-encryption: AES256
x-yottaa-optimizations: ob/1000 si/3811cc023143-1693316487-2170619399 tts/1701196602045 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-cache: Hit from cloudfront, HIT
x-amz-meta-deploy: 621192
content-length: 676
x-amz-meta-bundle: 10314
x-served-by: cache-mia-kmia1760092-MIA
x-yottaa-forcecache: true, true
server: AmazonS3
x-timer: S1704102996.675073,VS0,VE1
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31104000
x-yottaa-metrics: 3821cc023163/[10,5,-] 3811cc023143/[-,12.661]
accept-ranges: bytes
x-amz-cf-id: 70OugxiSf_W_2oBGZWpK5nn8o8geC-jhiAjofa6MhEBqw-IVaeDIIQ==
x-cache-hits: 1

GET
H2 200 download-on-the-app-store-badge.png
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/static/img/global/ 4 KB
4 KB 80ms
29ms Image
image/webp 151.101.2.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/static/img/global/download-on-the-app-store-badge.png?yocs=1u_1y_1A_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f114a64c26edb67def4dd84a00694f76e0573aedddb68428c52c6ea8b00de4c3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-amz-version-id: Akq7KTd_WVm0_2HVhDA1m.JC63cBf7G7
via: 1.1 4bbf91f2f9edc22eb68408b6405ae452.cloudfront.net (CloudFront), 1.1 varnish
date: Mon, 01 Jan 2024 09:56:35 GMT
x-amz-cf-pop: DFW57-P1
age: 2299942
x-amz-server-side-encryption: AES256
x-yottaa-optimizations: ob/10000000000100 si/3211a5fec643-1692101820-676433836 tts/1701196602045 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-cache: Hit from cloudfront, HIT
x-amz-meta-deploy: 621192
content-length: 3724
x-amz-meta-bundle: 10314
x-served-by: cache-mia-kmia1760092-MIA
x-yottaa-forcecache: true, true
server: AmazonS3
x-timer: S1704102996.675259,VS0,VE1
content-type: image/webp
cache-control: public, max-age=31104000
x-yottaa-metrics: 3221a5fec6f1/[4,-,1701803009793] 3211a5fec643/[-,7.469]
accept-ranges: bytes
x-amz-cf-id: 38s9aQQXKJWNewA2fale5S7WWAIFlz7N-0QpWVLHJBfDsUdMRAnSkA==
x-cache-hits: 1

GET
H2 200 google-play-badge.png
cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/static/img/global/ 3 KB
4 KB 130ms
79ms Image
image/webp 151.101.2.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/static/img/global/google-play-badge.png?yocs=1u_1y_1A_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e8f118daabadc747ba3e2236a27edce749bb73dde4f16c6c6acc5cce36009a36

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-amz-version-id: XXBoQCUlKEOsesGOGsNaSVfpZce.5TGs
via: 1.1 4bdac961192507d044006fb8cf5c0d22.cloudfront.net (CloudFront), 1.1 varnish
date: Mon, 01 Jan 2024 09:56:35 GMT
x-amz-cf-pop: ATL56-C4
age: 2299011
x-amz-server-side-encryption: AES256
x-yottaa-optimizations: ob/10000000000100 si/33118cae0c63-1699034341-1414481470 tts/1701196602045 ti/5a0c9b7632f01c35d421021b ai/5a0c9b7632f01c35d42101b2 tm/0
x-cache: Hit from cloudfront, HIT
x-amz-meta-deploy: 621192
content-length: 3318
x-amz-meta-bundle: 10314
x-served-by: cache-mia-kmia1760092-MIA
x-yottaa-forcecache: true, true
server: AmazonS3
x-timer: S1704102996.675252,VS0,VE1
content-type: image/webp
cache-control: public, max-age=31104000
x-yottaa-metrics: 33218cae0ca9/[2,-,1701803009648] 33118cae0c63/[-,2.896]
accept-ranges: bytes
x-amz-cf-id: aEQtMizCrK8QKU8sy756aR-aACYQudRRsENoz3wZyo6CU346QupMQg==
x-cache-hits: 1

POST
H2 200 collector Show response
collector-pxxt4gy2ig.px-cloud.net/api/v2/ 564 B
811 B 162ms
90ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxt4gy2ig.px-cloud.net/api/v2/collector
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 1b882f34d2c8e8705e11734b595c877cee19e53b807a22a19a7311a523d63aba

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 01 Jan 2024 09:56:35 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 564

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/ 1 MB
152 KB 114ms
44ms Script
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/OtAutoBlock.js

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/main.js?yocs=1u_1y_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e038dff62440b626103b2b81adcbb64b5cb3bd80433d1a710f37162cd7c0cc17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 3281
content-md5: 3CHjrTrl4YSKzn90GsMA3A==
content-length: 154812
x-ms-lease-status: unlocked
last-modified: Mon, 30 Oct 2023 13:08:00 GMT
server: cloudflare
etag: 0x8DBD9493E0E92B7
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f8fafcb2-f01e-003b-4c0e-177c27000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 83e9e4b1faa77471-MIA
expires: Tue, 02 Jan 2024 09:56:36 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 106ms
36ms Script
application/javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/main.js?yocs=1u_1y_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d72fa0f78c80b1874d3ee4aadf43d973edc442a65fef83d37e684ac559893b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 5rel+BW+cbOCNkEJ4C4NBQ==
age: 6108
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6841
x-ms-lease-status: unlocked
last-modified: Thu, 21 Dec 2023 21:19:55 GMT
server: cloudflare
etag: 0x8DC026A943751A5
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: d530a67f-201e-0007-3283-3455e0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 83e9e4b1fa9e7471-MIA

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 428 KB
121 KB 169ms
61ms Script
application/javascript 2607:f8b0:4004:c09::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WL3STMX&gtm_auth=&gtm_preview=&gtm_cookies_win=x

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::61 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ef6dac5c8eeca61f027ab57976921b71aed97543e8d8c49599c21b2e22f27f62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:36 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 123611
x-xss-protection: 0
last-modified: Mon, 01 Jan 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 01 Jan 2024 09:56:36 GMT

GET
H2 200 api_dynamic.js Show response
cdn.dynamicyield.com/api/8772046/ 378 KB
44 KB 390ms
223ms Script
application/javascript 2600:9000:26a0:4200:a:b89d:a6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.dynamicyield.com/api/8772046/api_dynamic.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26a0:4200:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: DYCDN /
Resource Hash: 30ca5a7ae3f12eb7d187d400d8c23903395c7e9c3fa7f85cb742785af28f2c81

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:37 GMT
content-encoding: gzip
via: 1.1 141b2a0bfdcf3225afbe04affb901120.cloudfront.net (CloudFront)
last-modified: Thu, 28 Dec 2023 20:49:56 GMT
server: DYCDN
x-amz-cf-pop: YUL62-P2
x-amz-server-side-encryption: AES256
etag: W/"b89b7a9d333258d9640358edad54dc22"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: max-age=30
link: <//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
x-amz-cf-id: di-YwLygJ_D4eQCIoOpHFOcMS8cPLymUGog7dOjxKDefW1B6PlCTiQ==

GET
H2 200 api_static.js Show response
cdn.dynamicyield.com/api/8772046/ 385 KB
111 KB 246ms
79ms Script
application/javascript 2600:9000:26a0:4200:a:b89d:a6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.dynamicyield.com/api/8772046/api_static.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26a0:4200:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: DYCDN /
Resource Hash: 2c8574ba42424a1dcf02c58fda5e3482e2262e0b0dddd09e5935bd94e5eba03e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 07:26:51 GMT
content-encoding: gzip
via: 1.1 141b2a0bfdcf3225afbe04affb901120.cloudfront.net (CloudFront)
last-modified: Fri, 22 Dec 2023 09:27:57 GMT
server: DYCDN
age: 8986
x-amz-cf-pop: YUL62-P2
x-amz-server-side-encryption: AES256
etag: W/"81d82ff6d3b7239a1cfc7723116ee4aa"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400
link: <//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
x-amz-cf-id: SfbvoJYyuXGviv6hQz3znou7sEn-HZr1b-Ihss2x-eb3hz03pLtxLA==

GET
H/1.1 200
OK / Show response
api.ipify.org/ 22 B
222 B 284ms
90ms XHR
application/json 104.237.62.212
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.237.62.212 El Segundo, United States, ASN18450 (WEBNX, US),
Reverse DNS: api.ipify.org
Software: nginx/1.25.2 /
Resource Hash: 729926f1c51e4c5faf0607d2b93e04b427b8e7a0658e54d8a212a76832fe1343

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 01 Jan 2024 09:56:36 GMT
Server: nginx/1.25.2
Connection: keep-alive
Content-Length: 22
Vary: Origin
Content-Type: application/json

GET
H/1.1 200
OK / Show response
api.ipify.org/ 22 B
222 B 285ms
90ms XHR
application/json 104.237.62.212
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.237.62.212 El Segundo, United States, ASN18450 (WEBNX, US),
Reverse DNS: api.ipify.org
Software: nginx/1.25.2 /
Resource Hash: 729926f1c51e4c5faf0607d2b93e04b427b8e7a0658e54d8a212a76832fe1343

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 01 Jan 2024 09:56:36 GMT
Server: nginx/1.25.2
Connection: keep-alive
Content-Length: 22
Vary: Origin
Content-Type: application/json

GET
H2

200

callback
www.elfcosmetics.com/
Redirect Chain

https://www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/authorize?redirect_uri=https%3A%2F%2Fwww.elfcosmetics.com%2Fcallback&response_type=code&client_id=...
https://www.elfcosmetics.com/callback?usid=2eeca965-d19a-4748-8988-73649158393f&code=iLndwgVfWGlYxbSBRWyNkANmI9iP0WrAYoWVQga3Gac

0
0

329ms
328ms

Fetch
application/json

204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/callback?usid=2eeca965-d19a-4748-8988-73649158393f&code=iLndwgVfWGlYxbSBRWyNkANmI9iP0WrAYoWVQga3Gac
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Server: 204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/cosmetic-criminals
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:37 GMT
via: 1.1 bfad77da64cd65a36fcbbe44acb655e8.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 0
x-amz-cf-pop: SFO53-P2
age: 0
x-amzn-remapped-connection: close
x-amzn-requestid: a8e42cd1-8384-4af8-be04-725b495e91f9
x-yottaa-optimizations: ob/1000 si/25D1cc028531-1703880236-2730629392 tts/1701194968684 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-cache: Miss from cloudfront
x-amz-apigw-id: Q2rdbEayiYcETYA=
content-length: 0
x-yottaa-forcecache: true
x-amzn-trace-id: Root=1-65928c55-1b1919d104c949a30a26172a;Sampled=0;lineage=2b75b0e9:0
content-type: application/json
cache-control: public, max-age=604800
x-yottaa-os: 200
x-yottaa-metrics: 2521cc028a88/[232,228,-] 25D1cc028531/[-,232.862]
x-amzn-remapped-date: Mon, 01 Jan 2024 09:56:37 GMT
x-amz-cf-id: AtTQE-cfYe4NwR01V48nIgIRk8HePZ2XPPnFljPZmm-r0elCqkBGYA==

Redirect headers

date: Mon, 01 Jan 2024 09:56:37 GMT
x-correlation-id: 83e9e4b49e813099
via: 1.1 68a8bf1c51ac47222204adb56c4024ac.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: SFO53-P2
age: 0
x-yottaa-optimizations: ob/0 si/25D1cc028531-1703880236-2730629391 tts/1701194968684 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-cache: Miss from cloudfront
content-length: 0
pragma: no-cache
x-ratelimit-1m-remaining: 23532, 1977027
x-ratelimit-1m-reset: 22735, 22734
x-ratelimit-1m-limit: 24000, 2000000
vary: Accept-Encoding
location: https://www.elfcosmetics.com/callback?usid=2eeca965-d19a-4748-8988-73649158393f&code=iLndwgVfWGlYxbSBRWyNkANmI9iP0WrAYoWVQga3Gac
cache-control: no-store
x-yottaa-os: 303
x-proxy-request-url: https://6p9dgqhn.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/authorize?redirect_uri=https%3A%2F%2Fwww.elfcosmetics.com%2Fcallback&response_type=code&client_id=f9f7052a-f742-4c38-bdf5-1da004e7fb3b&hint=guest&channel_id=elf-us&code_challenge=P804Ohj-Jfu9Rs4h-g-x2uCbKnP51bMR2S43PjRa-JM
x-yottaa-metrics: 2521cc028a8a/[158,156,-] 25D1cc028531/[-,159.890]
cf-ray: 83e9e4b49e813099-SEA
x-amz-cf-id: d5dQ6BfHT_Gvf44FMka4zL9DWiHTn9VthNi-PlYKqWNt1KI4_fgI4w==

POST
H2 201 / Show response
sdk.iad-05.braze.com/api/v3/data/ 323 B
463 B 201ms
201ms XHR
application/json 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/data/

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1a09824b6d7bbd0f5e82a23d14da408abfba60d02f5bdb48309d3ab6ca61bb1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57
X-Braze-TriggersRequest: true
X-Braze-DataRequest: true
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-type: application/json
Referer: https://www.elfcosmetics.com/
X-Requested-With: XMLHttpRequest

Response headers

date: Mon, 01 Jan 2024 09:56:37 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: MISS
x-request-id: cbe33d72-3285-4074-9762-848f5c0c2f47
x-served-by: cache-mia-kmia1760070-MIA
x-runtime: 0.059242
etag: W/"1a09824b6d7bbd0f5e82a23d14da408a"
access-control-max-age: 7200
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
vary: Origin,Accept-Encoding
accept-ranges: bytes
x-cache-hits: 0

OPTIONS
H2 200 /
sdk.iad-05.braze.com/api/v3/data/ Frame 0
0 204ms
145ms Preflight 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-triggersrequest,x-requested-with
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-triggersrequest,x-requested-with
access-control-allow-methods: POST, GET
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
content-encoding: gzip
date: Mon, 01 Jan 2024 09:56:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760070-MIA

POST
H2 200 collector Show response
collector-pxxt4gy2ig.px-cloud.net/api/v2/ 600 B
655 B 78ms
77ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxt4gy2ig.px-cloud.net/api/v2/collector
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: cd36a9a40e33aa3d4fa0d7b81e5f1126d62aaf421c6e032aa397b7bac9dc9c7c

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 01 Jan 2024 09:56:36 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 600

GET
H2 200 6ee1574c-d59b-4e80-9930-2e1c3c7db4ff.json Show response
cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/ 5 KB
2 KB 97ms
41ms XHR
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8a6566c7e926c37c010dc811a5e82d5eddad8b10057bf711f0f644be60707d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 82712
content-md5: 4swZDWVp4C0QChiGUbrcTg==
content-length: 1746
x-ms-lease-status: unlocked
last-modified: Tue, 14 Nov 2023 15:26:04 GMT
server: cloudflare
etag: 0x8DBE5260423F079
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: b26488eb-901e-0084-770e-174b82000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 83e9e4b42b2c3343-MIA
expires: Tue, 02 Jan 2024 09:56:37 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
306 B 107ms
41ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71cfd0bf781e3f393bca283fc9d44777a2036985a4ffe9abedf14909e63a8aef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 83e9e4b51e9e4c32-MIA
access-control-allow-headers: Content-Type

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 160ms
54ms Script
text/javascript 2607:f8b0:4004:c07::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 01 Jan 2024 09:49:35 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 422
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 01 Jan 2024 11:49:35 GMT

GET activityi;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1l1l1...
9231397.fls.doubleclick.net/ Frame 6296 0
0

GET activityi;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0...
10742279.fls.doubleclick.net/ Frame B555 0
0

GET
H2 200 cnxtag-min.js Show response
js.cnnx.link/roi/ 2 KB
1 KB 239ms
69ms Script
text/javascript 2600:9000:215f:600:11:85b0:d600:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.cnnx.link/roi/cnxtag-min.js?id=316282
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL3STMX&gtm_auth=&gtm_preview=&gtm_cookies_win=x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:215f:600:11:85b0:d600:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: ff2fe181c12146189657e92f9ce0489f7f3b51345796f5a5ec9b089f9fb47616

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:49:47 GMT
via: 1.1 google, 1.1 fe2c65104051140806cad998f531e478.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: YUL62-C2
age: 410
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
cache-control: max-age=600
x-amz-cf-id: _w5cUKVgTBb-sftbPYesFRjEGCtd_-nzy8xNw2WWMhfs_BkeyK-cxg==

GET
H2

200

/
www.google.com/pagead/1p-user-list/698270988/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/698270988/?random=1704102997256&cv=11&fst=1704102997256&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&...
https://www.google.com/pagead/1p-user-list/698270988/?random=1704102997256&cv=11&fst=1704099600000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elf...

42 B
455 B

173ms
67ms

Image
image/gif

2607:f8b0:4004:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/698270988/?random=1704102997256&cv=11&fst=1704099600000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&frm=0&data=ecomm_prodid%3D%3Becomm_totalvalue%3D&is_vtc=1&cid=CAQSGwAvHhf_SPa_KRwyEMG2zV4l2YnbdELa2ik3QA&random=1553330161

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Server

2607:f8b0:4004:c1d::69 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:37 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:37 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-user-list/698270988/?random=1704102997256&cv=11&fst=1704099600000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&frm=0&data=ecomm_prodid%3D%3Becomm_totalvalue%3D&is_vtc=1&cid=CAQSGwAvHhf_SPa_KRwyEMG2zV4l2YnbdELa2ik3QA&random=1553330161
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync
hb.yahoo.net/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=3ftfnh3&ct=0:8m23e30&fmt=3
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=0af71ab2-cea5-4d86-a5a8-39b5271f8832
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D0af71ab2-cea5-4d86-a5a8-39b5271f8832
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5990193701797365675&ttd_tdid=0af71ab2-cea5-4d86-a5a8-39b5271f8832
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0af71ab2-cea5-4d86-a5a8-39b5271f8832&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=MGFmNzFhYjItY2VhNS00ZDg2LWE1YTgtMzliNTI3MWY4ODMy&gdpr=0&gdpr_consent=&ttd_tdid=0af71ab2-cea5-4d86-a5a8-39b52...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&google_gid=CAESEIQdvT6yJpcEsN1jxZnyIOU&google_cver=1
https://ups.analytics.yahoo.com/ups/55953/sync?uid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/55953/sync?uid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=55953&ovsid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&gdpr=0&redir=true
https://hb.yahoo.net/cksync?cs=63&axid_e=eS12dDc5UHJsRTJ1SE1ieUR0LkhPbDVCUWFrSjZPOWs1bH5B&gdpr=0&ovsid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&dpid=55953

57 B
663 B

234ms
79ms

Image
image/gif

23.218.218.25
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hb.yahoo.net/cksync?cs=63&axid_e=eS12dDc5UHJsRTJ1SE1ieUR0LkhPbDVCUWFrSjZPOWs1bH5B&gdpr=0&ovsid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&dpid=55953

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Server

23.218.218.25 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-218-218-25.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ed079d77ba54a8e4bfc931029de75b1f5128fcae45e274d53aca95f8ab17b438

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Mon, 01 Jan 2024 09:56:38 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 57
x-mnet-hl2: E
expires: Mon, 01 Jan 2024 09:56:38 GMT

Redirect headers

location: https://hb.yahoo.net/cksync?cs=63&axid_e=eS12dDc5UHJsRTJ1SE1ieUR0LkhPbDVCUWFrSjZPOWs1bH5B&gdpr=0&ovsid=0af71ab2-cea5-4d86-a5a8-39b5271f8832&dpid=55953
date: Mon, 01 Jan 2024 09:56:38 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

cnv
cnv.event.prod.bidr.io/log/
Redirect Chain

https://pixel.pointmediatracker.com/kpi?c=elfcosmetics&kpi=visit&tag_id=244&fpc=8451e0c1-ecb3-4b73-b4bf-e36d9fb3a53a&user_id=&utm_source=undefined&utm_medium=undefined&utm_campaign=undefined&new=un...
https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=03bf2c12-fc57-464f-8e5c-9723e630e503.&ord=2351504529137125996
https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=03bf2c12-fc57-464f-8e5c-9723e630e503.&ord=2351504529137125996&_bee_ppp=1

43 B
796 B

53ms
52ms

Image
image/gif

54.157.127.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=03bf2c12-fc57-464f-8e5c-9723e630e503.&ord=2351504529137125996&_bee_ppp=1

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

HTTP/1.1

Server

54.157.127.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-157-127-36.compute-1.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:38 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cnv.event.prod.bidr.io/log/cnv?tag_id=244&buzz_key=blisspoint&value=elfcosmetics&segment_key=&order=03bf2c12-fc57-464f-8e5c-9723e630e503.&ord=2351504529137125996&_bee_ppp=1
Date: Mon, 01 Jan 2024 09:56:37 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2 200 st Show response
st.dynamicyield.com/ 114 KB
10 KB 263ms
94ms Script
text/javascript 2600:9000:269f:ae00:15:ad21:c740:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.dynamicyield.com/st?sec=8772046&inHead=true&id=0&jsession=09uqjccnx5ywkhe19s1i6fsja8vsnjvv&ref=&scriptVersion=1.213.0&isSesNew=true&dyid_server=&ctx=%7B%22type%22%3A%22OTHER%22%2C%22lng%22%3A%22en-US%22%2C%22data%22%3A%5B%5D%7D
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:269f:ae00:15:ad21:c740:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4b10c3904e3ed31d12553afebe7ee47ec07d57ff9c5d023ca533580834ba2ca4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:37 GMT
content-encoding: gzip
via: 1.1 480d73d26133a5d3268f9cfc7c99d59c.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
cache-control: no-cache
x-amz-cf-id: 4CJGuMW_2XGfXeSC6EjVTbqXJckQfIslIQTqLyCLOCU3ma0-D3EnlA==
expires: Mon, 01 Jan 2024 09:56:36 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202306.1.0/ 404 KB
98 KB 36ms
35ms Script
application/javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def2a184135eba029f8f785b3ed69edc5f36b368226ce1fcfeda4f5aa301d1b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: XJk1ZZTljtwHFT3qcIJg+w==
age: 5602
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 99599
x-ms-lease-status: unlocked
last-modified: Wed, 12 Jul 2023 06:29:36 GMT
server: cloudflare
etag: 0x8DB82A15D413626
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 80bad15d-801e-006c-2fda-12d214000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 83e9e4b6ee667471-MIA

POST
H2 201 sync Show response
sdk.iad-05.braze.com/api/v3/content_cards/ 756 B
668 B 311ms
311ms XHR
application/json 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b7f3fee14cf966a67d1b0a6dfec5f0f19002fcd494965c99f75059e7f0a2f53d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57
X-Braze-DataRequest: true
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-type: application/json
BRAZE-SYNC-RETRY-COUNT: 0
Referer: https://www.elfcosmetics.com/
X-Requested-With: XMLHttpRequest
X-Braze-ContentCardsRequest: true

Response headers

date: Mon, 01 Jan 2024 09:56:37 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: MISS
x-request-id: 8f6be4c9-c1b2-40b7-acae-fb45c26090bb
x-served-by: cache-mia-kmia1760070-MIA
x-runtime: 0.255187
etag: W/"b7f3fee14cf966a67d1b0a6dfec5f0f1"
access-control-max-age: 7200
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
vary: Origin,Accept-Encoding
accept-ranges: bytes
x-cache-hits: 0

OPTIONS
H2 200 sync
sdk.iad-05.braze.com/api/v3/content_cards/ Frame 0
0 57ms
56ms Preflight 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: braze-sync-retry-count,content-type,x-braze-api-key,x-braze-contentcardsrequest,x-braze-datarequest,x-requested-with
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-headers: braze-sync-retry-count,content-type,x-braze-api-key,x-braze-contentcardsrequest,x-braze-datarequest,x-requested-with
access-control-allow-methods: POST, GET
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
content-encoding: gzip
date: Mon, 01 Jan 2024 09:56:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760070-MIA

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 61ms
60ms XHR
text/plain 2607:f8b0:4004:c07::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1450957019&t=pageview&_s=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&dp=%2Fcosmetic-criminals&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACgAI~&jid=1272351196&gjid=1575717248&cid=1144441024.1704102998&tid=UA-432816-1&_gid=2141509973.1704102998&_r=1&_slc=1&gtm=45He3bt0n81WL3STMXv896608294&gcd=11l1l1l1l1&dma=0&z=1602317056

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/fce1bc7f-b7cb-4383-a7e9-8430e48a01d7/ 202 KB
36 KB 41ms
39ms Fetch
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/fce1bc7f-b7cb-4383-a7e9-8430e48a01d7/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf1b4e2a57de561424fb99aa43ef462868d58d9c205a38ae3f564c10266a4dbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 80100
content-md5: A+auRPWlNU8wck+viG1D2g==
content-length: 36970
x-ms-lease-status: unlocked
last-modified: Tue, 14 Nov 2023 15:26:15 GMT
server: cloudflare
etag: 0x8DBE5260AC67F7E
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 45a814af-d01e-005e-170e-17d263000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 83e9e4b75d573343-MIA
expires: Tue, 02 Jan 2024 09:56:37 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 2 B
350 B 166ms
60ms XHR
text/plain 2607:f8b0:4004:c1d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-432816-1&cid=1144441024.1704102998&jid=1272351196&gjid=1575717248&_gid=2141509973.1704102998&_u=YEBAAEAAAAAAACgAI~&z=728087162

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 01 Jan 2024 09:56:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202306.1.0/assets/ 13 KB
3 KB 37ms
36ms Fetch
application/json 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202306.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 5mNZducabMgxSDzBo+ZI8w==
age: 80100
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3017
x-ms-lease-status: unlocked
last-modified: Wed, 12 Jul 2023 06:29:30 GMT
server: cloudflare
etag: 0x8DB82A159AF8EA6
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 0c718e4e-201e-0081-6f27-129959000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 83e9e4b7bd993343-MIA

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202306.1.0/assets/v2/ 61 KB
13 KB 35ms
35ms Fetch
application/json 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202306.1.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: sXFDxCJwbPEMIT/8f5Prwg==
age: 73504
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12544
x-ms-lease-status: unlocked
last-modified: Wed, 12 Jul 2023 06:29:33 GMT
server: cloudflare
etag: 0x8DB82A15AFF8646
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: d3dc8d97-601e-0029-71cc-0b07f7000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 83e9e4b7bd9a3343-MIA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202306.1.0/assets/ 21 KB
4 KB 37ms
36ms Fetch
text/css 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202306.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0c233d327541d2961f1cde9e53a6166279655f4d4041c1bc458ac1701827719

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: oWkBTLgDDXvrUsd93y/Zxg==
age: 80100
x-ms-lease-status: unlocked
last-modified: Wed, 12 Jul 2023 06:29:41 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: d09127de-b01e-0048-64cd-1224b4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 83e9e4b7bd9b3343-MIA

GET
H2

200

activityi;dc_pre=CNCf4K72u4MDFdQXigMdQoQJcg;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm... Show response
9231397.fls.doubleclick.net/ Frame 6296
Redirect Chain

https://9231397.fls.doubleclick.net/activityi;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;g...
https://9231397.fls.doubleclick.net/activityi;dc_pre=CNCf4K72u4MDFdQXigMdQoQJcg;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=unde...

690 B
708 B

74ms
73ms

Document
text/html

142.251.163.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9231397.fls.doubleclick.net/activityi;dc_pre=CNCf4K72u4MDFdQXigMdQoQJcg;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals?

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f148.1e100.net

Software

cafe /

Resource Hash

e3acb368deafaa8bd7c2d422a6268423eec9f5b1fba4e4ac9e38c6b5200803dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 368
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 01 Jan 2024 09:56:37 GMT
expires: Mon, 01 Jan 2024 09:56:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 01 Jan 2024 09:56:37 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9231397.fls.doubleclick.net/activityi;dc_pre=CNCf4K72u4MDFdQXigMdQoQJcg;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

activityi;dc_pre=CKbW4K72u4MDFb0aigMdV7MMCw;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3... Show response
10742279.fls.doubleclick.net/ Frame B555
Redirect Chain

https://10742279.fls.doubleclick.net/activityi;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45...
https://10742279.fls.doubleclick.net/activityi;dc_pre=CKbW4K72u4MDFb0aigMdV7MMCw;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmeti...

563 B
642 B

71ms
70ms

Document
text/html

142.251.163.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10742279.fls.doubleclick.net/activityi;dc_pre=CKbW4K72u4MDFb0aigMdV7MMCw;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals?

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f149.1e100.net

Software

cafe /

Resource Hash

2fbe1331e7f38c07783a28fff71ccf9b5f3434f40e2a9993182e55ec5b37e07b

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 304
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 01 Jan 2024 09:56:37 GMT
expires: Mon, 01 Jan 2024 09:56:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 01 Jan 2024 09:56:37 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10742279.fls.doubleclick.net/activityi;dc_pre=CKbW4K72u4MDFb0aigMdV7MMCw;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
599 B 36ms
35ms Image
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 1576
x-ms-lease-status: unlocked
last-modified: Thu, 21 Dec 2023 21:20:05 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 81552adf-c01e-000f-5b93-344fef000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 83e9e4b8382e7471-MIA

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
490 B 36ms
36ms Fetch
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202306.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
age: 80100
x-ms-lease-status: unlocked
last-modified: Thu, 21 Dec 2023 21:20:04 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: a9b48ef7-701e-0078-4f9b-349a7b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 83e9e4b84e043343-MIA

GET
H2 200 px
secure.adnxs.com/ 43 B
790 B 64ms
63ms Image
image/gif 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/px?id=160890&%20seg=6104893&t=2

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:37 GMT
an-x-request-uuid: d2ac205b-3c4e-4ae0-8711-a0582e13491e
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.67; 38.132.118.67; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ot_company_logo.png
cdn.cookielaw.org/logos/static/ 4 KB
4 KB 38ms
37ms Image
image/png 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_company_logo.png

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: E8+sk/ECzKgTUVtDLikiIA==
age: 5619
content-length: 4036
x-ms-lease-status: unlocked
last-modified: Thu, 21 Dec 2023 21:20:05 GMT
server: cloudflare
etag: 0x8DC026A9A33BA9F
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 2916b006-b01e-0077-67ae-34ec17000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 83e9e4b8585d7471-MIA

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 36ms
35ms Image
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Jan 2024 09:56:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 8049
x-ms-lease-status: unlocked
last-modified: Thu, 21 Dec 2023 21:20:05 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: a220a8b7-a01e-006b-498a-34be77000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 83e9e4b858607471-MIA

GET
H2 200 dy-coll-min.js Show response
cdn.dynamicyield.com/scripts/1.213.0/ 199 KB
62 KB 74ms
74ms Script
application/javascript 2600:9000:26a0:4200:a:b89d:a6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.dynamicyield.com/scripts/1.213.0/dy-coll-min.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26a0:4200:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: DYCDN /
Resource Hash: 19b9a6628fa003af26766ce1578420be5068227a572c78f0e20b53e2f2fc1886

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 19:46:00 GMT
content-encoding: gzip
via: 1.1 141b2a0bfdcf3225afbe04affb901120.cloudfront.net (CloudFront)
last-modified: Sun, 15 Oct 2023 07:23:37 GMT
server: DYCDN
age: 1001438
x-amz-cf-pop: YUL62-P2
etag: W/"b587b1ed184fe1cb6e2ea31f12e547c2"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000
link: <//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
x-amz-cf-id: sMOw-dslLQt6-AEsZCWWItRN6LaHBSfscpAQUaqtaK4_NQJb5GuR5w==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 65ms
64ms Image
image/gif 2607:f8b0:4004:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-432816-1&cid=1144441024.1704102998&jid=1272351196&_u=YEBAAEAAAAAAACgAI~&z=1082750316

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::69 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collector Show response
collector-pxxt4gy2ig.px-cloud.net/api/v2/ 32 B
49 B 59ms
59ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxt4gy2ig.px-cloud.net/api/v2/collector
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ca0a766a064104105db7a847ffd8d594fb8556d364f724916f30a3e45a1ebab4

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 01 Jan 2024 09:56:37 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32

GET
H2

204

t
evt.undertone.com/ Frame 6296
Redirect Chain

https://ads.undertone.com/t?trackerid=7729&cb=1499990551
https://evt.undertone.com/t?trackerid=7729&cb=1499990551

0
654 B

281ms
113ms

Image
text/plain

3.161.213.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evt.undertone.com/t?trackerid=7729&cb=1499990551
Requested by: Host: 9231397.fls.doubleclick.net
URL: https://9231397.fls.doubleclick.net/activityi;dc_pre=CNCf4K72u4MDFdQXigMdQoQJcg;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals?
Protocol: H2
Server: 3.161.213.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-49.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://9231397.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 a6f2e7c3dd76750ec70d32e7fcf09838.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
x-cache: Miss from cloudfront
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://9231397.fls.doubleclick.net/
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
x-amz-cf-id: K9Z-ssr8vaZpVx_v2opx9KnTEUCPsAuHRO5c4NDlFRhTKsHeDoAu3A==
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 ab1abc326c36ea4cd78ce117e4c20e88.cloudfront.net (CloudFront)
accept-ch: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
x-amz-cf-pop: YUL62-C2
x-cache: Miss from cloudfront
location: https://evt.undertone.com/t?trackerid=7729&cb=1499990551
content-length: 0
x-amz-cf-id: pRz_PfaWSADiwiq_gcYtQItSqwI5RLDkXnu4FCNKO0UMLTu2IKEdIg==

GET
H2 200 dc_pre=CNCf4K72u4MDFdQXigMdQoQJcg;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=*;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1...
adservice.google.com/ddm/fls/z/ Frame 6296 42 B
401 B 178ms
69ms Image
image/gif 2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNCf4K72u4MDFdQXigMdQoQJcg;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=*;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals

Requested by

Host: 9231397.fls.doubleclick.net
URL: https://9231397.fls.doubleclick.net/activityi;dc_pre=CNCf4K72u4MDFdQXigMdQoQJcg;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://9231397.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CKbW4K72u4MDFb0aigMdV7MMCw;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=*;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;d...
adservice.google.com/ddm/fls/z/ Frame B555 42 B
107 B 172ms
70ms Image
image/gif 2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKbW4K72u4MDFb0aigMdV7MMCw;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=*;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals

Requested by

Host: 10742279.fls.doubleclick.net
URL: https://10742279.fls.doubleclick.net/activityi;dc_pre=CKbW4K72u4MDFb0aigMdV7MMCw;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://10742279.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 token Show response
www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/ 2 KB
2 KB 283ms
283ms Fetch
application/json 204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/token

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

eb65984bf2e525e7945e950a88816a69a1234d9f2489190a95aced6662755016

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.elfcosmetics.com/cosmetic-criminals
accept-language: en-US,en;q=0.9
x-pwa-request: true
Authorization
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 01 Jan 2024 09:56:38 GMT
content-encoding: gzip
x-correlation-id: 83e9e4b98977c4c5
cf-cache-status: DYNAMIC
via: 1.1 099189655b83d166e49fb0d4f2925b9c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: SFO53-P2
age: 0
x-yottaa-optimizations: ob/1000 si/25D1cc028531-1703880236-2730629394 tts/1701194968684 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-cache: Miss from cloudfront
pragma: no-cache
x-ratelimit-1m-remaining: 23522, 1976654
x-ratelimit-1m-reset: 21937, 21936
vary: Accept-Encoding, User-Agent
x-ratelimit-1m-limit: 24000, 2000000
content-type: application/json
cache-control: no-store
x-yottaa-os: 200
x-proxy-request-url: https://6p9dgqhn.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/token
x-yottaa-metrics: 2521cc02851d/[185,184,-] 25D1cc028531/[-,187.023]
cf-ray: 83e9e4b98977c4c5-SEA
x-amz-cf-id: lJO-Gg1nFfV2__lbqSLKUCzWH9Q2wZ154ihkXO6cy1NpqI5mOo5Dng==

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 239ms
87ms Fetch 3.161.213.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=794091&uid=-5692549678184100779&sec=8772046&t=ri&e=1261284&p=1&ve=11209913&va=%5B27119924%5D&ses=f5708e456efdd5bfeb018ea1dfe96e67&expSes=31179&aud=1004363.1092373.1167402.1274296.1324059.1426804.1443347.1846919.884367.884375.884385.884387.998337.1182144.799438.799440&expVisitId=-7379025182880065070&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1704102998061&rri=8655989
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/1.213.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-115.yul62.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 05515d3ee39ade93c9eed3120029b212.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: hVvIcTfc1p3BvZTNef4utaxqfum7Dn0jcghXO-lRIrQApC0pIzoxSQ==
expires: 0

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 239ms
88ms Fetch 3.161.213.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=406396&uid=-5692549678184100779&sec=8772046&t=ri&e=1574966&p=1&ve=12698518&va=%5B28347247%5D&ses=f5708e456efdd5bfeb018ea1dfe96e67&expSes=31179&aud=1004363.1092373.1167402.1274296.1324059.1426804.1443347.1846919.884367.884375.884385.884387.998337.1182144.799438.799440&expVisitId=-7379025182635850581&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1704102998063&rri=7559705
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/1.213.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-115.yul62.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 05515d3ee39ade93c9eed3120029b212.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: HnzMB4BXMfEI9nQK6KWW2m-IlPTUyGuyoQ4vep3ZIi-jZ8_QyBPgAQ==
expires: 0

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 236ms
86ms Fetch 3.161.213.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=452739&uid=-5692549678184100779&sec=8772046&t=ri&e=1609852&p=1&ve=12669413&va=%5B28321879%5D&ses=f5708e456efdd5bfeb018ea1dfe96e67&expSes=31179&aud=1004363.1092373.1167402.1274296.1324059.1426804.1443347.1846919.884367.884375.884385.884387.998337.1182144.799438.799440&expVisitId=-7379025182992182122&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1704102998064&rri=2824252
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/1.213.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-115.yul62.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 05515d3ee39ade93c9eed3120029b212.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: kjXJUMYioAnPrGN3ysx-8BhxXgyn3HxxVBjiKMrYhbF3WsacfE-2iQ==
expires: 0

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 236ms
87ms Fetch 3.161.213.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=54721&uid=-5692549678184100779&sec=8772046&t=ri&e=1575901&p=1&ve=12692962&va=%5B28207095%5D&ses=f5708e456efdd5bfeb018ea1dfe96e67&expSes=31179&aud=1004363.1092373.1167402.1274296.1324059.1426804.1443347.1846919.884367.884375.884385.884387.998337.1182144.799438.799440&expVisitId=-7379025180864763644&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1704102998065&rri=7726745
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/1.213.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-115.yul62.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 05515d3ee39ade93c9eed3120029b212.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: 6PAy63ZIPYUi1sppbXoTzo_W8S1jdtk_qOLTr3SvuEj3qVWTPT7gAQ==
expires: 0

POST
H2 200 uia Show response
async-px.dynamicyield.com/ 0
382 B 234ms
88ms XHR
text/plain 3.161.213.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/uia?cnst=1&_=1704102998067
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/1.213.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-115.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 05515d3ee39ade93c9eed3120029b212.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: p2re8GoY75MSA9fmk3DMp-YfL7zsXwUztCJvHgav5hFyUrku4tQo7A==
expires: 0

POST
H2 200 batch
async-px.dynamicyield.com/ 0
384 B 227ms
86ms Ping
text/plain 3.161.213.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/batch?cnst=1&_=1704102998078_9254
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/1.213.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-115.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 480d73d26133a5d3268f9cfc7c99d59c.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
x-amz-cf-id: IZnPyGLJSj9rmslmnJ4Na_6rTasWSa2sFBG1i7FkNxdAokT-SyrqUA==
expires: 0

POST
H2 204 sessions Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/ 0
1 KB 544ms
543ms XHR
text/plain 204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/sessions
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.elfcosmetics.com/cosmetic-criminals
accept-language: en-US,en;q=0.9
authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmODQ1NDdkOS03YjE0LTRkMDItYjkxMC1iODM1OTAxNWE1MzEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOjJlZWNhOTY1LWQxOWEtNDc0OC04OTg4LTczNjQ5MTU4MzkzZiIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImF1ZCI6ImNvbW1lcmNlY2xvdWQvcHJvZC9iYnhjX3ByZCIsIm5iZiI6MTcwNDEwMjk2OCwic3R5IjoiVXNlciIsImlzYiI6InVpZG86c2xhczo6dXBuOkd1ZXN0Ojp1aWRuOkd1ZXN0IFVzZXI6OmdjaWQ6YWJrS3RKdzBjM2xIc1J4YmMzd3FZWWxYbzI6OmNoaWQ6ICIsImV4cCI6MTcwNDEwNDc5OCwiaWF0IjoxNzA0MTAyOTk4LCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDM1MjQ3MjI0OTgwNTc3NzAxIn0.GSX8Wt1ni7BvwzTa0uAiZLoAA-zYhm43XnHW-hZ2URfrI7Fvfy1J626yl9IYStTalLW3kyHwtJfFU85HjXl0xQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 9b64e6d3539557e166b875a71dd8ecf4.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
x-amz-cf-pop: SFO53-P2
age: 0
x-yottaa-optimizations: ob/0 si/25D1cc028531-1703880236-2730629395 tts/1701194968684 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-dw-version-status: deprecated
x-cache: Miss from cloudfront
pragma: no-cache
allow: OPTIONS,POST
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: etag,location,x-dw-version-status,x-dw-resource-state,authorization,x-dw-request-base-id
x-yottaa-metrics: 2521cc0285f7/[446,444,-] 25D1cc028531/[-,446.991]
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/sessions
accept-ranges: bytes
cf-ray: 83e9e4bb6a13c4c0-SEA
x-dw-request-base-id: khmZ_VeMkmUBAAB_
x-amz-cf-id: dqaSrmDoplTE_fAJSlrWxZiWBjA4_M2nZ9-Xq_NM7OGYlnDcDJ-taQ==
x-yottaa-os: 204
expires: Thu, 01 Dec 1994 16:00:00 GMT

POST
H2 200 shoppercontext Show response
www.elfcosmetics.com/api/v1/ 114 B
784 B 618ms
617ms XHR
application/json 204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/api/v1/shoppercontext?siteId=elf-us
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: 6b42a56b231d70ea3691b9f46363b9f8ed6ca35f6b50084718669b8beac1e57d

Request headers

Referer: https://www.elfcosmetics.com/cosmetic-criminals
accept-language: en-US,en;q=0.9
authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmODQ1NDdkOS03YjE0LTRkMDItYjkxMC1iODM1OTAxNWE1MzEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOjJlZWNhOTY1LWQxOWEtNDc0OC04OTg4LTczNjQ5MTU4MzkzZiIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImF1ZCI6ImNvbW1lcmNlY2xvdWQvcHJvZC9iYnhjX3ByZCIsIm5iZiI6MTcwNDEwMjk2OCwic3R5IjoiVXNlciIsImlzYiI6InVpZG86c2xhczo6dXBuOkd1ZXN0Ojp1aWRuOkd1ZXN0IFVzZXI6OmdjaWQ6YWJrS3RKdzBjM2xIc1J4YmMzd3FZWWxYbzI6OmNoaWQ6ICIsImV4cCI6MTcwNDEwNDc5OCwiaWF0IjoxNzA0MTAyOTk4LCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDM1MjQ3MjI0OTgwNTc3NzAxIn0.GSX8Wt1ni7BvwzTa0uAiZLoAA-zYhm43XnHW-hZ2URfrI7Fvfy1J626yl9IYStTalLW3kyHwtJfFU85HjXl0xQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
content-type: application/json

Response headers

date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 922f380ce54182257be92d6c0111acb4.cloudfront.net (CloudFront)
content-encoding: gzip
x-amzn-remapped-content-length: 114
x-amz-cf-pop: SFO53-P2
age: 0
x-amzn-remapped-connection: close
x-yottaa-optimizations: ob/1000 si/25D1cc028531-1703880236-2730629396 tts/1701194968684 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-amzn-requestid: 270bde51-ab70-4ed4-950c-aca2246e36c5
x-cache: Miss from cloudfront
x-amz-apigw-id: Q2rdjGbEiYcEZRg=
content-length: 108
etag: W/"72-HgdmTgyCF/DQfqnMU3u+4UstAzI"
x-amzn-trace-id: Root=1-65928c56-687766a404ba095048413191;Sampled=0;lineage=2b75b0e9:0
content-type: application/json; charset=utf-8
x-yottaa-os: 200
x-yottaa-metrics: 2521cc0285f8/[520,518,-] 25D1cc028531/[-,521.225]
x-amzn-remapped-date: Mon, 01 Jan 2024 09:56:38 GMT
x-amz-cf-id: MamLzxtcpqLw-5bKx-sxgSImEAWH-TCJhJCcmhJYJXJGKaUU1AhP9g==

GET
H2 200 geo-ip Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/ 196 B
867 B 412ms
411ms XHR
application/json 204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=38.132.118.67

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

b0ae6ca3caa68945caf45f000efe5b8a052d45d9438cd4ca92221abe5c05e707

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/cosmetic-criminals
x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
accept-language: en-US,en;q=0.9
x-pwa-request: true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
content-type: application/json

Response headers

date: Mon, 01 Jan 2024 09:56:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 0560e3493bcd525e6e3e19cd7c9abdc0.cloudfront.net (CloudFront)
x-amz-cf-pop: SFO53-P2
age: 0
x-yottaa-optimizations: ob/1000 si/25D1cc028531-1703880236-2730629397 tts/1701194968684 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-dw-version-status: deprecated
x-cache: Miss from cloudfront
allow: GET,HEAD,OPTIONS
content-type: application/json;charset=UTF-8
cache-control: max-age=0,no-cache,no-store,must-revalidate
x-yottaa-os: 200
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=38.132.118.67
x-yottaa-metrics: 2521cc0285ab/[312,312,-] 25D1cc028531/[-,313.501]
cf-ray: 83e9e4bc4f3e307d-SEA
x-dw-request-base-id: 22TudFaMkmUBAAB_
x-amz-cf-id: Ln-ypLr8jzwvOoUgjgyBr9E3--R2ptA13kfK1K_Nlx4gRQh7oxED8g==

GET
H2 200 geo-ip Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/ 196 B
864 B 391ms
390ms XHR
application/json 204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=38.132.118.67

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

b0ae6ca3caa68945caf45f000efe5b8a052d45d9438cd4ca92221abe5c05e707

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/cosmetic-criminals
x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
accept-language: en-US,en;q=0.9
x-pwa-request: true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
content-type: application/json

Response headers

date: Mon, 01 Jan 2024 09:56:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 23e0198e3ba45afaefc61c0d0fc4eacc.cloudfront.net (CloudFront)
x-amz-cf-pop: SFO53-P2
age: 0
x-yottaa-optimizations: ob/1000 si/25D1cc028531-1703880236-2730629398 tts/1701194968684 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-dw-version-status: deprecated
x-cache: Miss from cloudfront
allow: GET,HEAD,OPTIONS
content-type: application/json;charset=UTF-8
cache-control: max-age=0,no-cache,no-store,must-revalidate
x-yottaa-os: 200
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=38.132.118.67
x-yottaa-metrics: 2521cc0285ac/[292,290,-] 25D1cc028531/[-,292.543]
cf-ray: 83e9e4bc2c2cec5c-SEA
x-dw-request-base-id: 22TtdFaMkmUBAAB_
x-amz-cf-id: FAi7di-guy4yXJ7tHrprVjrDKcLvW6Y-lvTqdr04drPDb8n1cg0tcw==

GET
H2 200 baskets Show response
www.elfcosmetics.com/mobify/proxy/api/customer/shopper-customers/v1/organizations/f_ecom_bbxc_prd/customers/abkKtJw0c3lHsRxbc3wqYYlXo2/ 11 B
824 B 317ms
317ms Fetch
application/json 204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/api/customer/shopper-customers/v1/organizations/f_ecom_bbxc_prd/customers/abkKtJw0c3lHsRxbc3wqYYlXo2/baskets?siteId=elf-us

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

31f48ed33afe7e437efa2c30cbf97fbd62c2de5c0732504077377846fe64973f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/cosmetic-criminals
accept-language: en-US,en;q=0.9
x-pwa-request: true
Authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmODQ1NDdkOS03YjE0LTRkMDItYjkxMC1iODM1OTAxNWE1MzEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOjJlZWNhOTY1LWQxOWEtNDc0OC04OTg4LTczNjQ5MTU4MzkzZiIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImF1ZCI6ImNvbW1lcmNlY2xvdWQvcHJvZC9iYnhjX3ByZCIsIm5iZiI6MTcwNDEwMjk2OCwic3R5IjoiVXNlciIsImlzYiI6InVpZG86c2xhczo6dXBuOkd1ZXN0Ojp1aWRuOkd1ZXN0IFVzZXI6OmdjaWQ6YWJrS3RKdzBjM2xIc1J4YmMzd3FZWWxYbzI6OmNoaWQ6ICIsImV4cCI6MTcwNDEwNDc5OCwiaWF0IjoxNzA0MTAyOTk4LCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDM1MjQ3MjI0OTgwNTc3NzAxIn0.GSX8Wt1ni7BvwzTa0uAiZLoAA-zYhm43XnHW-hZ2URfrI7Fvfy1J626yl9IYStTalLW3kyHwtJfFU85HjXl0xQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:38 GMT
x-correlation-id: 83e9e4bc2c23c505
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 ae8253630612e3347863de4af7a55446.cloudfront.net (CloudFront)
x-amz-cf-pop: SFO53-P2
age: 0
x-yottaa-optimizations: ob/1000 si/25D1cc028531-1703880236-2730629399 tts/1701194968684 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
content-encoding: gzip
x-cache: Miss from cloudfront
content-length: 37
allow: GET,HEAD,OPTIONS
x-ratelimit-remaining: 999
content-type: application/json;charset=UTF-8
vary: Accept-Encoding
sfdc_load: 2
cache-control: max-age=0,no-cache,no-store
x-yottaa-os: 200
x-proxy-request-url: https://6p9dgqhn.api.commercecloud.salesforce.com/customer/shopper-customers/v1/organizations/f_ecom_bbxc_prd/customers/abkKtJw0c3lHsRxbc3wqYYlXo2/baskets?siteId=elf-us
x-ratelimit-limit: 99999
accept-ranges: bytes
cf-ray: 83e9e4bc2c23c505-SEA
x-amz-cf-id: Ah_GFiayxvAhCBPkwQ9VOiPQWCYJqJXsZrsRcEz1ePs-fMIP6mhrwQ==
x-yottaa-metrics: 2521cc028599/[218,217,-] 25D1cc028531/[-,219.321]

POST
H2 201 sync Show response
sdk.iad-05.braze.com/api/v3/content_cards/ 77 B
188 B 154ms
153ms XHR
application/json 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c714fe2d9c248c9fd2f802b9b7ca8f607d5c57dd543146ad402b391707385305

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57
X-Braze-DataRequest: true
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-type: application/json
BRAZE-SYNC-RETRY-COUNT: 0
Referer: https://www.elfcosmetics.com/
X-Requested-With: XMLHttpRequest
X-Braze-ContentCardsRequest: true

Response headers

date: Mon, 01 Jan 2024 09:56:38 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: MISS
x-request-id: e6810d35-8ac2-40cc-9ccf-abdd684b2c49
x-served-by: cache-mia-kmia1760070-MIA
x-runtime: 0.096250
etag: W/"c714fe2d9c248c9fd2f802b9b7ca8f60"
access-control-max-age: 7200
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
vary: Origin,Accept-Encoding
accept-ranges: bytes
x-cache-hits: 0

OPTIONS
H2 200 sync
sdk.iad-05.braze.com/api/v3/content_cards/ Frame 0
0 139ms
138ms Preflight 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: braze-sync-retry-count,content-type,x-braze-api-key,x-braze-contentcardsrequest,x-braze-datarequest,x-requested-with
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-headers: braze-sync-retry-count,content-type,x-braze-api-key,x-braze-contentcardsrequest,x-braze-datarequest,x-requested-with
access-control-allow-methods: POST, GET
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
content-encoding: gzip
date: Mon, 01 Jan 2024 09:56:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760070-MIA

POST
H2 200 clog Show response
px.dynamicyield.com/ 0
228 B 167ms
52ms XHR
text/plain 52.3.200.153
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://px.dynamicyield.com/clog
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/1.213.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.200.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-200-153.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:38 GMT
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With
content-length: 0
expires: 0

POST
H3 200 collector Show response
collector-pxxt4gy2ig.px-cloud.net/api/v2/ 32 B
49 B 61ms
61ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxt4gy2ig.px-cloud.net/api/v2/collector
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ca0a766a064104105db7a847ffd8d594fb8556d364f724916f30a3e45a1ebab4

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 01 Jan 2024 09:56:38 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32

POST
H2 200 baskets Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/ 3 KB
2 KB 682ms
682ms XHR
application/json 204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/baskets

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

fc61323a624ca2cb473b60bd7554b9f2b4962b674a8736dbb9ab129dff3a1545

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/cosmetic-criminals
x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
accept-language: en-US,en;q=0.9
x-pwa-request: true
authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmODQ1NDdkOS03YjE0LTRkMDItYjkxMC1iODM1OTAxNWE1MzEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOjJlZWNhOTY1LWQxOWEtNDc0OC04OTg4LTczNjQ5MTU4MzkzZiIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImF1ZCI6ImNvbW1lcmNlY2xvdWQvcHJvZC9iYnhjX3ByZCIsIm5iZiI6MTcwNDEwMjk2OCwic3R5IjoiVXNlciIsImlzYiI6InVpZG86c2xhczo6dXBuOkd1ZXN0Ojp1aWRuOkd1ZXN0IFVzZXI6OmdjaWQ6YWJrS3RKdzBjM2xIc1J4YmMzd3FZWWxYbzI6OmNoaWQ6ICIsImV4cCI6MTcwNDEwNDc5OCwiaWF0IjoxNzA0MTAyOTk4LCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDM1MjQ3MjI0OTgwNTc3NzAxIn0.GSX8Wt1ni7BvwzTa0uAiZLoAA-zYhm43XnHW-hZ2URfrI7Fvfy1J626yl9IYStTalLW3kyHwtJfFU85HjXl0xQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
content-type: application/json

Response headers

date: Mon, 01 Jan 2024 09:56:39 GMT
via: 1.1 68a8bf1c51ac47222204adb56c4024ac.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
x-amz-cf-pop: SFO53-P2
age: 0
x-yottaa-optimizations: ob/1000 si/25D1cc028531-1703880236-2730629400 tts/1701194968684 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-dw-version-status: deprecated
x-cache: Miss from cloudfront
content-length: 1048
pragma: no-cache
etag: d94f2d90a59e3ffe000f659f4cb3006bb5ac2a6850910c6b037fb4de03d4b7d4
allow: OPTIONS,POST
content-type: application/json;charset=UTF-8
x-dw-resource-state: d94f2d90a59e3ffe000f659f4cb3006bb5ac2a6850910c6b037fb4de03d4b7d4
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: etag,location,x-dw-version-status,x-dw-resource-state,authorization,x-dw-request-base-id
x-yottaa-metrics: 2521cc028598/[584,582,-] 25D1cc028531/[-,585.405]
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/baskets
accept-ranges: bytes
cf-ray: 83e9e4be8f4b0875-SEA
x-dw-request-base-id: khml_VeMkmUBAAB_
x-amz-cf-id: nJdhDeKXkC3lRDnAXlvmyXqdUzNs2k0ky6XU2wLWx4Y8V31C_0BCDA==
x-yottaa-os: 200
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 NEW-beauty-squad-beauty-squad-loyalty-logo-staggered-paddedsquare
elfcosmetics.a.bigcontent.io/v1/static/ 5 KB
5 KB 252ms
38ms Image
image/png 2606:4700:4400::6812:2a49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://elfcosmetics.a.bigcontent.io/v1/static/NEW-beauty-squad-beauty-squad-loyalty-logo-staggered-paddedsquare?%24Desktop%24=&fmt=auto
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2a49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 210706c053295db0bfba03a98c0609a1f940c3f6b6c626f2f1084e089e959dc9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:39 GMT
x-amz-version-id: null
cf-cache-status: HIT
age: 75773
x-amz-server-side-encryption: AES256
x-amp-cf-worker: true
edge-control: max-age=86400
alt-svc: h3=":443"; ma=86400
content-length: 5378
last-modified: Sun, 31 Dec 2023 12:53:46 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=1800
accept-ranges: bytes
cf-ray: 83e9e4c1a9e04c0c-MIA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 icon-noun-gift-1165617
elfcosmetics.a.bigcontent.io/v1/static/ 2 KB
1 KB 251ms
38ms Image
image/svg+xml 2606:4700:4400::6812:2a49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://elfcosmetics.a.bigcontent.io/v1/static/icon-noun-gift-1165617?%24Desktop%24=&fmt=auto
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2a49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4aa855b8d34657ab4df5ca73fe7d7f67735ee1e39e8de83856ddc473d4713fbb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:39 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
age: 72155
x-amz-server-side-encryption: AES256
x-amp-cf-worker: true
edge-control: max-age=86400
alt-svc: h3=":443"; ma=86400
last-modified: Sun, 31 Dec 2023 13:54:04 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=1800
cf-ray: 83e9e4c1a9df4c0c-MIA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 icon-noun-snowflake-1044022
elfcosmetics.a.bigcontent.io/v1/static/ 3 KB
2 KB 249ms
36ms Image
image/svg+xml 2606:4700:4400::6812:2a49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://elfcosmetics.a.bigcontent.io/v1/static/icon-noun-snowflake-1044022?%24Desktop%24=&fmt=auto
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2a49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30766af54516bbc623c690d7506f7d86b6c987acbcc1229debb7dff8f463459b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:39 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
age: 69753
x-amz-server-side-encryption: AES256
x-amp-cf-worker: true
edge-control: max-age=86400
alt-svc: h3=":443"; ma=86400
last-modified: Sun, 31 Dec 2023 14:34:06 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=1800
cf-ray: 83e9e4c1a9de4c0c-MIA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 53ms
52ms Image
image/gif 2607:f8b0:4004:c07::66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1450957019&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&dp=%2Fcosmetic-criminals&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=ux&ea=scrolled%20page&el=25%25&_u=aEDAAEABAAAAACgAIAC~&jid=&gjid=&cid=1144441024.1704102998&tid=UA-432816-1&_gid=2141509973.1704102998&gtm=45He3bt0n81WL3STMXv896608294&cd4=0&cd6=&cd7=&cd8=&cd9=0&cd14=content&cd19=&cd21=US&gcd=11l1l1l1l1&dma=0&z=1985409649

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 31 Dec 2023 18:46:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54614
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 54ms
53ms Image
image/gif 2607:f8b0:4004:c07::66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1450957019&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&dp=%2Fcosmetic-criminals&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=ux&ea=scrolled%20page&el=50%25&_u=aEDAAEABAAAAACgAIAC~&jid=&gjid=&cid=1144441024.1704102998&tid=UA-432816-1&_gid=2141509973.1704102998&gtm=45He3bt0n81WL3STMXv896608294&cd4=0&cd6=&cd7=&cd8=&cd9=0&cd14=content&cd19=&cd21=US&gcd=11l1l1l1l1&dma=0&z=104354575

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 31 Dec 2023 18:46:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54614
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 53ms
53ms Image
image/gif 2607:f8b0:4004:c07::66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1450957019&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&dp=%2Fcosmetic-criminals&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=ux&ea=scrolled%20page&el=75%25&_u=aEDAAEABAAAAACgAIAC~&jid=&gjid=&cid=1144441024.1704102998&tid=UA-432816-1&_gid=2141509973.1704102998&gtm=45He3bt0n81WL3STMXv896608294&cd4=0&cd6=&cd7=&cd8=&cd9=0&cd14=content&cd19=&cd21=US&gcd=11l1l1l1l1&dma=0&z=1878743969

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 31 Dec 2023 18:46:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54614
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 54ms
54ms Image
image/gif 2607:f8b0:4004:c07::66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1450957019&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&dp=%2Fcosmetic-criminals&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=ux&ea=scrolled%20page&el=95%25&_u=aEDAAEABAAAAACgAIAC~&jid=&gjid=&cid=1144441024.1704102998&tid=UA-432816-1&_gid=2141509973.1704102998&gtm=45He3bt0n81WL3STMXv896608294&cd4=0&cd6=&cd7=&cd8=&cd9=0&cd14=content&cd19=&cd21=US&gcd=11l1l1l1l1&dma=0&z=1446432191

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 31 Dec 2023 18:46:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54614
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 PWA-UpdateSession Show response
www.elfcosmetics.com/mobify/proxy/controllers/on/demandware.store/Sites-elf-us-Site/en_US/ 56 B
1 KB 517ms
516ms XHR
application/json 204.2.133.49
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/mobify/proxy/controllers/on/demandware.store/Sites-elf-us-Site/en_US/PWA-UpdateSession
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/mobify/bundle/10314/vendor.js?yocs=1u_1y_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.2.133.49 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: f66f5edd05293c4351edcec020a867935f7495ef0d0ff7ceb3e6402748585ca6

Request headers

Referer: https://www.elfcosmetics.com/cosmetic-criminals
accept-language: en-US,en;q=0.9
x-pwa-request: true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:39 GMT
content-encoding: gzip
via: 1.1 7c6913fc3bfae6245d89d874d910fab4.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
x-amz-cf-pop: SFO53-P2
age: 0
x-yottaa-optimizations: ob/1000 si/25D1cc028531-1703880236-2730629402 tts/1701194968684 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-cache: Miss from cloudfront
pragma: no-cache
content-type: application/json
cache-control: no-cache, no-store, must-revalidate
x-yottaa-os: 200
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/on/demandware.store/Sites-elf-us-Site/en_US/PWA-UpdateSession
x-yottaa-metrics: 2521cc028597/[419,418,-] 25D1cc028531/[-,420.185]
cf-ray: 83e9e4c2d88b27f9-SEA
x-dw-request-base-id: SZjHwVeMkmUBAAB_
x-amz-cf-id: l3atagnLXjknUqgZ57M9TUedDQvjS90vx-teJvlM1ylvUl1QWpQMAw==
expires: Thu, 01 Dec 1994 16:00:00 GMT

POST
H2 200 event
qoe-1.yottaa.net/log-nt/ 3 B
191 B 324ms
94ms Ping
text/json 204.2.50.198
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://qoe-1.yottaa.net/log-nt/event
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.2.50.198 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 01 Jan 2024 09:56:39 GMT
access-control-expose-headers: X-Results-Data-Source
access-control-allow-credentials: true
cache-control: no-cache
timing-allow-origin: *
content-type: text/json

GET
H/1.1 200
OK main.js Show response
static.ordergroove.com/1e72a9589c4f11e9a62ebc764e10b970/ 144 KB
42 KB 273ms
58ms Script
application/javascript 184.27.13.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.ordergroove.com/1e72a9589c4f11e9a62ebc764e10b970/main.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

184.27.13.189 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-27-13-189.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

ec82b31e96055d86efd9adec9781b4b588e877c51b1b62ce71dbf73d64ab5318

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000
Content-Encoding: gzip
Date: Mon, 01 Jan 2024 09:56:39 GMT
Server: nginx
ETag: W/"5dfe8369a3933fdb6e1183aaae1f4985cce427b9"
X-Powered-By: Express
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: must-revalidate, max-age=900
Connection: keep-alive
Content-Length: 42894
Expires: Mon, 01 Jan 2024 10:11:39 GMT

GET
H2 200 110221.ct.js Show response
tag.rmp.rakuten.com/ 47 KB
15 KB 229ms
53ms Script
text/javascript 34.102.147.248
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.rmp.rakuten.com/110221.ct.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.102.147.248 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

248.147.102.34.bc.googleusercontent.com

Software

Resource Hash

11762f3811534382a7fe191591000ebd869ce22a1936004470c4ce1d420a36a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:39 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=31536000
last-modified: Mon, 01 Jan 2024 09:56:39 GMT
x-cache: hit
x-samesite: secure
content-type: text/javascript
cache-control: max-age=86400
x-dyn: 0
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 js Show response
www.paypal.com/sdk/ 405 KB
113 KB 195ms
31ms Script
application/javascript 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/sdk/js?client-id=AQ-EQFYFdmKNxtZRBoRdv2chvQI-_ZPvL1jVN9SFYCTseKT4OHPKrnT2yJlx8kWKnFI7JXEJM_cTSdbf&intent=authorize&currency=USD&vault=true&components=buttons,messages

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

406c93b0692878bad84a4f34065184d023ac12f1b92d9cb0398642fb0de45c2d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; script-src 'nonce-UNqZmo/1zJRNlkhd/gvCEQF2H2Y6KfUHxE38yYaDm6p3QGo7' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'nonce-UNqZmo/1zJRNlkhd/gvCEQF2H2Y6KfUHxE38yYaDm6p3QGo7' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-UNqZmo/1zJRNlkhd/gvCEQF2H2Y6KfUHxE38yYaDm6p3QGo7' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-UNqZmo/1zJRNlkhd/gvCEQF2H2Y6KfUHxE38yYaDm6p3QGo7' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
content-encoding: gzip
x-content-type-options: nosniff
disable-set-cookie: true
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Mon, 01 Jan 2024 09:56:39 GMT
age: 3043
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: HIT, HIT, MISS
p3p: true
paypal-debug-id: f699128d0b57b
server-timing: "traceparent;desc="00-0000000000000000000f699128d0b57b-59801b2ee47e3cee-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
content-length: 113491
x-xss-protection: 1; mode=block
x-served-by: cache-dfw-kdfw8210099-DFW, cache-mia-kmia1760053-MIA, cache-mia-kmia1760053-MIA
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent: 00-0000000000000000000f699128d0b57b-2afcff90e7e31dc5-01
x-timer: S1704103000.718668,VS0,VE4
etag: W/"1bb53-c79XMxVek5EmjAexQ41SV+7fXh0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Server-Timing
cache-control: public, max-age=3600, s-maxage=10800
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
x-cache-hits: 32679, 1, 0

GET
H/1.1 200
OK / Show response
websdk.appsflyer.com/ 38 KB
12 KB 326ms
172ms Script
application/javascript 2600:1408:c400:59::17d5:9e04
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://websdk.appsflyer.com/?st=banners&
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:59::17d5:9e04 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bf8b41f6693852a18d2449439f0400cfaf19b755e21f01eda21a6ff985d3526c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Mon, 01 Jan 2024 09:56:39 GMT
Content-Encoding: gzip
x-amz-request-id: VPCP98F3K3N7Y0S8
x-amz-server-side-encryption: AES256
Connection: keep-alive
Content-Length: 11792
x-amz-id-2: J0ehP83iGtFhFDzx9znFBbdK81DLNN3txzQUDzGLeFDByel0pX1qQacK6amhO9VxDmxquql6M8o=
Last-Modified: Wed, 14 Jun 2023 06:58:45 GMT
Server: AmazonS3
ETag: "5a676288bcea03bd05e483bc4ce066ae"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2986
Accept-Ranges: bytes
X-DataStream-Cache-Status: 1
Expires: Mon, 01 Jan 2024 10:46:25 GMT

GET
H2 200 loader.js Show response
cdn.usehero.com/ 98 KB
28 KB 268ms
77ms Script
application/javascript 2600:9000:269f:4e00:13:d6f4:3240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.usehero.com/loader.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:269f:4e00:13:d6f4:3240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ab99a75a2070736b0282d041df3a7e272ad5d4d1929ae430089ac0335e05ad2c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:06:41 GMT
content-encoding: gzip
via: 1.1 421f55bf919c48fdb315cf78c5d6e1dc.cloudfront.net (CloudFront)
last-modified: Tue, 19 Sep 2023 07:56:38 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P1
age: 3004
x-amz-server-side-encryption: AES256
etag: W/"fbf714a58cbac38c0deea519667d9044"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: Ufqu0BX0wmorNWvzbBRFCOnSl5ucClnWfbqb0_VtMXrekThXjyJvoQ==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10812184462/ 2 KB
1 KB 65ms
64ms Script
text/javascript 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10812184462/?random=1704102997237&cv=11&fst=1704102997237&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&hn=www.googleadservices.com&frm=0&auid=1145590087.1704102997&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cb08d2a78700ce581b6298e9186d7dacc943aecc6a39ef1b2644c57dba48bc56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1235
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/698270988/ 3 KB
2 KB 179ms
63ms Script
text/javascript 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/698270988/?random=1704102997241&cv=11&fst=1704102997241&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&label=87uyCIuRktcBEIyK-8wC&hn=www.googleadservices.com&frm=0&value=0&bttype=purchase&auid=1145590087.1704102997&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

cafe /

Resource Hash

00c8262f03a66a2ee09e72210fbf8a5c96af8936927b11b9e7aafdd5084ce303

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1608
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/865242110/ 2 KB
1 KB 65ms
64ms Script
text/javascript 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/865242110/?random=1704102997256&cv=11&fst=1704102997256&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&hn=www.googleadservices.com&frm=0&auid=1145590087.1704102997&uamb=0&uaw=0&data=ecomm_prodid%3D%3Becomm_totalvalue%3D&rfmt=3&fmt=4

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4fe7f21832dbf723dcfd8be15da287d2b88375c3b9a7cced90b51efc228634aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1269
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ 41 KB
18 KB 256ms
109ms Script
application/javascript 54.230.48.245
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.48.245 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-48-245.yul62.r.cloudfront.net
Software: CloudFront /
Resource Hash: ab12e815caea6aba8fe2da60e7d298cccb649166f81926ff64e5dc56ea526522

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:39 GMT
content-encoding: gzip
via: 1.1 f7da5d3db9ee44e1812f138a4bdfd564.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: YUL62-C2
x-cache: Miss from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 17610
x-amz-cf-id: F6a3f4kZ9PLWzMRYwBA_wZHVjxsE7NkSkED0s0KA9XUdnBABDyMO_Q==

GET
H2 200 core.js Show response
s.pinimg.com/ct/ 4 KB
2 KB 227ms
55ms Script
application/javascript 2600:1408:c400:38f::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:38f::1931 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: ef45c21f7e054481c81992c1a46293a28c9bb8b3722bc566479326187f473c8c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

akamai-x-true-ttl: 7200
content-encoding: br
x-cdn: akamai
etag: "8d7d8ce32aa2a45d64e9f04a9a5cb1c4"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=7200
accept-ranges: bytes
alt-svc: h3=":443"; ma=600
content-length: 1793

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 204ms
68ms Script
application/x-javascript 2a03:2880:f07d:0:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f07d:0:face:b00c:0:3 Apodaca, Mexico, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 01 Jan 2024 09:56:39 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: jHk68YHdILWIZlhyDeDENdc4j2FYsBCG+giVwPQ7/oBB/3YoLWmnypLUM30kOtTG5nylj4rDhHiEEeEqnVUyAQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 26 KB
9 KB 85ms
26ms Script
application/javascript 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 39657f7f198608406cab1de96720a22549e6b6d918db8dfdd0f5ef9ab84ef17c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:39 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Tue, 12 Dec 2023 19:56:38 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "ead4fccfb1bebd02138cf2dcadd7dcba"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 8123

GET
H2 200 events.js Show response
analytics.tiktok.com/i18n/pixel/ 6 KB
3 KB 197ms
80ms Script
application/javascript 23.218.216.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1EFEJPT0U322RQPGHFG&lib=ttq
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.216.202 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-218-216-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: caf0ae97ec23eaa1297b96a5906d543a45ff59f954c4a5563deaca79457f4a4a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-akamai-request-id: 5a8d19e6
date: Mon, 01 Jan 2024 09:56:39 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-2401010956396A88E19113D279FAAACA-17117D0ADA8C8F90-00
x-cache: TCP_MISS from a23-222-0-202.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52660090) (-)
server-timing: inner; dur=4, cdn-cache; desc=MISS, edge; dur=2, origin; dur=11
content-length: 1948
pragma: no-cache
server: nginx
x-tt-logid: 202401010956396A88E19113D279FAAACA
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 12,23.222.0.202
x-tt-trace-host: 012abdb6ded152821aa6b54fd2c6c3aa87feb9b4a6a0d3652d671e03af9e800359ce688b1903d9103091e418b71ea7b93c02674f8bfeebe15921d7cce74443cafbcd3266a2607e51d6818b4b0a65a3750a49f850c9e144eb0ba71c85acd8cb4f92
expires: Mon, 01 Jan 2024 09:56:39 GMT

GET
H2 200 widget.js Show response
js.jebbit.com/companion/v1/ 44 KB
44 KB 260ms
80ms Script
text/javascript 2600:9000:21a2:5a00:a:7914:b00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.jebbit.com/companion/v1/widget.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21a2:5a00:a:7914:b00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a68adcd6e4525179b1a4e28b16abe4777a0afb870b4317b427f6d6ea8fbe22ed

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-amz-version-id: Uw77y8f3Lm7O6.ZhO9qLmkRQyA3BbYtB
date: Mon, 01 Jan 2024 08:58:11 GMT
via: 1.1 90afcdb26518f969b68e124515efb74c.cloudfront.net (CloudFront)
last-modified: Thu, 21 Dec 2023 18:01:49 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-C1
age: 3509
x-amz-server-side-encryption: AES256
etag: "c3a781ab856fe1e791e7bbb3d0023f28"
x-cache: Hit from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 45036
x-amz-cf-id: jMA__9FEFjvXy7K_gtcdKbLKQzuQxWOlbunIUFKzkZ9uHc63qK3RlA==

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 113ms
53ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Mon, 01 Jan 2024 09:56:39 GMT
last-modified: Fri, 10 Nov 2023 20:09:55 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 11E91052B74940E9B310E665EE156404 Ref B: MIAEDGE1620 Ref C: 2024-01-01T09:56:39Z
etag: "80abcdf1114da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13175

GET
H3 200 /
www.google.com/pagead/1p-user-list/10812184462/ 42 B
64 B 65ms
65ms Image
image/gif 2607:f8b0:4004:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10812184462/?random=1704102997237&cv=11&fst=1704099600000&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&frm=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_ExAhgkaPw-NEYz2JQf87x5Jf5fuI8wfT42-QTj3GTKa_Gefl&random=2743966936&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::69 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:39 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/865242110/ 42 B
64 B 73ms
73ms Image
image/gif 2607:f8b0:4004:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/865242110/?random=1704102997256&cv=11&fst=1704099600000&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&frm=0&data=ecomm_prodid%3D%3Becomm_totalvalue%3D&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_ZNYBKGteUkQnQpXrAjyHOFwFQzmWzjsPOeRcPApd0AynXmWW&random=2597764474&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::69 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:39 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1a8bfa042c9c5.js Show response
t.contentsquare.net/uxa/ 283 KB
68 KB 234ms
81ms Script
application/javascript 13.225.195.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.contentsquare.net/uxa/1a8bfa042c9c5.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.195.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-195-64.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e164d3eb3e9b278fea4e13e0d68d3f1bb3fc421c3a2b709710ddfe8762dc4fad

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Sat, 30 Dec 2023 07:20:56 GMT
content-encoding: br
via: 1.1 c0216388ff1632eb6c4704890b01eee4.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-C1
age: 0
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 69384
last-modified: Tue, 19 Dec 2023 14:04:54 GMT
server: AmazonS3
etag: "cf13703979657a27cb3c3eeda3bbb72a"
vary: Origin
content-type: application/javascript;charset=utf-8
cache-control: max-age=900
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: B_trqn0mvzOqiDB3-YdMOtYLklU3ivulH_EgJb2R4uKGEPwksGU-Qw==

GET
H2 200 i.js Show response
tag.wknd.ai/4142/ 18 KB
6 KB 90ms
28ms Script
text/plain 34.120.253.250
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.wknd.ai/4142/i.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.253.250 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 250.253.120.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: 9a77cbb7b054563b83506932790e70186ba3a92e69a147216e3176337178adbb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:38 GMT
content-encoding: gzip
via: 1.1 google
age: 1
x-envoy-upstream-service-time: 0
x-region: us-central1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5754
server: istio-envoy
etag: 84d224ee45e478
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=60
timing-allow-origin: *
link: <https://assets.bounceexchange.com>; rel=dns-prefetch, <https://events.bouncex.net>; rel=dns-prefetch, <https://data.cdnbasket.net>; rel=dns-prefetch, <https://page.cdnbasket.net>; rel=dns-prefetch, <https://view.cdnbasket.net>; rel=dns-prefetch, <https://ids.cdnwidget.com>; rel=dns-prefetch, <https://u.cdnwidget.com>; rel=dns-prefetch, <https://pix.cdnwidget.com>; rel=dns-prefetch, <https://api.bounceexchange.com>; rel=preconnect, <https://pd.cdnwidget.com>; rel=preconnect

GET
H2 200 sdk.js Show response
analytics.tiktok.com/i18n/pixel/ 8 KB
3 KB 99ms
63ms Script
application/javascript 23.218.216.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/sdk.js?sdkid=BRR4GA0I9JJBU29G8GF0
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.216.202 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-218-216-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: b91192e24e8d4a8c79e94f96ae96848c6760546622a65897a91e35b3ea4de590

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-akamai-request-id: 5a8d19e7
date: Mon, 01 Jan 2024 09:56:39 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-2401010956396A88E19113D279FAAAC9-63BD6B60E17D81C7-00
x-cache: TCP_MISS from a23-222-0-202.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52660090) (-)
server-timing: inner; dur=3, cdn-cache; desc=MISS, edge; dur=1, origin; dur=6
content-length: 2371
pragma: no-cache
server: nginx
x-tt-logid: 202401010956396A88E19113D279FAAAC9
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 6,23.222.0.202
x-tt-trace-host: 012abdb6ded152821aa6b54fd2c6c3aa87feb9b4a6a0d3652d671e03af9e800359ce688b1903d9103091e418b71ea7b93c218d75678f52f45514baed86f21ecef6bf3de83962237674e912ced0499c12cf96477ed91ead7e3af67e363778c97b40
expires: Mon, 01 Jan 2024 09:56:39 GMT

GET
H3

200

/
www.google.com/pagead/1p-conversion/698270988/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/698270988/?random=1906463790&cv=11&fst=1704102997241&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&u_w=1600&...
https://www.google.com/pagead/1p-conversion/698270988/?random=1906463790&cv=11&fst=1704102997241&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A...

42 B
64 B

66ms
66ms

Image
image/gif

2607:f8b0:4004:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/698270988/?random=1906463790&cv=11&fst=1704102997241&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&label=87uyCIuRktcBEIyK-8wC&hn=www.googleadservices.com&frm=0&value=0&auid=1145590087.1704102997&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09MSnJBWVF6YzdkeXEzUjRfdm9BUkltQUpSUmV6T1NmZm5hemJaam9wYmxYNzNnRE5PSm1nMHBNNnlSU2p5cDBJUmxJbGNmWkRNGlpDaEVJZ09MSnJBWVFvNEhPNVBQaXZ0M1NBUkl1QVBDSGtpUjBvNFViLWZVcFFwQzIzbWV1LTF3V3JLTkwtaVVmVXp3dkFOSDhfMC1Cb1lXeTRwNnBQaE1haEEiEwjS7tav9ruDAxUEGWgIHYDNDBI&is_vtc=1&ocp_id=V4ySZZLnLISyoPMPgJuzkAE&cid=CAQSKQAvHhf_ylYBztCissycDXsicojYycL4mPolc3kWikVUP8THCvtX_XYO&eitems=ChEIgOLJrAYQ1tWj2sWOtp_NARIdANJWnmUpO_xZrCumx1xqoH3hgmAkK3R4cUbaQUQ&random=963113123

Protocol

Server

2607:f8b0:4004:c1d::69 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:39 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:39 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/698270988/?random=1906463790&cv=11&fst=1704102997241&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v896608294&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&label=87uyCIuRktcBEIyK-8wC&hn=www.googleadservices.com&frm=0&value=0&auid=1145590087.1704102997&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09MSnJBWVF6YzdkeXEzUjRfdm9BUkltQUpSUmV6T1NmZm5hemJaam9wYmxYNzNnRE5PSm1nMHBNNnlSU2p5cDBJUmxJbGNmWkRNGlpDaEVJZ09MSnJBWVFvNEhPNVBQaXZ0M1NBUkl1QVBDSGtpUjBvNFViLWZVcFFwQzIzbWV1LTF3V3JLTkwtaVVmVXp3dkFOSDhfMC1Cb1lXeTRwNnBQaE1haEEiEwjS7tav9ruDAxUEGWgIHYDNDBI&is_vtc=1&ocp_id=V4ySZZLnLISyoPMPgJuzkAE&cid=CAQSKQAvHhf_ylYBztCissycDXsicojYycL4mPolc3kWikVUP8THCvtX_XYO&eitems=ChEIgOLJrAYQ1tWj2sWOtp_NARIdANJWnmUpO_xZrCumx1xqoH3hgmAkK3R4cUbaQUQ&random=963113123
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 local Show response
www.paypal.com/credit-presentment/experiments/ Frame 5065 5 KB
2 KB 31ms
31ms Document
text/html 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/credit-presentment/experiments/local?uid=uid_numhnacfzmymuvpacsidplhppphjzs&disableSetCookie=true&features=disable-set-cookie&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEtRVFGWUZkbUtOeHRaUkJvUmR2MmNodlFJLV9aUHZMMWpWTjlTRllDVHNlS1Q0T0hQS3JuVDJ5Smx4OGtXS25GSTdKWEVKTV9jVFNkYmYmaW50ZW50PWF1dGhvcml6ZSZjdXJyZW5jeT1VU0QmdmF1bHQ9dHJ1ZSZjb21wb25lbnRzPWJ1dHRvbnMsbWVzc2FnZXMiLCJhdHRycyI6eyJkYXRhLXNkay1pbnRlZ3JhdGlvbi1zb3VyY2UiOiJyZWFjdC1wYXlwYWwtanMiLCJkYXRhLXVpZCI6InVpZF9udW1obmFjZnpteW11dnBhY3NpZHBsaHBwcGhqenMifX0&env=production&scriptUID=uid_numhnacfzmymuvpacsidplhppphjzs&version=1.53.0&integrationType=SDK

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AQ-EQFYFdmKNxtZRBoRdv2chvQI-_ZPvL1jVN9SFYCTseKT4OHPKrnT2yJlx8kWKnFI7JXEJM_cTSdbf&intent=authorize&currency=USD&vault=true&components=buttons,messages

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4c008957d2dfd259fac81d1a8dd5c40c7fa7aa460fe949e463c077fa58127228

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'sha256-RmYTC9iPUTyoPfOBR9rEZcPmA3A8NGQgxJOYYBUb740=' 'sha256-MkvCXwEdBhR/QU6eqGX5THWCtkqlaanwiNzVKNI9Vb8=' 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com https:; frame-src 'self' https://.paypalobjects.com https://.paypal.com https://.qualtrics.com; connect-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges: bytes
access-control-expose-headers: Server-Timing
age: 42713
cache-control: s-maxage=86400, max-age=0
content-encoding: gzip
content-length: 1525
content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'sha256-RmYTC9iPUTyoPfOBR9rEZcPmA3A8NGQgxJOYYBUb740=' 'sha256-MkvCXwEdBhR/QU6eqGX5THWCtkqlaanwiNzVKNI9Vb8=' 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com https:; frame-src 'self' https://*.paypalobjects.com https://*.paypal.com https://*.qualtrics.com; connect-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com
content-type: text/html; charset=utf-8
date: Mon, 01 Jan 2024 09:56:39 GMT
dc: ccg11-origin-www-1.paypal.com
edge-cache-tag: up-treatments-zoid
etag: W/"1479-U3n9AYU7gDlYF6jlbE0r8SkOBQk"
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
paypal-debug-id: f401228b89624
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
server-timing: "traceparent;desc="00-0000000000000000000f401228b89624-15bedb818c4ce1f4-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
traceparent: 00-0000000000000000000f401228b89624-eb1b33041f50b559-01
vary: Accept-Encoding
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT, MISS
x-cache-hits: 64, 9015, 0
x-served-by: cache-dfw-kdal2120123-DFW, cache-mia-kmia1760053-MIA, cache-mia-kmia1760053-MIA
x-timer: S1704103000.886905,VS0,VE4
x-xss-protection: 1; mode=block

GET
H2 200 pptm.js Show response
www.paypal.com/tagmanager/ 14 KB
6 KB 31ms
30ms Script
application/x-javascript 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/tagmanager/pptm.js?id=www.elfcosmetics.com&t=xo&v=5.0.416&source=payments_sdk&client_id=AQ-EQFYFdmKNxtZRBoRdv2chvQI-_ZPvL1jVN9SFYCTseKT4OHPKrnT2yJlx8kWKnFI7JXEJM_cTSdbf&comp=buttons,messages&disableSetCookie=true&vault=true

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f3581f5a13294626a46b39edec979145f6985d4959bc0404e080a6f5184c5ca5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'nonce-AS9zcWD+Xp5TR4Bfw0L7xfjC6YCpWJVZpgIOKMB+0kffrDrl' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; img-src * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://nexus.ensighten.com https://.google-analytics.com 'unsafe-inline' https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-AS9zcWD+Xp5TR4Bfw0L7xfjC6YCpWJVZpgIOKMB+0kffrDrl' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; img-src * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com 'unsafe-inline' https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 01 Jan 2024 09:56:39 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
age: 42514
x-cache: HIT, HIT, MISS
paypal-debug-id: f76638540d5f9
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
content-length: 4797
x-xss-protection: 1; mode=block
x-served-by: cache-dfw-kdfw8210147-DFW, cache-mia-kmia1760053-MIA, cache-mia-kmia1760053-MIA
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent: 00-0000000000000000000f76638540d5f9-80678ed9bc23e310-01
x-timer: S1704103000.889310,VS0,VE4
etag: W/"3692-YosEREl/73cSitkaJSsKgoXE1lM"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=3600
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
x-cache-hits: 7, 1, 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 271 KB
90 KB 70ms
69ms Script
application/javascript 2607:f8b0:4004:c09::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::61 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1d890b2023d02714bdf7a5b49e9fad03c46bc5d729674b3c15e23f82a0a2e355

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:39 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92153
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 01 Jan 2024 09:56:39 GMT

OPTIONS
H2 200 logger
www.paypal.com/xoplatform/logger/api/ Frame 0
0 188ms
134ms Preflight 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/xoplatform/logger/api/logger?disableSetCookie=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-length: 0
date: Mon, 01 Jan 2024 09:56:40 GMT
dc: ccg11-origin-www-1.paypal.com
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
paypal-debug-id: f127251ee6b19
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
traceparent: 00-0000000000000000000f127251ee6b19-f848e2a6a38e5e7c-01
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS, MISS
x-cache-hits: 0, 0, 0
x-content-type-options: nosniff
x-served-by: cache-dfw-kdfw8210114-DFW, cache-mia-kmia1760049-MIA, cache-mia-kmia1760049-MIA
x-timer: S1704103000.962614,VS0,VE107

POST
H2 200 logger Show response
www.paypal.com/xoplatform/logger/api/ 1003 B
922 B 129ms
129ms XHR
application/json 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/xoplatform/logger/api/logger?disableSetCookie=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

43495d385a567946c253f7d654649aa943b5b0e758c32b6286c2000ef637ba8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept: application/json
Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
content-type: application/json

Response headers

date: Mon, 01 Jan 2024 09:56:40 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
x-cache: MISS, MISS, MISS
paypal-debug-id: f127251396b23
server-timing: content-encoding;desc="br",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-served-by: cache-dfw-kdfw8210158-DFW, cache-mia-kmia1760049-MIA, cache-mia-kmia1760049-MIA
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent: 00-0000000000000000000f127251396b23-ed5a7be87ea29fe0-01
x-timer: S1704103000.098048,VS0,VE102
etag: W/"3eb-ghi3nUEafdtr8Z77cyGpYOUPf28"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: none
x-cache-hits: 0, 0, 0

GET
H2 200 main.74d80534.js Show response
s.pinimg.com/ct/lib/ 65 KB
19 KB 56ms
55ms Script
application/javascript 2600:1408:c400:38f::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.74d80534.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:38f::1931 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 60cc60a6fcbd230def379432395199b585791ed521e2e5f595369a2193e617fb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

akamai-x-true-ttl: 1209600
content-encoding: br
x-cdn: akamai
etag: "cb251578b1e91b3cc440fd1521770cc5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 18895

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 95ms
29ms Image
image/gif 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1704102999943&id=t2_16331p&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=85dc0ea6-dfe9-4e5f-b102-c9e61c6ef5f1&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_3549b422&dpm=&dpcc=&dprc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:40 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 display Show response
api.usehero.com/webplugin/ 189 B
1 KB 214ms
80ms XHR
application/json 3.220.158.64
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.usehero.com/webplugin/display?appId=efcf9631-4c6b-4874-9f76-51f71464249a&location=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&state=untouched&outboundFeature=

Requested by

Host: cdn.usehero.com
URL: https://cdn.usehero.com/loader.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.220.158.64 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-220-158-64.compute-1.amazonaws.com

Software

Resource Hash

e9ffb1fd04bca7c62968d8639c4ae3ff6d86632ac0593c30f7a5a5cff0bf4c34

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains, max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-permitted-cross-domain-policies: none
surrogate-control: no-store
x-dns-prefetch-control: off
klarna-correlation-id: 779d5925-42b9-4acb-8f29-51f8faee3dab
cross-origin-resource-policy: same-origin
x-geo-longitude: -80.19460
pragma: no-cache
referrer-policy: same-origin
etag: W/"bd-bRTEozStXJy0DPuOAiQ8z0v7F6o"
x-frame-options: SAMEORIGIN
x-geo-zip: 33197
content-type: application/json; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?1
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-geo-latitude: 25.76890
x-accuracy: 20
expires: 0
date: Mon, 01 Jan 2024 09:56:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains, max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
cross-origin-embedder-policy: require-corp
x-time-zone: America/New_York
x-envoy-upstream-service-time: 14
content-length: 189
x-xss-protection: 0
x-request-id: 779d5925-42b9-4acb-8f29-51f8faee3dab
cross-origin-opener-policy: same-origin
x-download-options: noopen
x-country: US
x-geo-city: Miami

GET
H2 200 js Show response
www.paypal.com/sdk/ Frame 5065 405 KB
112 KB 36ms
35ms Script
application/javascript 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/sdk/js?client-id=AQ-EQFYFdmKNxtZRBoRdv2chvQI-_ZPvL1jVN9SFYCTseKT4OHPKrnT2yJlx8kWKnFI7JXEJM_cTSdbf&intent=authorize&currency=USD&vault=true&components=buttons,messages

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/credit-presentment/experiments/local?uid=uid_numhnacfzmymuvpacsidplhppphjzs&disableSetCookie=true&features=disable-set-cookie&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEtRVFGWUZkbUtOeHRaUkJvUmR2MmNodlFJLV9aUHZMMWpWTjlTRllDVHNlS1Q0T0hQS3JuVDJ5Smx4OGtXS25GSTdKWEVKTV9jVFNkYmYmaW50ZW50PWF1dGhvcml6ZSZjdXJyZW5jeT1VU0QmdmF1bHQ9dHJ1ZSZjb21wb25lbnRzPWJ1dHRvbnMsbWVzc2FnZXMiLCJhdHRycyI6eyJkYXRhLXNkay1pbnRlZ3JhdGlvbi1zb3VyY2UiOiJyZWFjdC1wYXlwYWwtanMiLCJkYXRhLXVpZCI6InVpZF9udW1obmFjZnpteW11dnBhY3NpZHBsaHBwcGhqenMifX0&env=production&scriptUID=uid_numhnacfzmymuvpacsidplhppphjzs&version=1.53.0&integrationType=SDK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

406c93b0692878bad84a4f34065184d023ac12f1b92d9cb0398642fb0de45c2d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; script-src 'nonce-UNqZmo/1zJRNlkhd/gvCEQF2H2Y6KfUHxE38yYaDm6p3QGo7' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'nonce-UNqZmo/1zJRNlkhd/gvCEQF2H2Y6KfUHxE38yYaDm6p3QGo7' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.paypal.com/credit-presentment/experiments/local?uid=uid_numhnacfzmymuvpacsidplhppphjzs&disableSetCookie=true&features=disable-set-cookie&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEtRVFGWUZkbUtOeHRaUkJvUmR2MmNodlFJLV9aUHZMMWpWTjlTRllDVHNlS1Q0T0hQS3JuVDJ5Smx4OGtXS25GSTdKWEVKTV9jVFNkYmYmaW50ZW50PWF1dGhvcml6ZSZjdXJyZW5jeT1VU0QmdmF1bHQ9dHJ1ZSZjb21wb25lbnRzPWJ1dHRvbnMsbWVzc2FnZXMiLCJhdHRycyI6eyJkYXRhLXNkay1pbnRlZ3JhdGlvbi1zb3VyY2UiOiJyZWFjdC1wYXlwYWwtanMiLCJkYXRhLXVpZCI6InVpZF9udW1obmFjZnpteW11dnBhY3NpZHBsaHBwcGhqenMifX0&env=production&scriptUID=uid_numhnacfzmymuvpacsidplhppphjzs&version=1.53.0&integrationType=SDK
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-UNqZmo/1zJRNlkhd/gvCEQF2H2Y6KfUHxE38yYaDm6p3QGo7' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-UNqZmo/1zJRNlkhd/gvCEQF2H2Y6KfUHxE38yYaDm6p3QGo7' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
content-encoding: gzip
x-content-type-options: nosniff
disable-set-cookie: true
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Mon, 01 Jan 2024 09:56:40 GMT
age: 3043
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: HIT, HIT, MISS
p3p: true
paypal-debug-id: f699128d0b57b
server-timing: "traceparent;desc="00-0000000000000000000f699128d0b57b-59801b2ee47e3cee-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
content-length: 113491
x-xss-protection: 1; mode=block
x-served-by: cache-dfw-kdfw8210099-DFW, cache-mia-kmia1760053-MIA, cache-mia-kmia1760053-MIA
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent: 00-0000000000000000000f699128d0b57b-2afcff90e7e31dc5-01
x-timer: S1704103000.000696,VS0,VE4
etag: W/"1bb53-c79XMxVek5EmjAexQ41SV+7fXh0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Server-Timing
cache-control: public, max-age=3600, s-maxage=10800
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
x-cache-hits: 32679, 2, 0

GET
H2 200 ts
t.paypal.com/ 42 B
545 B 169ms
105ms Image
image/gif 151.101.193.35
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?pgrp=muse%3Athird-party%3Aanalytics-xo%3A%3A7PFGPLHGYKX72-1&page=muse%3Athird-party%3Aanalytics-xo%3A%3A7PFGPLHGYKX72-1%3A%3A%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=3a9b41b4-1a0b-4488-939e-bc9b13368cc5&fltp=analytics&mrid=7PFGPLHGYKX72&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&flag_consume=yes&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1704103000003&g=600&completeurl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&disableSetCookie=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.35 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0, 0
date: Mon, 01 Jan 2024 09:56:40 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, MISS
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id: 1e450acad71f8
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
x-served-by: cache-dfw-kdfw8210078-DFW, cache-mia-kmia1760090-MIA
pragma: no-cache
correlation-id: 1e450acad71f8
traceparent: 00-00000000000000000001e450acad71f8-058fabe817bc41c8-01
x-timer: S1704103000.082133,VS0,VE77
vary: Accept-Encoding
content-type: image/gif
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 01 Jan 2024 09:56:40 GMT

GET
H2 200 p
tr.snapchat.com/ 68 B
452 B 145ms
82ms Image
image/png 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.snapchat.com/p?pid=c69c204f-fba0-4685-aea8-ad32f799fa5d&ev=PAGE_VIEW&intg=gtm&pids=c69c204f-fba0-4685-aea8-ad32f799fa5d&u_c1=e35fd1f0-d4d8-4833-922c-2b5e7f2cd986&u_sclid=6e99d7bc-4a1f-4c52-adc8-d39149da641c&u_scsid=a2c80c5e-ee22-4bd8-8cd2-71487f90a94c&bt=1d53c387&d_bvs=%5B%5D&df=true&huah=true&m_dcl=2576&m_fcps=2567&m_pi=2575&m_pl=6316&m_pv=2&m_rd=6976&m_sh=1200&m_sl=0&m_sw=1600&pl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&trackId=73089b81-059a-4c38-850f-36f4cb3fb086&ts=1704103000012&v=3.7.3-2312182359

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, no-transform
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68

GET
H2 200 1638306756445368 Show response
connect.facebook.net/signals/config/ 146 KB
37 KB 188ms
187ms Script
application/x-javascript 2a03:2880:f07d:0:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1638306756445368?v=2.9.138&r=stable&domain=www.elfcosmetics.com

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f07d:0:face:b00c:0:3 Apodaca, Mexico, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7bab85eaa8d74cec964409d9e0a5c6d7ed0000b23b6400c562333c6483761ca2

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 01 Jan 2024 09:56:40 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: lV3Sk3N5cqJC/2NI3jbzxWzRGtZJ+n5Gqg5qLo+1Zxto6z3gW6Ae55NLy3EcjNTTUVq8fiMiUNEU8bk0BZn+DA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 5013978.js Show response
bat.bing.com/p/action/ 0
116 B 52ms
52ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5013978.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Mon, 01 Jan 2024 09:56:39 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BB31908AB5F941E08709CF22CC264DC3 Ref B: MIAEDGE1620 Ref C: 2024-01-01T09:56:40Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
358 B 115ms
115ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5013978&tm=gtm002&Ver=2&mid=ce4ee8be-5dfa-4244-98c6-f9fc0f3b6ff0&sid=0f4b44d0a88c11ee9e139953cae2c27e&vid=0f4b6cc0a88c11eeb66f73b5e223ce3b&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&p=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&r=&lt=6317&evt=pageLoad&sv=1&rn=671906

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 01 Jan 2024 09:56:39 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 40AA001D3E1246BB804450F0BE7D0C5F Ref B: MIAEDGE1620 Ref C: 2024-01-01T09:56:40Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 main.MWNkZmM2YTcxMA.js Show response
analytics.tiktok.com/i18n/pixel/static/ 401 KB
108 KB 56ms
56ms Script
application/javascript 23.218.216.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkZmM2YTcxMA.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.216.202 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-218-216-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 87260ecf581a44a18ca2165015348383b430e6b77ca0b0ec4a9a3b1ebff57160

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-akamai-request-id: 5a8d1adb
date: Mon, 01 Jan 2024 09:56:40 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server: nginx
x-tt-logid: 202312211225530AF991F40FF33C449570
x-tt-trace-id: 00-2312211225530AF991F40FF33C449570-46E776827B718BD9-00
vary: Accept-Encoding
x-cache: TCP_MEM_HIT from a23-222-0-202.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52660090) (-)
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-tt-trace-host: 01c1fc589ea0e1f5fbef11c8b43629f05ce09daea96b501f5eaed1b8947fb9f2e39a3886e58ec0d97767a71c2c100f71294a6fa1621b89e5f060c7219b038ff9389c1582caab3796fe181965b0c61490ebafbb7e051e26570497d4ec98a8d3685e
server-timing: cdn-cache; desc=HIT, edge; dur=0, origin; dur=0, inner; dur=46
content-length: 110346

GET
H2 200 main.MWNkZmM2YTcxMQ.js Show response
analytics.tiktok.com/i18n/pixel/static/ 420 KB
110 KB 161ms
161ms Script
application/javascript 23.218.216.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkZmM2YTcxMQ.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.216.202 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-218-216-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 8eeb23a1dcd42802d5d861556c6ae4848a05fd28cd22bb8ed884015b62eefd9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-akamai-request-id: 5a8d1ae2
date: Mon, 01 Jan 2024 09:56:40 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server: nginx
x-tt-logid: 20231221122559C5174C34978D3F5F6C00
x-tt-trace-id: 00-231221122559C5174C34978D3F5F6C00-3EF8C84AC0B42977-00
vary: Accept-Encoding
x-cache: TCP_MEM_HIT from a23-222-0-202.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52660090) (-)
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-tt-trace-host: 010bb11900f7a8b1d584ea181f7d3edbaff3c085ed8b388263d20fc92d487a003b04f1473c188701141afece4aed7af576a1e0df5837647c568531876a8a537a4b0ca896ef2388cb4b0444fd5e65398938d04e9df2708fa0186c6a90991d12ed5d
server-timing: cdn-cache; desc=HIT, edge; dur=0, origin; dur=0, inner; dur=3
content-length: 112112

POST
H2 204 collect
analytics.google.com/g/ 0
257 B 116ms
41ms Ping
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZLYXLXNDL8&gtm=45je3bt0v879088318z8896608294&_p=1704102996740&_gaz=1&gcd=11l1l1l1l1&dma=0&cid=1144441024.1704102998&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dt=&sid=1704103000&sct=1&seg=0&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&en=page_view&_fv=1&_ss=1&ep.page_type=content&ep.page_environment=production&ep.page_country=US&ep.page_language=EN&up.custom_user_id=&up.client_id=&up.user_has_transacted=false&up.user_logged_in=false&up.user_country=US&up.user_loyalty_status=false&tfd=7106
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:40 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 60ms
59ms Ping
text/plain 2607:f8b0:4004:c1d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-ZLYXLXNDL8&cid=1144441024.1704102998&gtm=45je3bt0v879088318z8896608294&aip=1&dma=0&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1d::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:40 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ 298 B
620 B 131ms
54ms XHR
application/json 151.101.192.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/user/?tid=2615235625530&pd=%7B%22np%22%3A%22gtm%22%7D&cb=1704103000239&dep=2%2CPAGE_LOAD
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.74d80534.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.192.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8e33955f54ef8025b647a6e685fa689a9256fc5c987f7dc98590310ac3c358e5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:40 GMT
content-encoding: gzip
x-cdn: fastly
x-envoy-upstream-service-time: 1
alt-svc: h3=":443";ma=600
x-pinterest-rid: 1674854385538119
content-length: 173
pin-unauth: dWlkPU16aGpOamN3WW1VdFlUWXhZUzAwTjJFd0xUazJOVGd0TnpKbU1XWTFZekk0WTJWaA
pragma: no-cache
referrer-policy: origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
pinterest-version: 8c23f27d55c77c9c78a5d022d53a766b1295cc23
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 jsp Show response
ut.rd.linksynergy.com/ 148 B
405 B 113ms
52ms Script
text/plain 34.98.67.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ut.rd.linksynergy.com/jsp?cn=rmuid&ro=0&cb=___rmuid

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.98.67.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

3.67.98.34.bc.googleusercontent.com

Software

Resource Hash

b6d2fca70ade2bd124d2bda6dfe8f74ec3027fe87ed255b495977ff32d6c475b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

content-type: text/plain; charset=utf-8
date: Mon, 01 Jan 2024 09:56:40 GMT
via: 1.1 google
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 148
x-samesite: secure

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
185 B 108ms
56ms Image
image/gif 151.101.192.84
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ct.pinterest.com/v3/?tid=2615235625530&pd=%7B%22np%22%3A%22gtm%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%2274d80534%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1704103000264
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.192.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:40 GMT
referrer-policy: origin
x-cdn: fastly
content-type: image/gif
access-control-allow-origin: *
pinterest-version: 8c23f27d55c77c9c78a5d022d53a766b1295cc23
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 2
alt-svc: h3=":443";ma=600
x-pinterest-rid: 8428262535369677
content-length: 35
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 hash Show response
www.paypal.com/credit-presentment/experiments/ Frame 5065 40 B
2 KB 154ms
154ms Fetch
text/html 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/credit-presentment/experiments/hash?device_id=uid_eaf589ab86_mdk6nty6nda&disableSetCookie=true&features=disable-set-cookie

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5eca572cd68aa4afde19d317daf93398ca142c3648214e16b37e054e15c3f9e1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com https:; frame-src 'self' https://.paypalobjects.com https://.paypal.com https://.qualtrics.com; connect-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.paypal.com/credit-presentment/experiments/local?uid=uid_numhnacfzmymuvpacsidplhppphjzs&disableSetCookie=true&features=disable-set-cookie&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEtRVFGWUZkbUtOeHRaUkJvUmR2MmNodlFJLV9aUHZMMWpWTjlTRllDVHNlS1Q0T0hQS3JuVDJ5Smx4OGtXS25GSTdKWEVKTV9jVFNkYmYmaW50ZW50PWF1dGhvcml6ZSZjdXJyZW5jeT1VU0QmdmF1bHQ9dHJ1ZSZjb21wb25lbnRzPWJ1dHRvbnMsbWVzc2FnZXMiLCJhdHRycyI6eyJkYXRhLXNkay1pbnRlZ3JhdGlvbi1zb3VyY2UiOiJyZWFjdC1wYXlwYWwtanMiLCJkYXRhLXVpZCI6InVpZF9udW1obmFjZnpteW11dnBhY3NpZHBsaHBwcGhqenMifX0&env=production&scriptUID=uid_numhnacfzmymuvpacsidplhppphjzs&version=1.53.0&integrationType=SDK
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com https:; frame-src 'self' https://*.paypalobjects.com https://*.paypal.com https://*.qualtrics.com; connect-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Mon, 01 Jan 2024 09:56:40 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
age: 0
edge-cache-tag: up-treatments-hash
x-cache: MISS, MISS, MISS
paypal-debug-id: f127251422188
server-timing: "traceparent;desc="00-0000000000000000000f127251422188-10be03a3f58b71ee-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
content-length: 56
x-xss-protection: 1; mode=block
x-served-by: cache-dfw-kdal2120127-DFW, cache-mia-kmia1760053-MIA, cache-mia-kmia1760053-MIA
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent: 00-0000000000000000000f127251422188-de7580998e26ef6d-01
x-timer: S1704103000.308320,VS0,VE127
etag: W/"28-xz7oeWVj/8B52QKKulWR9ZDQlKU"
vary: Accept-Encoding
content-type: text/html; charset=utf-8
access-control-expose-headers: Server-Timing
cache-control: s-maxage=86400, max-age=0
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
x-cache-hits: 0, 0, 0

GET
H2 200 widget.css
js.jebbit.com/companion/v1/ 15 KB
16 KB 76ms
76ms Stylesheet
text/css 2600:9000:21a2:5a00:a:7914:b00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.jebbit.com/companion/v1/widget.css
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21a2:5a00:a:7914:b00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1a1fe89f11a11d89299028b565a99569e2aa5df3055ce514ba4dec2a8f0fe4fa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-amz-version-id: RTEvjx9S_f.J6xhm_CGfuKjdaFCgE8S4
date: Mon, 01 Jan 2024 07:31:17 GMT
via: 1.1 90afcdb26518f969b68e124515efb74c.cloudfront.net (CloudFront)
last-modified: Thu, 21 Dec 2023 18:01:49 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-C1
age: 8724
x-amz-server-side-encryption: AES256
etag: "8e754beaa7f32e405c184f00c12cece1"
x-cache: Hit from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 15502
x-amz-cf-id: XaNV0wVhV362HDJXKq2Kzb-Iyzz4fNmcsnWQ2cD5BUOFvKP5oP08NQ==

GET
H2 200 launcher_configs Show response
external-api.jebbit.com/moments/v2/ 2 B
448 B 190ms
64ms XHR
application/json 34.198.176.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://external-api.jebbit.com/moments/v2/launcher_configs?key=542695a9-9318-492b-9638-2018989f6dc4&url=aHR0cHMlM0ElMkYlMkZ3d3cuZWxmY29zbWV0aWNzLmNvbSUyRmNvc21ldGljLWNyaW1pbmFscw==&completedLightboxCampaigns=W10=&jebbitCookies=

Requested by

Host: js.jebbit.com
URL: https://js.jebbit.com/companion/v1/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.198.176.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-198-176-45.compute-1.amazonaws.com

Software

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
surrogate-control: no-store
x-dns-prefetch-control: off
content-length: 2
x-xss-protection: 1; mode=block
pragma: no-cache
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
x-download-options: noopen
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
expires: 0

GET
H2 204 pageview
c.contentsquare.net/ 0
320 B 163ms
51ms Image
text/plain 107.20.54.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/pageview?pid=1926&uu=c8cbded1-0b47-aaef-a15d-59aa4b144138&sn=1&hd=1704103000&pn=1&dw=1600&dh=1202&ww=1600&wh=1200&sw=1600&sh=1200&dr=&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&uc=0&la=en-US&cvars=%7B%223%22%3A%5B%22Page%20Type%22%2C%22content%22%5D%7D&cvarp=%7B%223%22%3A%5B%22Page%20Type%22%2C%22content%22%5D%7D&v=13.76.1&pvt=n&ex=&r=569388
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.20.54.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-20-54-57.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:40 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 342ms
67ms Image
text/plain 2a03:2880:f171:81:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1638306756445368&ev=PageView&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&rl=&if=false&ts=1704103000397&sw=1600&sh=1200&v=2.9.138&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1704103000390.940333010&ic=fbpixel&ler=empty&it=1704103000039&coo=false&tm=1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f171:81:face:b00c:0:25de Apodaca, Mexico, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 01 Jan 2024 09:56:40 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 identify_ce767.js Show response
analytics.tiktok.com/i18n/pixel/static/ 135 KB
36 KB 56ms
55ms Script
application/javascript 23.218.216.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/identify_ce767.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.216.202 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-218-216-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a1d4b01843b9dad68a10bba7ab416fb60cbe6052a223f6bd74cbad286b812b2a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-akamai-request-id: 5a8d1c79
date: Mon, 01 Jan 2024 09:56:40 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server: nginx
x-tt-logid: 20231221122557239D88FB422047E46317
x-tt-trace-id: 00-231221122557239D88FB422047E46317-3934614D7632AC4A-00
vary: Accept-Encoding
x-cache: TCP_MEM_HIT from a23-222-0-202.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52660090) (-)
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-tt-trace-host: 013644e154f87e9beadf9986fd5f884dc47e918e0b42d901019cdaa1819f13ff44fd93aad0ddf2a27398009b6983c6e3ae430d0dedf9cdf207a0a2ad98a77f952cb5d07af253ca90ab8e25e7b3dad06107032ed56dd0551a3289a8ecbd5ccfd74c
server-timing: cdn-cache; desc=HIT, edge; dur=0, origin; dur=0, inner; dur=4
content-length: 36163

POST
H2 200 pangle_pixel
analytics.pangle-ads.com/api/v2/ 0
821 B 258ms
59ms Ping
text/plain 23.222.5.91
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.pangle-ads.com/api/v2/pangle_pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkZmM2YTcxMA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.222.5.91 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-222-5-91.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 2f73fa2d
date: Mon, 01 Jan 2024 09:56:40 GMT
x-bytefaas-request-id: 20240101095640A430AAED80961DFFB74C
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-240101095640A430AAED80961DFFB74C-35FC1E1AEB245FA3-00
x-cache: TCP_MISS from a23-209-100-91.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52668873) (-)
server-timing: inner; dur=5, cdn-cache; desc=MISS, edge; dur=1, origin; dur=8
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20240101095640A430AAED80961DFFB74C
access-control-max-age: 86400
access-control-allow-methods: *
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
x-bytefaas-execution-duration: 3.84
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-host: 012abdb6ded152821aa6b54fd2c6c3aa87a247a48546c64f04bb2322a1e7726544f4175c9903ccb109a2daa5b246fea5cd2475f58871c1a07463a51d4e6bd98aefcd7cc5a84797a5884b7e4e4abad76027180519cb0df9efce2242d75cf69e264b
x-origin-response-time: 8,23.209.100.91
access-control-allow-headers: *
expires: Mon, 01 Jan 2024 09:56:40 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
698 B 107ms
107ms Ping
text/plain 23.218.216.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkZmM2YTcxMA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.216.202 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-218-216-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 5a8d1cbb
date: Mon, 01 Jan 2024 09:56:40 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-24010109564044F6C696E14C05FEA125-12ED293E01BACE58-00
x-cache: TCP_MISS from a23-222-0-202.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52660090) (-)
server-timing: inner; dur=44, cdn-cache; desc=MISS, edge; dur=6, origin; dur=46
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 2024010109564044F6C696E14C05FEA125
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 47,23.222.0.202
x-tt-trace-host: 012abdb6ded152821aa6b54fd2c6c3aa87feb9b4a6a0d3652d671e03af9e800359124055c283ecdc41504c648d0f20647d354b5845cd5f2c46806a55b2531b973776d9ed206a6de96e33cbbe0c1850cf1aeb2d5b6b81477b67ada8fd2f68184afa
access-control-allow-headers: Authorization,*
expires: Mon, 01 Jan 2024 09:56:40 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
696 B 93ms
93ms Ping
text/plain 23.218.216.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkZmM2YTcxMA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.216.202 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-218-216-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 5a8d1cbd
date: Mon, 01 Jan 2024 09:56:40 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-2401010956406A88E19113D279FAAAEA-17117D0ADA8C920C-00
x-cache: TCP_MISS from a23-222-0-202.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52660090) (-)
server-timing: inner; dur=32, cdn-cache; desc=MISS, edge; dur=5, origin; dur=35
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202401010956406A88E19113D279FAAAEA
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 35,23.222.0.202
x-tt-trace-host: 012abdb6ded152821aa6b54fd2c6c3aa87feb9b4a6a0d3652d671e03af9e800359ce688b1903d9103091e418b71ea7b93c02674f8bfeebe15921d7cce74443cafb0885a146db5e96fdca9fda1700393fcc43869f103d5e516ad8ccc29843944032
access-control-allow-headers: Authorization,*
expires: Mon, 01 Jan 2024 09:56:40 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
697 B 109ms
109ms Ping
text/plain 23.218.216.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkZmM2YTcxMA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.216.202 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-218-216-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 5a8d1cc0
date: Mon, 01 Jan 2024 09:56:40 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-240101095640975A0D8474AA440A6C7D-4752B167333AE082-00
x-cache: TCP_MISS from a23-222-0-202.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52660090) (-)
server-timing: inner; dur=46, cdn-cache; desc=MISS, edge; dur=4, origin; dur=48
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20240101095640975A0D8474AA440A6C7D
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 48,23.222.0.202
x-tt-trace-host: 012abdb6ded152821aa6b54fd2c6c3aa87feb9b4a6a0d3652d671e03af9e800359dbbbaa46678f222c23c7ee52138677bc40373ed42cc31b691bb751b9f0bc13134eb14e809574aa04ee55c92bb6fb4836f4f3dd03c0cdb70dc6213b2f078b0343
access-control-allow-headers: Authorization,*
expires: Mon, 01 Jan 2024 09:56:40 GMT

GET
BLOB 200
OK 509308fc-62d3-499f-a12f-1036b7fc24cb
https://www.elfcosmetics.com/ 7 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.elfcosmetics.com/509308fc-62d3-499f-a12f-1036b7fc24cb
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a19915f513441bab259dbf5472a9501139e4eda8d1891ca5a0bd4efd6d60dd4d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Length: 7329
Content-Type: application/javascript

POST logger
www.paypal.com/xoplatform/logger/api/ Frame 5065 0
0

GET
H2 200 muse.js Show response
www.paypalobjects.com/muse/ 55 KB
16 KB 151ms
29ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/muse/muse.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (mic/9AFD) /

Resource Hash

20029e526c0674dd1f99d02142bbf324bd8ee217ca43705fa6fe1a64bd90ee0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: HIT
paypal-debug-id: 946d3f0ef38bc
dc: ccg11-origin-www-1.paypal.com
content-length: 16355
last-modified: Fri, 01 Sep 2023 21:10:59 GMT
server: ECAcc (mic/9AFD)
traceparent: 00-0000000000000000000946d3f0ef38bc-897d058aa8501879-01
etag: "64f25363-daa8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
expires: Mon, 01 Jan 2024 10:56:40 GMT

GET
H3 200 c69c204f-fba0-4685-aea8-ad32f799fa5d.js Show response
tr.snapchat.com/config/com/ 185 B
205 B 110ms
80ms Script
application/javascript 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/config/com/c69c204f-fba0-4685-aea8-ad32f799fa5d.js?v=3.7.3-2312182359

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

2125f1a011cbd591338ae3c896d3b5b6ad80930fe86493af4518510ede5795cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://www.elfcosmetics.com/
Origin: https://www.elfcosmetics.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
content-type: application/javascript
access-control-allow-origin: https://www.elfcosmetics.com
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 185

GET
H2 200 i Show response
tr.snapchat.com/cm/ Frame BC5F 672 B
746 B 94ms
93ms Document
text/html 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/i?pid=c69c204f-fba0-4685-aea8-ad32f799fa5d&u_scsid=a2c80c5e-ee22-4bd8-8cd2-71487f90a94c&u_sclid=6e99d7bc-4a1f-4c52-adc8-d39149da641c

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

6501140033c3bb20da4b5ac73c90f687ba8a2053c4ba37c4b6f5275166db7fa6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: clear h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 672
content-type: text/html
date: Mon, 01 Jan 2024 09:56:40 GMT
server: API Gateway
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
x-envoy-upstream-service-time: 8

GET
H2 200 runtime_8b30b4890203fd4144c54b9ffd765f5e.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 3 KB
2 KB 143ms
28ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/runtime_8b30b4890203fd4144c54b9ffd765f5e.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: c4fad867557fa65e1a778e915c0b4ed0cd1bbb4443452c8943e5cec6504311e7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 17:15:44 GMT
content-encoding: br
age: 232856
x-guploader-uploadid: ABPtcPoVi2Fi6kzWVOzIOk5qxyodM3TAyJFWd1bf4abd3uj7tfeunNWN4Q9bNppA1jG4WIa7hgs
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1317
last-modified: Wed, 13 Dec 2023 20:29:20 GMT
server: UploadServer
etag: "dbc90523c425a5d782995c1a39051881"
x-goog-generation: 1701276233202747
x-goog-hash: crc32c=Xs/EYg==, md5=28kFI8QlpdeCmVwaOQUYgQ==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 1317
accept-ranges: bytes
content-type: text/javascript

GET
H2 204 dvar
c.contentsquare.net/ 0
319 B 51ms
51ms Image
text/plain 107.20.54.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/dvar?v=13.76.1&pid=1926&pn=1&sn=1&uu=c8cbded1-0b47-aaef-a15d-59aa4b144138&dv=H4sIAAAAAAAAA0WMsQrCUAxFfyVkdnHtpq0VwVEKnUraBgnERF6DWor%2F7hOUjvdwzl1wt%2B%2Bqtjuq96RQukVyhQtPgQVWs9FNBmiFdYTD685J2AaecPPrVgbbHDSUhELc8vorZ3%2FCyYLt%2B1i6KvWesvRgqEUj53bF9wcxTAoRiQAAAA%3D%3D&ct=2&r=618196
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.20.54.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-20-54-57.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:40 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

POST
H2 200 act
analytics.tiktok.com/api/v2/pixel/ 0
697 B 104ms
103ms Ping
text/plain 23.218.216.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel/act
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWNkZmM2YTcxMA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.216.202 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-218-216-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 5a8d1da7
date: Mon, 01 Jan 2024 09:56:40 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-240101095640975A0D8474AA440A6C8E-0C3010FDFD2EDA92-00
x-cache: TCP_MISS from a23-222-0-202.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52660090) (-)
server-timing: inner; dur=37, cdn-cache; desc=MISS, edge; dur=9, origin; dur=40
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20240101095640975A0D8474AA440A6C8E
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 40,23.222.0.202
x-tt-trace-host: 012abdb6ded152821aa6b54fd2c6c3aa87feb9b4a6a0d3652d671e03af9e800359dbbbaa46678f222c23c7ee52138677bc975aa11eaee4d20b4ed5fbf4c82222c48d8831318446a6ae4d1c5e395e68e8cf42ea24d9a432c9649c8a955d4a89d5d8
access-control-allow-headers: Authorization,*
expires: Mon, 01 Jan 2024 09:56:40 GMT

GET
H2 200 script-tag.js Show response
cdn-scripts.signifyd.com/api/ 8 KB
3 KB 227ms
70ms Script
application/javascript 3.162.3.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-scripts.signifyd.com/api/script-tag.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-47.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 613a0081b64a7df6a20f9ba46cd384e4061e288f439ba8755cd664fbad3177c8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:50:52 GMT
content-encoding: gzip
via: 1.1 212f3832d7f59d71fd3926166fcc89ae.cloudfront.net (CloudFront)
last-modified: Wed, 13 Dec 2023 10:00:02 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P2
age: 349
x-amz-server-side-encryption: AES256
etag: W/"615c232b2321c7908499921b3adc8138"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=1800
x-amz-cf-id: 8Mi7T4BoCC1AFLBVZQLMjUehBufUdGl7h9xKWrLV6Rh2lq9tcpbQ9A==

GET
H2 200 main-v2_8aebf97cc6bdaca1cfc56940afdbc7d5.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 452 KB
101 KB 29ms
28ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main-v2_8aebf97cc6bdaca1cfc56940afdbc7d5.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 828011e932c7f65177e00c50ef88564628178b9d3190845404b02e3132a14c90

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 17:20:28 GMT
content-encoding: br
age: 1442172
x-guploader-uploadid: ABPtcPpULrCp1h-4MSKNHjuFgwaDePuE6RIRgWgVXZnqfDnVOpkKRqzwtnvL6d-Y5uzI3Nd0hpEz79VPHQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103229
last-modified: Wed, 13 Dec 2023 20:29:02 GMT
server: UploadServer
etag: "2404e3009bfbe89e5d2c7f7b24179df7"
x-goog-generation: 1702499342060242
x-goog-hash: crc32c=kCJJLw==, md5=JATjAJv76J5dLH97JBed9w==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 103229
accept-ranges: bytes
content-type: text/javascript

GET
H2 200 cjs_min_1e55b565811f11b08485230cf1d150d6.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 49 KB
16 KB 87ms
87ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_1e55b565811f11b08485230cf1d150d6.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 9846c98d92f9ede0abb2db68013d613791db3ccdb486451de1432034b563fb77

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 16:23:17 GMT
content-encoding: gzip
age: 1618403
x-guploader-uploadid: ABPtcPpiRERm5uuNXTbD5FSkEVgEzpmJbj3LgA54R9phKK-6fDp2JA3pnUjhb7ubQCXF_LD-fpjrvymYQJfMo6vNLRP38RzaUwJe
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15751
last-modified: Wed, 13 Dec 2023 16:23:11 GMT
server: UploadServer
etag: "d7dc7d7ebcc4f5af5fc2d4804e7ec737"
x-goog-generation: 1702484591435387
x-goog-hash: crc32c=3TW0yQ==, md5=19x9frzE9a9fwtSATn7HNw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000,no-transform
x-goog-stored-content-length: 15751
accept-ranges: bytes
content-type: text/javascript; charset=utf-8

GET
H2 200 index.html Show response
www.paypalobjects.com/muse/analytics/ Frame E9D2 55 KB
17 KB 30ms
30ms Document
text/html 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/muse/analytics/index.html

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (mic/9BA9) /

Resource Hash

7247ab83a30fbd92bf8425aca87dbb9f3f44c1b7facc6f7fd80df157ea6b5e03

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: s-maxage=31536000, public,max-age=3600
content-encoding: gzip
content-length: 16892
content-type: text/html
date: Mon, 01 Jan 2024 09:56:40 GMT
dc: ccg11-origin-www-1.paypal.com
etag: "64f25363-dacc"
expires: Mon, 01 Jan 2024 10:56:40 GMT
last-modified: Fri, 01 Sep 2023 21:10:59 GMT
paypal-debug-id: 0c17123d9a14a
server: ECAcc (mic/9BA9)
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-00000000000000000000c17123d9a14a-d70a49df8ada56c7-01
vary: Accept-Encoding
x-cache: HIT
x-content-type-options: nosniff

GET
H2 200 noop.js Show response
www.paypalobjects.com/muse/ Frame E9D2 18 B
210 B 104ms
103ms Fetch
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/muse/noop.js

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/muse/analytics/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (daa/7D8C) /

Resource Hash

0739b17b1053de387d55795753300a79626787634f8c909277efff94d0e3f154

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.paypalobjects.com/muse/analytics/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:40 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
paypal-debug-id: c4b63383dfa62
dc: ccg11-origin-www-1.paypal.com
content-length: 18
last-modified: Sat, 13 Feb 2021 00:26:56 GMT
server: ECAcc (daa/7D8C)
traceparent: 00-0000000000000000000c4b63383dfa62-f8c225de2aba66e7-01
etag: "60271cd0-12"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
expires: Mon, 01 Jan 2024 09:56:39 GMT

GET
H2 200 ts
t.paypal.com/ 42 B
204 B 89ms
89ms Image
image/gif 151.101.193.35
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?pgrp=muse%3Aoffer%3A%3A%3A7PFGPLHGYKX72-1&page=muse%3Aoffer%3A%3A%3A7PFGPLHGYKX72-1%3A%3AvisitorInfoFlowStarted%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=3a9b41b4-1a0b-4488-939e-bc9b13368cc5&es=visitorInfoFlowStarted&mrid=7PFGPLHGYKX72&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1704103000779&g=600&completeurl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&disableSetCookie=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.35 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0, 0
date: Mon, 01 Jan 2024 09:56:40 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, MISS
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id: 0faa3a30b7fe0
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
x-served-by: cache-dfw-kdfw8210036-DFW, cache-mia-kmia1760090-MIA
pragma: no-cache
correlation-id: 0faa3a30b7fe0
traceparent: 00-00000000000000000000faa3a30b7fe0-962be0c9c008841e-01
x-timer: S1704103001.793736,VS0,VE63
vary: Accept-Encoding
content-type: image/gif
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 01 Jan 2024 09:56:40 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame BC5F 41 KB
18 KB 81ms
81ms Script
application/javascript 54.230.48.245
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: tr.snapchat.com
URL: https://tr.snapchat.com/cm/i?pid=c69c204f-fba0-4685-aea8-ad32f799fa5d&u_scsid=a2c80c5e-ee22-4bd8-8cd2-71487f90a94c&u_sclid=6e99d7bc-4a1f-4c52-adc8-d39149da641c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.48.245 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-48-245.yul62.r.cloudfront.net
Software: CloudFront /
Resource Hash: ab12e815caea6aba8fe2da60e7d298cccb649166f81926ff64e5dc56ea526522

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tr.snapchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Sun, 31 Dec 2023 15:21:31 GMT
content-encoding: gzip
via: 1.1 f7da5d3db9ee44e1812f138a4bdfd564.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: YUL62-C2
age: 66909
etag: b0abdf9f9dff4cfeb2717a9960d575ec
x-cache: Hit from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=86400, max-age=600
access-control-allow-headers: Content-Type
content-length: 17610
x-amz-cf-id: wNho1Ry8SD0YGQj23QlUvM5Fq0C2QfDqZgKZxGWR_AJpI58MGYT0Bw==

GET
H3 200 inbox-v2_48b3046e5658d067d380731acb25edd9.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 16 KB
5 KB 30ms
29ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/inbox-v2_48b3046e5658d067d380731acb25edd9.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d37545bbfbab30b44e51e630172af7d5d8a717afe66642b3e8eba0f6e1666872

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 21:13:42 GMT
content-encoding: br
age: 1255378
x-guploader-uploadid: ABPtcPrMCPnyr6U2oPNQxUoFFhMt7ZWUzhy3j64V-by7ROJnif46l1Cy_DBp74jieuus_H-oFL7LjgAiZA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4862
last-modified: Wed, 13 Dec 2023 20:28:54 GMT
server: UploadServer
etag: "e08d76c0eee63d930afa55862092fe13"
x-goog-generation: 1699889612802679
x-goog-hash: crc32c=om6Z6Q==, md5=4I12wO7mPZMK+lWGIJL+Ew==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 4862
accept-ranges: bytes
content-type: text/javascript

GET
H3 200 sms-v2_59133b5ff2491255abf0da3a6c439b40.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 3 KB
1 KB 30ms
29ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/sms-v2_59133b5ff2491255abf0da3a6c439b40.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 7d6b2e34f8baa2cbb0d0352ba4401894ca78bd0e98a8f0259798be00d3f9f4ec

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 17:16:01 GMT
content-encoding: br
age: 232839
x-guploader-uploadid: ABPtcPpU8e97gYqSOtppJxgOmRr5fvLESp2Aqlj2hqExzuZwXLtbVKM25Ql_gtbY8r9sviY0T10dQbqj_w
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1301
last-modified: Wed, 13 Dec 2023 20:29:24 GMT
server: UploadServer
etag: "fc8b1adafd5fdfc3a8542a947659bc4f"
x-goog-generation: 1701276236795581
x-goog-hash: crc32c=pCs8WQ==, md5=/Isa2v1f38OoVCqUdlm8Tw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 1301
accept-ranges: bytes
content-type: text/javascript

GET
H3 200 onsite-v2_5631bf90701659009118a89f964ae570.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 16 KB
5 KB 30ms
30ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/onsite-v2_5631bf90701659009118a89f964ae570.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: eddc11d8be0ae5311acc08d5f2ebe7ff9426384f6408ecbb56abbd7fb5e03743

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 23:24:21 GMT
content-encoding: br
age: 1333939
x-guploader-uploadid: ABPtcPptA0LQhdhwYCczAZOxW0eElhuGn9EwzzyjbA_wSVMlNM9iyYNwCPr6YnStnmL4HSVOC83cMscIAw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4962
last-modified: Wed, 13 Dec 2023 20:29:09 GMT
server: UploadServer
etag: "801d41813e7b11c4986b4ca00307283b"
x-goog-generation: 1699889623529535
x-goog-hash: crc32c=+KL22A==, md5=gB1BgT57EcSYa0ygAwcoOw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 4962
accept-ranges: bytes
content-type: text/javascript

POST
H2 200 p
tr6.snapchat.com/ 0
48 B 84ms
81ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr6.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 01 Jan 2024 09:56:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 0
via: 1.1 google, 1.1 google
server: API Gateway
alt-svc: clear, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1 200
OK / Show response
data.cdnbasket.net/ 14 B
338 B 247ms
63ms XHR
application/json 34.117.254.15
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_1e55b565811f11b08485230cf1d150d6.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.254.15 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 15.254.117.34.bc.googleusercontent.com
Software: /
Resource Hash: b73d23721ec3d102971773ff4ab2e13a6a4eea7f8e3a95b8fbf79c5c731188c6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:41 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
page.cdnbasket.net/ 14 B
338 B 280ms
65ms XHR
application/json 34.117.86.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://page.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_1e55b565811f11b08485230cf1d150d6.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.86.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.86.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 27c2b549e5a8c790671c751928917df02e62ab94e7d0c038a19c6ce4d561cb17

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:41 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
view.cdnbasket.net/ 14 B
338 B 247ms
63ms XHR
application/json 34.149.239.87
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://view.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_1e55b565811f11b08485230cf1d150d6.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.239.87 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 87.239.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 5930c52386428cfc5a608b256ce54b1688495c985d54500dce5b7cc18af7d01c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:41 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H3 200 jquery-3.5.1.min.js Show response
assets.bounceexchange.com/assets/bounce/ 87 KB
31 KB 28ms
28ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/jquery-3.5.1.min.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 06:45:57 GMT
content-encoding: br
age: 1739443
x-guploader-uploadid: ABPtcPohJbdqh-kMom3FJwRS1K8Ho8tujRbyBfuuuhnTMaqYzkZfxiRUq3hkrA76AZ7gf0tuXARr7DhbaPvanuhhC4jS6Q
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31564
last-modified: Mon, 11 Dec 2023 15:58:03 GMT
server: UploadServer
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
vary: Accept-Encoding
x-goog-generation: 1702310283670380
x-goog-hash: crc32c=W9o9Ng==, md5=3F5/GMjTasHT1HU6h8mNCg==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 89476
accept-ranges: none
content-type: text/javascript; charset=UTF-8

GET
H3 200 local_storage_frame17.min.html Show response
assets.bounceexchange.com/assets/bounce/ Frame 89B8 2 KB
969 B 30ms
29ms Document
text/html 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/local_storage_frame17.min.html
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f4fc114373da7e63fade04d84f7f1cfb5b31632246f33b10f3b7b275b85e6dd6

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: none
access-control-allow-origin: *
access-control-expose-headers: etag Content-Type
age: 876108
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=31536000
content-encoding: br
content-length: 938
content-type: text/html; charset=UTF-8
date: Fri, 22 Dec 2023 06:34:52 GMT
etag: W/"fc893948c3efc689b5b19d8a77958e23"
last-modified: Wed, 13 Dec 2023 20:28:30 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-generation: 1702499310379960
x-goog-hash: crc32c=kX4cqg== md5=/Ik5SMPvxom1sZ2Kd5WOIw==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 2408
x-guploader-uploadid: ABPtcPqR_99hxa7l0YI6LnDBrVEwhnAAyE2kG60DhvACTzefWNrhyx_-kRSPZ-Sra_8KXh1dBV4

GET
H2

200

p Show response
tr.snapchat.com/cm/ Frame BDBF
Redirect Chain

https://tr.snapchat.com/cm/s?bt=1d53c387&pnid=140&cb=1704103000890&u_scsid=d437146e-83a5-4058-aceb-758296bf89e5&u_sclid=db5de9cf-b185-41bf-b06b-67c60938ef0b
https://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1703024924203%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1703024924203%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D
https://tr.snapchat.com/cm/p?rand=1703024924203&pnid=140&pcid=0b0e1874-2e7f-4930-a78c-7aba836ebedc

0
201 B

94ms
94ms

Document
text/html

35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/p?rand=1703024924203&pnid=140&pcid=0b0e1874-2e7f-4930-a78c-7aba836ebedc

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains

Request headers

Referer: https://tr.snapchat.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-transform
content-length: 0
content-type: text/html
date: Mon, 01 Jan 2024 09:56:41 GMT
server: API Gateway
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
x-envoy-upstream-service-time: 13

Redirect headers

accept-ch: Sec-CH-UA Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Sec-CH-UA-WoW64
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 01 Jan 2024 09:56:41 GMT
location: https://tr.snapchat.com/cm/p?rand=1703024924203&pnid=140&pcid=0b0e1874-2e7f-4930-a78c-7aba836ebedc
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
server: Jetty(11.0.13)
strict-transport-security: max-age=31536000
via: 1.1 google

POST
H2 200 graphql Show response
www.paypal.com/targeting/ Frame E9D2 435 B
1 KB 218ms
218ms Fetch
application/json 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/targeting/graphql?disableSetCookie=true

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/muse/analytics/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8f8305fc7db342160602b17fae20225987e9bb15c5be4bdbb00633653e2dd25f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; img-src 'self' https:; script-src 'nonce-RiA4h/ClIUABZgjBVdxbotJBcucahMXW2+7Q4Fbn9wnoSB6i' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' ; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; object-src 'none'; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.paypalobjects.com/
disable-set-cookie: true
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: application/json

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' https:; script-src 'nonce-RiA4h/ClIUABZgjBVdxbotJBcucahMXW2+7Q4Fbn9wnoSB6i' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'none'; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com;
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Mon, 01 Jan 2024 09:56:41 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, MISS, MISS
paypal-debug-id: f244540194e24
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-xss-protection: 1; mode=block
x-served-by: cache-dfw-kdal2120050-DFW, cache-mia-kmia1760053-MIA, cache-mia-kmia1760053-MIA
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent: 00-0000000000000000000f244540194e24-d22e523d1ecaa6bb-01
x-timer: S1704103001.039941,VS0,VE191
etag: W/"1b3-eL22HdUWFn6wxO3bpXXQ96V4s6U"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.paypalobjects.com
access-control-expose-headers: Paypal-Debug-Id
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
x-cache-hits: 0, 0, 0

OPTIONS
H2 204 graphql
www.paypal.com/targeting/ Frame 0
0 132ms
132ms Preflight 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/targeting/graphql?disableSetCookie=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,disable-set-cookie
Access-Control-Request-Method: POST
Origin: https://www.paypalobjects.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type,disable-set-cookie
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://www.paypalobjects.com
access-control-expose-headers: Paypal-Debug-Id
cache-control: max-age=0, no-cache, no-store, must-revalidate
date: Mon, 01 Jan 2024 09:56:41 GMT
dc: ccg11-origin-www-1.paypal.com
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
paypal-debug-id: f244540cdeaef
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
traceparent: 00-0000000000000000000f244540cdeaef-fbbaad1e22ebeb6b-01
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS, MISS
x-cache-hits: 0, 0, 0
x-served-by: cache-dfw-kdal2120064-DFW, cache-mia-kmia1760049-MIA, cache-mia-kmia1760049-MIA
x-timer: S1704103001.907060,VS0,VE105

GET
H2 200 company_toolkit.js Show response
cdn-scripts.signifyd.com/api/ 4 KB
2 KB 70ms
70ms Script
application/javascript 3.162.3.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-scripts.signifyd.com/api/company_toolkit.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-47.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6082597f3871c77c9b31aa1383577f8c0e54cb5ff09275dc817bc70d96e6217d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:53:22 GMT
content-encoding: gzip
via: 1.1 212f3832d7f59d71fd3926166fcc89ae.cloudfront.net (CloudFront)
last-modified: Tue, 30 May 2023 10:18:44 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P2
age: 319
x-amz-server-side-encryption: AES256
etag: W/"2c3950f122b3977df61b0e077aaa92c8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=1800
x-amz-cf-id: lldNHKDi7ivNp4O-qJ1kWo8kTss-RwEiayPOrWEYl_Iutj6OoVenHQ==

POST
H2 200 exist Show response
srm.ba.contentsquare.net/ 2 B
94 B 415ms
137ms Fetch
application/json 54.154.97.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://srm.ba.contentsquare.net/exist?v=13.76.1&pid=1926&pn=1&sn=1&uu=c8cbded1-0b47-aaef-a15d-59aa4b144138
Requested by: Host: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/1a8bfa042c9c5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.97.89 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-154-97-89.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 01 Jan 2024 09:56:41 GMT
content-length: 2
content-type: application/json

POST
H2 200 p
tr.snapchat.com/ 0
93 B 82ms
82ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 01 Jan 2024 09:56:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
access-control-allow-origin: https://www.elfcosmetics.com
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 ct.html Show response
ct.pinterest.com/ Frame 8724 565 B
427 B 54ms
53ms Document
text/html 151.101.192.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/ct.html
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.192.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: f83b1a3ea61ad62e47fad82de5495a2547e2f12e591ad8108050538c566ae1e3

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443";ma=600
cache-control: max-age=86400
content-encoding: gzip
content-length: 323
content-type: text/html; charset=utf-8
date: Mon, 01 Jan 2024 09:56:41 GMT
pinterest-version: 8c23f27d55c77c9c78a5d022d53a766b1295cc23
referrer-policy: origin
x-cdn: fastly
x-envoy-upstream-service-time: 0
x-pinterest-rid: 1156914911340101

GET
H/1.1 200
OK wabgbbbvulog34zr.js Show response
imgs.signifyd.com/ 95 KB
13 KB 303ms
99ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/wabgbbbvulog34zr.js?6wbtlyzrcf8nzh1p=w2txo5aa&yzgatmnvlypb7sjr=L2NhMzJkODZhZTNmYjVkMTlkMGE5OTkwNjI5

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

52c9f82e3a7249ceaa7a069f9a836186a1c36a75cdf4b0c2a80bcc10e90b986e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Mon, 01 Jan 2024 09:56:41 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: CP=IVAa PSAa
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK xWu0lyV27fXYkLmF Show response
imgs.signifyd.com/ Frame 3FBC 272 KB
46 KB 107ms
106ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/xWu0lyV27fXYkLmF?0490cd7fb95face5=em8IlAO9Cezpci_v1Wnr1MnipKhLsdOZzKwBmB6enUUD7SfoK6jZBkDOABPX8a-cgELpsfijlC1N-oBgHSdGE5jGI-7PxB19VP73j-HF9ZG35JYrY2W9xY_AqgMiVDD-HABAnOLWKlnZ2isTpN0Gmcn8S4S2AJKxwOJWtB1vgsFphS4c-G3GSKkbPEcUWx0DanheQQgT5THETkKb&jb=3d3b2c2e6279657f375763666e6f7d7b2e607165355761646c6d77732f323a333b2c62736a77374b607865676f26607b683d49607a656f6f2d32383b3a32

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/wabgbbbvulog34zr.js?6wbtlyzrcf8nzh1p=w2txo5aa&yzgatmnvlypb7sjr=L2NhMzJkODZhZTNmYjVkMTlkMGE5OTkwNjI5

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

a5a1dab450bed7901011c6ef1fcd3b9072953cf91d8fc14183b599cc04591c87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Mon, 01 Jan 2024 09:56:41 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
tmx-nonce: d71637e429220a89
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=2, max=99
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK vy8T05_XD2D2ThJT
imgs.signifyd.com/ Frame 3FBC 81 B
475 B 292ms
96ms Image
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/vy8T05_XD2D2ThJT?b6cd3081b669f1da=bIpqSq0wT1nhUn6guiIZ9_s2P2FKanr_nGScUGXgBE-j5awgTq3zjhk7D3Q8N9LyrCni3iTgFONBobFebk3gupsHKEihgARRpcPVZUk2DLRgwENYtiEFjhjr2q15p9Ve8CoHMAg_2vXsHedQHJ9tSSao1gooUaDr8nUyKos

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:41 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK LKj7ivB6vf2hYBcC
imgs.signifyd.com/ Frame 3FBC 81 B
475 B 295ms
99ms Image
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/LKj7ivB6vf2hYBcC?3237d92967976f87=WmhmXvmnMF1QztCqADT6WVx4K19NLy6wSZMkwQvuLmhupgdsTY-FD615LqPyeiMqRKoxdRo-girp6r1N9HD1vRyHfd-SF0IJx18heaJEnM28_gHG81hSjbl50t9wSaUDDcBqkkM3COUxeFcRQdk3pHZb9lHnmsDxaIQkw9A

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:41 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png Show response
imgs.signifyd.com/fp/ Frame 3FBC 81 B
536 B 291ms
98ms XHR
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/xWu0lyV27fXYkLmF?0490cd7fb95face5=em8IlAO9Cezpci_v1Wnr1MnipKhLsdOZzKwBmB6enUUD7SfoK6jZBkDOABPX8a-cgELpsfijlC1N-oBgHSdGE5jGI-7PxB19VP73j-HF9ZG35JYrY2W9xY_AqgMiVDD-HABAnOLWKlnZ2isTpN0Gmcn8S4S2AJKxwOJWtB1vgsFphS4c-G3GSKkbPEcUWx0DanheQQgT5THETkKb&jb=3d3b2c2e6279657f375763666e6f7d7b2e607165355761646c6d77732f323a333b2c62736a77374b607865676f26607b683d49607a656f6f2d32383b3a32

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, w2txo5aa/d71637e429220a89l2nhmzjkodzhztnmyjvkmtlkmge5otkwnji5
Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Mon, 01 Jan 2024 09:56:41 GMT
Strict-Transport-Security: max-age=31536000
Last-Modified: Mon, 01 Jan 2024 09:56:41 GMT
Server: Apache
Etag: d37901914df54d2eadd1237c52d411d7
Content-Type: image/png
Access-Control-Allow-Origin: https://www.elfcosmetics.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Sat, 30 Dec 2028 09:56:41 GMT

GET
H/1.1 200
OK 4qt9Ip9NkewrIrh2 Show response
imgs.signifyd.com/ Frame D114 90 KB
14 KB 99ms
98ms Document
text/html 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/4qt9Ip9NkewrIrh2?3adb6cf73644d251=RBdMTng1eiQ_pjX3YeLYJ34PS_nccdzPuiRofa0beWbcy54Dnyy7UpSwtg9LwoZms4vGi_JHZ9YM1PmtSsPz5BmiK0j-MleOt9esZxHnxxNVmfNre6a8R0eEmqpQuk25C61lFz_3vi_VYKfwrRT5TJrCFEq60Nvj0L1StzFC2BEgVfNy3BjQ7zOTW6mfK2_-B65eF3vlg-ctPXta7qY

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

3a4b4716f5667e655a56096fb1fcb87a1f2d12431dc5053fc1c4f52855056254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Mon, 01 Jan 2024 09:56:41 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=98
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content EoC2lzmyeZd1ku8c Show response
imgs.signifyd.com/ Frame 3FBC 0
387 B 165ms
97ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:41 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK n3TZXCLdqdZz8U45 Show response
h.online-metrix.net/ Frame 5570 103 KB
15 KB 311ms
100ms Document
text/html 192.225.158.1
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/n3TZXCLdqdZz8U45?d3358eee210d6e79=3Pew4pWgXNieedmDTtf2SDgbXcHCmCpC9atyBz3Nu2e3PZvL3YSdq3cYOHy5iw5XzJotGLxhmSHj1l_bImbDAOzn5XPqUS-p8GYsQm0gRQEZVeh5KzxWX7ck3LTvHDcyDRcxsVAQtgsj8MfLJEUZTNnTg1_jzQ3KiGUv2madHkY3Zed8Wv6vh662C_tDbLuhWRsU3c-57pS8ZPLVezDX

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.1 , United States, ASN30286 (THM, US),

Reverse DNS

a-sac.h.online-metrix.net

Software

Apache /

Resource Hash

0eb2ec35de6e266aeda9a5c2ad3d2aa6f2298fc6ed1f241c33b77bf885dc3e57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Mon, 01 Jan 2024 09:56:41 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=100
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK w9ONHuVRAcbx-Tpd Show response
imgs.signifyd.com/ Frame D875 90 KB
13 KB 144ms
99ms Document
text/html 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/w9ONHuVRAcbx-Tpd?74a7c4172d6faaf2=lv_LKA-UcO6M-KSFMadTI4pB7t7rDedXoy4up6Wz_Yv-5cyZGxJ8asqu7jPGx3LIDuLqv4P68FIemcccgWNuGCPt3baHdd0gi0kIcWUTTGrLiKDpb8TjsqJrlmWiAD1WuaWLPru6O3RPYKPSPUsGuJ9cyiZeeYidUlp8drdHL-UGScqboOx1mZN0SFeycixZfpSgwuNo5M3o8-kchvfW

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

8ff3d96021a7e98a82bbc5ae4f02c71d58b25fb607f2ab06e85fb19c56f4c2dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Mon, 01 Jan 2024 09:56:41 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=99
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
204 EoC2lzmyeZd1ku8c Show response
imgs.signifyd.com/ Frame 3FBC 0
218 B 189ms
97ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/EoC2lzmyeZd1ku8c?0650be16d7ca5714=dqXih_Y4juiylDfmZWjlcThOxQHHgKLZaQpY8VnOnr18Zve1Wd31rV6SuMyKRAgOvTZtByg2_wXeDNcgyBaY_D2EH-RNN0oxif-6_79_43tdyxXAZHGoQExo1HFpxzcUqE-6dP1uhlT5n5PDpXLLre7p5Qg&ja=3f353e2e2e6937273c303a2e703d3a2e6e37333c3830703b3a3230266b6637333c3a387839303a382e797273373072382c647a7a353b2e3b3e3038263930303026313c323a263932383226393e3a3a263b323a3826313c38382633383830243a2432266d7e3d6b3a323869626b66693f3f6e6e6c6e66336d6b383e39393e353a3e62316b3f63266d643d3e2479696c3d3a362c646037627e7e70792d39412f3a4e2f304c7f777f246d6e6663657367677e636b73266165652d384c696573676d7e6969256b786b67616e69667b24706c37332c7262373f386e303269693c68696c626f393b33683f3b32356b6d306c396a6662326e342c6a62373e313b663d6a31693a6f6b323a3932656b693c32376e6d656b326c6631336f632c6879653557616c6e677f792f383a313b2e607368354b62706565652d38383332302c6a796d7f375f696666657f7b2c60796875374b627265656d2c6c626b3d3c2c66666d3d3226646f7e7a35302e76706c355a6b696366636b2f324c4067646d667d6c7d2c65637468783d3e323a396c316b30686d6b3a386f3c63693d3c303a303a6b663b3d353c3a396464343f3832333e3b6c366d636b3a3c6e69333e616c6a6e37383b393933333e612e6e7a3f68747e707927394b2d324e27384e7f7d7d246f6c6c6b6573676d7c636179266367672d304663657367677e636b2d6b70636561646b6679267a357a6c7f6f61645d6c64617b622d3745666b6c79672b7a64756f6b64577f63646e6577795767656e616955726669796d782d3745666b6c79672b7a64756f6b6457696e65686f5f6b6b786f68697c2f374f6e6164796d23706c7f67636c557b7d696b697e61656f2f3f4f666b6479652b78647f6563665f7b6267616b776b766f273f4f6e6164716f2978667f6d636e557a6f616678646b7b6f7a253d4f6e636c736f217a6e7f6d616e5774666b577a666b7365782d3f456c696479672b786c7d6d616c5f646f766b6e7c782d354d646b647b6f2b7a66756d61645f797e6f5574636d776d782d3745666b6c79672b7a64756f6b6457626b7c6b2f354f6e6b6c796d2e69616e3531&jb=39373f2e647b3747657a636466612f3a4e3f2c3a2d3238225f6b6e6465777927383a46542d303a3938243a2f39422f3a3a5763663e3e27394a253a3a703434292f323a437a7a64655f676843617e2f384c35393f24333c2d3a3a2a41405445462d3043253830666b616f2d3238456f6b6365232f38304960786f676d2d38443b3a30263a26343039332e3b30332f3a305b636c697a632f384c35393f24333c

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Mon, 01 Jan 2024 09:56:41 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK oCHwYOIjhv1nRnqY
w2txo5aamha37dhyt6s4zo3cbugt326k3vkuullxd71637e429220a89sac.d.aa.online-metrix.net/ Frame 3FBC 81 B
438 B 1031ms
96ms Image
image/png 192.225.158.3
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://w2txo5aamha37dhyt6s4zo3cbugt326k3vkuullxd71637e429220a89sac.d.aa.online-metrix.net/oCHwYOIjhv1nRnqY?aa41d00a094eebf3=1gOKTCkO50fKyFaO1lD2jGyhia9yGsPM0ykdF3j5bWJPkjEsh8g1YItJHpKf0qnP_5DEl2tPgvMGYNd5jnOwzgvaNZauKBdx4iHy-xl9DMDNXCm3tW7r6lRrBk0ofEvFX9Pl0H-zyjSsCtwEeVprO87WUkleiulqfDwp

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.3 , United States, ASN30286 (THM, US),

Reverse DNS

d.aa.online-metrix.net

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:42 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 c Show response
ids.cdnwidget.com/ 448 B
786 B 143ms
73ms XHR
application/json 2600:1901:0:56e0::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ids.cdnwidget.com/c?cookieID=&deviceID=&iv=&v=&GCH1=&SCH1=&GCS1=176001186&GCS2=ZWE5Njc5YjEtNWQ4Zi00ZjE4LTgxMzAtMjc2ZTdlZGI3NTQ0LmxvY2Fs&pe=false&wsid=4142&varID=&varData=undefined&log=%7B%22config%22%3A%7B%22gmEN%22%3Atrue%2C%22pixEN%22%3Atrue%7D%2C%22apikey%22%3A%222%5EHIykD%22%2C%22cjsversion%22%3A%221.5.9%22%2C%22wsid%22%3A4142%2C%22loadID%22%3A%22TYV4SlzlNRZRPUF%22%2C%22timing%22%3A%7B%22sessionStorageLoad%22%3A2%2C%22IDStageStart%22%3A2%2C%22netComplete%22%3A214%2C%22obsReqdata%22%3A251%2C%22obsReqview%22%3A252%2C%22obsReqpage%22%3A285%2C%22IDStagePrefire%22%3A285%7D%2C%22matches%22%3A%7B%22cookie%22%3Afalse%2C%22LS%22%3Afalse%7D%2C%22info%22%3A%7B%22isSpoofed%22%3Afalse%2C%22PM%22%3Afalse%2C%22DNT%22%3Afalse%2C%22deviceTimezone%22%3A-10%2C%22extensionID%22%3Anull%2C%22externalID%22%3Anull%2C%22agent%22%3A%7B%22device%22%3Anull%7D%2C%22firstLoad%22%3Atrue%7D%2C%22deviceid%22%3A%222489235156514818950%22%2C%22visitid%22%3A%221704103000908285%22%7D
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_1e55b565811f11b08485230cf1d150d6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:56e0:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software: /
Resource Hash: db83dc79f507c14201c4953b86a33d85ee61c5d04112b5248a698cd7b1571de9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:41 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 448

GET
H/1.1 204
204 VuuMhRYdAq2Hkdsg
imgs.signifyd.com/ Frame 3FBC 0
400 B 166ms
101ms Image
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/VuuMhRYdAq2Hkdsg?60515be0fba72133=C_oBJ6SVXA-_-T2SVfAjkLbXR6EULKdSB2F9AMzy-zEl0apbVH8_pj5_NeHvjNUPldvm8Vi1EUNICGv5xmZFYtN81CF0vQbTkbwKO7TPeaELNa-R11GFZ9DMh8GfTZOUVgSZMyfCRMZ-lMo7oJsQ2Jv2Zjj03WYIGRL3_K2kRaD3oxfBBThs8VGk4t-zGyenRkOOve7PlMoNN8V0TqA&jf=3c33322e7b636e55786e6e357e647857665b68587955463a407334394d4e65612c79616457666b7c6d373b3d3a343b3839303a392e796b6e5774717a6d3f7765683a6f616e7969267b6b6e57636f733739303f3139303b3b383c323d3a61303c3c3a636539643a303a3b3836383a3869303c3e326965396c3a333a39383d32393c32383a3836666438323e35686f3b34383468696c3a683c3c393c3033616b69313864693a386d6b6d6132333c3332663f3c3d306a316f3031386e3e3e626b6e39373f3a3e3d35323a626b683d3b61326b653c333d3f3b343a323939383e32396c323d3e3e373269303f35693f396a6e3f3036633d643e3b393a39616b603d3d3d693a3c3c652c7b6364557b616d3f3938343e3a3a3031303a626f316b6b6d636c303d3d6b3f336b6f393a3c33383339393e323e3d38306e3a306634696168646f3c3b653e603f3e3c6e326c6b373d3d6f386f316969603a6d303a38393230663b306c3a693c6a326a343a6d3e323c3b68636e3f38663e3f3b333a6f69326e6f3b613034696339646c3331343f63396a3c323e6c3831693c39633d396d393b2c7b696e783532

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:41 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=98
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content s6RQES_TLZtqATQ7 Show response
imgs.signifyd.com/ Frame D114 0
388 B 176ms
96ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/s6RQES_TLZtqATQ7?14659304ba2e311f=_irrdY5w-e64iqLEUxi4ovMlUVBz-SSKBMNPNJFGigR44f7IawrdUhyM_3sGAFz9UV6Byf8a6KaTVyahhQd1hh5L-oo8uzqLDhU58Y-5-KNmuYZgij4ov82TWQ9nKAJJLzQw2bE_frAK2wUj2KJiORYiv4g&jf=3b342c647b68376c3e343c6938386c6b3e69363e3d6131683a3b66353d316863323f38373f366c

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/4qt9Ip9NkewrIrh2?3adb6cf73644d251=RBdMTng1eiQ_pjX3YeLYJ34PS_nccdzPuiRofa0beWbcy54Dnyy7UpSwtg9LwoZms4vGi_JHZ9YM1PmtSsPz5BmiK0j-MleOt9esZxHnxxNVmfNre6a8R0eEmqpQuk25C61lFz_3vi_VYKfwrRT5TJrCFEq60Nvj0L1StzFC2BEgVfNy3BjQ7zOTW6mfK2_-B65eF3vlg-ctPXta7qY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imgs.signifyd.com/4qt9Ip9NkewrIrh2?3adb6cf73644d251=RBdMTng1eiQ_pjX3YeLYJ34PS_nccdzPuiRofa0beWbcy54Dnyy7UpSwtg9LwoZms4vGi_JHZ9YM1PmtSsPz5BmiK0j-MleOt9esZxHnxxNVmfNre6a8R0eEmqpQuk25C61lFz_3vi_VYKfwrRT5TJrCFEq60Nvj0L1StzFC2BEgVfNy3BjQ7zOTW6mfK2_-B65eF3vlg-ctPXta7qY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:41 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 lookup Show response
pd.cdnwidget.com/ 49 B
169 B 150ms
86ms XHR
application/json 34.149.130.207
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pd.cdnwidget.com/lookup?deviceID=2aLfuNW9V2ZvgRBpn2VIO8L232h&bxwid=4142&bxdid=2489235156514818950&visitID=1704103000908285&enableUID2=false
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main-v2_8aebf97cc6bdaca1cfc56940afdbc7d5.br.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.130.207 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 207.130.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 771196c556ce9fe2914aa0d336cf0f11fbd579c7cdd52e8436b19e0fffdd783b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 01 Jan 2024 09:56:41 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49
content-type: application/json

GET
H2

200

cs
tags.rd.linksynergy.com/
Redirect Chain

https://idsync.rlcdn.com/458359.gif?partner_uid=387d1e4e-80b5-4c42-bf8d-a15fea4726d9
https://idsync.rlcdn.com/1000.gif?memo=CPf8GxIwCiwIARCd5gEaJDM4N2QxZTRlLTgwYjUtNGM0Mi1iZjhkLWExNWZlYTQ3MjZkORAAGg0I2ZjKrAYSBQjoBxAAQgBKAA
https://tags.rd.linksynergy.com/cs?ns=lr&uid3=b4baddee7ca72e6ac2d1efce61f4bd3b5366d3d313129ebda8455967eafeace26ac34734d8e453ee

37 B
293 B

154ms
145ms

Image
image/gif

34.98.67.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tags.rd.linksynergy.com/cs?ns=lr&uid3=b4baddee7ca72e6ac2d1efce61f4bd3b5366d3d313129ebda8455967eafeace26ac34734d8e453ee

Protocol

Server

34.98.67.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

3.67.98.34.bc.googleusercontent.com

Software

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 01 Jan 2024 09:56:42 GMT
via: 1.1 google
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
x-samesite: secure

Redirect headers

date: Mon, 01 Jan 2024 09:56:41 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://tags.rd.linksynergy.com/cs?ns=lr&uid3=b4baddee7ca72e6ac2d1efce61f4bd3b5366d3d313129ebda8455967eafeace26ac34734d8e453ee
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 init1.js Show response
api.bounceexchange.com/bounce/ 122 KB
22 KB 245ms
155ms Script
text/javascript 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.bounceexchange.com/bounce/init1.js?wklzs=1151&wklz=C4ewVgigvAZgrgOwMbAJYgQMhQZygRgHYAGAFn2IGZjj8BOUgVk2AC8QoA2GzAdwFMARjlTB+AfVQATKOVIAmTACd+OEABs4aDAW7EAHvnk8VMfkpVKo2AIbr1qBAHNxcJeqgALYMAAOOAFJKAEEA+QAxMPDeGIA6fnUYJBAcAFt+NCQcWOTUqOS0jNQkAFokJVRUxzscTAA3VBFgcWSQAGtUfigAwgAhMPl1XwGg0Pl5bz9A+UYQsMYI+YiY3njEgvTM7Nyl8I2i0vLK6vVp+TCAYQGlEbnxkcIAEWwQds7uvoGpaVux8dIABx0eSURj4RicMGA-BAxjEEbyK7jBpSX5EMgUag0OjEAHyAGMS4DOq-Hr9cbqEBOJz8KSSBC-GA1fhE8b8OrmcSU6m0+mM5ms+RIGxKZoAR2AAE9fvDEQNhaLxHU7HAWfcQrKkfIcHBBFUfLyME01ecQkzTmqtdyaXTHJIpPwEGgYJ1UerguacJb5SLml7gPyLYKFQH3Z6WU9BVInOFUEocMAADIgGxu03BYBKVWCzwiqQASUepPG8hsifgEHUiYA8voABoAKTrAE02ghiL4AAoAdUThFScEIcYRWrUMGAheL4zL8AAct26AA1eQALTqTgASr1fAh5Iv89WAYmQRMR18nKTPuNGp2VA0QHAcBdH6B0jcwwK5decABlXU4I5BHMQMvWDGwkE8CRgDOUZ0XIKgaHoUhSB6IsnnqEUcAAbWtXlHAAXVgZkMPjLD2U5XDbQQQjwxI7CQ3ECVJUI4g6KwhjlU0fgWLY3wlBAOk+OKbiiItXj+LpBAbHSGjiOVUi7QTEAkDaWSxPk7CdT1UQxDpI1RBE2iNPY14OgkVIBLscQ+NUR1gDUr02Mo+l7Ts1AXVpBz+DYhj-S83ipF8cQcDaOB-OMkNwswrCbLqYLQvCh0YHY30lRVETWLqJKcKpG0XOkNyPKkRL+GS3yMn81ozPEUAQC5EUaVExzBF8KBWIyVqsIAIhDLqABoepsMQnBAJRJX6nrIJUh9gAmzwQHSCa+IEuAUAmr0RQgrr8MwXxoOsXJfAcGxkAkGB1BsJxrDqXNrFzJRbRkUtyzgSsa3rJtW3bLte37Qc40wMdmmkKBnrnBdlzXTdt13fdD2PSgJiAA
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: 3d3ca38cfe6a8bfb34834df8ac04f9951ebbf9292456666aa4dc519e462c32a5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:42 GMT
content-encoding: gzip
via: 1.1 google
last-modified: Mon, 01 Jan 2024 09:56:42 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 23
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H/1.1 204
204 z05WrTAJ10Kjptr5
h.online-metrix.net/ Frame 5570 0
400 B 176ms
176ms Image
image/png 192.225.158.1
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://h.online-metrix.net/z05WrTAJ10Kjptr5?027835fe63e0279c=23pnxDZ68eB3NXHetjiongoumRyTSAiqv-RhP2Cz4F4JYv2_JAaLo6sfBOby-jV7saYSslcFMv-XHLNX9akZlDQCE8JhR0YN99xXFQjTL1XgHXJiiIRAvBUq2fP44Hvpfg5Xi36qAhU-KYlGmEL558taoWGtCasqrUyywtWGxpvd4fLiPtf9C2IX9FXQbP343b4LFNuLtN9b7yd-hnc&jf=3c333c2e7b636e55786e6e357e6478575e40496d653764793951385472343c492c79616457666b7c6d373b3d3a343b3839303a3a2e796b6e5774717a6d3f7765683a6f616e7969267b6b6e57636f733739303f3139303b3b383c323d3a61303c3c3a636539643a303a3b3836383a3869303c3e326965396c3a333a39383d32393c32383a3836333139376932696f3a3430353a306a3d3c693f613f6b3a393b6b6e69606c39393f383e37353669326b60683f313939353a3d6b6f693e3b336f6c3a623c3b383830383e333b3d3d3a623932373a343f3c3a663a61686d3e3b33393c316c6d68353a6e3d38306b39323d38303739386c6638313e6e393830673a3a6b68386938612c7b6364557b616d3f3938343d3a3a3031303a6338346e323f3638373b6c3d6c3b323c353f6a6832686e3b6b673b31383d693f6639363c6469366c3f39343b673c3b30386e693e383b3f68303e3b386c63326e303a383837333132656b36396931373f31686e303e3a6b69303c306e336f396a6c3b3b3c306b326b64303739376c636e683c6631306c3d69323b6f3e36693d3e316b31302c71636e72353b

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.1 , United States, ASN30286 (THM, US),

Reverse DNS

a-sac.h.online-metrix.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://h.online-metrix.net/n3TZXCLdqdZz8U45?d3358eee210d6e79=3Pew4pWgXNieedmDTtf2SDgbXcHCmCpC9atyBz3Nu2e3PZvL3YSdq3cYOHy5iw5XzJotGLxhmSHj1l_bImbDAOzn5XPqUS-p8GYsQm0gRQEZVeh5KzxWX7ck3LTvHDcyDRcxsVAQtgsj8MfLJEUZTNnTg1_jzQ3KiGUv2madHkY3Zed8Wv6vh662C_tDbLuhWRsU3c-57pS8ZPLVezDX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:42 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content EoC2lzmyeZd1ku8c Show response
imgs.signifyd.com/ Frame 3FBC 0
387 B 97ms
96ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:42 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 creatives-base-styles.a53944a2.min.css
assets.bounceexchange.com/tag/css/ 37 KB
6 KB 29ms
28ms Stylesheet
text/css 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/tag/css/creatives-base-styles.a53944a2.min.css
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 286a9eb90b3236f3c77e9cd147b524d542d53ba83973de175c45be3eb1147805

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Sun, 24 Dec 2023 20:12:27 GMT
content-encoding: gzip
age: 654255
x-guploader-uploadid: ABPtcPqbOqXmR9CIObgiAWEfZqNhyKnfp8KPB53NLNA_b6Rf2WrkAeEZgAAhXCKVTrRXX6y31nM
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6053
last-modified: Tue, 13 Dec 2022 17:12:22 GMT
server: UploadServer
etag: "54f61bdcbfb6f81427c8a6803f48b02f"
vary: Accept-Encoding
x-goog-generation: 1670951542233151
x-goog-hash: crc32c=lLRhfg==, md5=VPYb3L+2+BQnyKaAP0iwLw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 6053
accept-ranges: bytes
content-type: text/css

GET
H2 200 visit
events.bouncex.net/track.gif/ 42 B
97 B 55ms
54ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/visit?wklz=G4SwziAuBcCuYFMBOBDA5ggdpAvAWQHsAvEAG1JQFIAmAMQFYA6ABhuYAoB1ETAEwIDuYNgDkAKmwCMzFpQDMAITbdMANgAs8pdWYAPDQEo2AQQAOp0gk4IARgGkoNBnIDsjOarbs7ACTF4AGRoAYTZSEABrBDYAcQQAYwiCIx1ggAskAgBbaLpJHRZGVWYAThLGfJK2AGUUADMUJBAneld3VQAyUAgYJAQ65D6kHC7wKGgKPh40U3QEWCRSHDTISFNhalbjGno6HboBQ8YEUjr4gjAcyBB4sEZzrP3ac8uEa-iAWnimrJ4UUjAox60D6YAIpFg1wImF0OEkxWYQPGoPBkJA0IAnnCdIjuuN4vBINlgI0QCgbJYwDhKC5tNRSAQ0BheAB9Hg0ajybbUagNAG5TnUUI8hDAZAshlMhCs9k8rkcvmIDkhDnxRqQFkAR0gGOVcm5OmVQtV6pZJIhAvlPNYcuNPNMmVZDpulv1Cv+SttwuoDoIrMwKByeoNistduoPBZYCJiWD7v5Ru9YFgNl+q2lLOhPVdIY9Ye95wIERACBZWT9-xZDoQiGwcZ5ocTHMlzLZmDZvCw1zqJd49d5eabPLVSA1iEg-cbXo5pl4pijEVgk8H0+H6uXCdXPr6wAXS7lbobK85LgAIkiYIXiwhqbSObwQH2DwbqOoABwlahyeiSeiqH-vpIH70DagreqAT6cvqkguMw6jSHIzDMNQv7qOoJT0CqPLAHGd5nlh1C8GgtAgEg0YBAQKCQVykBILAuTemkjS8AAkqe-bUCgAR1LAACKpABAA8roAAaABSIkAJoRJgzCmAACpwAQuFksAuKRQ7UGCdSQGxHFcTxIicCUABq1AAFrAGgABKCimJg1AmSxglvgEX7UGkmlEbhdLgPJO7ovAwSEtkyDBlO3rgNUKZgN8IA2GFz4RSa8RpKWkAbFBxgwXBCFIZIJRoTS7HhnUwATs+OXwcwiHIQRKAEMGNreqQpj9isawbFsTxPIcAjHKcLxXDcdwPE8Q1vDcXw-H8AKaSgmVcs1HLAKYOGVQR1GHoRmlIP2mnxOVwZVXldXhhAW3GB8kgEWg3zBm+b4EY8z7LTypBHZVsHVbVYEmlkswgGgmCLW6d48ihqgFe+PkretWVvfSn1ZSdNVISeJXel+LiqCUQGw9h8NLQRH0VSj32nRjxXFR08DIHM2DQDYmRCMgODpJkOS04gqAYIzYpkeimDYjIMjFGUFTUCU3P03zMAWCgkB1AQSBZDgKj8EIUiInTvNdtAnagPEbwYqYN6dmAEREqYHQEtGoVINATGxdCAuQNKOCIhgBDQOcsDYEgGLnJ2OAAKrVB03u+wQ-u0UHfoIHIYfVMYkcID7fsBxiAY5GHmBQNKNSQIrNZpz7fRoELOC0AEZcggglfQjnN60AyTS8CgdfxFAWJ4GSvx16YFzF6Qwc3nIcgFS4XfQtcmBdmPOAiKn5Yh4iAi2Nmj44PB6jUBe2+o79qHofQHSGy62+vh+X4-n+AFvkBGGIrMGCgAgAiHx0iCavRmDG9vRE8RwhdmuDkaMgZTBwgpmjZCPJJC2xAdgFApgQACwgNCHAxc0ByHPqKF0OBeDfxjkgY2OAN42A6AzXAutiE6Q7DgTi3FYBGVMhZKytl7KOWcq5dyaQOhMSQDKXgjCDJ8QEsJcSUkZJyUUspVS6kkBAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:42 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 pageview
events.bouncex.net/track.gif/ 42 B
165 B 54ms
53ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/pageview?wklz=A4Qw5gpgbglhDuAuArgJwDYF4AWAXXwAzgKQDMAgsQEwBi1N8jAdBOgGYDGA9oQLYS4YHQk26963PgKEBaDqhi8YAOxDpCAMlCRYCRB2SFcXXlBAKQAI3QRCmYgHYAQtSrouYSABMA+itdklFRUbGqEEAFUAMKu0BCoPu6eEL7+wYGuoeoR6dGuHOa4PgCOuACeARSuAAyRMcEFqEVm6Mg5VBnBtbn1VMCoXL79Qu2dIWGjecH9gz6q-JVB49l1rio+RlwcANaLmROrwYTIlkr4KT5cyoQwuKNVwVnhh1TcXNtwPryDaj79thBlLg9o8Dj1XElvH5lH4vIDBGw4F4QctnuCGoUNgIUU9Jr1gF5gBttsgcWCOlNXoUySt0X1UNBiaT0g9UaMHAARLTgaBwJBvD62GAALwgmAAbABWAAs3J0fP0IGUVyEahw+CInTotEY8BY7Ek-EEwlEJgkPCNsnkihUYTlvL0As+xi4iXMkEwuPtun5XHezrKwDFpGA6m9CqdEA2IrFkuqAEZqhoxMB9LxgJgkynELgOGxM8mTKnDBms0XEGBgKWNN84QX4BBLDc7jAvJhpfHpVQNLBm63MPGHNUO9VSNVqlR4zLpQBOSUaOGwDgQftUaUADhnVFIkqnUs76-jm7j4YQ-fjGnCxTaymX5+T6DgQME-CMIHTA6HI7HE+Cso4j7wiAwAwFA8Q3FcmC4OApALryy6YF4l5cGgCENpYGg8kCmCGPEyFsEUq4gAAMmwyAAHIAOozgAalQABaUBgAASk4wDKFQNEAJIAPLrsR25UNgGjYOYqRtlQJFkQAiugxE8QAHgAGgAUkpACa2zKNUwAAAqUcRDi8MgDgwKgQA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:42 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H3 200 7fe61b61deb67574fcbd423f591430a3.jpg
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 72 KB
72 KB 30ms
29ms Image
image/jpeg 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/7fe61b61deb67574fcbd423f591430a3.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: be699ffd6b1fdc6facf4666ddbff72e6903bc7ee85f7b271dcfd1a3b18fe00dc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 17:25:36 GMT
age: 232266
x-guploader-uploadid: ABPtcPqRMElMDfKgdnxB8-29ISw9LprHKVlPhE7GRnz3XZQFGK2FtwIVV8kEDwOwslk5-Bvt9pc
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73525
last-modified: Tue, 31 Oct 2023 17:11:44 GMT
server: UploadServer
etag: "7fe61b61deb67574fcbd423f591430a3"
x-goog-generation: 1698772304840828
x-goog-hash: crc32c=itwfgw==, md5=f+YbYd62dXT8vUI/WRQwow==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 73525
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 59a941c096f98029341d8c56b7b89113.png
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 18 KB
18 KB 40ms
38ms Image
image/png 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/59a941c096f98029341d8c56b7b89113.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 2f9c91dd6030ee0311497f63531e9e27cb31cb8468a74c0b8482075bdbaa80b5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 23:33:05 GMT
age: 1333417
x-guploader-uploadid: ABPtcPpIxGk7NWRK8Ne59tJHpFaxTjUoarTAo6WYUlCrJq-QT7T65DhWmamJ87KG8X9CFcEw_Ds5yfa6dA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18352
last-modified: Tue, 25 Aug 2020 15:57:40 GMT
server: UploadServer
etag: "59a941c096f98029341d8c56b7b89113"
x-goog-generation: 1598371060392963
x-goog-hash: crc32c=8aFhaA==, md5=WalBwJb5gCk0HYxWt7iREw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 18352
accept-ranges: bytes
content-type: image/png

GET
H3 200 21acb0e87b74f5d66b46f5abbdfdae5d.jpg
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 34 KB
34 KB 48ms
46ms Image
image/jpeg 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/21acb0e87b74f5d66b46f5abbdfdae5d.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: c30b3c8f59aa0a8a6b4a286bee5ee71142b349231f200a3d8a8b1439f10c0cff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 17:36:36 GMT
age: 231606
x-guploader-uploadid: ABPtcPp893KqUf-NJecNK-6VjFJ17bEYbcqGrE1umIYV6Zi79amqImHyLokglTQ5-S4amjPOVvs
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35063
last-modified: Wed, 01 Nov 2023 17:15:09 GMT
server: UploadServer
etag: "21acb0e87b74f5d66b46f5abbdfdae5d"
x-goog-generation: 1698858909771820
x-goog-hash: crc32c=ojJAOQ==, md5=Iayw6Ht09dZrRvWrvf2uXQ==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 35063
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 2d76399daf4b42a8a1789b981554960f.jpg
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 43 KB
43 KB 55ms
53ms Image
image/jpeg 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/2d76399daf4b42a8a1789b981554960f.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 4b412e122fd548bc6bf3a4bb81438a5a86dd8aadeae74a013dcd1a0c10f2ebca

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 03:20:34 GMT
age: 369368
x-guploader-uploadid: ABPtcPrS_f_Trf98OPYdqmEbT9g9jPZHygLBVjFSMGSKzxYX_vfq53SGCFqX7Jmb8As9_h3VhNXtfHD9gw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44310
last-modified: Tue, 31 Oct 2023 17:01:36 GMT
server: UploadServer
etag: "2d76399daf4b42a8a1789b981554960f"
x-goog-generation: 1698771696675921
x-goog-hash: crc32c=0f/E0Q==, md5=LXY5na9LQqiheJuYFVSWDw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 44310
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 077fb7636e1876128516799bc11f63f5.jpg
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 50 KB
50 KB 63ms
62ms Image
image/jpeg 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/077fb7636e1876128516799bc11f63f5.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f445b2f3037ecfea6eb43c2eb344c2ed2f24c58a9880c2aa5aaf328d012df607

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 17:25:36 GMT
age: 232266
x-guploader-uploadid: ABPtcPpswiGdqodxJUn_CRiw16iVCZu0ihq4gFqJaJKfDNyQuKSQo1EQzx6aT4TJGLYbM7W6310
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51556
last-modified: Tue, 31 Oct 2023 17:01:59 GMT
server: UploadServer
etag: "077fb7636e1876128516799bc11f63f5"
x-goog-generation: 1698771719473549
x-goog-hash: crc32c=IwEB3w==, md5=B3+3Y24YdhKFFnmbwR9j9Q==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 51556
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 aad294f617411e0fd0ad3a2b05a5ae0d.jpg
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 57 KB
57 KB 72ms
71ms Image
image/jpeg 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/aad294f617411e0fd0ad3a2b05a5ae0d.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 6f34262b9a0345ac42b2d8d30b29c919a72d2c5bc789b0d5548cb41e2576df78

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 01:41:57 GMT
age: 375285
x-guploader-uploadid: ABPtcPoyIKwItvr9PVOto2OdbpcTU-oo_xF_QFUU2yqdVSOFEZNcHrg05T-cPkmexTtuuNDCQHQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58088
last-modified: Tue, 31 Oct 2023 17:02:17 GMT
server: UploadServer
etag: "aad294f617411e0fd0ad3a2b05a5ae0d"
x-goog-generation: 1698771737010712
x-goog-hash: crc32c=zHWrCA==, md5=qtKU9hdBHg/QrTorBaWuDQ==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 58088
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 949ca8ee3c54e911de817865524ddb08.jpg
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 64 KB
64 KB 79ms
77ms Image
image/jpeg 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/949ca8ee3c54e911de817865524ddb08.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b734645b3b1ff2f0daafc3b1f558a0418f557f893cfd737f569654b024260953

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 02:19:51 GMT
age: 373011
x-guploader-uploadid: ABPtcPrUPzzIwGqjGTmy-DThqzWmaRsThUT1MXgCH8_Rn0JVuWZPLp6UokFYsCt7DyitYmc65sU
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65413
last-modified: Tue, 31 Oct 2023 17:02:40 GMT
server: UploadServer
etag: "949ca8ee3c54e911de817865524ddb08"
x-goog-generation: 1698771760157666
x-goog-hash: crc32c=05n7iQ==, md5=lJyo7jxU6RHegXhlUk3bCA==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 65413
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 16f45df19355361dc1c101036c0035b0.png
assets.bounceexchange.com/assets/uploads/clients/3258/creatives/ 2 KB
2 KB 78ms
77ms Image
image/png 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/3258/creatives/16f45df19355361dc1c101036c0035b0.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 915046d9ebab575f9b2f8ba9a35e030b2be55b1439edce6e72f7a19b4a55bd45

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 02:26:24 GMT
age: 1150218
x-guploader-uploadid: ABPtcPrBBAVKcJD_en65B3qx7_-tKv4KAYAu5ZFDnndXnO0hpO9mjbXww65l24bY6x8qdrbM1Oc
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2419
last-modified: Thu, 01 Apr 2021 03:01:32 GMT
server: UploadServer
etag: "16f45df19355361dc1c101036c0035b0"
x-goog-generation: 1617246092060079
x-goog-hash: crc32c=pklVBw==, md5=FvRd8ZNVNh3BwQEDbAA1sA==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 2419
accept-ranges: bytes
content-type: image/png

GET
H2

200

hash.gif
pix.cdnwidget.com/
Redirect Chain

https://pix.cdnwidget.com/redirect?CID=2aLfuQlLOxXJXYkn0pPWL7mu7ir&DID=2aLfuNW9V2ZvgRBpn2VIO8L232h&v=&iv=&deviceid=2489235156514818950&visitid=1704103002154495&wsid=4142&apikey=2^HIykD
https://pippio.com/api/sync?pid=5749
https://pix.cdnwidget.com/hash.gif?md5=none&sha1=none&sha256=none

68 B
626 B

66ms
65ms

Image
image/png

34.149.254.212
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.cdnwidget.com/hash.gif?md5=none&sha1=none&sha256=none
Protocol: H2
Server: 34.149.254.212 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 212.254.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Mon, 01 Jan 2024 09:56:42 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

date: Mon, 01 Jan 2024 09:56:42 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pix.cdnwidget.com/hash.gif?md5=none&sha1=none&sha256=none
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 202 graph
idr.cdnwidget.com/ 0
100 B 129ms
64ms Image
text/plain 34.149.130.207
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idr.cdnwidget.com/graph?cookieID=2aLfuQlLOxXJXYkn0pPWL7mu7ir&deviceID=2aLfuNW9V2ZvgRBpn2VIO8L232h&bxdid=2489235156514818950&bxvid=1704103002154495&bxwid=4142&gm=true&apikey=2^HIykD&loadID=TYV4SlzlNRZRPUF
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.130.207 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 207.130.149.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 01 Jan 2024 09:56:42 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 eligible
events.bouncex.net/track.gif/ 42 B
95 B 54ms
53ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/eligible?wklz=CYcwXAlgzgygrgIygYwE4QQU1QXgGYCGANlJgGSiRQAKqmAbhAPZxQDCrALkwLbb7FSFcMgLIAFpgAqMHAEYA7AAYALHKUBmJUrkBOFSrJwAjvLKkQfAHacA+hGBQcZUTwAOBCCCsOcAJg0FADZdOQAOcxZUZEwcBBYrGIAPMgIQTBscACsoMh4mYFilMgB3TCQITkxfNRU-MkYoSt9FVXUtJT85AFYDXW6KBggY3z8VMN0A7p6g6fHw-uKPdMZMEpbzTGM4DJHgfxciCAzOTgg+KE4Cd3llNU1tMe1D45sCNwh6bCamKxwrkAaQaMGI4YCRPB2UYEAAyeDgADkAOq6ABqfgAWvQQAAlABCbisflRAEkAPJhGEBPziMjiAioYD2fZ+WHwgCKRBhZKSAA0AFK8gCaAGsrEo3NQkTCFDw4AoIKggA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:42 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 pop
events.bouncex.net/track.gif/ 42 B
95 B 54ms
53ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/pop?wklz=A4e2C4EMGMBcEsBukEgHYF4EFsCmAnAMgHNcRxoQBXNWfAT0oBNcMBVAZRLPH12PjoMAMQAy3cpVrw0uWs1YA5AIKEqARwwBGQtEjZgkeMTTwmGAEwBmAOwA2AJxaAHIQDO1fNFYAjamm8AD0JIUloMACs3QmwQFgwABkIAd1wfN3hYXDMMABYtXItCRHgMhHMtGwT8hKsEhIstAFZc3IcmwhYS7xyLXOcHaybmu2H+l3akw1IS3GScnTdcdSo5HvMrXQAbeDlYHFw3WH1gbSqauobchu3d2khgJAIMoWPiTa74bwwmdxAAM1gAH1epBRP8qIoAOoOABqFgAWohiAAlABCwDQFlhAEkAPLOUTWCwAC0IJMg+CYIPMFjBEIAiltRHjAgANABSbIAmgBrNAJYAABShohs2CoNng+CAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:42 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 52ms
52ms Image
image/gif 2607:f8b0:4004:c07::66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1450957019&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&dp=%2Fcosmetic-criminals&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Wunderkind&ea=Wunderkind%20Impression&el=SMS%20Opt-In%20-%20Entrance%20-%20Combined%20(Email%20THEN%20Type%20Text)%20%7C%20Entrance%20%7C%20Desktop%2FTablet%20%7C%20Unidentified%20%7C%20Test%3A%20Creative%20-%20GIF%20v%20Static%20%7C%20CCC%20%7C%20Single%20Build%20(2376912)%3A%20Overlay%20-%20variation%20-%20Combined%20(Email%20THEN%20Type%20Text)%20%7C%20Entrance%20%7C%20Static%20(2376918)&_u=aHDAAEABAAAAACgAIAC~&jid=&gjid=&cid=1144441024.1704102998&tid=UA-432816-1&_gid=2141509973.1704102998&gtm=45He3bt0n81WL3STMXv896608294&gcd=11l1l1l1l1&dma=0&z=834064210

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 31 Dec 2023 18:46:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54617
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 204 dvar
c.contentsquare.net/ 0
319 B 52ms
51ms Image
text/plain 107.20.54.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/dvar?v=13.76.1&pid=1926&pn=1&sn=1&uu=c8cbded1-0b47-aaef-a15d-59aa4b144138&dv=H4sIAAAAAAAAA5VOywrCMBD8lSUnPYj33jTGB6KXRjyWtFllabot7VoU67%2B74Bd4GebBDPM2p1VxPRa2bUpijDBzTaAEfu%2FO4F8dgsenzGECx9IHrlDpBoda2m7pQ5lQ1LgwRWShG%2BnCpJVBMrA9BqERYQG7wxZGyEV1pbm1VjEnvieE9YNSNJn568Fvyny%2B8HX0Zr8AAAA%3D&ct=2&r=676938
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.20.54.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-20-54-57.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:42 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

POST
H3 200 collector Show response
collector-pxxt4gy2ig.px-cloud.net/api/v2/ 32 B
49 B 57ms
56ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxt4gy2ig.px-cloud.net/api/v2/collector
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/XT4Gy2ig/init.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ca0a766a064104105db7a847ffd8d594fb8556d364f724916f30a3e45a1ebab4

Request headers

Referer: https://www.elfcosmetics.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 01 Jan 2024 09:56:41 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.elfcosmetics.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32

GET
H/1.1 204
No Content EoC2lzmyeZd1ku8c Show response
imgs.signifyd.com/ Frame 3FBC 0
387 B 97ms
96ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Jan 2024 09:56:42 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 id_sync
events.bouncex.net/track.gif/ 42 B
60 B 54ms
53ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/id_sync?id_sync:id_type=sid&id_sync:id_source=graph&soft_id=2aLfuNW9V2ZvgRBpn2VIO8L232h&source=web&agent=cjs&deviceid=2489235156514818950&visitid=1704103002154495&websiteid=4142&pageviewid=1&sequenceid=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:42 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
54 B 42ms
41ms Ping
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZLYXLXNDL8&gtm=45je3bt0v879088318&_p=1704102996740&gcd=11l1l1l1l1&dma=0&cid=1144441024.1704102998&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&_s=2&dt=&sid=1704103000&sct=1&seg=0&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&en=scroll&ep.page_type=content&ep.page_environment=production&ep.page_country=US&ep.page_language=EN&epn.percent_scrolled=90&_et=106&tfd=12226
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Jan 2024 09:56:45 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/

Domain: 9231397.fls.doubleclick.net
URL: https://9231397.fls.doubleclick.net/activityi;src=9231397;type=retarget;cat=globa0;ord=4795749409075;auiddc=1145590087.1704102997;u6=%2Fcosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals?

Domain: 10742279.fls.doubleclick.net
URL: https://10742279.fls.doubleclick.net/activityi;src=10742279;type=elf8j0;cat=glo_flap;ord=4584385336966;auiddc=1145590087.1704102997;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals;gtm=45He3bt0v896608294;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals?

Domain: www.paypal.com
URL: https://www.paypal.com/xoplatform/logger/api/logger?disableSetCookie=true

Verdicts & Comments Add Verdict or Comment

190 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

92 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 17:23:09	Name: X-AB Value: b0abdf9f9dff4cfeb2717a9960d575ec
.elfcosmetics.com/	1970-01-21 02:07:18	Name: _pxvid Value: 0cbee83a-a88c-11ee-8c7a-979db74e8784
.elfcosmetics.com/	1969-12-31 23:59:59	Name: pxcts Value: 0cbf7745-a88c-11ee-8c7a-6f817a1b262b
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: initAuthComplete Value: true
.elfcosmetics.com/	1970-01-21 02:57:42	Name: ab.storage.sessionId.609afcb2-1dc3-41ef-a771-0a9aaf10bf57 Value: %7B%22g%22%3A%2271b12b4e-eacf-97a5-2ba3-1d616a3db156%22%2C%22e%22%3A1704104796758%2C%22c%22%3A1704102996758%2C%22l%22%3A1704102996758%7D
.elfcosmetics.com/	1970-01-21 02:57:42	Name: ab.storage.deviceId.609afcb2-1dc3-41ef-a771-0a9aaf10bf57 Value: %7B%22g%22%3A%22ef2bb55d-a1b2-bc49-0f8a-e682bd521626%22%2C%22c%22%3A1704102996760%2C%22l%22%3A1704102996760%7D
.elfcosmetics.com/	1970-01-20 17:21:43	Name: _px3 Value: bcaa97d023b0e9e87049fad561dff9bf86eea2f4cb0fca2ad2020c9d88a327d8:D72xoZovtZKBmhTr0+9v8AqD6fH9dtO+9sEq0Lw7xcsNxcXr4mxL+4aEt5P0WE9r7+H3HnM3Jg3cMMr5zVXTdQ==:1000:e9wXjBXHTPgk5GBtyVkkq2Hx4fRZun7tks2DAmzZXgqLQh92Cgo8TBfBhOIgSBtMxBeWtO6S+G+f3rySvk1UiJrt4essv1QC0LOwE5QY6+S3faRjRAJG8O7rzqH3SABB65zxXJfRykJ07GdTGyI6/N9iznA+VcQhKoJ8QY/OAmrL0tbuWu9N9f4JQeNvzrH4EtbMkwbWnZJu5z1THe6jMdQCp0kBfsvtelNGZD334pU=
.elfcosmetics.com/	1970-01-20 19:31:18	Name: _gcl_au Value: 1.1.1145590087.1704102997
www.elfcosmetics.com/	1970-01-20 17:31:47	Name: FPC Value: 8451e0c1-ecb3-4b73-b4bf-e36d9fb3a53a
.elfcosmetics.com/	1970-01-20 17:21:44	Name: _dyjsession Value: 09uqjccnx5ywkhe19s1i6fsja8vsnjvv
.elfcosmetics.com/	1969-12-31 23:59:59	Name: dy_fs_page Value: www.elfcosmetics.com%2Fcosmetic-criminals
.elfcosmetics.com/	1970-01-20 17:21:45	Name: _dy_csc_ses Value: 09uqjccnx5ywkhe19s1i6fsja8vsnjvv
.elfcosmetics.com/	1970-01-20 18:04:54	Name: _dy_c_exps Value:
.adsrvr.org/	1970-01-21 02:08:45	Name: TDID Value: 0af71ab2-cea5-4d86-a5a8-39b5271f8832
.elfcosmetics.com/	1970-01-21 02:07:18	Name: _dy_soct Value: 647796.1248068.1704102997.09uqjccnx5ywkhe19s1i6fsja8vsnjvv836603.1652212.1704102997837245.1654610.1704102997*861617.1750272.1704102997
.elfcosmetics.com/	1970-01-20 17:23:09	Name: _gid Value: GA1.2.2141509973.1704102998
.elfcosmetics.com/	1970-01-20 17:21:43	Name: _gat_UA-432816-1 Value: 1
.pointmediatracker.com/	1970-01-21 02:08:45	Name: c Value: 9d24489b-b198-4875-8f6a-a12b4a61e3ec
.adnxs.com/	1970-01-20 19:31:18	Name: uuid2 Value: 5990193701797365675
.elfcosmetics.com/	1970-01-21 02:07:18	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Sun+Dec+31+2023+23%3A56%3A37+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=202306.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=e9ee00ef-1682-43a1-a582-b098d9161f2c&interactionCount=0&landingPath=https%3A%2F%2Fwww.elfcosmetics.com%2Fcosmetic-criminals&groups=1%3A1%2C2%3A1%2C3%3A1%2COSSTA_BG%3A1%2C4%3A1%2C5%3A1
.dynamicyield.com/	1970-01-21 02:08:45	Name: DYID Value: -5692549678184100779
.elfcosmetics.com/	1970-01-20 18:04:54	Name: _dycnst Value: dg
.adnxs.com/	1970-01-20 19:31:18	Name: anj Value: dTM7k!M4/8CxrEQF']wIg2GU#o09$v!]tbP6j2F-XstGt!@DIq$_v)/
.doubleclick.net/	1970-01-21 02:57:42	Name: IDE Value: AHWqTUnZD_gB46uwEhMB9PqxpxQUoOe6ppUAnxE8VzARE0kBdtpaXsWbPgNNy4ciuIc
.elfcosmetics.com/	1970-01-20 18:04:54	Name: _dyid Value: -5692549678184100779
.elfcosmetics.com/	1969-12-31 23:59:59	Name: _dyfs Value: 1704102997948
.elfcosmetics.com/	1970-01-20 18:04:54	Name: _dycst Value: dk.w.c.ws.
.elfcosmetics.com/	1970-01-20 18:04:54	Name: _dy_geo Value: US.NA.US_FL.US_FL_Miami
.elfcosmetics.com/	1970-01-20 18:04:54	Name: _dy_df_geo Value: United%20States.Florida.Miami
.elfcosmetics.com/	1970-01-20 18:04:54	Name: _dy_toffset Value: 0
.bidr.io/	1970-01-21 02:50:12	Name: bito Value: AAF5FU7LJRkABK_41I1p3Q
.bidr.io/	1970-01-21 02:50:12	Name: bitoIsSecure Value: ok
.rubiconproject.com/	1970-01-21 02:07:18	Name: khaos Value: LQUQXCO1-1F-9KL9
.rubiconproject.com/	1970-01-21 02:07:18	Name: audit Value: 1\|9cWXc72FHAhvkJAsmjx2GdDS/tU1ZGXMWKdCe+W/t1qbz16xSA9sXZ+O6jYL+IJ/RRV4xoTHOd2M1KxoLazIt9i2Wk5FrGos0XY24Ec+XLsZgiRqZ118Y4XQIsETfzgOrXidGhGyNcqlemdiIuTEzLg8dHVCrqrHvqAH+LZKodtbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: scapi Value: prd:2eeca965-d19a-4748-8988-73649158393f:eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmODQ1NDdkOS03YjE0LTRkMDItYjkxMC1iODM1OTAxNWE1MzEiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOjJlZWNhOTY1LWQxOWEtNDc0OC04OTg4LTczNjQ5MTU4MzkzZiIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImF1ZCI6ImNvbW1lcmNlY2xvdWQvcHJvZC9iYnhjX3ByZCIsIm5iZiI6MTcwNDEwMjk2OCwic3R5IjoiVXNlciIsImlzYiI6InVpZG86c2xhczo6dXBuOkd1ZXN0Ojp1aWRuOkd1ZXN0IFVzZXI6OmdjaWQ6YWJrS3RKdzBjM2xIc1J4YmMzd3FZWWxYbzI6OmNoaWQ6ICIsImV4cCI6MTcwNDEwNDc5OCwiaWF0IjoxNzA0MTAyOTk4LCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDM1MjQ3MjI0OTgwNTc3NzAxIn0.GSX8Wt1ni7BvwzTa0uAiZLoAA-zYhm43XnHW-hZ2URfrI7Fvfy1J626yl9IYStTalLW3kyHwtJfFU85HjXl0xQ
.adsrvr.org/	1970-01-21 02:08:45	Name: TDCPM Value: CAESFwoIYXBwbmV4dXMSCwiiyoaov67FPBAFEhYKB3J1Ymljb24SCwiK54aov67FPBAFEhUKBmdvb2dsZRILCPjR06y_rsU8EAUSGQoKcmlnaHRtZWRpYRILCPL006y_rsU8EAUYBSADKAEyCwjCm8jQ1a7FPBAFQg8iDQgBEgkKBXRpZXIyEAFaBzNmdGZuaDNgAXIKcmlnaHRtZWRpYQ..
.yahoo.com/	1970-01-21 02:07:40	Name: A3 Value: d=AQABBFaMkmUCEFyq3bALWWpMhx_OdyG-azAFEgEBAQHdk2WcZdxH0iMA_eMAAA&S=AQAAAmRtf0GFI3-YuRrprAjAysM
.undertone.com/	1970-01-21 02:07:18	Name: UTID Value: 118b270c596d4574beee90e69ea9c94e
.undertone.com/	1970-01-21 02:07:18	Name: UTID_ENC Value: 11e1x9crbh0ptqu01e8eyhgsu
.analytics.yahoo.com/	1970-01-21 02:07:18	Name: IDSYNC Value: "1769~2fxl:19e0~2fxl"
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: dwsid Value: yDBQJAKWJrAfM8mF5M7F-LFX0bGVtyXNG9SJ8P6RHiK05mZ5bLIUd7656j1iSmf0yBFFk3UrQ7Sp9K8t1MVd5g==
www.elfcosmetics.com/	1970-01-20 21:40:54	Name: dwanonymous_1a00c2845eeb01c699351ea28e20fd92 Value: abkKtJw0c3lHsRxbc3wqYYlXo2
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: __cq_dnt Value: 1
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: dw_dnt Value: 1
.hb.yahoo.net/	1970-01-20 21:40:54	Name: visitor-id Value: 3471045981523578000V10
.hb.yahoo.net/	1970-01-20 17:41:52	Name: data-ttd Value: 0af71ab2-cea5-4d86-a5a8-39b5271f8832~~63
.elfcosmetics.com/	1970-01-20 18:04:54	Name: rmStore Value: dmid:9097
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: esw.currency Value: USD
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: sid Value: W3EacA3hnbFT2cAs81kFwSIWm-WawJ7MVz4
www.elfcosmetics.com/	1970-01-21 02:07:39	Name: _dyid_server Value: -5692549678184100779
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: esw.InternationalUser Value: ""
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: esw.location Value: US
www.elfcosmetics.com/	1970-01-20 17:23:09	Name: currentLocale Value: en_US
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: esw.sessionid Value: abkKtJw0c3lHsRxbc3wqYYlXo2
www.elfcosmetics.com/	1969-12-31 23:59:59	Name: esw.LanguageIsoCode Value: en_US
.elfcosmetics.com/	1970-01-20 19:31:18	Name: _rdt_uuid Value: 1704102999942.85dc0ea6-dfe9-4e5f-b102-c9e61c6ef5f1
.tiktok.com/	1970-01-21 02:43:18	Name: _ttp Value: 2aLfu9CKSGFQEPteBXngBN25VF4
.elfcosmetics.com/	1970-01-21 02:51:29	Name: _scid Value: e35fd1f0-d4d8-4833-922c-2b5e7f2cd986
.elfcosmetics.com/	1970-01-21 02:51:29	Name: _scid_r Value: e35fd1f0-d4d8-4833-922c-2b5e7f2cd986
.elfcosmetics.com/	1970-01-20 17:23:09	Name: _uetsid Value: 0f4b44d0a88c11ee9e139953cae2c27e
.elfcosmetics.com/	1970-01-21 02:43:19	Name: _uetvid Value: 0f4b6cc0a88c11eeb66f73b5e223ce3b
.elfcosmetics.com/	1970-01-21 02:57:43	Name: _ga Value: GA1.1.1144441024.1704102998
.bing.com/	1970-01-21 02:43:19	Name: MUID Value: 2448D24311E86B0F12A7C1BA104F6AC1
.bat.bing.com/	1970-01-20 17:31:47	Name: MR Value: 0
.elfcosmetics.com/	1970-01-21 02:57:43	Name: _ga_ZLYXLXNDL8 Value: GS1.1.1704103000.1.0.1704103000.60.0.0
.elfcosmetics.com/	1970-01-21 02:07:19	Name: hero-session-efcf9631-4c6b-4874-9f76-51f71464249a Value: author=client&expires=1735639000259&visitor=21d4fe65-ae4f-4da5-bda9-945c48d4c985
.elfcosmetics.com/	1970-01-21 02:51:07	Name: _cs_c Value: 0
.pinterest.com/	1970-01-21 02:07:19	Name: ar_debug Value: 1
.linksynergy.com/	1970-01-21 02:07:19	Name: rmuid Value: 387d1e4e-80b5-4c42-bf8d-a15fea4726d9
.elfcosmetics.com/	1970-01-21 02:51:07	Name: _cs_id Value: c8cbded1-0b47-aaef-a15d-59aa4b144138.1704103000.1.1704103000.1704103000.1558384338.1738267000375
.elfcosmetics.com/	1970-01-20 19:31:19	Name: _fbp Value: fb.1.1704103000390.940333010
.elfcosmetics.com/	1970-01-21 02:43:19	Name: _tt_enable_cookie Value: 1
.elfcosmetics.com/	1970-01-21 02:43:19	Name: _ttp Value: YkgU6Gd0HHHuAL8FavBkkYL8s8X
.elfcosmetics.com/	1970-01-21 02:07:19	Name: _pin_unauth Value: dWlkPU16aGpOamN3WW1VdFlUWXhZUzAwTjJFd0xUazJOVGd0TnpKbU1XWTFZekk0WTJWaA
.tapad.com/	1970-01-20 18:48:07	Name: TapAd_TS Value: 1704103001060
.tapad.com/	1970-01-20 18:48:07	Name: TapAd_DID Value: 0b0e1874-2e7f-4930-a78c-7aba836ebedc
.elfcosmetics.com/	1970-01-20 17:21:44	Name: _cs_s Value: 1.5.0.1704104801100
.tapad.com/	1970-01-20 18:48:07	Name: TapAd_3WAY_SYNCS Value:
.snapchat.com/	1970-01-21 02:43:19	Name: sc_at Value: v2\|H4sIAAAAAAAAAE3IwQ0AIQgEwIpIdhUx2g3gWYXFn09/k6G7YYSJZTbRtZuEEvK5JXewrJqHismO+xXgeYgf4jLe7EAAAAA=
.elfcosmetics.com/	1970-01-21 02:51:29	Name: _sctr Value: 1%7C1704016800000
imgs.signifyd.com/	1970-01-21 02:57:43	Name: thx_guid Value: db3242938f5ae405e8202cb312c8f994
.cdnwidget.com/	1970-01-21 02:53:23	Name: __3idcontext Value: {"cookieID":"2aLfuQlLOxXJXYkn0pPWL7mu7ir","deviceID":"2aLfuNW9V2ZvgRBpn2VIO8L232h","iv":"","v":""}
.elfcosmetics.com/	1970-01-21 02:50:31	Name: __idcontext Value: eyJjb29raWVJRCI6IjJhTGZ1UWxMT3hYSlhZa24wcFBXTDdtdTdpciIsImRldmljZUlEIjoiMmFMZnVOVzlWMlp2Z1JCcG4yVklPOEwyMzJoIiwiaXYiOiIiLCJ2IjoiIn0%3D
.rlcdn.com/	1970-01-21 02:07:19	Name: rlas3 Value: NX/vHQfiR32YCT/RThVuJIBqhLKt6XL309QROoJWwls=
.rlcdn.com/	1970-01-20 18:48:07	Name: pxrc Value: CNmYyqwGEgUI6AcQABIGCOTrARAA
.linksynergy.com/	1970-01-21 02:07:19	Name: icts Value: 2024-01-01T09:56:42Z
.bounceexchange.com/	1970-01-20 17:21:44	Name: bounceClientVisit4142c Value: %7B%22vid%22%3A1704103002154495%2C%22did%22%3A%222489235156514818950%22%7D
.elfcosmetics.com/	1970-01-20 17:21:44	Name: bounceClientVisit4142v Value: N4IgNgDiBcIBYBcEQM4FIDMBBNAmAYnvgO6kB0ApmAGYDGA9igLYUICWtKZDTRDzrDgFpaAJzZM2AOwCGYFCAA0IUTBBKQbFAH0A5vW0oKKFG3pSY1OUeVa9EQ8dPnL1igF8gA
.pippio.com/	1970-01-21 02:07:19	Name: did Value: xOiVpZU9geYLURbv
.pippio.com/	1970-01-21 02:07:19	Name: didts Value: 1704103002
.pippio.com/	1970-01-20 18:48:07	Name: nnls Value:
.pippio.com/	1970-01-20 18:48:07	Name: pxrc Value: CNqYyqwGEgUI9ywQAA==

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://www.elfcosmetics.com/cosmetic-criminals(Line 362) Message: Access to image at 'https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/#elfcosmetics_a_00000055698485330971283280000018393236039574697104_?yocs=1u_' from origin 'https://www.elfcosmetics.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d42101b2/www.elfcosmetics.com/v~4b.a3/#elfcosmetics_a_00000055698485330971283280000018393236039574697104_?yocs=1u_ Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://connect.facebook.net/signals/config/1638306756445368?v=2.9.138&r=stable&domain=www.elfcosmetics.com(Line 146) Message: Unrecognized feature: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10742279.fls.doubleclick.net
9231397.fls.doubleclick.net
ads.undertone.com
adservice.google.com
alb.reddit.com
analytics.google.com
analytics.pangle-ads.com
analytics.tiktok.com
api.bounceexchange.com
api.ipify.org
api.usehero.com
assets.bounceexchange.com
async-px.dynamicyield.com
bat.bing.com
c.contentsquare.net
cdn-fsly.yottaa.net
cdn-scripts.signifyd.com
cdn.cookielaw.org
cdn.dynamicyield.com
cdn.usehero.com
cm.g.doubleclick.net
cnv.event.prod.bidr.io
collector-pxxt4gy2ig.px-cloud.net
connect.facebook.net
cosmeticcriminals.com
ct.pinterest.com
data.cdnbasket.net
elfcosmetics.a.bigcontent.io
events.bouncex.net
evt.undertone.com
external-api.jebbit.com
geolocation.onetrust.com
googleads.g.doubleclick.net
h.online-metrix.net
hb.yahoo.net
ib.adnxs.com
idr.cdnwidget.com
ids.cdnwidget.com
idsync.rlcdn.com
imgs.signifyd.com
insight.adsrvr.org
js.cnnx.link
js.jebbit.com
match.adsrvr.org
page.cdnbasket.net
pd.cdnwidget.com
pippio.com
pix.cdnwidget.com
pixel.pointmediatracker.com
pixel.rubiconproject.com
pixel.tapad.com
px.dynamicyield.com
qoe-1.yottaa.net
s.pinimg.com
sc-static.net
sdk.iad-05.braze.com
secure.adnxs.com
srm.ba.contentsquare.net
st.dynamicyield.com
static.ordergroove.com
stats.g.doubleclick.net
t.contentsquare.net
t.paypal.com
tag.rmp.rakuten.com
tag.wknd.ai
tags.rd.linksynergy.com
tr.snapchat.com
tr6.snapchat.com
ups.analytics.yahoo.com
ut.rd.linksynergy.com
view.cdnbasket.net
w2txo5aamha37dhyt6s4zo3cbugt326k3vkuullxd71637e429220a89sac.d.aa.online-metrix.net
websdk.appsflyer.com
www.elfcosmetics.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.paypal.com
www.paypalobjects.com
www.redditstatic.com
10742279.fls.doubleclick.net
9231397.fls.doubleclick.net
cdn-fsly.yottaa.net
www.paypal.com
104.237.62.212
107.178.254.65
107.20.54.57
13.225.195.64
142.251.163.148
142.251.163.149
142.251.167.155
151.101.192.84
151.101.193.140
151.101.193.21
151.101.193.35
151.101.194.133
151.101.2.133
172.253.63.155
184.27.13.189
192.225.157.157
192.225.158.1
192.225.158.3
192.229.210.155
2001:4860:4802:34::181
204.141.88.73
204.2.133.49
204.2.50.198
23.218.216.202
23.218.218.25
23.222.5.91
2600:1408:c400:38f::1931
2600:1408:c400:59::17d5:9e04
2600:1901:0:56e0::
2600:9000:215f:600:11:85b0:d600:93a1
2600:9000:21a2:5a00:a:7914:b00:93a1
2600:9000:269f:4e00:13:d6f4:3240:93a1
2600:9000:269f:ae00:15:ad21:c740:93a1
2600:9000:26a0:4200:a:b89d:a6c0:93a1
2606:4700:4400::6812:2a49
2606:4700:4400::ac40:9b77
2606:4700::6812:83ec
2607:f8b0:4004:c07::66
2607:f8b0:4004:c07::9b
2607:f8b0:4004:c09::61
2607:f8b0:4004:c17::9a
2607:f8b0:4004:c1d::69
2607:f8b0:4004:c1d::9b
2620:1ec:c11::200
2a03:2880:f07d:0:face:b00c:0:3
2a03:2880:f171:81:face:b00c:0:25de
2a04:4e42:600::396
3.161.213.115
3.161.213.49
3.162.3.47
3.220.158.64
34.102.147.248
34.111.113.62
34.111.8.32
34.117.254.15
34.117.86.137
34.120.253.250
34.149.130.207
34.149.239.87
34.149.254.212
34.198.176.45
34.200.65.202
34.206.78.39
34.98.67.3
34.98.72.95
35.190.10.96
35.190.43.134
35.244.154.8
52.223.40.198
52.3.200.153
54.154.97.89
54.157.127.36
54.192.51.117
54.230.48.245
68.67.160.132
69.173.151.100
00c8262f03a66a2ee09e72210fbf8a5c96af8936927b11b9e7aafdd5084ce303
0739b17b1053de387d55795753300a79626787634f8c909277efff94d0e3f154
0eb2ec35de6e266aeda9a5c2ad3d2aa6f2298fc6ed1f241c33b77bf885dc3e57
11762f3811534382a7fe191591000ebd869ce22a1936004470c4ce1d420a36a1
19b9a6628fa003af26766ce1578420be5068227a572c78f0e20b53e2f2fc1886
1a09824b6d7bbd0f5e82a23d14da408abfba60d02f5bdb48309d3ab6ca61bb1f
1a1fe89f11a11d89299028b565a99569e2aa5df3055ce514ba4dec2a8f0fe4fa
1b882f34d2c8e8705e11734b595c877cee19e53b807a22a19a7311a523d63aba
1d890b2023d02714bdf7a5b49e9fad03c46bc5d729674b3c15e23f82a0a2e355
20029e526c0674dd1f99d02142bbf324bd8ee217ca43705fa6fe1a64bd90ee0c
210706c053295db0bfba03a98c0609a1f940c3f6b6c626f2f1084e089e959dc9
2125f1a011cbd591338ae3c896d3b5b6ad80930fe86493af4518510ede5795cf
27c2b549e5a8c790671c751928917df02e62ab94e7d0c038a19c6ce4d561cb17
286a9eb90b3236f3c77e9cd147b524d542d53ba83973de175c45be3eb1147805
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2c8574ba42424a1dcf02c58fda5e3482e2262e0b0dddd09e5935bd94e5eba03e
2f9c91dd6030ee0311497f63531e9e27cb31cb8468a74c0b8482075bdbaa80b5
2fbe1331e7f38c07783a28fff71ccf9b5f3434f40e2a9993182e55ec5b37e07b
30766af54516bbc623c690d7506f7d86b6c987acbcc1229debb7dff8f463459b
30ca5a7ae3f12eb7d187d400d8c23903395c7e9c3fa7f85cb742785af28f2c81
31f48ed33afe7e437efa2c30cbf97fbd62c2de5c0732504077377846fe64973f
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
39657f7f198608406cab1de96720a22549e6b6d918db8dfdd0f5ef9ab84ef17c
3a2b3b5ecaa7d5c67e5e28f9712ebcf28a592c7191e24bcde25cc5bb374cbf7b
3a4b4716f5667e655a56096fb1fcb87a1f2d12431dc5053fc1c4f52855056254
3d3ca38cfe6a8bfb34834df8ac04f9951ebbf9292456666aa4dc519e462c32a5
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
406c93b0692878bad84a4f34065184d023ac12f1b92d9cb0398642fb0de45c2d
43495d385a567946c253f7d654649aa943b5b0e758c32b6286c2000ef637ba8b
4aa855b8d34657ab4df5ca73fe7d7f67735ee1e39e8de83856ddc473d4713fbb
4b10c3904e3ed31d12553afebe7ee47ec07d57ff9c5d023ca533580834ba2ca4
4b412e122fd548bc6bf3a4bb81438a5a86dd8aadeae74a013dcd1a0c10f2ebca
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c008957d2dfd259fac81d1a8dd5c40c7fa7aa460fe949e463c077fa58127228
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4f770b32793546ad41060cc03c06e4a744b10e9ae4af0b2b0522cfcf1fb33285
4fe7f21832dbf723dcfd8be15da287d2b88375c3b9a7cced90b51efc228634aa
52c9f82e3a7249ceaa7a069f9a836186a1c36a75cdf4b0c2a80bcc10e90b986e
57e461c9b78558e62478cca713658387eaf54afe6ae0a8128ee38e5846b4d6d8
5930c52386428cfc5a608b256ce54b1688495c985d54500dce5b7cc18af7d01c
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
5eca572cd68aa4afde19d317daf93398ca142c3648214e16b37e054e15c3f9e1
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
6082597f3871c77c9b31aa1383577f8c0e54cb5ff09275dc817bc70d96e6217d
60cc60a6fcbd230def379432395199b585791ed521e2e5f595369a2193e617fb
613a0081b64a7df6a20f9ba46cd384e4061e288f439ba8755cd664fbad3177c8
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
6501140033c3bb20da4b5ac73c90f687ba8a2053c4ba37c4b6f5275166db7fa6
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6b42a56b231d70ea3691b9f46363b9f8ed6ca35f6b50084718669b8beac1e57d
6d72fa0f78c80b1874d3ee4aadf43d973edc442a65fef83d37e684ac559893b7
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
6f34262b9a0345ac42b2d8d30b29c919a72d2c5bc789b0d5548cb41e2576df78
71cfd0bf781e3f393bca283fc9d44777a2036985a4ffe9abedf14909e63a8aef
7247ab83a30fbd92bf8425aca87dbb9f3f44c1b7facc6f7fd80df157ea6b5e03
729926f1c51e4c5faf0607d2b93e04b427b8e7a0658e54d8a212a76832fe1343
771196c556ce9fe2914aa0d336cf0f11fbd579c7cdd52e8436b19e0fffdd783b
7bab85eaa8d74cec964409d9e0a5c6d7ed0000b23b6400c562333c6483761ca2
7d6b2e34f8baa2cbb0d0352ba4401894ca78bd0e98a8f0259798be00d3f9f4ec
828011e932c7f65177e00c50ef88564628178b9d3190845404b02e3132a14c90
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87260ecf581a44a18ca2165015348383b430e6b77ca0b0ec4a9a3b1ebff57160
8bd09a31bc892afc88d1e2fbca71d888ee5beebe1c9aea3342e9e95473794b30
8e33955f54ef8025b647a6e685fa689a9256fc5c987f7dc98590310ac3c358e5
8eeb23a1dcd42802d5d861556c6ae4848a05fd28cd22bb8ed884015b62eefd9e
8f8305fc7db342160602b17fae20225987e9bb15c5be4bdbb00633653e2dd25f
8ff3d96021a7e98a82bbc5ae4f02c71d58b25fb607f2ab06e85fb19c56f4c2dd
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
915046d9ebab575f9b2f8ba9a35e030b2be55b1439edce6e72f7a19b4a55bd45
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
9846c98d92f9ede0abb2db68013d613791db3ccdb486451de1432034b563fb77
9a77cbb7b054563b83506932790e70186ba3a92e69a147216e3176337178adbb
a19915f513441bab259dbf5472a9501139e4eda8d1891ca5a0bd4efd6d60dd4d
a1d4b01843b9dad68a10bba7ab416fb60cbe6052a223f6bd74cbad286b812b2a
a33177a1b1a44698bc85bc710dfd4a6aba8bbe329db64dbb0622c894a1c05cbd
a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e
a5a1dab450bed7901011c6ef1fcd3b9072953cf91d8fc14183b599cc04591c87
a68adcd6e4525179b1a4e28b16abe4777a0afb870b4317b427f6d6ea8fbe22ed
ab12e815caea6aba8fe2da60e7d298cccb649166f81926ff64e5dc56ea526522
ab99a75a2070736b0282d041df3a7e272ad5d4d1929ae430089ac0335e05ad2c
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b0ae6ca3caa68945caf45f000efe5b8a052d45d9438cd4ca92221abe5c05e707
b1fdabf0bbfde031d2de37b191e0b07576b06d3a4f4bd226d1b674e40d047f22
b6d2fca70ade2bd124d2bda6dfe8f74ec3027fe87ed255b495977ff32d6c475b
b734645b3b1ff2f0daafc3b1f558a0418f557f893cfd737f569654b024260953
b73d23721ec3d102971773ff4ab2e13a6a4eea7f8e3a95b8fbf79c5c731188c6
b7f3fee14cf966a67d1b0a6dfec5f0f19002fcd494965c99f75059e7f0a2f53d
b91192e24e8d4a8c79e94f96ae96848c6760546622a65897a91e35b3ea4de590
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
be699ffd6b1fdc6facf4666ddbff72e6903bc7ee85f7b271dcfd1a3b18fe00dc
bf8b41f6693852a18d2449439f0400cfaf19b755e21f01eda21a6ff985d3526c
c1640f64b5396d16334760442e6dbd14d0854f71e34965bac4a690e1a038707d
c30b3c8f59aa0a8a6b4a286bee5ee71142b349231f200a3d8a8b1439f10c0cff
c4fad867557fa65e1a778e915c0b4ed0cd1bbb4443452c8943e5cec6504311e7
c714fe2d9c248c9fd2f802b9b7ca8f607d5c57dd543146ad402b391707385305
ca0a766a064104105db7a847ffd8d594fb8556d364f724916f30a3e45a1ebab4
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
caf0ae97ec23eaa1297b96a5906d543a45ff59f954c4a5563deaca79457f4a4a
cb08d2a78700ce581b6298e9186d7dacc943aecc6a39ef1b2644c57dba48bc56
cd0b162bc6e5a1dfcdba80c8b12d3f2ec6ac423a1c1ed7d996779d9c6b81f346
cd36a9a40e33aa3d4fa0d7b81e5f1126d62aaf421c6e032aa397b7bac9dc9c7c
cf1b4e2a57de561424fb99aa43ef462868d58d9c205a38ae3f564c10266a4dbc
d0c233d327541d2961f1cde9e53a6166279655f4d4041c1bc458ac1701827719
d37545bbfbab30b44e51e630172af7d5d8a717afe66642b3e8eba0f6e1666872
d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e
d8a6566c7e926c37c010dc811a5e82d5eddad8b10057bf711f0f644be60707d3
db83dc79f507c14201c4953b86a33d85ee61c5d04112b5248a698cd7b1571de9
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
def2a184135eba029f8f785b3ed69edc5f36b368226ce1fcfeda4f5aa301d1b6
e038dff62440b626103b2b81adcbb64b5cb3bd80433d1a710f37162cd7c0cc17
e164d3eb3e9b278fea4e13e0d68d3f1bb3fc421c3a2b709710ddfe8762dc4fad
e3acb368deafaa8bd7c2d422a6268423eec9f5b1fba4e4ac9e38c6b5200803dc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8f118daabadc747ba3e2236a27edce749bb73dde4f16c6c6acc5cce36009a36
e9ffb1fd04bca7c62968d8639c4ae3ff6d86632ac0593c30f7a5a5cff0bf4c34
ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0
eb65984bf2e525e7945e950a88816a69a1234d9f2489190a95aced6662755016
ec82b31e96055d86efd9adec9781b4b588e877c51b1b62ce71dbf73d64ab5318
ed079d77ba54a8e4bfc931029de75b1f5128fcae45e274d53aca95f8ab17b438
eddc11d8be0ae5311acc08d5f2ebe7ff9426384f6408ecbb56abbd7fb5e03743
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef45c21f7e054481c81992c1a46293a28c9bb8b3722bc566479326187f473c8c
ef6dac5c8eeca61f027ab57976921b71aed97543e8d8c49599c21b2e22f27f62
f114a64c26edb67def4dd84a00694f76e0573aedddb68428c52c6ea8b00de4c3
f3581f5a13294626a46b39edec979145f6985d4959bc0404e080a6f5184c5ca5
f445b2f3037ecfea6eb43c2eb344c2ed2f24c58a9880c2aa5aaf328d012df607
f4fc114373da7e63fade04d84f7f1cfb5b31632246f33b10f3b7b275b85e6dd6
f66f5edd05293c4351edcec020a867935f7495ef0d0ff7ceb3e6402748585ca6
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f83b1a3ea61ad62e47fad82de5495a2547e2f12e591ad8108050538c566ae1e3
fc61323a624ca2cb473b60bd7554b9f2b4962b674a8736dbb9ab129dff3a1545
ff2fe181c12146189657e92f9ce0489f7f3b51345796f5a5ec9b089f9fb47616

www.elfcosmetics.com Open in urlscan Pro 204.2.133.49 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

202 Requests

94 %HTTPS

29 %IPv6

54 Domains

82 Subdomains

67 IPs

3 Countries

3802 kBTransfer

13832 kBSize

92 Cookies

16 Outgoing links

Page URL History

Redirected requests

202 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.elfcosmetics.com Open in urlscan Pro
204.2.133.49 Public Scan

Screenshot
Live screenshot

Full Image

202
Requests

94 %
HTTPS

29 %
IPv6

54
Domains

82
Subdomains

67
IPs

3
Countries

3802 kB
Transfer

13832 kB
Size

92
Cookies

202 HTTP transactions
3 data transactions