chwpromoonline.com Open in urlscan Pro
146.20.84.216 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ejf8rjks.com/4RQSJ/3B8HKJ/?sub1=8203&sub2=8edfc32ffc344c1389f8c305069a8dd0&sub5=
Effective URL:
https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_se...
Submission: On October 27 via api (October 27th 2024, 6:27:36 am UTC) from US — Scanned from US

Summary HTTP 77 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 30 IPs in 2 countries across 24 domains to perform 77 HTTP transactions. The main IP is 146.20.84.216, located in United States and belongs to RACKSPACE, US. The main domain is chwpromoonline.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 18th 2024. Valid for: a year.

This is the only time chwpromoonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.120.129.26 34.120.129.26	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	172.67.213.89 172.67.213.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
23	146.20.84.216 146.20.84.216	27357 (RACKSPACE) (RACKSPACE)
5	2607:f8b0:400... 2607:f8b0:4006:816::2008	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80e::200a	15169 (GOOGLE) (GOOGLE)
1	142.250.80.2 142.250.80.2	15169 (GOOGLE) (GOOGLE)
1	18.173.132.125 18.173.132.125	16509 (AMAZON-02) (AMAZON-02)
1	108.139.33.128 108.139.33.128	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4006:823::200e	15169 (GOOGLE) (GOOGLE)
2	142.250.65.227 142.250.65.227	15169 (GOOGLE) (GOOGLE)
2	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80b::2008	15169 (GOOGLE) (GOOGLE)
3	142.250.65.164 142.250.65.164	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:81c::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::181	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c1b::9b	15169 (GOOGLE) (GOOGLE)
2	31.13.67.20 31.13.67.20	32934 (FACEBOOK) (FACEBOOK)
1	52.92.206.0 52.92.206.0	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:33::10 2620:1ec:33::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	3.168.71.9 3.168.71.9	16509 (AMAZON-02) (AMAZON-02)
1 5	35.227.244.1 35.227.244.1	15169 (GOOGLE) (GOOGLE)
3	2600:9000:284... 2600:9000:2840:8600:d:370a:51c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	98.82.157.137 98.82.157.137	14618 (AMAZON-AES) (AMAZON-AES)
6	104.18.41.49 104.18.41.49	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f12... 2a03:2880:f12c:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2600:9000:23c... 2600:9000:23cb:da00:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:1f18:730... 2600:1f18:730:b150:d702:ffce:b7d0:e69a	14618 (AMAZON-AES) (AMAZON-AES)
1	3.213.66.168 3.213.66.168	14618 (AMAZON-AES) (AMAZON-AES)
1 2	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1	3.5.11.141 3.5.11.141	14618 (AMAZON-AES) (AMAZON-AES)
1	35.190.54.17 35.190.54.17	15169 (GOOGLE) (GOOGLE)
1	75.2.91.175 75.2.91.175	16509 (AMAZON-02) (AMAZON-02)
77	30

1 34.120.129.26 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 26.129.120.34.bc.googleusercontent.com

ejf8rjks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.213.89 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tracksecuresite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 146.20.84.216 (United States)

ASN27357 (RACKSPACE, US)

chwpromoonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.chwplan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:816::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80e::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.80.2 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s33-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.132.125 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-132-125.jfk52.r.cloudfront.net

cdn.datasteam.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.33.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-33-128.jfk50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:823::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.65.227 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.40.130 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80b::2008 (United States)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.65.164 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81c::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1b::9b (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.67.20 (Boca Raton, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-mia3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.92.206.0 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2.amazonaws.com

s3-us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.168.71.9 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-168-71-9.jfk50.r.cloudfront.net

cdn.listrakbi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.227.244.1 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 1.244.227.35.bc.googleusercontent.com

shop.pe	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.shop.pe	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
manage.safeopt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2840:8600:d:370a:51c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

d2mjzob2nc713b.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 98.82.157.137 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-98-82-157-137.compute-1.amazonaws.com

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.18.41.49 (None, )

ASN13335 (CLOUDFLARENET, US)

s1.listrakbi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
at1.listrakbi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sca1.listrakbi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12c:83:face:b00c:0:25de (Boca Raton, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:23cb:da00:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b150:d702:ffce:b7d0:e69a (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.213.66.168 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-66-168.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.197.193.217 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.5.11.141 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: s3-1-w.amazonaws.com

addshoppers.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.54.17 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 17.54.190.35.bc.googleusercontent.com

shopper.shop.pe	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 75.2.91.175 (United States)

ASN16509 (AMAZON-02, US)
PTR: a954c1fc80b8251dc.awsglobalaccelerator.com

nytrng.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	chwpromoonline.com chwpromoonline.com	1 MB
7	listrakbi.com cdn.listrakbi.com — Cisco Umbrella Rank: 12007 s1.listrakbi.com — Cisco Umbrella Rank: 12980 at1.listrakbi.com — Cisco Umbrella Rank: 13398 sca1.listrakbi.com — Cisco Umbrella Rank: 46125	27 KB
5	shop.pe 1 redirects shop.pe — Cisco Umbrella Rank: 12983 shopper.shop.pe — Cisco Umbrella Rank: 15450 app.shop.pe — Cisco Umbrella Rank: 14668	11 KB
5	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 td.doubleclick.net — Cisco Umbrella Rank: 192 stats.g.doubleclick.net — Cisco Umbrella Rank: 136	5 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	455 KB
4	google.com www.google.com — Cisco Umbrella Rank: 3 analytics.google.com — Cisco Umbrella Rank: 147	128 B
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34 ssl.google-analytics.com — Cisco Umbrella Rank: 927	39 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 3517 rp.liadm.com — Cisco Umbrella Rank: 925 rp4.liadm.com — Cisco Umbrella Rank: 5447	46 KB
3	cloudfront.net d2mjzob2nc713b.cloudfront.net	55 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 348	15 KB
3	adsrvr.org 1 redirects js.adsrvr.org — Cisco Umbrella Rank: 1442 insight.adsrvr.org — Cisco Umbrella Rank: 945 match.adsrvr.org — Cisco Umbrella Rank: 373	7 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	3 KB
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 352	950 B
2	amazonaws.com s3-us-west-2.amazonaws.com addshoppers.s3.amazonaws.com — Cisco Umbrella Rank: 18595	85 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	72 KB
2	gstatic.com fonts.gstatic.com	63 KB
2	tracksecuresite.com 1 redirects tracksecuresite.com	2 KB
1	nytrng.com nytrng.com — Cisco Umbrella Rank: 6726
1	safeopt.com manage.safeopt.com — Cisco Umbrella Rank: 23869	837 B
1	datasteam.io cdn.datasteam.io — Cisco Umbrella Rank: 21549	22 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 89	20 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	1 KB
1	chwplan.com www.chwplan.com	62 KB
1	ejf8rjks.com 1 redirects ejf8rjks.com	921 B
77	24

	Domain	Requested by
22	chwpromoonline.com	tracksecuresite.com chwpromoonline.com
5	www.googletagmanager.com	chwpromoonline.com www.googletagmanager.com
4	at1.listrakbi.com	cdn.listrakbi.com
3	d2mjzob2nc713b.cloudfront.net	chwpromoonline.com shop.pe
3	shop.pe	1 redirects d2mjzob2nc713b.cloudfront.net
3	bat.bing.com	chwpromoonline.com bat.bing.com
3	www.google.com	www.googletagmanager.com chwpromoonline.com
2	www.facebook.com	chwpromoonline.com
2	s.amazon-adsystem.com	1 redirects chwpromoonline.com
2	connect.facebook.net	chwpromoonline.com connect.facebook.net
2	td.doubleclick.net	www.googletagmanager.com
2	ssl.google-analytics.com	chwpromoonline.com
2	googleads.g.doubleclick.net	www.googleadservices.com www.googletagmanager.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	tracksecuresite.com	1 redirects
1	nytrng.com	d2mjzob2nc713b.cloudfront.net
1	manage.safeopt.com	shopper.shop.pe
1	app.shop.pe	d2mjzob2nc713b.cloudfront.net
1	shopper.shop.pe	shop.pe
1	addshoppers.s3.amazonaws.com	d2mjzob2nc713b.cloudfront.net
1	match.adsrvr.org	js.adsrvr.org
1	insight.adsrvr.org	1 redirects
1	rp4.liadm.com	chwpromoonline.com
1	rp.liadm.com	1 redirects
1	b-code.liadm.com	s3-us-west-2.amazonaws.com
1	sca1.listrakbi.com	chwpromoonline.com
1	s1.listrakbi.com	cdn.listrakbi.com
1	cdn.listrakbi.com	chwpromoonline.com
1	s3-us-west-2.amazonaws.com	chwpromoonline.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	js.adsrvr.org	chwpromoonline.com
1	cdn.datasteam.io	chwpromoonline.com
1	www.googleadservices.com	chwpromoonline.com
1	fonts.googleapis.com	chwpromoonline.com
1	www.chwplan.com	chwpromoonline.com
1	ejf8rjks.com	1 redirects
77	38

This site contains links to these domains. Also see Links.

Domain
www.choicehomewarranty.com

Subject Issuer	Validity	Valid
tracksecuresite.com WE1	`2024-10-08` - `2025-01-06`	3 months	crt.sh
chwplan.com Go Daddy Secure Certificate Authority - G2	`2024-03-18` - `2025-04-19`	a year	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.googleadservices.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
cdn.datasteam.io Amazon RSA 2048 M02	`2024-07-19` - `2025-08-16`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2024-04-23` - `2025-05-25`	a year	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-05` - `2024-11-03`	3 months	crt.sh
*.s3-us-west-2.amazonaws.com Amazon RSA 2048 M01	`2024-09-14` - `2025-08-29`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.listrakbi.com Amazon RSA 2048 M03	`2023-12-08` - `2025-01-03`	a year	crt.sh
s.amazon-adsystem.com Amazon RSA 2048 M01	`2024-04-24` - `2025-04-17`	a year	crt.sh
listrakbi.com E6	`2024-10-10` - `2025-01-08`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
*.liadm.com Amazon RSA 2048 M03	`2023-12-02` - `2024-12-29`	a year	crt.sh
*.shop.pe GlobeSSL DV CA	`2024-06-13` - `2025-06-13`	a year	crt.sh
*.s3.amazonaws.com Amazon RSA 2048 M01	`2024-04-22` - `2025-04-07`	a year	crt.sh
*.safeopt.com GlobeSSL DV CA	`2024-05-17` - `2025-06-14`	a year	crt.sh
nytrng.com Amazon RSA 2048 M03	`2024-02-23` - `2025-03-23`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Frame ID: 60F45815F327EC448474B2E312D5F9EF
Requests: 71 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/1038983633?random=1730010448487&cv=11&fst=1730010448487&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ao0v9100724500za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848&u_w=1600&u_h=1200&url=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&hn=www.googleadservices.com&frm=0&tiba=Choice%20Home%20Warranty&npa=0&pscdl=noapi&auid=2129283443.1730010448&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: 2C7BF3243EFD1AFA9D21B01DE31EDF25
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-9X781FPXLE&gacid=751981518.1730010449&gtm=45be4ao0v9100724500za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101823848&z=764989319
Frame ID: 0D4F104AD227399E961E8675ED53E085
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fchwpromoonline.com
Frame ID: AEBB9CEB1DE41FA379CD6FC0ACC5634F
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?d=generic&ex-fargs=%3Fid%3D3b289a46-9b76-58a9-88f0-c89b1606534d%26type%3D82%26m%3D1&ex-fch=416613&ex-src=https://www.choicehomewarranty.com/&ex-hargs=v%3D1.0%3Bc%3D6293635390601%3Bp%3D3B289A46-9B76-58A9-88F0-C89B1606534D&cb=126615541940968690&dcc=t
Frame ID: 813819771DCD1922EC7B4FCD760A4361
Requests: 1 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/upb/?adv=zl9kfqh1&ref=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&upid=7h0r1mr&upv=1.1.0&paapi=1
Frame ID: D64A3CA6FF32218EA9A8239629321515
Requests: 1 HTTP requests in this frame

Frame: https://nytrng.com/iframe?vcp=4dd5h0np&as_id=613182124050461884f9998003f27502
Frame ID: BBB95CE0403BA983675C7362CEFB8D0C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Choice Home Warranty

Page URL History Show full URLs

https://ejf8rjks.com/4RQSJ/3B8HKJ/?sub1=8203&sub2=8edfc32ffc344c1389f8c305069a8dd0&sub5= HTTP 302
https://tracksecuresite.com/?flux_fts=qxtitiiipioxltztctletcoozizocqilciitpila7a9d&flux_fn=2314144526189... Page URL
https://tracksecuresite.com/index.php?flux_mrurl=68747470733a2f2f63687770726f6d6f6f6e6c696e652e636f6d2f6... HTTP 307
https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

77
Requests

97 %
HTTPS

38 %
IPv6

24
Domains

38
Subdomains

30
IPs

2
Countries

2025 kB
Transfer

3652 kB
Size

85
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.choicehomewarranty.com/privacy-policy/
Title: Click here

Search URL Search Domain Scan URL

URL: https://www.choicehomewarranty.com/user_agreement.php
Title: Click Here

Search URL Search Domain Scan URL

URL: https://www.choicehomewarranty.com/privacy_policy.php
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.choicehomewarranty.com/homeowners/california-residents/
Title: Click Here

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ejf8rjks.com/4RQSJ/3B8HKJ/?sub1=8203&sub2=8edfc32ffc344c1389f8c305069a8dd0&sub5= HTTP 302
https://tracksecuresite.com/?flux_fts=qxtitiiipioxltztctletcoozizocqilciitpila7a9d&flux_fn=2314144526189006505&click_id=afa12f2ef8c74a4cbd678ea37c92b99b&utm_source=aff_3&utm_campaign=ef_47&utm_medium=8203&utm_term=&utm_content=&pid=b4641&creative=873&azip= Page URL
https://tracksecuresite.com/index.php?flux_mrurl=68747470733a2f2f63687770726f6d6f6f6e6c696e652e636f6d2f612f613136382f696e6465782e7068703f75746d5f736f757263653d65666c736e2675746d5f63616d706169676e3d3837335f623436343126746f6b656e3d3233333030363235343833383930363532303626417a69703d&flux_mrcntr=1 HTTP 307
https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://ejf8rjks.com/4RQSJ/3B8HKJ/?sub1=8203&sub2=8edfc32ffc344c1389f8c305069a8dd0&sub5= HTTP 302
https://tracksecuresite.com/?flux_fts=qxtitiiipioxltztctletcoozizocqilciitpila7a9d&flux_fn=2314144526189006505&click_id=afa12f2ef8c74a4cbd678ea37c92b99b&utm_source=aff_3&utm_campaign=ef_47&utm_medium=8203&utm_term=&utm_content=&pid=b4641&creative=873&azip=

Request Chain 48

https://shop.pe/widget/widget_async.js HTTP 301
https://d2mjzob2nc713b.cloudfront.net/widget/widget_async.js

Request Chain 49

https://s.amazon-adsystem.com/iu3?d=generic&ex-fargs=%3Fid%3D3b289a46-9b76-58a9-88f0-c89b1606534d%26type%3D82%26m%3D1&ex-fch=416613&ex-src=https://www.choicehomewarranty.com/&ex-hargs=v%3D1.0%3Bc%3D6293635390601%3Bp%3D3B289A46-9B76-58A9-88F0-C89B1606534D&cb=126615541940968690 HTTP 302
https://s.amazon-adsystem.com/iu3?d=generic&ex-fargs=%3Fid%3D3b289a46-9b76-58a9-88f0-c89b1606534d%26type%3D82%26m%3D1&ex-fch=416613&ex-src=https://www.choicehomewarranty.com/&ex-hargs=v%3D1.0%3Bc%3D6293635390601%3Bp%3D3B289A46-9B76-58A9-88F0-C89B1606534D&cb=126615541940968690&dcc=t

Request Chain 66

https://rp.liadm.com/j?dtstmp=1730010449709&se=e30&duid=13e8cbd54e95--01jb6ah1nkssx47dtmvcv5rfdm&tv=v3.3.1&pu=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&wpn=lc-bundle&wpv=v3.3.1&cd=.chwpromoonline.com&pv=3263ce73-fb1a-4c12-9283-ae016f8ed1c9 HTTP 302
https://rp4.liadm.com/j?dtstmp=1730010449709&se=e30&duid=13e8cbd54e95--01jb6ah1nkssx47dtmvcv5rfdm&tv=v3.3.1&pu=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&wpn=lc-bundle&wpv=v3.3.1&cd=.chwpromoonline.com&pv=3263ce73-fb1a-4c12-9283-ae016f8ed1c9&i6=MjAwMTo1NTA6MWQwNToxOjo4&n3pc=true

Request Chain 67

https://insight.adsrvr.org/track/up?adv=zl9kfqh1&ref=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&upid=7h0r1mr&upv=1.1.0&paapi=1 HTTP 302
https://match.adsrvr.org/track/upb/?adv=zl9kfqh1&ref=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&upid=7h0r1mr&upv=1.1.0&paapi=1

77 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

/ Show response
tracksecuresite.com/
Redirect Chain

https://ejf8rjks.com/4RQSJ/3B8HKJ/?sub1=8203&sub2=8edfc32ffc344c1389f8c305069a8dd0&sub5=
https://tracksecuresite.com/?flux_fts=qxtitiiipioxltztctletcoozizocqilciitpila7a9d&flux_fn=2314144526189006505&click_id=afa12f2ef8c74a4cbd678ea37c92b99b&utm_source=aff_3&utm_campaign=ef_47&utm_medi...

802 B
1 KB

500ms
310ms

Document
text/html

172.67.213.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracksecuresite.com/?flux_fts=qxtitiiipioxltztctletcoozizocqilciitpila7a9d&flux_fn=2314144526189006505&click_id=afa12f2ef8c74a4cbd678ea37c92b99b&utm_source=aff_3&utm_campaign=ef_47&utm_medium=8203&utm_term=&utm_content=&pid=b4641&creative=873&azip=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.213.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.14
Resource Hash: 13a41894df863c6d10c3b75b86d63d4fd975b89ad4517f1377118a78effdabd2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8d909ecb8fda4982-MIA
content-encoding: br
content-type: text/html; charset=utf-8
date: Sun, 27 Oct 2024 06:27:26 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
p3p: CP="This is not a P3P policy"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gTPGldhnITjcvFhAWopbAvinwzyFwuhTMB0C8sfKj%2B%2BWRKIFG1AyGk7nGHGwLV4GzcJtTpvy2%2BCMwdrb5QaJgoyoxfK4uw6iXgLUKHTY8CO7atZVkgphE3gVhysF2WrQVu3sda6e"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=30854&sent=13&recv=11&lost=0&retrans=0&sent_bytes=4219&recv_bytes=4705&delivery_rate=505&cwnd=12000&unsent_bytes=0&cid=c1680757f10ace4f&ts=452&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding
x-powered-by: PHP/7.3.14
x-robots-tag: noindex, noarchive, nofollow

Redirect headers

accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 319
content-type: text/html; charset=utf-8
date: Sun, 27 Oct 2024 06:27:26 GMT
location: https://tracksecuresite.com/?flux_fts=qxtitiiipioxltztctletcoozizocqilciitpila7a9d&flux_fn=2314144526189006505&click_id=afa12f2ef8c74a4cbd678ea37c92b99b&utm_source=aff_3&utm_campaign=ef_47&utm_medium=8203&utm_term=&utm_content=&pid=b4641&creative=873&azip=
server: nginx
vary: Origin
via: 1.1 google
x-eflow-request-id: 0749907d-0645-4844-a642-4c9a4c59646e

GET
H/1.1

200
OK

Primary Request index.php Show response
chwpromoonline.com/a/a168/
Redirect Chain

https://tracksecuresite.com/index.php?flux_mrurl=68747470733a2f2f63687770726f6d6f6f6e6c696e652e636f6d2f612f613136382f696e6465782e7068703f75746d5f736f757263653d65666c736e2675746d5f63616d706169676e3d...
https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

61 KB
61 KB

300ms
81ms

Document
text/html

146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Requested by: Host: tracksecuresite.com
URL: https://tracksecuresite.com/?flux_fts=qxtitiiipioxltztctletcoozizocqilciitpila7a9d&flux_fn=2314144526189006505&click_id=afa12f2ef8c74a4cbd678ea37c92b99b&utm_source=aff_3&utm_campaign=ef_47&utm_medium=8203&utm_term=&utm_content=&pid=b4641&creative=873&azip=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 0acdf283dd239ced8e5c50cead47768ff1d852fb2c639c3517a1e8fb0ee50c5b

Request headers

Referer: https://tracksecuresite.com/?flux_fts=qxtitiiipioxltztctletcoozizocqilciitpila7a9d&flux_fn=2314144526189006505&click_id=afa12f2ef8c74a4cbd678ea37c92b99b&utm_source=aff_3&utm_campaign=ef_47&utm_medium=8203&utm_term=&utm_content=&pid=b4641&creative=873&azip=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Sun, 27 Oct 2024 06:27:27 GMT
Keep-Alive: timeout=5, max=96
Server: Apache
Transfer-Encoding: chunked

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8d909ece89634982-MIA
content-type: text/html; charset=utf-8
date: Sun, 27 Oct 2024 06:27:27 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
p3p: CP="This is not a P3P policy"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jFf9QvOsV2YDgYJ0vSEnBLFWPc7Gw%2Fn3X5wLZ9Qhz%2BWw4J4tiqCZG9j7K9tO3B4Abzydm3buMXhrXG3KLRp2Tjsgu0IBWhHCD4uU4iUzMhncEPwdgpvxHLzmk83G2S%2BSlCtvNVVl"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=30750&sent=16&recv=13&lost=0&retrans=0&sent_bytes=5643&recv_bytes=5380&delivery_rate=46624&cwnd=12000&unsent_bytes=0&cid=c1680757f10ace4f&ts=794&x=1" cfExtPri cfHdrFlush;dur=0
x-powered-by: PHP/7.3.14
x-robots-tag: noindex, noarchive, nofollow

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 221 KB
79 KB 368ms
93ms Script
application/javascript 2607:f8b0:4006:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-6898183-1

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e503215e8213b8dfe8d6d372c11ca269ea09ed556e84ec52cf1a1e2fc586e89d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sun, 27 Oct 2024 06:27:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 06:27:27 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 27 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 80582
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 386 KB
125 KB 463ms
189ms Script
application/javascript 2607:f8b0:4006:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1038983633

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fcbbc0ec322cfe873b66364b15141edfd799775274eec256e326ce881988a6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sun, 27 Oct 2024 06:27:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 06:27:27 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 128102
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK bootstrap.min.css
chwpromoonline.com/a/a168/bootstrap/css/ 119 KB
119 KB 109ms
63ms Stylesheet
text/css 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://chwpromoonline.com/a/a168/bootstrap/css/bootstrap.min.css
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: edd03ab3a1f8f4fee1f13400764eaa7de9b4ec3da31a2de7f2a5a40e2ea181a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "1da10-5d9f67f088400"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 121360
Keep-Alive: timeout=5, max=96
Date: Sun, 27 Oct 2024 06:27:27 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:00 GMT
Content-Type: text/css
Server: Apache

GET
H/1.1 200
OK font-awesome.css
chwpromoonline.com/a/a168/bootstrap/css/ 22 KB
22 KB 184ms
65ms Stylesheet
text/css 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://chwpromoonline.com/a/a168/bootstrap/css/font-awesome.css
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 52b860bf171d4c3ddb8c50fe9b1cf48cd6337c07f0b111788d7ba34aad733299

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "58b3-5d9f67f088400"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 22707
Keep-Alive: timeout=5, max=100
Date: Sun, 27 Oct 2024 06:27:27 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:00 GMT
Content-Type: text/css
Server: Apache

GET
H/1.1 200
OK style.css
chwpromoonline.com/a/a168/css/ 3 KB
3 KB 192ms
60ms Stylesheet
text/css 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://chwpromoonline.com/a/a168/css/style.css?1730010447
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: f3a974df6314eccf6bafadf8a8008e1b9c5e4686688f862c6a4e866f20725d72

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "a2b-5d9f67f458d00"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 2603
Keep-Alive: timeout=5, max=99
Date: Sun, 27 Oct 2024 06:27:27 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:04 GMT
Content-Type: text/css
Server: Apache

GET
H/1.1 200
OK jquery-1.11.1.min.js Show response
chwpromoonline.com/a/a168/bootstrap/js/ 94 KB
94 KB 197ms
65ms Script
application/javascript 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://chwpromoonline.com/a/a168/bootstrap/js/jquery-1.11.1.min.js
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "1762a-5d9f67f270880"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 95786
Keep-Alive: timeout=5, max=100
Date: Sun, 27 Oct 2024 06:27:27 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:02 GMT
Content-Type: application/javascript
Server: Apache

GET
H/1.1 200
OK masked.min.js Show response
www.chwplan.com/jsinc/ 62 KB
62 KB 408ms
60ms Script
application/javascript 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.chwplan.com/jsinc/masked.min.js
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: ee5e6f24e63a934667e065cf35fa4cdb9a1ec3391da17621c3994fdb63bb82ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

ETag: "f85d-568e1785f6000"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 63581
Keep-Alive: timeout=5, max=97
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Mon, 02 Apr 2018 18:08:00 GMT
Content-Type: application/javascript
Server: Apache

GET
H2 200 css
fonts.googleapis.com/ 7 KB
1 KB 372ms
94ms Stylesheet
text/css 2607:f8b0:4006:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Ubuntu:400,500,700,300

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

08178536ea61e2b2662caaf4ff39393f016e6154f4c59ed2d660008bd5aabde0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sun, 27 Oct 2024 06:27:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 06:27:27 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sun, 27 Oct 2024 06:21:16 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H/1.1 200
OK logo2.png
chwpromoonline.com/a/a168/images/ 15 KB
15 KB 190ms
61ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/logo2.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 79270dfeec80a9831db892c6afa6203afcfcbe58fb78d76c6b610b9b79a45739

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "3a67-5d9f67f54cf40"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 14951
Keep-Alive: timeout=5, max=100
Date: Sun, 27 Oct 2024 06:27:27 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:05 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK icon1.png
chwpromoonline.com/a/a168/images/ 15 KB
16 KB 157ms
66ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/icon1.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 4540fe3d85b175ac7c0272025c164aee14f38b34d5515d35591fe752eeab7780

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "3cf8-5d9f67f54cf40"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 15608
Keep-Alive: timeout=5, max=100
Date: Sun, 27 Oct 2024 06:27:27 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:05 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK icon2.png
chwpromoonline.com/a/a168/images/ 15 KB
15 KB 62ms
61ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/icon2.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 688aa4443fd103dd4eba9512fbd4a0ff2c47b8ebbd4b8c8d4aaef45f4e4f48b0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "3a92-5d9f67f54cf40"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 14994
Keep-Alive: timeout=5, max=98
Date: Sun, 27 Oct 2024 06:27:27 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:05 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK icon3.png
chwpromoonline.com/a/a168/images/ 21 KB
21 KB 66ms
66ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/icon3.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: f30bf2284e7872587d6aa890cc2611f01e4be6a2fcfdc0003d63c6fa137745c7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "5233-5d9f67f54cf40"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 21043
Keep-Alive: timeout=5, max=99
Date: Sun, 27 Oct 2024 06:27:27 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:05 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK repair_b.png
chwpromoonline.com/a/a168/images/ 28 KB
28 KB 62ms
62ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/repair_b.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 342f64eee8020ed8ccd8c957c7c3442acc3fd585a200470edfcd199549a1eae9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "6e3f-5d9f67f641180"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 28223
Keep-Alive: timeout=5, max=99
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:06 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK replace_b.png
chwpromoonline.com/a/a168/images/ 145 KB
145 KB 63ms
61ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/replace_b.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 81a3487cf49a66c946a642f19c8f0a0d0484c49958d22f13d803f148f635039d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "243ad-5d9f67f641180"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 148397
Keep-Alive: timeout=5, max=98
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:06 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK 24_b.png
chwpromoonline.com/a/a168/images/ 30 KB
30 KB 64ms
63ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/24_b.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 55b90523aabe14478d4e85de11038ffe927f92a520b2ff59907f5a6755f0df8f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "78c2-5d9f67f458d00"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30914
Keep-Alive: timeout=5, max=98
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:04 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK jquery.validate.js Show response
chwpromoonline.com/a/a168/ 38 KB
39 KB 64ms
63ms Script
application/javascript 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://chwpromoonline.com/a/a168/jquery.validate.js
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 93f6ce56be9b5d1cc8f0462801eebf1f4612ed1c5e9e0a389072c7b3fabee5b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "999b-5d9f67f641180"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 39323
Keep-Alive: timeout=5, max=99
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:06 GMT
Content-Type: application/javascript
Server: Apache

GET
H3 200 conversion.js Show response
www.googleadservices.com/pagead/ 57 KB
20 KB 169ms
85ms Script
text/javascript 142.250.80.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.2 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f2.1e100.net

Software

cafe /

Resource Hash

3a1ae68d835d095297598e1964665fed616649a20fd7d3bfdc6a97c9b468acd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: br
etag: 9483358020438696386
x-content-type-options: nosniff
expires: Sun, 27 Oct 2024 06:27:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 27 Oct 2024 06:27:28 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 20936
x-xss-protection: 0
server: cafe

GET
H2 200 D24328ECFA2D48.js Show response
cdn.datasteam.io/js/ 66 KB
22 KB 204ms
62ms Script
application/x-javascript 18.173.132.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.datasteam.io/js/D24328ECFA2D48.js
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-125.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 39c8bdb9694291eda332da1eb381a58e84c9caf3f8f8955f1f9146b378497d59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=600,s-maxage=86400
content-encoding: gzip
etag: W/"9ba2519f53ca4890ea3f130d425fb226"
age: 63390
via: 1.1 1dbafa627b28576f280c85d24d02a0c2.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: zW5OT6BV9mLY5Es3Aey_jBM6E-qvBlYwAkaBqM3Mf-9Mp4kobSDMoA==
date: Sat, 26 Oct 2024 12:50:59 GMT
content-type: application/x-javascript
last-modified: Sat, 11 May 2024 11:30:42 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 15 KB
6 KB 462ms
320ms Script
application/x-javascript 108.139.33.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.33.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-33-128.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9418fabfb9e44d2e317c49c500d1f19c42ce6c8cf5b48197f78da3fa6015077b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

Transfer-Encoding: chunked
Vary: accept-encoding
Content-Encoding: gzip
ETag: W/"22ee89684eccfa7a3bff28d78c22ff4b"
Age: 32301
Connection: keep-alive
Via: 1.1 fdc88b576635a6d1858343ad162c44fc.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: du9evVUwVSDwxPv515FpWepKllrocX4rBV_19KzgR6KThAciyjvEtw==
Date: Sat, 26 Oct 2024 21:29:08 GMT
Content-Type: application/x-javascript
Last-Modified: Thu, 24 Oct 2024 21:26:22 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK50-P2
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 386 KB
125 KB 154ms
153ms Script
application/javascript 2607:f8b0:4006:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-9X781FPXLE&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-6898183-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1a28fc1b5bfdd6c64cc2fdfb785f8051ff221976ef98a0ffcdb3356a9cc5d6f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sun, 27 Oct 2024 06:27:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 06:27:28 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 127965
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 465ms
60ms Script
text/javascript 2607:f8b0:4006:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-6898183-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: gzip
age: 3624
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sun, 27 Oct 2024 07:27:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 05:27:04 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 386 KB
125 KB 150ms
149ms Script
application/javascript 2607:f8b0:4006:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1038983633&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-6898183-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2a740b239284a1a62c426623f3095acb1b10c220be6abf9864cc0d0fb1960209

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sun, 27 Oct 2024 06:27:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 06:27:28 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 128023
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK promo_header_a.png
chwpromoonline.com/a/a168/images/ 33 KB
34 KB 263ms
262ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/promo_header_a.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: f8ddd991c09bb40c08dfe2d04fbc0853a6062f07f23f0b83a72c1347bd00c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "8526-62255d232ccdc"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 34086
Keep-Alive: timeout=5, max=97
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Tue, 17 Sep 2024 19:37:34 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK bg5.jpg
chwpromoonline.com/a/a168/images/ 256 KB
257 KB 262ms
261ms Image
image/jpeg 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/bg5.jpg
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: a86d546ba4f21408943105cf3fd3d38fd881777babe0a96936fa7d22cfc13ea2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "4019f-5d9f67f458d00"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 262559
Keep-Alive: timeout=5, max=98
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:04 GMT
Content-Type: image/jpeg
Server: Apache

GET
H/1.1 200
OK espn.png
chwpromoonline.com/a/a168/images/ 17 KB
18 KB 260ms
260ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/espn.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 90dc1edaca43e2e886e6e556485fa4f2d9bbb86193f9d8d6b3b1b5b087bb140c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "4586-5d9f67f458d00"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 17798
Keep-Alive: timeout=5, max=96
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:04 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK fox.png
chwpromoonline.com/a/a168/images/ 18 KB
19 KB 260ms
258ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/fox.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: d3573cda52041247cfe2bec3dd48b363196a581a5aa0686f6cd74a5f96bb090f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "49cc-5d9f67f54cf40"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 18892
Keep-Alive: timeout=5, max=96
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:05 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK tvland.png
chwpromoonline.com/a/a168/images/ 18 KB
18 KB 61ms
61ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/tvland.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 10bef3f85822237893d33ac7eed079f59191bf1457d08309401afc43a1902d50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "47a3-5d9f67f641180"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 18339
Keep-Alive: timeout=5, max=97
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:06 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK lifetime.png
chwpromoonline.com/a/a168/images/ 16 KB
17 KB 559ms
59ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/lifetime.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 6d97fccd01135ed97a465ce2d65e3d5993c7b240b06a7638b3fec90424f6252a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "41bd-5d9f67f54cf40"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 16829
Keep-Alive: timeout=5, max=97
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:05 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK universalhd.png
chwpromoonline.com/a/a168/images/ 18 KB
19 KB 383ms
238ms Image
image/png 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chwpromoonline.com/a/a168/images/universalhd.png
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: ec286d9204d650f3688680ab7df9b05406c4baddb997cf762d2fedd7b5084365

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "49b3-5d9f67f641180"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 18867
Keep-Alive: timeout=5, max=96
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:06 GMT
Content-Type: image/png
Server: Apache

GET
H3 200 4iCv6KVjbNBYlgoCxCvjsGyN.woff2
fonts.gstatic.com/s/ubuntu/v20/ 29 KB
29 KB 142ms
63ms Font
font/woff2 142.250.65.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjsGyN.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu:400,500,700,300

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.227 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f3.1e100.net

Software

sffe /

Resource Hash

7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://chwpromoonline.com
Referer: https://fonts.googleapis.com/

Response headers

age: 393118
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 17:15:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 17:15:30 GMT
last-modified: Wed, 27 Apr 2022 17:05:11 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 29752
x-xss-protection: 0
server: sffe

GET
H3 200 4iCs6KVjbNBYlgoKfw72.woff2
fonts.gstatic.com/s/ubuntu/v20/ 34 KB
34 KB 146ms
68ms Font
font/woff2 142.250.65.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu:400,500,700,300

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.227 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f3.1e100.net

Software

sffe /

Resource Hash

7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://chwpromoonline.com
Referer: https://fonts.googleapis.com/

Response headers

age: 311255
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 15:59:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 15:59:53 GMT
last-modified: Wed, 27 Apr 2022 16:31:23 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34852
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK fontawesome-webfont.woff
chwpromoonline.com/a/a168/bootstrap/fonts/ 43 KB
44 KB 114ms
67ms Font
font/woff 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://chwpromoonline.com/a/a168/bootstrap/fonts/fontawesome-webfont.woff?v=4.0.1
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/bootstrap/css/font-awesome.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: c151a7e68aedc7bd4d84cb2096e92ee2f055c16be01c2ba027acd38b6cc9d52a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://chwpromoonline.com
Referer: https://chwpromoonline.com/a/a168/bootstrap/css/font-awesome.css

Response headers

Cache-Control: max-age=31536000
ETag: "adbc-5d9f67f17c640"
Connection: Keep-Alive
Expires: Mon, 27 Oct 2025 06:27:28 GMT
Accept-Ranges: bytes
Content-Length: 44476
Keep-Alive: timeout=5, max=95
Date: Sun, 27 Oct 2024 06:27:28 GMT
Last-Modified: Fri, 11 Mar 2022 19:40:01 GMT
Content-Type: font/woff
Server: Apache

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1038983633/ 5 KB
2 KB 226ms
81ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1038983633/?random=1730010448305&cv=9&fst=1730010448305&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=376635470%2C375603260%2C466465925%2C512247838&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=-600&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&tiba=Choice%20Home%20Warranty&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

f52cad459520ec61b1813b4de63855696e880996d543846f1aea8a593cb48c64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2383
date: Sun, 27 Oct 2024 06:27:28 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 209ms
61ms Script
text/javascript 2607:f8b0:4006:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://chwpromoonline.com/

Response headers

content-encoding: gzip
age: 4824
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:215:0"}],}
x-content-type-options: nosniff
expires: Sun, 27 Oct 2024 07:07:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 05:07:04 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:215:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 17168
server: Golfe2

POST
H3 200 collect
www.google.com/ccm/ 0
0 224ms
82ms Ping
text/html 142.250.65.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php&scrsrc=www.googletagmanager.com&frm=0&rnd=1227008349.1730010448&auid=2129283443.1730010448&npa=0&gtm=45be4ao0v9100724500za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848&tft=1730010448496&tfd=1388&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1038983633
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.65.164 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s71-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1038983633/ 5 KB
2 KB 87ms
85ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1038983633/?random=1730010448487&cv=11&fst=1730010448487&bg=ffffff&guid=ON&async=1&gtm=45be4ao0v9100724500za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848&u_w=1600&u_h=1200&url=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&hn=www.googleadservices.com&frm=0&tiba=Choice%20Home%20Warranty&npa=0&pscdl=noapi&auid=2129283443.1730010448&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1038983633

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

e7dd8521bf129d77379963dc1cdff39625a29a319b40f7f80ae3276361b2178e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2440
date: Sun, 27 Oct 2024 06:27:28 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 1038983633
td.doubleclick.net/td/rul/ Frame 2C7B 0
0 227ms
84ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/1038983633?random=1730010448487&cv=11&fst=1730010448487&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ao0v9100724500za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848&u_w=1600&u_h=1200&url=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&hn=www.googleadservices.com&frm=0&tiba=Choice%20Home%20Warranty&npa=0&pscdl=noapi&auid=2129283443.1730010448&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1038983633

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://chwpromoonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Oct 2024 06:27:28 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
analytics.google.com/g/ 0
0 231ms
79ms Fetch
text/plain 2001:4860:4802:32::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-9X781FPXLE&gtm=45be4ao0v9100724500za200&_p=1730010447662&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101823848&cid=751981518.1730010449&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1730010448&sct=1&seg=0&dl=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&dt=Choice%20Home%20Warranty&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1425
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1038983633
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://chwpromoonline.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 06:27:28 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
556 B 195ms
63ms Ping
text/plain 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-9X781FPXLE&cid=751981518.1730010449&gtm=45be4ao0v9100724500za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101533422~101823848
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1038983633
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://chwpromoonline.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 06:27:28 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 0D4F 0
0 199ms
81ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-9X781FPXLE&gacid=751981518.1730010449&gtm=45be4ao0v9100724500za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101823848&z=764989319

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1038983633

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://chwpromoonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Oct 2024 06:27:28 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame AEBB 0
0 187ms
61ms Document
text/html 2607:f8b0:4006:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fchwpromoonline.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1038983633

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 292547
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Wed, 23 Oct 2024 21:11:41 GMT
expires: Thu, 23 Oct 2025 21:11:41 GMT
last-modified: Mon, 21 Oct 2024 16:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 /
www.google.com/pagead/1p-user-list/1038983633/ 42 B
64 B 124ms
83ms Image
image/gif 142.250.65.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1038983633/?random=1730010448305&cv=9&fst=1730008800000&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=376635470%2C375603260%2C466465925%2C512247838&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=-600&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&tiba=Choice%20Home%20Warranty&hn=www.googleadservices.com&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnf60LujfmjhN_z5c14MDRWiDv9uXPKVA&random=1072828615&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.164 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 27 Oct 2024 06:27:28 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
410 B 76ms
74ms Image
image/gif 2607:f8b0:4006:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1560136143&utmhn=chwpromoonline.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Choice%20Home%20Warranty&utmhid=1695665285&utmr=-&utmp=%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&utmht=1730010448613&utmac=UA-6898183-1&utmcc=__utma%3D203466178.751981518.1730010449.1730010449.1730010449.1%3B%2B__utmz%3D203466178.1730010449.1.1.utmcsr%3Deflsn%7Cutmccn%3D873_b4641%7Cutmcmd%3D(not%2520set)%3B&utmjid=1580886221&utmredir=1&utmu=DAAAAAAAAAAAAAAAAAABAAAE~

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:169:0"}],}
x-content-type-options: nosniff
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:169:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 06:27:28 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
server: Golfe2

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 229 KB
58 KB 86ms
35ms Script
application/x-javascript 31.13.67.20
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.67.20 Boca Raton, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-mia3.fbcdn.net

Software

Resource Hash

eab9cbb1928a9de3ed2b7164ea7215b1ee0c9d7584d04aac97fe5b6798140c48

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-7BlHEHY3' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 27 Oct 2024 06:27:28 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-7BlHEHY3' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=33, rtx=0, c=23, mss=1232, tbw=4474, tp=9, tpl=0, uplat=3, ullat=-1
pragma: public
x-fb-debug: 8rFsMYEBVeZJNdWVqdFcfr97013Kfywd/dz8Z1i7P2pPOFJZ0G1RLv3g3GJ/FuV9TpRVsc03sDKIVF+m8dXQEQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 59722
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H/1.1 200
OK ge.js Show response
s3-us-west-2.amazonaws.com/jsstore/a/R18H13Y/ 84 KB
84 KB 394ms
157ms Script
application/javascript 52.92.206.0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-us-west-2.amazonaws.com/jsstore/a/R18H13Y/ge.js
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.92.206.0 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: c856760811d2a782cd995faeca206ab2120f3c4b5794be36132fe2b56860a295

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

x-amz-id-2: EoUN5BhX/vrE8H+IsRjIMD5yHzHHLo/a2tL1VrdN48e9yvliD3oOk56nRf739hbf5EKEV7KhwCw=
Cache-Control: max-age=2592000
ETag: "a0cd0fb4b78fa04c6c82aaee4be10c73"
x-amz-request-id: PK1HGG4Y90NWHVHJ
Expires: Sat, 16 Nov 2024 17:36:53 GMT
Accept-Ranges: bytes
Content-Length: 85845
Date: Sun, 27 Oct 2024 06:27:29 GMT
Last-Modified: Thu, 17 Oct 2024 17:36:54 GMT
Content-Type: application/javascript
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 183ms
56ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A1AAD44047DF42F1B100CCB08AC9B4D8 Ref B: MIAEDGE2510 Ref C: 2024-10-27T06:27:28Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Sun, 27 Oct 2024 06:27:28 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H/1.1 200
OK script.js Show response
cdn.listrakbi.com/scripts/ 71 KB
24 KB 254ms
96ms Script
text/javascript 3.168.71.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.listrakbi.com/scripts/script.js?m=3QgckfkNYGiq&v=1
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.71.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-71-9.jfk50.r.cloudfront.net
Software: cloudflare /
Resource Hash: d3e6414b4ec5d683c3bce39ff8668ad86ac82981a3247aea44e425d26a9fe7b0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
ETag: "ZLH5I2M9OutvqKJXWK3Sgw=="
X-Cache: RefreshHit from cloudfront
X-Amz-Cf-Id: yALh26KI1Eli4Eq1phpViAYa0mMgOlSQRzOsmiZsZgQn5d4S8NwQ5g==
Date: Sun, 27 Oct 2024 06:27:28 GMT
Content-Type: text/javascript; charset=utf-8
Last-Modified: Sun, 27 Oct 2024 04:01:34 GMT
Vary: Accept-Encoding
Cache-Control: no-store
Connection: keep-alive
Via: 1.1 a830c4d835a3be700150fe894f9bffd4.cloudfront.net (CloudFront)
CF-RAY: 8d9048f08e2a20bd-IAD
Accept-Ranges: bytes
Content-Length: 23897
X-Amz-Cf-Pop: JFK50-P9
Server: cloudflare

GET
H2

200

widget_async.js Show response
d2mjzob2nc713b.cloudfront.net/widget/
Redirect Chain

https://shop.pe/widget/widget_async.js
https://d2mjzob2nc713b.cloudfront.net/widget/widget_async.js

3 KB
2 KB

219ms
64ms

Script
application/javascript

2600:9000:2840:8600:d:370a:51c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2mjzob2nc713b.cloudfront.net/widget/widget_async.js
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: H2
Server: 2600:9000:2840:8600:d:370a:51c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d35dec674eeb6ea303b01dbb26c4cf819a50d4f59ca0d2db2ffc00e9cf6ff2ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: gzip
etag: "c8515978dc28108fed1b0a29960dbcde"
age: 2729
x-amz-meta-mtime: 1728414440.51
x-cache: Hit from cloudfront
x-amz-cf-id: eXOIqAAf5FGyRKoHcAzneo7bdNzFD0oUf8kTxn63jbETcPLQTAXXzw==
date: Sun, 27 Oct 2024 05:42:01 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 08 Oct 2024 19:07:23 GMT
cache-control: max-age=3600, public
via: 1.1 92f94ac195c7f28197d4898bcd6519b8.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 1192
x-amz-cf-pop: JFK52-P7
server: AmazonS3
x-amz-server-side-encryption: AES256

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors none;
location: https://d2mjzob2nc713b.cloudfront.net/widget/widget_async.js
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 162
date: Sun, 27 Oct 2024 06:27:28 GMT
content-type: text/html
server: nginx
x-frame-options: deny

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 8138
Redirect Chain

https://s.amazon-adsystem.com/iu3?d=generic&ex-fargs=%3Fid%3D3b289a46-9b76-58a9-88f0-c89b1606534d%26type%3D82%26m%3D1&ex-fch=416613&ex-src=https://www.choicehomewarranty.com/&ex-hargs=v%3D1.0%3Bc%3...
https://s.amazon-adsystem.com/iu3?d=generic&ex-fargs=%3Fid%3D3b289a46-9b76-58a9-88f0-c89b1606534d%26type%3D82%26m%3D1&ex-fch=416613&ex-src=https://www.choicehomewarranty.com/&ex-hargs=v%3D1.0%3Bc%3...

0
0

87ms
87ms

Document
text/html

98.82.157.137
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?d=generic&ex-fargs=%3Fid%3D3b289a46-9b76-58a9-88f0-c89b1606534d%26type%3D82%26m%3D1&ex-fch=416613&ex-src=https://www.choicehomewarranty.com/&ex-hargs=v%3D1.0%3Bc%3D6293635390601%3Bp%3D3B289A46-9B76-58A9-88F0-C89B1606534D&cb=126615541940968690&dcc=t

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-98-82-157-137.compute-1.amazonaws.com

Software

Server /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://chwpromoonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 1945
Content-Type: text/html;charset=ISO-8859-1
Date: Sun, 27 Oct 2024 06:27:28 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 46T7CY98P62N187D1TZ9

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Sun, 27 Oct 2024 06:27:28 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?d=generic&ex-fargs=%3Fid%3D3b289a46-9b76-58a9-88f0-c89b1606534d%26type%3D82%26m%3D1&ex-fch=416613&ex-src=https://www.choicehomewarranty.com/&ex-hargs=v%3D1.0%3Bc%3D6293635390601%3Bp%3D3B289A46-9B76-58A9-88F0-C89B1606534D&cb=126615541940968690&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 9SMSYXJG297CR3GR7V8J

GET
H3 200 /
www.google.com/pagead/1p-user-list/1038983633/ 42 B
64 B 78ms
76ms Image
image/gif 142.250.65.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1038983633/?random=1730010448487&cv=11&fst=1730008800000&bg=ffffff&guid=ON&async=1&gtm=45be4ao0v9100724500za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848&u_w=1600&u_h=1200&url=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&hn=www.googleadservices.com&frm=0&tiba=Choice%20Home%20Warranty&npa=0&pscdl=noapi&auid=2129283443.1730010448&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfvd-UkaPbi-A4WCptwiQWXlYRhmwupA&random=2192226185&rmt_tld=0&ipr=y

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.164 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 27 Oct 2024 06:27:28 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 1374492936214348 Show response
connect.facebook.net/signals/config/ 67 KB
14 KB 111ms
110ms Script
application/x-javascript 31.13.67.20
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1374492936214348?v=2.9.174&r=stable&domain=chwpromoonline.com&hme=ead923021ccd3483ef3b9b04703d0a78b943fbdc01e8d7cec21c5059f1f4a5e9&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C194%2C193%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.67.20 Boca Raton, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-mia3.fbcdn.net

Software

Resource Hash

d01cf5227a418013cb2a71fd05696af86054ca75f793755fcf2bca209719cb45

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 27 Oct 2024 06:27:28 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=32, rtx=0, c=75, mss=1232, tbw=67866, tp=63, tpl=0, uplat=78, ullat=0
pragma: public
x-fb-debug: 1booIPVIrO26G4+FzaM65ZXCv/j2vfJeRIGR1D8f6/9i/Rg81PeAa09+wDfMIuU0OvqaL/2VOJGAyxm/hS2QOA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
421 B 79ms
78ms XHR
text/plain 2607:f8b0:4006:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1695665285&t=pageview&_s=1&dl=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&ul=en-us&de=UTF-8&dt=Choice%20Home%20Warranty&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=203466178.751981518.1730010449.1730010449.1730010449.1&_utmz=203466178.1730010449.1.1.utmcsr%3Deflsn%7Cutmccn%3D873_b4641%7Cutmcmd%3D(not%2520set)&_utmht=1730010448799&_u=YADCAUABAAAAACAAI~&jid=1355088537&gjid=1327892141&cid=751981518.1730010449&tid=UA-6898183-1&_gid=1093302255.1730010449&_r=1&gtm=457e4ao0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101823848&jsscut=1&z=1836991833

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://chwpromoonline.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 27 Oct 2024 06:27:28 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://chwpromoonline.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H2 200 5223598.js Show response
bat.bing.com/p/action/ 370 B
423 B 59ms
59ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5223598.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7f47f02c93d5de5de03db0ebffa39fe1060767437b086996e295c9818a05b2f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8D35605A42E34FBB8477FDA507AAC8DA Ref B: MIAEDGE2510 Ref C: 2024-10-27T06:27:28Z
x-cache: CONFIG_NOCACHE
date: Sun, 27 Oct 2024 06:27:28 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 204 0
bat.bing.com/action/ 0
360 B 58ms
57ms Image
text/plain 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5223598&Ver=2&mid=2adb5d9f-b47f-433a-bdb6-7467d3c2672d&bo=1&sid=8a244fe0942c11ef9b7a75c7b104428f&vid=8a247190942c11ef87170375fc3b621b&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Choice%20Home%20Warranty&p=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&r=&lt=1540&evt=pageLoad&sv=1&cdb=AQAQ&rn=350706

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9F5E82134D604230877BBE889538FE44 Ref B: MIAEDGE2510 Ref C: 2024-10-27T06:27:28Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sun, 27 Oct 2024 06:27:28 GMT

GET
H2 200 getIds Show response
s1.listrakbi.com/3QgckfkNYGiq/session/ 175 B
1006 B 193ms
75ms Script
application/x-javascript 104.18.41.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.listrakbi.com/3QgckfkNYGiq/session/getIds?callback=ltkCallback9207&gsid=&_sid=&_tid=564543&ps=null&dps=true
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=3QgckfkNYGiq&v=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9bf11b7f9834139714eb31a4e698be6b2d433bb4f010390945614158216e4423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cache-control: no-cache
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 8d909eda7e176ddf-MIA
expires: -1
date: Sun, 27 Oct 2024 06:27:29 GMT
content-type: application/x-javascript; charset=utf-8
server: cloudflare

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 113ms
31ms Image
text/plain 2a03:2880:f12c:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1374492936214348&ev=PageView&dl=https%3A%2F%2Fchwpromoonline.com&rl=&if=false&ts=1730010448953&sw=1600&sh=1200&v=2.9.174&r=stable&ec=0&o=4124&fbp=fb.1.1730010448948.409900569299361418&pm=1&hrl=c090a3&ler=empty&cdl=API_unavailable&it=1730010448786&coo=false&cs_cc=1&cas=1450997478264033%2C1222755887840689%2C8828469127174830%2C3978878805567253%2C2316263911791564%2C2584232434954631%2C2327076257418762%2C2981652575233814%2C2204202242966141%2C1635991026504996&rqm=GET

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12c:83:face:b00c:0:25de Boca Raton, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=30, rtx=0, c=10, mss=1297, tbw=2976, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sun, 27 Oct 2024 06:27:29 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 200ms
118ms Image
image/png 2a03:2880:f12c:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1374492936214348&ev=PageView&dl=https%3A%2F%2Fchwpromoonline.com&rl=&if=false&ts=1730010448953&sw=1600&sh=1200&v=2.9.174&r=stable&ec=0&o=4124&fbp=fb.1.1730010448948.409900569299361418&pm=1&hrl=c090a3&ler=empty&cdl=API_unavailable&it=1730010448786&coo=false&cs_cc=1&cas=1450997478264033%2C1222755887840689%2C8828469127174830%2C3978878805567253%2C2316263911791564%2C2584232434954631%2C2327076257418762%2C2981652575233814%2C2204202242966141%2C1635991026504996&rqm=FGET

Requested by

Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12c:83:face:b00c:0:25de Boca Raton, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7430338301883392708"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 27 Oct 2024 06:27:29 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: CUS6X50ZyhUcX45Liy/1AAHuQBLjeHW42XCm9RgtEqXzkFHq6xA5dVKpCc8uA8rvo4JizW1UCLv77d+lRvLUqA==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7430338301883392708", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=30, rtx=0, c=14, mss=1297, tbw=3294, tp=-1, tpl=-1, uplat=86, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 triggerRunner.js Show response
d2mjzob2nc713b.cloudfront.net/widget/ 11 KB
4 KB 74ms
72ms Script
application/javascript 2600:9000:2840:8600:d:370a:51c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2mjzob2nc713b.cloudfront.net/widget/triggerRunner.js?v=53f4a9a
Requested by: Host: shop.pe
URL: https://shop.pe/widget/widget_async.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2840:8600:d:370a:51c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 45fdcedbeb833ea40206c98dfcbfa73842f72d53f166a26b47ecc3b01a55286d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: gzip
etag: "6866a400e135f757d0d00c3e9c032d3b"
age: 1595899
x-amz-meta-mtime: 1728414440.5
x-cache: Hit from cloudfront
x-amz-cf-id: exs_7OwXPlOdbJuoOVUO9WE63Ow38GL9VxQ-Esk3BxZ4DU5xdeIS7Q==
date: Tue, 08 Oct 2024 19:09:11 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 08 Oct 2024 19:07:27 GMT
cache-control: max-age=2592000, public
via: 1.1 92f94ac195c7f28197d4898bcd6519b8.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 3876
x-amz-cf-pop: JFK52-P7
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 3QgckfkNYGiq Show response
at1.listrakbi.com/activity/ 111 B
625 B 115ms
92ms Script
text/javascript 104.18.41.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://at1.listrakbi.com/activity/3QgckfkNYGiq
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=3QgckfkNYGiq&v=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78128229564dfa75c63ca276fc0343f5c73aa722e9be5ec174951d447c9dac2b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cf-ray: 8d909edb2e4c6ddf-MIA
cache-control: private
content-encoding: gzip
cf-cache-status: DYNAMIC
date: Sun, 27 Oct 2024 06:27:29 GMT
content-type: text/javascript; charset=utf-8
server: cloudflare

GET
H2 200 update
sca1.listrakbi.com/3QgckfkNYGiq/cart/ 44 B
417 B 177ms
154ms Image
image/gif 104.18.41.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sca1.listrakbi.com/3QgckfkNYGiq/cart/update?gsid=445940ec-d8fa-4d1a-bb6c-f12ad3312480&_sid=c13b0344-0138-43b4-b9a2-dee989f859de&_tid=564543&_uid=8F1701E1-33B3-4890-90C7-1825D31C8066&s_0=warranty-quote&q_0=1&p_0=1.00&n_0=Warranty%20Quote
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d1c4aa4fc27ca65d42b693b60f19546c4a50c002394c364dbbef45710858df7a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cf-ray: 8d909edb2e4d6ddf-MIA
cache-control: no-cache
content-length: 44
cf-cache-status: DYNAMIC
date: Sun, 27 Oct 2024 06:27:29 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 widget.js Show response
d2mjzob2nc713b.cloudfront.net/widget/ 193 KB
49 KB 70ms
69ms Script
application/javascript 2600:9000:2840:8600:d:370a:51c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2mjzob2nc713b.cloudfront.net/widget/widget.js?v=9dfd28d
Requested by: Host: shop.pe
URL: https://shop.pe/widget/widget_async.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2840:8600:d:370a:51c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b59c566beb6437498b6052e0a71a16a5ef44669f991348887a99a624c443f079

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: gzip
etag: "ebd23a99ae7f85cf9e45b89747a7b01d"
age: 1595899
x-amz-meta-mtime: 1728414438.65
x-cache: Hit from cloudfront
x-amz-cf-id: atyEAQMHoCbO_smVqNxLVYPXigz2xV7ZoaGopn7I-soe7VAftqmrYg==
date: Tue, 08 Oct 2024 19:09:11 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 08 Oct 2024 19:07:25 GMT
cache-control: max-age=2592000, public
via: 1.1 92f94ac195c7f28197d4898bcd6519b8.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 50165
x-amz-cf-pop: JFK52-P7
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 3QgckfkNYGiq Show response
at1.listrakbi.com/activity/ 111 B
494 B 72ms
70ms Script
text/javascript 104.18.41.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://at1.listrakbi.com/activity/3QgckfkNYGiq?vuid=b840de19-754f-42b8-9e58-842bdefa6587&uid=0AE26680-E0C4-4FDF-AFBA-9346765E898B&gsid=445940ec-d8fa-4d1a-bb6c-f12ad3312480&sid=c13b0344-0138-43b4-b9a2-dee989f859de&_t_0=at&t_0=ProductBrowse&k_0=warranty-quote
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=3QgckfkNYGiq&v=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78128229564dfa75c63ca276fc0343f5c73aa722e9be5ec174951d447c9dac2b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cf-ray: 8d909edbce806ddf-MIA
cache-control: private
content-encoding: gzip
cf-cache-status: DYNAMIC
date: Sun, 27 Oct 2024 06:27:29 GMT
content-type: text/javascript; charset=utf-8
server: cloudflare

GET
H2 200 3QgckfkNYGiq Show response
at1.listrakbi.com/activity/ 111 B
492 B 73ms
72ms Script
text/javascript 104.18.41.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://at1.listrakbi.com/activity/3QgckfkNYGiq?vuid=b840de19-754f-42b8-9e58-842bdefa6587&uid=9FA3BE63-9D69-45FF-8C4A-F18AFF11E038&gsid=445940ec-d8fa-4d1a-bb6c-f12ad3312480&sid=c13b0344-0138-43b4-b9a2-dee989f859de&_t_0=at&t_0=Identification&k_0=3&_t_1=at&t_1=Identification&k_1=4&_t_2=at&t_2=Identification&k_2=5
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=3QgckfkNYGiq&v=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78128229564dfa75c63ca276fc0343f5c73aa722e9be5ec174951d447c9dac2b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cf-ray: 8d909edbce826ddf-MIA
cache-control: private
content-encoding: gzip
cf-cache-status: DYNAMIC
date: Sun, 27 Oct 2024 06:27:29 GMT
content-type: text/javascript; charset=utf-8
server: cloudflare

GET
H2 200 lc2.js Show response
b-code.liadm.com/ 132 KB
45 KB 259ms
71ms Script
application/javascript 2600:9000:23cb:da00:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/lc2.js
Requested by: Host: s3-us-west-2.amazonaws.com
URL: https://s3-us-west-2.amazonaws.com/jsstore/a/R18H13Y/ge.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23cb:da00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 1ff2991706993698d865d20f119aaedb13a5b28b845876b2eac96ba565564dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cache-control: public,max-age=86400
content-encoding: gzip
age: 46186
via: 1.1 23a7db9b99ad0ff99aeef1ab5f27e734.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: yKraHFaM5LIbTi2ZszhQpB7t23ndsLpGhNtEHnwwsnaeQn75M5Prvw==
date: Sat, 26 Oct 2024 17:37:43 GMT
content-type: application/javascript
vary: Accept-Encoding
x-amz-cf-pop: JFK50-P1

GET
H2 200 3QgckfkNYGiq Show response
at1.listrakbi.com/activity/ 111 B
491 B 74ms
71ms Script
text/javascript 104.18.41.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://at1.listrakbi.com/activity/3QgckfkNYGiq?vuid=b840de19-754f-42b8-9e58-842bdefa6587&uid=E0D0F3F7-4550-4F62-B828-5609782FCAC5&gsid=445940ec-d8fa-4d1a-bb6c-f12ad3312480&sid=c13b0344-0138-43b4-b9a2-dee989f859de&_t_0=at&t_0=PageBrowse&k_0=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=3QgckfkNYGiq&v=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78128229564dfa75c63ca276fc0343f5c73aa722e9be5ec174951d447c9dac2b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

cf-ray: 8d909edcfed86ddf-MIA
cache-control: private
content-encoding: gzip
cf-cache-status: DYNAMIC
date: Sun, 27 Oct 2024 06:27:29 GMT
content-type: text/javascript; charset=utf-8
server: cloudflare

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1730010449709&se=e30&duid=13e8cbd54e95--01jb6ah1nkssx47dtmvcv5rfdm&tv=v3.3.1&pu=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_camp...
https://rp4.liadm.com/j?dtstmp=1730010449709&se=e30&duid=13e8cbd54e95--01jb6ah1nkssx47dtmvcv5rfdm&tv=v3.3.1&pu=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_cam...

13 B
348 B

229ms
69ms

XHR
application/json

3.213.66.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1730010449709&se=e30&duid=13e8cbd54e95--01jb6ah1nkssx47dtmvcv5rfdm&tv=v3.3.1&pu=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&wpn=lc-bundle&wpv=v3.3.1&cd=.chwpromoonline.com&pv=3263ce73-fb1a-4c12-9283-ae016f8ed1c9&i6=MjAwMTo1NTA6MWQwNToxOjo4&n3pc=true
Requested by: Host: chwpromoonline.com
URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a
Protocol: H2
Server: 3.213.66.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-66-168.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

x-pixel-event-id: 5c42eb51-bd0c-4833-bebd-4b8a03acc16c
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Sun, 27 Oct 2024 06:27:30 GMT
content-type: application/json

Redirect headers

access-control-allow-origin: https://chwpromoonline.com
location: https://rp4.liadm.com/j?dtstmp=1730010449709&se=e30&duid=13e8cbd54e95--01jb6ah1nkssx47dtmvcv5rfdm&tv=v3.3.1&pu=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&wpn=lc-bundle&wpv=v3.3.1&cd=.chwpromoonline.com&pv=3263ce73-fb1a-4c12-9283-ae016f8ed1c9&i6=MjAwMTo1NTA6MWQwNToxOjo4&n3pc=true
content-length: 0
access-control-expose-headers: *
date: Sun, 27 Oct 2024 06:27:29 GMT
access-control-allow-credentials: true
access-control-allow-methods: GET

GET
H2

200

/
match.adsrvr.org/track/upb/ Frame D64A
Redirect Chain

https://insight.adsrvr.org/track/up?adv=zl9kfqh1&ref=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%...
https://match.adsrvr.org/track/upb/?adv=zl9kfqh1&ref=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%...

0
0

62ms
58ms

Document
text/html

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/upb/?adv=zl9kfqh1&ref=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&upid=7h0r1mr&upv=1.1.0&paapi=1
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash

Request headers

Referer: https://chwpromoonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Sun, 27 Oct 2024 06:27:32 GMT
server: Kestrel
vary: Accept-Encoding

Redirect headers

content-length: 599
date: Sun, 27 Oct 2024 06:27:31 GMT
location: https://match.adsrvr.org/track/upb/?adv=zl9kfqh1&ref=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&upid=7h0r1mr&upv=1.1.0&paapi=1
server: Kestrel

GET
H2 200 params Show response
shop.pe/widget/main/init/ 260 B
747 B 85ms
83ms Script
text/javascript 35.227.244.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://shop.pe/widget/main/init/params?siteid=5db99fcfbbddbd09cdf02f85&product=Choice%20Home%20Warranty&product_url=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php&image=&price=&currency=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&callback=AddShoppersWidget.load_widget&no_cookie_callback=AddShoppersWidget.load_no_cookie&sos=false&rand=85136&cookie=&referer=

Requested by

Host: d2mjzob2nc713b.cloudfront.net
URL: https://d2mjzob2nc713b.cloudfront.net/widget/widget.js?v=9dfd28d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.227.244.1 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

1.244.227.35.bc.googleusercontent.com

Software

nginx /

Resource Hash

e1fe2fa19c038c94d7375c4ffa00c4e553e2f5115b195ef5c9fcf5e49c02de3c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	deny

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: gzip
etag: W/"6599f4c09948cdabfff690139ba6275b59e3aefd"
access-control-allow-methods: POST, GET, OPTIONS, DELETE, PATCH
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
date: Sun, 27 Oct 2024 06:27:31 GMT
content-type: text/javascript
x-frame-options: deny
access-control-allow-headers: X-Requested-With, Content-Type, X-XSRFToken
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors none;
data-regulation-gdpr-enforced: false
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
access-control-allow-origin: https://my.addshoppers.com
backend-version: 47
server: nginx

GET
H3 200 params Show response
shop.pe/widget/main/init/ 1 KB
664 B 88ms
87ms Script
text/javascript 35.227.244.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://shop.pe/widget/main/init/params?siteid=5db99fcfbbddbd09cdf02f85&product=Choice%20Home%20Warranty&product_url=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php&image=&price=&currency=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Fchwpromoonline.com%2Fa%2Fa168%2Findex.php%3Futm_source%3Deflsn%26utm_campaign%3D873_b4641%26token%3D2330062548389065206%26Azip%3D%26flux_sess%3D11653324db7e9046dc38aad840beee0a&callback=AddShoppersWidget.load_widget&rand=90649&cookie=2%7C1%3A0%7C10%3A1730010451%7C15%3Aaddshoppers.com%7C44%3ANjEzMTgyMTI0MDUwNDYxODg0Zjk5OTgwMDNmMjc1MDI%3D%7C93a758a6ec33bea3b94563f072b21e63e770dfb126ae876286023be961c280b6&referer=

Requested by

Host: d2mjzob2nc713b.cloudfront.net
URL: https://d2mjzob2nc713b.cloudfront.net/widget/widget.js?v=9dfd28d

Protocol

Security

QUIC, , AES_128_GCM

Server

35.227.244.1 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

1.244.227.35.bc.googleusercontent.com

Software

nginx /

Resource Hash

c23160fe2a2d80806264949827ca8f0ee9bec8b508676940c2c94c0de8b5ead2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	deny

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

content-encoding: gzip
etag: W/"c0b557c8439402fc1bd45195d7212f31b4723a45"
access-control-allow-methods: POST, GET, OPTIONS, DELETE, PATCH
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
date: Sun, 27 Oct 2024 06:27:31 GMT
content-type: text/javascript
x-frame-options: deny
access-control-allow-headers: X-Requested-With, Content-Type, X-XSRFToken
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors none;
data-regulation-gdpr-enforced: false
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
access-control-allow-origin: https://my.addshoppers.com
backend-version: 47
server: nginx

GET
H/1.1 200
OK fd56b16dd7084b44ad1a2c2a599d340a.js Show response
addshoppers.s3.amazonaws.com/customize/5db99fcfbbddbd09cdf02f85/ 879 B
919 B 383ms
75ms Script
application/javascript 3.5.11.141
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://addshoppers.s3.amazonaws.com/customize/5db99fcfbbddbd09cdf02f85/fd56b16dd7084b44ad1a2c2a599d340a.js?_t=1722496492
Requested by: Host: d2mjzob2nc713b.cloudfront.net
URL: https://d2mjzob2nc713b.cloudfront.net/widget/widget.js?v=9dfd28d
Protocol: HTTP/1.1
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 3.5.11.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: da9cb7b8fd56aa757776540ba32317a795a8c79b0b920591bd12eda3898475ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

x-amz-id-2: JVTfWV+FiB3QkZ2D1gn9z3o/CLUlXcK19vzGZWHy9TMt/2VrKxZcroDi3H/IwLVt1KnhU/efjQ5c3B8ajlKosA==
Cache-Control: max-age=2592000, public
Content-Encoding: gzip
ETag: "c469a1534778520e77f299160d83c871"
x-amz-version-id: wxe4YBzj406YHyMy79grO1bW0uJ9Y.MP
x-amz-request-id: S27PDP84MFN2BVMN
Accept-Ranges: bytes
Content-Length: 369
Date: Sun, 27 Oct 2024 06:27:33 GMT
Last-Modified: Thu, 01 Aug 2024 07:14:54 GMT
Content-Type: application/javascript; charset=utf-8
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 input.js Show response
shopper.shop.pe/ 26 KB
9 KB 343ms
35ms Script
application/javascript 35.190.54.17
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://shopper.shop.pe/input.js
Requested by: Host: shop.pe
URL: https://shop.pe/widget/widget_async.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.54.17 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 17.54.190.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 620a97911c6964bfc7cfacf4df74b3ba598ef728f2117675d171e4c62d500add

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

x-goog-metageneration: 2
access-control-expose-headers: Access-Control-Allow-Origin
content-encoding: gzip
x-goog-hash: crc32c=mi0bhQ==, md5=0xF0XoMHewePpWbHehXZtQ==
etag: "d311745e83077b078fa566c77a15d9b5"
age: 7959
x-goog-stored-content-encoding: gzip
expires: Sun, 27 Oct 2024 08:14:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 8831
date: Sun, 27 Oct 2024 04:14:53 GMT
last-modified: Tue, 13 Feb 2024 16:47:53 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY3jWpFcXdMVr0N3Ut2T_K4rfrrVi5m1WJVDjMeXZ57PQklT99HpuvpE2oMX2oPipnXG_SA
cache-control: public, max-age=14400
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1707842873418606
content-length: 8831
server: UploadServer

GET
H2 200 status Show response
app.shop.pe/app/datapartners/ 34 B
500 B 389ms
81ms XHR
application/json 35.227.244.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://app.shop.pe/app/datapartners/status?usersite_id=5db99fcfbbddbd09cdf02f85

Requested by

Host: d2mjzob2nc713b.cloudfront.net
URL: https://d2mjzob2nc713b.cloudfront.net/widget/widget.js?v=9dfd28d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.227.244.1 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

1.244.227.35.bc.googleusercontent.com

Software

nginx /

Resource Hash

b4435b5ac2f1916ed1135fb1738a1cef87cb666f4356a6678fb1c77e1273f9e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	deny

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: W/"0467ba22658b680d6de72dc567071b5bc495547f"
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, DELETE, PATCH
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
date: Sun, 27 Oct 2024 06:27:32 GMT
content-type: application/json; charset=UTF-8
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type, X-XSRFToken

HEAD
H2 200 consent Show response
manage.safeopt.com/ 0
837 B 173ms
81ms XHR
text/html 35.227.244.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://manage.safeopt.com/consent

Requested by

Host: shopper.shop.pe
URL: https://shopper.shop.pe/input.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.227.244.1 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

1.244.227.35.bc.googleusercontent.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	deny

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/

Response headers

access-control-expose-headers: Data-Regulation-Gdpr-Enforced
etag: "da39a3ee5e6b4b0d3255bfef95601890afd80709"
access-control-allow-methods: HEAD, GET, POST
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
date: Sun, 27 Oct 2024 06:27:32 GMT
content-type: text/html; charset=UTF-8
x-frame-options: deny
access-control-allow-headers: X-Requested-With, Content-Type, Data-Regulation-Gdpr-Enforced
strict-transport-security: max-age=31536000; includeSubDomains
data-regulation-gdpr-enforced: false
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
content-length: 0
server: nginx

GET
H2 200 iframe
nytrng.com/ Frame BBB9 0
0 461ms
123ms Document
text/html 75.2.91.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nytrng.com/iframe?vcp=4dd5h0np&as_id=613182124050461884f9998003f27502
Requested by: Host: d2mjzob2nc713b.cloudfront.net
URL: https://d2mjzob2nc713b.cloudfront.net/widget/widget.js?v=9dfd28d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.91.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a954c1fc80b8251dc.awsglobalaccelerator.com
Software: gunicorn /
Resource Hash

Request headers

Referer: https://chwpromoonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-length: 417
content-type: text/html; charset=utf-8
date: Sun, 27 Oct 2024 06:27:32 GMT
server: gunicorn

GET
H/1.1 200
OK favicon.ico
chwpromoonline.com/ 894 B
1 KB 61ms
61ms Other
image/vnd.microsoft.icon 146.20.84.216
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://chwpromoonline.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.84.216 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: Apache /
Resource Hash: 585304b03a0c62bcd6c5e580bcd2f47e157aef5e36a5faf1253d57c526bd24b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a

Response headers

ETag: "37e-5c8996b66bd40"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 894
Keep-Alive: timeout=5, max=93
Date: Sun, 27 Oct 2024 06:27:32 GMT
Last-Modified: Mon, 02 Aug 2021 20:29:01 GMT
Content-Type: image/vnd.microsoft.icon
Server: Apache

Verdicts & Comments Add Verdict or Comment

149 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

85 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.at1.listrakbi.com/activity/3QgckfkNYGiq	1970-01-21 00:33:34	Name: _vuid Value: b840de19-754f-42b8-9e58-842bdefa6587
.listrakbi.com/3QgckfkNYGiq	1970-01-21 10:09:30	Name: gsid Value: F9h2%2bRPC%2bpT3ddQFihLF%2f4SVLw7pXcPYYmGj74A0RauIzrtmjad4nFy6rp3oBGPXO%2bUPXTfzYUs%3d
.listrakbi.com/3QgckfkNYGiq	1970-01-21 09:19:06	Name: scasid Value: c13b0344-0138-43b4-b9a2-dee989f859de
chwpromoonline.com/a/a168	1970-01-21 00:33:34	Name: _vuid Value: b840de19-754f-42b8-9e58-842bdefa6587
.liadm.com/j	1970-01-21 10:09:30	Name: lidid Value: 6812715d-f977-43c8-b218-674c37f322d4
ejf8rjks.com/	1970-01-21 00:55:06	Name: uniqueClick_3B8HKJ Value: 3dcd762a-ef40-4314-b328-616e132e4d47:1730010446
ejf8rjks.com/	1970-01-21 02:43:06	Name: transaction_id Value: afa12f2ef8c74a4cbd678ea37c92b99b
tracksecuresite.com/	1970-01-21 00:34:56	Name: PHPSESSID Value: 11653324db7e9046dc38aad840beee0a
tracksecuresite.com/	1970-01-21 09:19:06	Name: csid3 Value: 11653324db7e9046dc38aad840beee0a
chwpromoonline.com/	1969-12-31 23:59:59	Name: COOKIE Value: !NicyG0mT3UR71VwOTrqneA6i3HfRP/BC5ShtZsNN8CuswkHevMJGFCWvY/+7WEOTDKghrGMma16I3g==
.chwpromoonline.com/	1970-01-21 02:43:06	Name: _gcl_au Value: 1.1.2129283443.1730010448
.chwpromoonline.com/	1970-01-21 10:09:30	Name: _ga_9X781FPXLE Value: GS1.1.1730010448.1.0.1730010448.60.0.0
.chwpromoonline.com/	1970-01-21 10:09:30	Name: __utma Value: 203466178.751981518.1730010449.1730010449.1730010449.1
.chwpromoonline.com/	1969-12-31 23:59:59	Name: __utmc Value: 203466178
.chwpromoonline.com/	1970-01-21 04:56:18	Name: __utmz Value: 203466178.1730010449.1.1.utmcsr=eflsn\|utmccn=873_b4641\|utmcmd=(not%20set)
.chwpromoonline.com/	1970-01-21 00:33:31	Name: __utmt Value: 1
.chwpromoonline.com/	1970-01-21 00:33:32	Name: __utmb Value: 203466178.1.10.1730010449
.doubleclick.net/	1970-01-21 10:09:30	Name: IDE Value: AHWqTUnABUwWi3_-Xj7t3t1t0GNa_SSuX0Gq0XxoQAthUcKwGPrZVDtg2r1vLufH
.doubleclick.net/	1970-01-21 00:33:31	Name: test_cookie Value: CheckForPermission
.chwpromoonline.com/	1970-01-21 10:09:30	Name: _ga Value: GA1.2.751981518.1730010449
.chwpromoonline.com/	1970-01-21 00:34:56	Name: _gid Value: GA1.2.1093302255.1730010449
.chwpromoonline.com/	1970-01-21 00:33:30	Name: _gat_gtag_UA_6898183_1 Value: 1
.chwpromoonline.com/	1970-01-21 00:34:56	Name: _uetsid Value: 8a244fe0942c11ef9b7a75c7b104428f
.chwpromoonline.com/	1970-01-21 09:55:06	Name: _uetvid Value: 8a247190942c11ef87170375fc3b621b
.amazon-adsystem.com/	1970-01-21 06:29:11	Name: ad-id Value: AyA9fvo900XXj_LgRWHld44
.amazon-adsystem.com/	1970-01-21 10:09:30	Name: ad-privacy Value: 0
.chwpromoonline.com/	1970-01-21 02:43:06	Name: _fbp Value: fb.1.1730010448948.409900569299361418
.bing.com/	1970-01-21 09:55:06	Name: MUID Value: 28E8F755F55B6E023DB2E270F4476FE1
.bat.bing.com/	1970-01-21 00:43:35	Name: MR Value: 0
chwpromoonline.com/	1970-01-21 00:34:56	Name: _ltkpdtb Value: 1
s1.listrakbi.com/	1970-01-21 00:43:35	Name: AWSALBCORS Value: n9bQs/0k6GeaFQGm8P0cb0+eljnR1Ad/drUfRlDjUZkC5VsmX4ZvtQrSrCefIWlfYE/2oY7ZMeI9TKw9my8u67FpFNgtq9snunsIaphEVTpOLjDJkI7E8E5CuPOm
.listrakbi.com/	1970-01-21 02:43:06	Name: usid Value: 40c66e95d72242bdb80e40437bbeb62f
.chwpromoonline.com/	1970-01-21 10:09:30	Name: GSID3QgckfkNYGiq Value: 445940ec-d8fa-4d1a-bb6c-f12ad3312480
.chwpromoonline.com/	1970-01-21 09:19:06	Name: STSID564543 Value: c13b0344-0138-43b4-b9a2-dee989f859de
.connatix.com/	1970-01-21 01:16:42	Name: cnx_userId Value: f7034a2244744a4bab97279b8d354777
.casalemedia.com/	1970-01-21 09:19:06	Name: CMID Value: Zx3dUdHM42YAAHtdAGMlBAAA
.casalemedia.com/	1970-01-21 02:43:06	Name: CMPS Value: 930
.casalemedia.com/	1970-01-21 02:43:06	Name: CMPRO Value: 930
sca1.listrakbi.com/	1970-01-21 00:43:35	Name: AWSALBCORS Value: 4umuYOeQn8hiJ5bmo2QfQstCDeokGF9/jZWzzq/G053XO3kwgVkid6NM5LEohR0K0zxHDZ8oB39Kt9BXPnJINgR3Dyd5nYf16F+6OUKrMnB0MMWBEk0SpgwVxbPa
ads.samba.tv/	1970-01-21 10:03:44	Name: sambapxid Value: 13e063c07a0791236
.smartadserver.com/	1970-01-21 10:03:44	Name: pid Value: 4334139983959106386
.smartadserver.com/	1970-01-21 10:03:44	Name: TestIfCookieP Value: ok
.smartadserver.com/	1970-01-21 09:19:06	Name: csync Value: 144:tfFfBft-QjKXNnqD31M2MA
.pbs.yahoo.com/	1970-01-21 04:55:35	Name: uids Value: eyJ0ZW1wVUlEcyI6eyJhbWF6b24iOnsidWlkIjoiemhYRTBBM0JScWFnNXNjR1dDOG56USIsImV4cGlyZXMiOiIyMDI0LTExLTEwVDA2OjI3OjI5LjM4ODYzNTM0M1oifX19
.adnxs.com/	1970-01-21 10:09:30	Name: receive-cookie-deprecation Value: 1
.rubiconproject.com/	1970-01-21 09:19:06	Name: khaos Value: M2R7JY1W-25-389
.rubiconproject.com/	1970-01-21 09:19:06	Name: khaos_p Value: M2R7JY1W-25-389
.demdex.net/	1970-01-21 04:52:42	Name: demdex Value: 85676548378917804580105678434582080524
.mookie1.com/	1970-01-21 10:02:18	Name: id Value: 10618080547099664265
.mookie1.com/	1970-01-21 10:02:18	Name: mdata Value: 1\|10618080547099664265\|1730010449463
.mookie1.com/	1970-01-21 10:02:18	Name: ov Value: 53db0d471a43be5d6bea2effbb87f0ae
at1.listrakbi.com/	1970-01-21 00:43:35	Name: AWSALBCORS Value: JhhrypSjnklWK7E/uxSVtq2evnI/ON45vx6c4OUO24AGDKmNN9Tye87bqGfAeUV0Sf6DtCPdHMSY/1RFjRSU+mQi97fVCVokmFt1ZfO9rxtPlLZnI9DIRcDfTGQ9
.dpm.demdex.net/	1970-01-21 04:52:42	Name: dpm Value: 85676548378917804580105678434582080524
.chwpromoonline.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .chwpromoonline.com
.chwpromoonline.com/	1970-01-21 10:09:30	Name: _lc2_fpi Value: 13e8cbd54e95--01jb6ah1nkssx47dtmvcv5rfdm
.adform.net/	1970-01-21 01:18:08	Name: C Value: 1
.kargo.com/	1970-01-21 09:19:06	Name: ktcid Value: bc74d23a-07d9-02e7-5f7b-90f9fdec43d5
.adform.net/	1970-01-21 01:59:54	Name: uid Value: 5278782160374612407
.pubmatic.com/	1970-01-21 02:43:06	Name: KRTBCOOKIE_290 Value: 23219-oT6Wyb9TTw2Uj7lo_J-UHw&KRTB&23261-oT6Wyb9TTw2Uj7lo_J-UHw&KRTB&23561-oT6Wyb9TTw2Uj7lo_J-UHw&KRTB&23612-oT6Wyb9TTw2Uj7lo_J-UHw
.pubmatic.com/	1970-01-21 01:16:42	Name: PugT Value: 1730010449
.exelator.com/	1970-01-21 03:26:18	Name: EE Value: "3ff0c54e955b0687910b3c1821f55733"
.yieldmo.com/	1970-01-21 09:19:06	Name: yieldmo_id Value: VeJsqAA95sAH2XlaazRk%7C1729987200000%7C0
.ads.yieldmo.com/	1970-01-21 09:19:06	Name: ptramazon Value: nXlOct5NQ32hmVpMhpAcMA
.liadm.com/	1970-01-21 10:09:30	Name: lidid Value: 6812715d-f977-43c8-b218-674c37f322d4
.ninthdecimal.com/	1970-01-21 09:19:06	Name: ndat Value: CppID2cd3VF7dgAWVZUnAg==
.agkn.com/	1970-01-21 09:19:06	Name: ab Value: 0001%3AM2AvV%2BNd4QeDdyMB%2BLYeOVRy4wVGJ4IA
.exelator.com/	1970-01-21 03:26:18	Name: ud Value: "eJxrXxzq6XKLQcE4Lc0g2dQk1dLUNMnAzMLc0tAgyTjZ0MLIMM3U1NzYeHFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDYYEl%252BUWb6otDgxUUpaQyLSopPBZ9MCwEAaXEpeA%253D%253D"
.csync.loopme.me/	1970-01-21 02:45:59	Name: viewer_token Value: 28c217bb-fc6c-4544-a32b-dd7f1b0fcc27
.zeotap.com/	1970-01-21 09:19:06	Name: zc Value: fb82b3ba-8789-44c0-6332-96430e72c6dc
.yahoo.com/	1970-01-21 09:19:28	Name: A3 Value: d=AQABBFLdHWcCEDXF1v79pd2XYIKpW19yi90FEgEBAQEuH2cnZ9ww0iMA_eMAAA&S=AQAAArFa4DV2vj-0_Sjpuf1hdKA
.analytics.yahoo.com/	1970-01-21 09:19:06	Name: IDSYNC Value: 19b9~2lhi
.3lift.com/	1970-01-21 02:43:06	Name: tluidp Value: 4136390323530111166052
.3lift.com/	1970-01-21 02:43:06	Name: tluid Value: 4136390323530111166052
.scorecardresearch.com/	1970-01-21 09:55:06	Name: UID Value: 18F70c0864d5320fe774a531730010450
.scorecardresearch.com/	1970-01-21 09:55:06	Name: XID Value: 18F70c0864d5320fe774a531730010450
.ispot.tv/	1970-01-21 10:09:30	Name: pt Value: v2:4ff54c943151bdd9bbee050f62efbdf76518147ef862afa23182f0d18fe25a44\|42052473b68ab13bf5a252652aa44fd91da8fa2822e8d0ca3bbef7b9d4251ae7
.semasio.net/	1970-01-21 09:19:06	Name: SEUNCY Value: CFF7F465112BADBF
.pubmatic.com/	1970-01-21 09:19:06	Name: KADUSERCOOKIE Value: 13A9812B-A544-427D-8BA1-429EBAC92076
chwpromoonline.com/	1970-01-21 04:52:42	Name: _geuid Value: 7b02376e-9d57-4321-b661-93fb6699e0af
shop.pe/	1970-01-21 10:09:30	Name: addshoppers Value: "2\|1:0\|10:1730010451\|11:addshoppers\|44:NjEzMTgyMTI0MDUwNDYxODg0Zjk5OTgwMDNmMjc1MDI=\|c02a35f7e1fb4712e7f7ddf6645572990114fe0a27e7c6b39aef793dc744f942"
chwpromoonline.com/	1970-01-21 10:09:30	Name: addshoppers.com Value: 2%7C1%3A0%7C10%3A1730010451%7C15%3Aaddshoppers.com%7C44%3ANjEzMTgyMTI0MDUwNDYxODg0Zjk5OTgwMDNmMjc1MDI%3D%7C93a758a6ec33bea3b94563f072b21e63e770dfb126ae876286023be961c280b6
.adsrvr.org/	1970-01-21 09:19:06	Name: TDID Value: a65bfae8-bb72-41af-85bb-81e1792b76f2
.rubiconproject.com/	1970-01-21 09:19:06	Name: audit_p Value: 1\|+IevpHTeTk8foV62qEdKaFZJPuBWYGHJeCb1X9pWn0o8fCYmOTvXg/I6t8tuPKIynor/0TrV5b5CbuL7wqM7W1b7+lYqTGSeQS7q4WQ6vbWXiJdVeP+Dpl851cRlmtJH5lAl3IdWpvt/pOe1CWJEfoSn0+I4giw+qF7VFZLzNs+yqVI1k5poNA==
.rubiconproject.com/	1970-01-21 09:19:06	Name: audit Value: 1\|+IevpHTeTk8foV62qEdKaFZJPuBWYGHJeCb1X9pWn0o8fCYmOTvXg/I6t8tuPKIynor/0TrV5b5CbuL7wqM7W1b7+lYqTGSeQS7q4WQ6vbWXiJdVeP+Dpl851cRlmtJH5lAl3IdWpvt/pOe1CWJEfoSn0+I4giw+qF7VFZLzNs+yqVI1k5poNA==
.adsrvr.org/	1970-01-21 09:19:06	Name: TDCPM Value: CAESEgoDYWFtEgsI1KGaiM-Wuz0QBRIXCghhcHBuZXh1cxILCIzBmojPlrs9EAUSFgoHcnViaWNvbhILCJDkmojPlrs9EAUYBSABKAMyCwiU_Jy15Za7PRAFOAFCBCICCAFaCHpsOWtmcWgxYAE.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a(Line 1048) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://chwpromoonline.com/a/a168/index.php?utm_source=eflsn&utm_campaign=873_b4641&token=2330062548389065206&Azip=&flux_sess=11653324db7e9046dc38aad840beee0a(Line 1048) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

addshoppers.s3.amazonaws.com
analytics.google.com
app.shop.pe
at1.listrakbi.com
b-code.liadm.com
bat.bing.com
cdn.datasteam.io
cdn.listrakbi.com
chwpromoonline.com
connect.facebook.net
d2mjzob2nc713b.cloudfront.net
ejf8rjks.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
insight.adsrvr.org
js.adsrvr.org
manage.safeopt.com
match.adsrvr.org
nytrng.com
rp.liadm.com
rp4.liadm.com
s.amazon-adsystem.com
s1.listrakbi.com
s3-us-west-2.amazonaws.com
sca1.listrakbi.com
shop.pe
shopper.shop.pe
ssl.google-analytics.com
stats.g.doubleclick.net
td.doubleclick.net
tracksecuresite.com
www.chwplan.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
104.18.41.49
108.139.33.128
142.250.65.164
142.250.65.227
142.250.80.2
142.251.40.130
146.20.84.216
15.197.193.217
172.67.213.89
18.173.132.125
2001:4860:4802:32::181
2600:1f18:730:b150:d702:ffce:b7d0:e69a
2600:9000:23cb:da00:8:8845:1500:93a1
2600:9000:2840:8600:d:370a:51c0:93a1
2607:f8b0:4004:c1b::9b
2607:f8b0:4006:80b::2008
2607:f8b0:4006:80e::200a
2607:f8b0:4006:816::2008
2607:f8b0:4006:81c::2002
2607:f8b0:4006:823::200e
2620:1ec:33::10
2a03:2880:f12c:83:face:b00c:0:25de
3.168.71.9
3.213.66.168
3.5.11.141
31.13.67.20
34.120.129.26
35.190.54.17
35.227.244.1
52.92.206.0
75.2.91.175
98.82.157.137
08178536ea61e2b2662caaf4ff39393f016e6154f4c59ed2d660008bd5aabde0
0acdf283dd239ced8e5c50cead47768ff1d852fb2c639c3517a1e8fb0ee50c5b
10bef3f85822237893d33ac7eed079f59191bf1457d08309401afc43a1902d50
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
13a41894df863c6d10c3b75b86d63d4fd975b89ad4517f1377118a78effdabd2
1a28fc1b5bfdd6c64cc2fdfb785f8051ff221976ef98a0ffcdb3356a9cc5d6f2
1ff2991706993698d865d20f119aaedb13a5b28b845876b2eac96ba565564dff
2a740b239284a1a62c426623f3095acb1b10c220be6abf9864cc0d0fb1960209
342f64eee8020ed8ccd8c957c7c3442acc3fd585a200470edfcd199549a1eae9
39c8bdb9694291eda332da1eb381a58e84c9caf3f8f8955f1f9146b378497d59
3a1ae68d835d095297598e1964665fed616649a20fd7d3bfdc6a97c9b468acd6
4540fe3d85b175ac7c0272025c164aee14f38b34d5515d35591fe752eeab7780
45fdcedbeb833ea40206c98dfcbfa73842f72d53f166a26b47ecc3b01a55286d
52b860bf171d4c3ddb8c50fe9b1cf48cd6337c07f0b111788d7ba34aad733299
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
55b90523aabe14478d4e85de11038ffe927f92a520b2ff59907f5a6755f0df8f
585304b03a0c62bcd6c5e580bcd2f47e157aef5e36a5faf1253d57c526bd24b8
620a97911c6964bfc7cfacf4df74b3ba598ef728f2117675d171e4c62d500add
688aa4443fd103dd4eba9512fbd4a0ff2c47b8ebbd4b8c8d4aaef45f4e4f48b0
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d97fccd01135ed97a465ce2d65e3d5993c7b240b06a7638b3fec90424f6252a
78128229564dfa75c63ca276fc0343f5c73aa722e9be5ec174951d447c9dac2b
79270dfeec80a9831db892c6afa6203afcfcbe58fb78d76c6b610b9b79a45739
7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa
7f47f02c93d5de5de03db0ebffa39fe1060767437b086996e295c9818a05b2f2
7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a
81a3487cf49a66c946a642f19c8f0a0d0484c49958d22f13d803f148f635039d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
90dc1edaca43e2e886e6e556485fa4f2d9bbb86193f9d8d6b3b1b5b087bb140c
93f6ce56be9b5d1cc8f0462801eebf1f4612ed1c5e9e0a389072c7b3fabee5b7
9418fabfb9e44d2e317c49c500d1f19c42ce6c8cf5b48197f78da3fa6015077b
9bf11b7f9834139714eb31a4e698be6b2d433bb4f010390945614158216e4423
a86d546ba4f21408943105cf3fd3d38fd881777babe0a96936fa7d22cfc13ea2
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
b4435b5ac2f1916ed1135fb1738a1cef87cb666f4356a6678fb1c77e1273f9e1
b59c566beb6437498b6052e0a71a16a5ef44669f991348887a99a624c443f079
c151a7e68aedc7bd4d84cb2096e92ee2f055c16be01c2ba027acd38b6cc9d52a
c23160fe2a2d80806264949827ca8f0ee9bec8b508676940c2c94c0de8b5ead2
c856760811d2a782cd995faeca206ab2120f3c4b5794be36132fe2b56860a295
d01cf5227a418013cb2a71fd05696af86054ca75f793755fcf2bca209719cb45
d1c4aa4fc27ca65d42b693b60f19546c4a50c002394c364dbbef45710858df7a
d3573cda52041247cfe2bec3dd48b363196a581a5aa0686f6cd74a5f96bb090f
d35dec674eeb6ea303b01dbb26c4cf819a50d4f59ca0d2db2ffc00e9cf6ff2ce
d3e6414b4ec5d683c3bce39ff8668ad86ac82981a3247aea44e425d26a9fe7b0
da9cb7b8fd56aa757776540ba32317a795a8c79b0b920591bd12eda3898475ed
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e1fe2fa19c038c94d7375c4ffa00c4e553e2f5115b195ef5c9fcf5e49c02de3c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e503215e8213b8dfe8d6d372c11ca269ea09ed556e84ec52cf1a1e2fc586e89d
e7dd8521bf129d77379963dc1cdff39625a29a319b40f7f80ae3276361b2178e
eab9cbb1928a9de3ed2b7164ea7215b1ee0c9d7584d04aac97fe5b6798140c48
ec286d9204d650f3688680ab7df9b05406c4baddb997cf762d2fedd7b5084365
edd03ab3a1f8f4fee1f13400764eaa7de9b4ec3da31a2de7f2a5a40e2ea181a7
ee5e6f24e63a934667e065cf35fa4cdb9a1ec3391da17621c3994fdb63bb82ea
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f30bf2284e7872587d6aa890cc2611f01e4be6a2fcfdc0003d63c6fa137745c7
f3a974df6314eccf6bafadf8a8008e1b9c5e4686688f862c6a4e866f20725d72
f52cad459520ec61b1813b4de63855696e880996d543846f1aea8a593cb48c64
f8ddd991c09bb40c08dfe2d04fbc0853a6062f07f23f0b83a72c1347bd00c0e3
fcbbc0ec322cfe873b66364b15141edfd799775274eec256e326ce881988a6a8

chwpromoonline.com Open in urlscan Pro 146.20.84.216 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

77 Requests

97 %HTTPS

38 %IPv6

24 Domains

38 Subdomains

30 IPs

2 Countries

2025 kBTransfer

3652 kBSize

85 Cookies

4 Outgoing links

Page URL History

Redirected requests

77 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

chwpromoonline.com Open in urlscan Pro
146.20.84.216 Public Scan

Screenshot
Live screenshot

Full Image

77
Requests

97 %
HTTPS

38 %
IPv6

24
Domains

38
Subdomains

30
IPs

2
Countries

2025 kB
Transfer

3652 kB
Size

85
Cookies

77 HTTP transactions
0 data transactions