urlscan.io logo urlscan.io
SecurityTrails logo

item1.club Open in urlscan Pro
162.0.215.23  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://item1.club/private/
Submission: On October 28 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 23 IPs in 7 countries across 20 domains to perform 113 HTTP transactions. The main IP is 162.0.215.23, located in United States and belongs to NAMECHEAP-NET, US. The main domain is item1.club.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 30th 2021. Valid for: a year.
This is the only time item1.club was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fidelity (Banking)

Domain & IP information

IP Address AS Autonomous System
1 18 162.0.215.23 22612 (NAMECHEAP...)
2 2 34.195.10.198 14618 (AMAZON-AES)
2 2600:9000:21f... 16509 (AMAZON-02)
2 2.16.186.195 20940 (AKAMAI-ASN1)
1 13.224.189.22 16509 (AMAZON-02)
6 54.155.40.229 16509 (AMAZON-02)
6 2.16.186.211 20940 (AKAMAI-ASN1)
5 2.16.186.162 20940 (AKAMAI-ASN1)
1 52.211.12.99 16509 (AMAZON-02)
1 1 54.74.40.111 16509 (AMAZON-02)
2 35.244.174.68 15169 (GOOGLE)
2 3 37.252.173.27 29990 (ASN-APPNEX)
10 104.17.209.240 13335 (CLOUDFLAR...)
2 3 142.250.185.98 15169 (GOOGLE)
1 104.244.42.67 13414 (TWITTER)
1 1 2620:1ec:c11:... 8068 (MICROSOFT...)
9 10 151.101.194.49 54113 (FASTLY)
1 1 151.101.2.49 54113 (FASTLY)
1 69.173.144.139 26667 (RUBICONPR...)
49 104.17.208.240 13335 (CLOUDFLAR...)
1 2 185.80.39.216 27381 (CASALE-MEDIA)
1 34.98.64.218 396982 (GOOGLE-CL...)
1 185.64.189.110 62713 (AS-PUBMATIC)
1 2 185.94.180.126 35220 (SPOTX-AMS)
1 2a03:2880:f11... 32934 (FACEBOOK)
1 2.18.232.194 16625 (AKAMAI-AS)
113 23
18    162.0.215.23 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium184-2.web-hosting.com
item1.club
2    34.195.10.198 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-195-10-198.compute-1.amazonaws.com
www.glancecdn.net
2    2600:9000:21f3:7e00:d:addc:2400:93a1 (United States)

ASN16509 (AMAZON-02, US)
storage.glancecdn.net
2    2.16.186.195 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-195.deploy.static.akamaitechnologies.com
www.fidelity.com
1    13.224.189.22 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-22.fra2.r.cloudfront.net
nexus.ensighten.com
6    54.155.40.229 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-155-40-229.eu-west-1.compute.amazonaws.com
dpm.demdex.net
6    2.16.186.211 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-211.deploy.static.akamaitechnologies.com
dmt.fidelity.com
5    2.16.186.162 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-162.deploy.static.akamaitechnologies.com
assets.fidelity.com
sitecatalyst.fidelity.com
1    52.211.12.99 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-211-12-99.eu-west-1.compute.amazonaws.com
fidelity.demdex.net
1    54.74.40.111 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-74-40-111.eu-west-1.compute.amazonaws.com
cm.everesttech.net
2    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
idsync.rlcdn.com
3    37.252.173.27 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com
10    104.17.209.240 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)
zncvgjh8lmjxbkyln-fmrpi.siteintercept.qualtrics.com
siteintercept.qualtrics.com
3    142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net
cm.g.doubleclick.net
1    104.244.42.67 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
1    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
10    151.101.194.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
rtd-tm.everesttech.net
1    151.101.2.49 (United States)

ASN54113 (FASTLY, US)
rtd.tubemogul.com
1    69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
49    104.17.208.240 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)
siteintercept.qualtrics.com
2    185.80.39.216 (Canada)

ASN27381 (CASALE-MEDIA, CA)
dsum-sec.casalemedia.com
1    34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com
us-u.openx.net
1    185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
2    185.94.180.126 (Amsterdam, Netherlands)

ASN35220 (SPOTX-AMS, US)
sync.search.spotxchange.com
1    2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2.18.232.194 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-194.deploy.static.akamaitechnologies.com
sjc1.qualtrics.com
Apex Domain
Subdomains		 Transfer
60 qualtrics.com
zncvgjh8lmjxbkyln-fmrpi.siteintercept.qualtrics.com — Cisco Umbrella Rank: 26569
siteintercept.qualtrics.com — Cisco Umbrella Rank: 958
sjc1.qualtrics.com — Cisco Umbrella Rank: 10333
126 KB
18 item1.club
item1.club
687 KB
13 fidelity.com
www.fidelity.com — Cisco Umbrella Rank: 18265
dmt.fidelity.com — Cisco Umbrella Rank: 20868
assets.fidelity.com — Cisco Umbrella Rank: 18282
sitecatalyst.fidelity.com — Cisco Umbrella Rank: 16006
261 KB
11 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 1073
sync-tm.everesttech.net — Cisco Umbrella Rank: 578
rtd-tm.everesttech.net — Cisco Umbrella Rank: 2552
2 KB
7 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 214
fidelity.demdex.net — Cisco Umbrella Rank: 26999
10 KB
4 glancecdn.net
www.glancecdn.net — Cisco Umbrella Rank: 4070
storage.glancecdn.net — Cisco Umbrella Rank: 5310
12 KB
3 doubleclick.net
cm.g.doubleclick.net — Cisco Umbrella Rank: 215
899 B
3 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 232
3 KB
2 spotxchange.com
sync.search.spotxchange.com — Cisco Umbrella Rank: 572
1 KB
2 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 542
1 KB
2 rlcdn.com
idsync.rlcdn.com — Cisco Umbrella Rank: 344
140 B
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 107
553 B
1 pubmatic.com
image2.pubmatic.com — Cisco Umbrella Rank: 894
449 B
1 openx.net
us-u.openx.net — Cisco Umbrella Rank: 409
273 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 347
239 B
1 tubemogul.com
rtd.tubemogul.com — Cisco Umbrella Rank: 7551
199 B
1 bing.com
c.bing.com — Cisco Umbrella Rank: 236
541 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 547
395 B
1 ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 2866
265 KB
0 fmr.com Failed
clixqa4.fmr.com Failed
113 20
Domain Requested by
58 siteintercept.qualtrics.com nexus.ensighten.com
18 item1.club 1 redirects item1.club
9 sync-tm.everesttech.net 9 redirects
6 dmt.fidelity.com nexus.ensighten.com
item1.club
6 dpm.demdex.net nexus.ensighten.com
item1.club
3 cm.g.doubleclick.net 2 redirects
3 ib.adnxs.com 2 redirects
3 assets.fidelity.com item1.club
2 sync.search.spotxchange.com 1 redirects
2 dsum-sec.casalemedia.com 1 redirects
2 idsync.rlcdn.com item1.club
2 sitecatalyst.fidelity.com nexus.ensighten.com
2 www.fidelity.com item1.club
2 storage.glancecdn.net item1.club
2 www.glancecdn.net 2 redirects
1 sjc1.qualtrics.com
1 www.facebook.com
1 image2.pubmatic.com
1 us-u.openx.net
1 pixel.rubiconproject.com
1 rtd-tm.everesttech.net
1 rtd.tubemogul.com 1 redirects
1 c.bing.com 1 redirects
1 analytics.twitter.com
1 zncvgjh8lmjxbkyln-fmrpi.siteintercept.qualtrics.com nexus.ensighten.com
1 cm.everesttech.net 1 redirects
1 fidelity.demdex.net nexus.ensighten.com
1 nexus.ensighten.com item1.club
0 clixqa4.fmr.com Failed nexus.ensighten.com
113 29
Subject Issuer Validity Valid
item1.club
Sectigo RSA Domain Validation Secure Server CA		 2021-11-30 -
2022-11-30		 a year crt.sh
www.fidelity.com
Entrust Certification Authority - L1M		 2022-10-06 -
2023-10-06		 a year crt.sh
nexus.ensighten.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-07 -
2023-10-14		 a year crt.sh
*.demdex.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-26 -
2023-10-27		 a year crt.sh
dmt.fidelity.com
Entrust Certification Authority - L1M		 2022-10-03 -
2023-10-03		 a year crt.sh
dpcs.fidelity.com
Entrust Certification Authority - L1M		 2022-04-28 -
2023-04-28		 a year crt.sh
akamai.piprod4.fidelity.com
Entrust Certification Authority - L1M		 2022-09-30 -
2023-09-30		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
*.qualtrics.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-05-04 -
2023-05-04		 a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh

This page contains 2 frames:

Primary Page: https://item1.club/private/
Frame ID: 2A4B7D4A6C1A7DCD6196A110A59C9E5B
Requests: 99 HTTP requests in this frame

Frame: https://fidelity.demdex.net/dest5.html?d_nsid=0
Frame ID: 30CD67BAF35D4D6D7A68A218244D7A97
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Fidelity Investments - Retirement Plans, Investing, Brokerage, Wealth Management, Financial Planning and Advice, Online Trading.

Page URL History Show full URLs

  1. https://item1.club/private HTTP 301
    https://item1.club/private/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • //nexus\.ensighten\.com/
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

Page Statistics

113
Requests

85 %
HTTPS

12 %
IPv6

20
Domains

29
Subdomains

23
IPs

7
Countries

1365 kB
Transfer

3685 kB
Size

23
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://item1.club/private HTTP 301
    https://item1.club/private/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://www.glancecdn.net/cobrowse/CobrowseJS.ashx?group=19772&site=production HTTP 302
  • https://storage.glancecdn.net/cobrowse/js/GlanceCobrowseLoader_5.6.3M.js
Request Chain 24
  • https://www.glancecdn.net/cobrowse/js/GlancePresenceVisitor_5.6.3M.js HTTP 301
  • https://storage.glancecdn.net/cobrowse/js/GlancePresenceVisitor_5.6.3M.js
Request Chain 32
  • https://cm.everesttech.net/cm/dd?d_uuid=37834629693295341820115681406568758943 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y1srAAAAAGD-dwN-
Request Chain 35
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP 302
  • https://dpm.demdex.net/ibs:dpid=358&dpuuid=2319289887296085200
Request Chain 38
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=Mzc4MzQ2Mjk2OTMyOTUzNDE4MjAxMTU2ODE0MDY1Njg3NTg5NDM= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=Mzc4MzQ2Mjk2OTMyOTUzNDE4MjAxMTU2ODE0MDY1Njg3NTg5NDM=&google_tc= HTTP 302
  • https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEH_xeyztZgwR1cYC1GXGY2w&google_cver=1?gdpr=0&gdpr_consent=
Request Chain 42
  • https://c.bing.com/c.gif?uid=37834629693295341820115681406568758943&Red3=MSAdobe_pd&gdpr=0&gdpr_consent= HTTP 302
  • https://dpm.demdex.net/ibs:dpid=1957&dpuuid=1B6AEE97F63E6F383DE2FCDCF7556E65
Request Chain 45
  • https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D782%26dpuuid%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://dpm.demdex.net/ibs:dpid=782&dpuuid=Y1srAAAAAGD-dwN-
Request Chain 46
  • https://rtd.tubemogul.com/migrate_et3/ HTTP 302
  • https://rtd-tm.everesttech.net/migrate_et3/
Request Chain 47
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTFzckFBQUFBR0QtZHdOLQ==
Request Chain 49
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y1srAAAAAGD-dwN-&expires=90
Request Chain 104
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y1srAAAAAGD-dwN- HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y1srAAAAAGD-dwN-&C=1
Request Chain 105
  • https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://ib.adnxs.com/setuid?entity=158&code=Y1srAAAAAGD-dwN-
Request Chain 106
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y1srAAAAAGD-dwN-
Request Chain 107
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y1srAAAAAGD-dwN-
Request Chain 108
  • https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y1srAAAAAGD-dwN-&img=1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y1srAAAAAGD-dwN-&img=1&__user_check__=1&sync_id=b5d87f5c-565c-11ed-a239-1d66682b0106
Request Chain 109
  • https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
  • https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y1srAAAAAGD-dwN-&t=2592000&o=0

113 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
item1.club/private/
Redirect Chain
  • https://item1.club/private
  • https://item1.club/private/
368 KB
38 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash
1a66ddf47eed0d8b3967e6dac81c875341345ac95af542ef34a10ace5d900278

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 28 Oct 2022 01:06:06 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.2.34
x-turbo-charged-by
LiteSpeed

Redirect headers

content-length
707
content-type
text/html
date
Fri, 28 Oct 2022 01:06:06 GMT
location
https://item1.club/private/
server
LiteSpeed
x-turbo-charged-by
LiteSpeed
GlanceCobrowseLoader_5.6.3M.js
storage.glancecdn.net/cobrowse/js/
Redirect Chain
  • https://www.glancecdn.net/cobrowse/CobrowseJS.ashx?group=19772&site=production
  • https://storage.glancecdn.net/cobrowse/js/GlanceCobrowseLoader_5.6.3M.js
11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://storage.glancecdn.net/cobrowse/js/GlanceCobrowseLoader_5.6.3M.js
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Server
2600:9000:21f3:7e00:d:addc:2400:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1e37b248a85a3ba711b5dfe3d3c0b9efd2f361d41a28601acda628013c6a20d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Wed, 19 Oct 2022 22:46:15 GMT
x-amz-version-id
gAyaMY01Hz5bW8oLzBQITq.h0cdYQqlQ
content-encoding
br
via
1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
age
699593
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Tue, 26 Jul 2022 12:23:55 GMT
server
AmazonS3
etag
W/"acaf6762074b827a84400164fee8fbd2"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31556926
x-amz-cf-id
uKQxGNw8NYFPZ6fb9FID8HkU8lV4505vPQDWJ6P8PqOnza6Vh_6Ydw==

Redirect headers

date
Fri, 28 Oct 2022 01:06:07 GMT
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
text/html; charset=utf-8
location
https://storage.glancecdn.net/cobrowse/js/GlanceCobrowseLoader_5.6.3M.js
access-control-allow-origin
*
cache-control
max-age=3600
content-length
189
css.css
item1.club/private/ 		900 KB
432 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://item1.club/private/css.css
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed /
Resource Hash
ec1a416ecdb7b44747a62f6c9d629dcfa941419484fad7d37e3cf720054c676e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:07 GMT
content-encoding
br
last-modified
Fri, 24 Jul 2020 17:08:54 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
441607
expires
Fri, 04 Nov 2022 01:06:07 GMT
HP_Master-CSS%5B1%5D.css
item1.club/bin-public/060_www_fidelity_com/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://item1.club/bin-public/060_www_fidelity_com/css/HP_Master-CSS%5B1%5D.css
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:07 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
nav-07.18.min.css
www.fidelity.com/bin-public/060_www_fidelity_com/css/ 		43 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fidelity.com/bin-public/060_www_fidelity_com/css/nav-07.18.min.css
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.186.195 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-195.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
f55b9d9ac7bc2eb4528447bd8928c9469428956b6bbc9759656e517a44dea2ab

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id
GuyOXJNt3BXtAbUpwHJhqKqS.bXCqDi.
content-encoding
gzip
date
Fri, 28 Oct 2022 01:06:07 GMT
x-amz-request-id
VTV9Y5YM53AQQCAK
x-amz-server-side-encryption
AES256
x-amz-replication-status
PENDING
content-length
12840
x-amz-id-2
bUiFCcXkmnmmN6MmyDkeLxliQodIsk3tGbAcs+9GKlypcHqIXB17aGlibfDzGGv3QKAl2hzPWKA=
pragma
no-cache
last-modified
Thu, 28 Oct 2021 20:29:56 GMT
server
AmazonS3
etag
"d88524a63ab9582a63b77f76a924536f"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Fri, 28 Oct 2022 01:06:07 GMT
nav-07.18.min.js
www.fidelity.com/bin-public/060_www_fidelity_com/js/ 		101 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fidelity.com/bin-public/060_www_fidelity_com/js/nav-07.18.min.js
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.186.195 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-195.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
3280a25a3c82cd2a29b6c5e18aee0c341e10b5cc381b59eef1bd4ea01219e54c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id
_xb0hXl9o3msNBlIBqAdQK3pYACXKKKF
content-encoding
gzip
date
Fri, 28 Oct 2022 01:06:07 GMT
x-amz-request-id
X2QJAEQJHTA62NN5
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
content-length
36134
x-amz-id-2
bv8bRDORs/bA5Lj6BWiMPUgLn1O7AiJ8tgQdPpGbINLryuRdoK4V73nfOmT1C2OpQqDVQV3l1Ns=
pragma
no-cache
last-modified
Wed, 08 Aug 2018 00:50:30 GMT
server
AmazonS3
etag
"1fa0c21a960f0651e4ba7d224096cabc"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Fri, 28 Oct 2022 01:06:07 GMT
1.png
item1.club/private/ 		56 KB
56 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://item1.club/private/1.png
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed /
Resource Hash
e90598ea92620b5e2df2b055f3f50ed64a70aaada4266a3914d8822f514b6095

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:07 GMT
last-modified
Fri, 24 Jul 2020 17:21:46 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
57524
expires
Fri, 04 Nov 2022 01:06:07 GMT
hp-tabset.js
item1.club/bin-public/060_www_fidelity_com/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://item1.club/bin-public/060_www_fidelity_com/js/hp-tabset.js
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:07 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
white-check-new.png
item1.club/bin-public/060_www_fidelity_com/images/why-fidelity/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://item1.club/bin-public/060_www_fidelity_com/images/why-fidelity/white-check-new.png
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash
21e48e923af6d9f3c2696ea5040575cf91c41c76e417f8e0a384bb077b372583

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:07 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
gray-check-new.png
item1.club/bin-public/060_www_fidelity_com/images/homepage/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://item1.club/bin-public/060_www_fidelity_com/images/homepage/gray-check-new.png
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash
0a878fdce40dc36bc9d054d5f27db7f1ef9d33bea49cc66fb6fadaa10e9d4aff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:07 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
seo-footer.css
item1.club/bin-public/060_www_fidelity_com/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://item1.club/bin-public/060_www_fidelity_com/css/seo-footer.css
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:07 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
hp_ret-score-style.css
item1.club/bin-public/060_www_fidelity_com/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://item1.club/bin-public/060_www_fidelity_com/css/hp_ret-score-style.css
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:07 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
hp-tabset.css
item1.club/bin-public/060_www_fidelity_com/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://item1.club/bin-public/060_www_fidelity_com/css/hp-tabset.css
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:07 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
hp_ratings-style.css
item1.club/bin-public/060_www_fidelity_com/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://item1.club/bin-public/060_www_fidelity_com/css/hp_ratings-style.css
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:07 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
hp_table-styles.css
item1.club/bin-public/060_www_fidelity_com/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://item1.club/bin-public/060_www_fidelity_com/css/hp_table-styles.css
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:07 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
Bootstrap.js
nexus.ensighten.com/fidelity/prod/ 		1 MB
265 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.189.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-22.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
eaaa914edfaa2eb9cde3f6291e6ad070046eecb5058a5baa97bfaf440310de2b

Request headers

Referer
https://item1.club/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 20 Oct 2022 06:51:31 GMT
x-amz-version-id
JbEu0z8wBI5dzpgWfHY3P.FIltQlPPsN
content-encoding
br
via
1.1 0e7eb16f335fe24acf3f13c5dee19c88.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
670478
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Thu, 20 Oct 2022 06:50:20 GMT
server
AmazonS3
etag
W/"9bde612d4c79862bed6041ca41569d4c"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=300
x-amz-cf-id
uXC0blDceKGuascv5jmIIPLngdXemwF0jrR5KkZMlEX35FwbKxY1Lg==
id
dpm.demdex.net/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=EDCF01AC512D2B770A490D4C%40AdobeOrg&d_nsid=0&ts=1666919168287
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.155.40.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-155-40-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
9c8bfd8259efea6b16083370b31670a300d462917b7fd663928a4bfcb2943328
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://item1.club/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-1-v044-0b1a912a4.edge-irl1.demdex.com 2 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
7sY016haSzw=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://item1.club
Content-Type
application/json;charset=utf-8
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
1202
Expires
Thu, 01 Jan 1970 00:00:00 UTC
serverComponent.php
dmt.fidelity.com/fidelity/prod/ 		297 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dmt.fidelity.com/fidelity/prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=dmt.fidelity.com/fidelity/prod/code/&publishedOn=Thu%20Oct%2020%2006:50:14%20GMT%202022&ClientID=65&PageID=https%3A%2F%2Fitem1.club%2Fprivate%2F
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.186.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-211.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a828564dc10e2df640964a2c97a3c7c1eb4de8a096de0e5ce478caa8eb310473

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:08 GMT
server
nginx
x-amz-cf-pop
CDG50-C2
content-type
text/javascript
cache-control
no-cache, no-store
content-length
297
x-amz-cf-id
fJNte6upI__M964xpMdIqJDMwDwm50LoSQeYfgb9nURoZ_MVrDH1Vw==
expires
Fri, 28 Oct 2022 01:06:07 GMT
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a458e7d5f78e768334824e9f97f2d362e10a86ee84b3fc9fb9d0441d65f9266d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/svg+xml
FidelitySans-Regular.woff
assets.fidelity.com/fonts/ 		49 KB
50 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.fidelity.com/fonts/FidelitySans-Regular.woff
Requested by
Host: item1.club
URL: https://item1.club/private/css.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.162 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-162.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f2039afe1f42eebdc7774eccc3ba81e44541eb0936357bf2088846dd96cffd4d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://item1.club/
Origin
https://item1.club
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Date
Fri, 28 Oct 2022 01:06:08 GMT
X-Content-Type-Options
nosniff
P3P
CP="UNI DEM GOV FIN STA COM NAV PRE INT ONL CUR ADM DEV PSA PSD CUSi IVDi IVAi TELi CONi TAI OUR OTRi"
fscalleeid
https-digital.fidelity.com-10000
Connection
keep-alive
Content-Length
50220
fsreqid
REQ6356884ae4ac0f3094f8c46a86b5aa33
Server
Apache
ETag
"1164b06880f3cca02a34f8b00555b1b8"
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
application/font-woff; charset=iso-8859-1
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-XSRF-TOKEN
fselapsedtime
99928
Cache-Control
no-store
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
appid, appname, content-type, X-XSRF-TOKEN
Expires
Fri, 28 Oct 2022 01:06:08 GMT
white-check-new.png
item1.club/bin-public/060_www_fidelity_com/images/why-fidelity/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://item1.club/bin-public/060_www_fidelity_com/images/why-fidelity/white-check-new.png
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash
5084b706ae83d254fd5bf6ddc95c2ee4e5a37fc656f0448076778f99e732d5e5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:08 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
content-length
5722
expires
Thu, 19 Nov 1981 08:52:00 GMT
gray-check-new.png
item1.club/bin-public/060_www_fidelity_com/images/homepage/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://item1.club/bin-public/060_www_fidelity_com/images/homepage/gray-check-new.png
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash
a8b1e52e4907bc4f0905763b905eada0d2c668138282f92829390579d8a94574

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:08 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
truncated
/ 		52 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25aac3c0244fdf4d9f9ddae3db3049ca21dffef72043f769fcde8fb4fda14245

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
FidelitySans-Light.woff
assets.fidelity.com/fonts/ 		52 KB
53 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.fidelity.com/fonts/FidelitySans-Light.woff
Requested by
Host: item1.club
URL: https://item1.club/private/css.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.162 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-162.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
414ed8003ce4f1835e33a296fb2a54f52b9e646da2f8fac4caf765893749909f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://item1.club/
Origin
https://item1.club
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Date
Fri, 28 Oct 2022 01:06:08 GMT
X-Content-Type-Options
nosniff
P3P
CP="UNI DEM GOV FIN STA COM NAV PRE INT ONL CUR ADM DEV PSA PSD CUSi IVDi IVAi TELi CONi TAI OUR OTRi"
fscalleeid
https-digital.fidelity.com-10000
Connection
keep-alive
Content-Length
53316
fsreqid
REQ63568d7488748c4786f493354028aa33
Server
Apache
ETag
"26cfa5483fdb802f8aed0d9bdd67d76b"
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
application/font-woff; charset=iso-8859-1
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-XSRF-TOKEN
fselapsedtime
102502
Cache-Control
no-store
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
appid, appname, content-type, X-XSRF-TOKEN
Expires
Fri, 28 Oct 2022 01:06:08 GMT
FidelitySans-Bold.woff
assets.fidelity.com/fonts/ 		46 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.fidelity.com/fonts/FidelitySans-Bold.woff
Requested by
Host: item1.club
URL: https://item1.club/private/css.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.162 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-162.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
44e033b4ca419dbf36f29ffd31977b4b47eecc9b7590e219bb82f982fc4fc153
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://item1.club/
Origin
https://item1.club
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Date
Fri, 28 Oct 2022 01:06:08 GMT
X-Content-Type-Options
nosniff
P3P
CP="UNI DEM GOV FIN STA COM NAV PRE INT ONL CUR ADM DEV PSA PSD CUSi IVDi IVAi TELi CONi TAI OUR OTRi"
fscalleeid
https-digital.fidelity.com-10000
Connection
keep-alive
Content-Length
46800
fsreqid
REQ635689c7ebc99e268306c63cd1d9aa33
Server
Apache
ETag
"6eca06fb033d0829b5075a48c19079a4"
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
application/font-woff; charset=iso-8859-1
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-XSRF-TOKEN
fselapsedtime
93013
Cache-Control
no-store
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
appid, appname, content-type, X-XSRF-TOKEN
Expires
Fri, 28 Oct 2022 01:06:08 GMT
GlancePresenceVisitor_5.6.3M.js
storage.glancecdn.net/cobrowse/js/
Redirect Chain
  • https://www.glancecdn.net/cobrowse/js/GlancePresenceVisitor_5.6.3M.js
  • https://storage.glancecdn.net/cobrowse/js/GlancePresenceVisitor_5.6.3M.js
18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://storage.glancecdn.net/cobrowse/js/GlancePresenceVisitor_5.6.3M.js
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Server
2600:9000:21f3:7e00:d:addc:2400:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
61fbcc82f876d63e9d0ddd1251d638646510ae157cd8ccc839144773ec53982c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Wed, 19 Oct 2022 22:46:18 GMT
x-amz-version-id
pjNZSME4V0jyETPyEufm22uG0D7KL3oW
content-encoding
br
via
1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
age
699591
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Tue, 26 Jul 2022 12:23:56 GMT
server
AmazonS3
etag
W/"f3a346a8f3f38ba1e5097562b5dcc59f"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31556926
x-amz-cf-id
GkHmIOd_Rj2ZiaL_sqsjCVTqGevnNu7tj_wvR5tpu-UHhFh4XVzsTQ==

Redirect headers

location
https://storage.glancecdn.net/cobrowse/js/GlancePresenceVisitor_5.6.3M.js
access-control-allow-origin
*
date
Fri, 28 Oct 2022 01:06:08 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-length
196
content-type
text/html; charset=UTF-8
r.rnc
dmt.fidelity.com/privacy/v1/b/ 		0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dmt.fidelity.com/privacy/v1/b/r.rnc?n=0&c=65&i=4u838w&p=prod&s=332&d=8BV7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNTcUAPAcY2xpZW50SWQiOjY1LCJwdWJsaXNoUGF0aCI6InByb2QiLCJpbnN0YW5jZSUA8lgiNHU4Mzh3IiwicGFja2V0IjowLCJtb2RlIjoib2JzZXJ2ZSIsImNvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IkFsbG93ZWQgRG9tYWluIiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0uABgIiwidHlwWwDwD2JpbGxpbmciLCJzdGFydCI6MTY2NjkxOTE2ODM5M2QAwGQiOi0xLCJzb3VyYzIAAisAYXR1cyI6ImYAQGFzb25lANRdLCJkYXRhUGF0dGVyEgDCbGlzdCI6W10sImlkXQDAOTE5MTY4MzkzfV19
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.186.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-211.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:08 GMT
cache-control
no-cache, no-store
server
nginx
x-amz-cf-pop
CDG50-P1
x-amz-cf-id
esy72ODrZCpLbU527haFqVgoMoH0J2d10rKxQGgFBorvFvij2yopdA==
expires
Fri, 28 Oct 2022 01:06:07 GMT
popup.gif
item1.club/images/css/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://item1.club/images/css/popup.gif
Requested by
Host: item1.club
URL: https://item1.club/private/css.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash
d11e22c6d94650a1c16bd54e1cb9e48ddccbb5d2b7699a091750948c888c4f6a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/css.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:08 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
Footer_BG.png
item1.club/images/css/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://item1.club/images/css/Footer_BG.png
Requested by
Host: item1.club
URL: https://item1.club/private/css.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash
6eea4b52809599360ba8959dee02d7feacbd62403f6ed2297b987b5154708fd8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/css.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:08 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
grey-pipe-sm.gif
item1.club/images/css/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://item1.club/images/css/grey-pipe-sm.gif
Requested by
Host: item1.club
URL: https://item1.club/private/css.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.215.23 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium184-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash
3f4826d4308fd8ea2faf844cc5983f913e7207fa00ac5e938700f0cb6ec71366

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/private/css.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:08 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-turbo-charged-by
LiteSpeed
expires
Thu, 19 Nov 1981 08:52:00 GMT
truncated
/ 		60 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
021ecc4b40ba6752d0770862fecd74029b1e4ebfa770d21b568c73fbe2cffe7f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/gif
dest5.html
fidelity.demdex.net/ Frame 30CD 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fidelity.demdex.net/dest5.html?d_nsid=0
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.211.12.99 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-12-99.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://item1.club/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
text/html;charset=UTF-8
DCS
dcs-prod-irl1-1-v044-077cfb62e.edge-irl1.demdex.com 0 ms
Expires
Thu, 01 Jan 1970 00:00:00 UTC
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
xpmkw95mQNc=
content-encoding
gzip
date
Fri, 28 Oct 2022 01:06:08 GMT
last-modified
Thu, 29 Sep 2022 16:18:55 GMT
transfer-encoding
chunked
vary
accept-encoding
id
sitecatalyst.fidelity.com/ 		2 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://sitecatalyst.fidelity.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=EDCF01AC512D2B770A490D4C%40AdobeOrg&mid=43853915370395148110704670920637163202&ts=1666919168486
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.162 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-162.deploy.static.akamaitechnologies.com
Software
jag /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://item1.club/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Fri, 28 Oct 2022 01:06:09 GMT
x-content-type-options
nosniff
Server
jag
Vary
Origin
Content-Type
application/x-javascript;charset=utf-8
Access-Control-Allow-Origin
https://item1.club
p3p
CP="This is not a P3P policy"
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
2
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=Y1srAAAAAGD-dwN-
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=37834629693295341820115681406568758943
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y1srAAAAAGD-dwN-
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y1srAAAAAGD-dwN-
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
HTTP/1.1
Server
54.155.40.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-155-40-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v044-0deb8e9c6.edge-irl1.demdex.com 1 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
GxU2twAoTm0=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y1srAAAAAGD-dwN-
Date
Fri, 28 Oct 2022 01:06:08 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
c4d53c518fa4bd1002c5b9e392e2abaf.js
dmt.fidelity.com/fidelity/prod/code/ 		194 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dmt.fidelity.com/fidelity/prod/code/c4d53c518fa4bd1002c5b9e392e2abaf.js?conditionId0=46215&conditionId1=422684
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.186.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-211.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
10da41dd4e5e3cf00a64e86e92fa625bc6e6b3cb97714815f260e165598ce37e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id
XyBEMRKBUS3gdEutjrOws6RgJvv_TAEf
content-encoding
gzip
date
Fri, 28 Oct 2022 01:06:08 GMT
last-modified
Thu, 20 Oct 2022 06:50:20 GMT
server
AmazonS3
x-amz-cf-pop
LHR50-C1
etag
W/"8d56ffacc1c66b42db19bf06c345ec1e"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
x-amz-replication-status
PENDING
x-amz-cf-id
92hLSesZKI-L8GM0gld7c0L_bvnSQ1MfjGU68ZWTdyIJHVq8jEYfhw==
content-length
52887
365868.gif
idsync.rlcdn.com/ Frame 30CD 		0
98 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/365868.gif?partner_uid=37834629693295341820115681406568758943
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:08 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
ibs:dpid=358&dpuuid=2319289887296085200
dpm.demdex.net/ Frame 30CD
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID
  • https://dpm.demdex.net/ibs:dpid=358&dpuuid=2319289887296085200
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=358&dpuuid=2319289887296085200
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
HTTP/1.1
Server
54.155.40.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-155-40-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v044-0f3529585.edge-irl1.demdex.com 1 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
wrw5CiRgQ6k=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma
no-cache
Date
Fri, 28 Oct 2022 01:06:08 GMT
AN-X-Request-Uuid
9d3b8fe5-295f-456d-813c-49dd7ffdea92
Server
nginx/1.21.3
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Location
https://dpm.demdex.net/ibs:dpid=358&dpuuid=2319289887296085200
Connection
keep-alive
X-Proxy-Origin
217.114.218.23; 217.114.218.23; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
365868.gif
idsync.rlcdn.com/ Frame 30CD 		0
42 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/365868.gif?partner_uid=37834629693295341820115681406568758943
Requested by
Host: item1.club
URL: https://item1.club/private/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:08 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
/
zncvgjh8lmjxbkyln-fmrpi.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zncvgjh8lmjxbkyln-fmrpi.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_cvGJH8lmjxbKyln&Q_LOC=https%3A%2F%2Fitem1.club%2Fprivate%2F&t=1666919169026
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
512570b4ec9948dc4b498fec9fa7728edd56b486247af9806b3d3e70c9536554
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
28532
cf-polished
origSize=8487
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"2127-IgOjmdv+KsuGBj7yTHC2fgFqUto"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=3600, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46718f9bbe9-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
ibs:dpid=771&dpuuid=CAESEH_xeyztZgwR1cYC1GXGY2w&google_cver=1
dpm.demdex.net/ Frame 30CD
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=Mzc4MzQ2Mjk2OTMyOTUzNDE4MjAxMTU2ODE0MDY1Njg3NTg5NDM=
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=Mzc4MzQ2Mjk2OTMyOTUzNDE4MjAxMTU2ODE0MDY1Njg3NTg5NDM=&google_tc=
  • https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEH_xeyztZgwR1cYC1GXGY2w&google_cver=1?gdpr=0&gdpr_consent=
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEH_xeyztZgwR1cYC1GXGY2w&google_cver=1?gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
54.155.40.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-155-40-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v044-0cc10ed06.edge-irl1.demdex.com 2 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
LS4Edq9qSTA=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:09 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEH_xeyztZgwR1cYC1GXGY2w&google_cver=1?gdpr=0&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
s46143041231304
sitecatalyst.fidelity.com/b/ss/fidelitycom/10/JS-2.9.0/ 		4 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sitecatalyst.fidelity.com/b/ss/fidelitycom/10/JS-2.9.0/s46143041231304?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=28%2F9%2F2022%201%3A6%3A9%205%200&d.&nsid=0&jsonv=1&.d&ts=1666919169&mid=43853915370395148110704670920637163202&aamlh=6&ce=UTF-8&ns=fidelity&pageName=item1.club%2Fprivate%2F&g=https%3A%2F%2Fitem1.club%2Fprivate%2F&c.&bot=0&mcvisid=43853915370395148110704670920637163202&ptst=0&shareYourScreen=true&tms=3&ens_loc=body&d80=0&d83=0&dateDetail=43%7C5%7C1%3A00%7C6&lilo=Lo&p9=No%20NavBar%20Interaction&rmdata=rNA%7Cg00%7Cei0%7CciNA&subdomain=item1&VSSOURCE=Fidelity&SEC=NotConfigured&VSCHANNEL=Fid.com%20web&channelManager=Typed%2FBookmarked&channelManagerDetail=tb%7Citem1.club%2Fprivate%2F&channelManagerKeyword=n%2Fa&channelManagerStacking=Typed%2FBookmarked&p8=%7C%7C&VSFORMAT=1600%7CLarge%7CNo%20App%20Format&sourceEnv=prod&ecidMIDDebug=43853915370395148110704670920637163202&csEnabled=0&.c&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v16=D%3Dc11&v18=D%3Dc16&v21=First%20Visit&v75=2022-10-20%7CS.2.9.0%7CTMS&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=EDCF01AC512D2B770A490D4C%40AdobeOrg&AQE=1
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.162 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-162.deploy.static.akamaitechnologies.com
Software
jag /
Resource Hash
61e233f08ebab372d508a9a4142b590add10284482a71c7603ffe094ffd8669f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-aam-tid
+5IFmfYKS04=
Date
Fri, 28 Oct 2022 01:06:09 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy"
Connection
keep-alive
Content-Length
1132
x-xss-protection
1; mode=block
dcs
dcs-prod-irl1-1-v044-043da1e93.edge-irl1.demdex.com 5 ms
Pragma
no-cache
Last-Modified
Sat, 29 Oct 2022 01:06:09 GMT
Server
jag
ETag
3579681658526269440-4619376845286629514
Vary
*, Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Expires
Thu, 27 Oct 2022 01:06:09 GMT
adsct
analytics.twitter.com/i/ Frame 30CD 		43 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/i/adsct?p_user_id=37834629693295341820115681406568758943&p_id=38594
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-response-time
112
date
Fri, 28 Oct 2022 01:06:08 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
f2efd9f29a3c7c29
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
0af9ad74c9611b4998986cff7f53a623f60538366609e479ded13a28838dc8d1
content-length
43
11.1163f93a1b03283dcecd.chunk.js
siteintercept.qualtrics.com/dxjsmodule/ 		61 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/11.1163f93a1b03283dcecd.chunk.js?Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web&Q_BRANDID=item1.club
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fcc99bc542379c45755d2d0dda5263aecbac09227b828b070b891af45c61bf7a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
22589
cf-polished
origSize=63507
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 10 Oct 2022 17:00:14 GMT
cf-bgj
minify
server
cloudflare
etag
W/"f813-183c2d70130"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc467aa58bbe9-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
ibs:dpid=1957&dpuuid=1B6AEE97F63E6F383DE2FCDCF7556E65
dpm.demdex.net/ Frame 30CD
Redirect Chain
  • https://c.bing.com/c.gif?uid=37834629693295341820115681406568758943&Red3=MSAdobe_pd&gdpr=0&gdpr_consent=
  • https://dpm.demdex.net/ibs:dpid=1957&dpuuid=1B6AEE97F63E6F383DE2FCDCF7556E65
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=1B6AEE97F63E6F383DE2FCDCF7556E65
Protocol
HTTP/1.1
Server
54.155.40.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-155-40-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v044-030456c97.edge-irl1.demdex.com 1 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
7VrFS6MMTRA=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:08 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: C31AD14D83654824AA52DE427DBDBA0E Ref B: FRAEDGE1515 Ref C: 2022-10-28T01:06:09Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=1B6AEE97F63E6F383DE2FCDCF7556E65
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
Targeting.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		118 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_cvGJH8lmjxbKyln&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93a1d42da9ee3e7b25f8bbdba4a361560ab25043f5be40761a94685868aae7c9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://item1.club/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://item1.club
cache-control
no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
permissions-policy
camera=(), geolocation=(), microphone=()
trace-id
c881bc88c454c1da
cf-ray
760fc4683b3dbbe9-FRA
timing-allow-origin
*
clix
clixqa4.fmr.com/ 		0
0
ibs:dpid=782&dpuuid=Y1srAAAAAGD-dwN-
dpm.demdex.net/ Frame 30CD
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D782%26dpuuid%3D%24%7BTM_USER_ID%7D
  • https://dpm.demdex.net/ibs:dpid=782&dpuuid=Y1srAAAAAGD-dwN-
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=782&dpuuid=Y1srAAAAAGD-dwN-
Protocol
HTTP/1.1
Server
54.155.40.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-155-40-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v044-0e9d243f4.edge-irl1.demdex.com 2 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
fBjhfLUzTXs=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

x-served-by
cache-hhn4054-HHN
pragma
no-cache
date
Fri, 28 Oct 2022 01:06:09 GMT
via
1.1 varnish
server
Varnish
x-timer
S1666919169.405835,VS0,VE0
x-cache
HIT
location
https://dpm.demdex.net/ibs:dpid=782&dpuuid=Y1srAAAAAGD-dwN-
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
/
rtd-tm.everesttech.net/migrate_et3/ Frame 30CD
Redirect Chain
  • https://rtd.tubemogul.com/migrate_et3/
  • https://rtd-tm.everesttech.net/migrate_et3/
0
219 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtd-tm.everesttech.net/migrate_et3/
Protocol
H2
Server
151.101.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-served-by
cache-hhn4054-HHN
pragma
no-cache
date
Fri, 28 Oct 2022 01:06:09 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
x-timer
S1666919170.523423,VS0,VE88
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
content-length
0
x-cache-hits
0

Redirect headers

x-served-by
cache-hhn4071-HHN
pragma
no-cache
date
Fri, 28 Oct 2022 01:06:09 GMT
via
1.1 varnish
server
Varnish
x-timer
S1666919169.499675,VS0,VE0
x-cache
HIT
location
https://rtd-tm.everesttech.net/migrate_et3/
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
pixel
cm.g.doubleclick.net/ Frame 30CD
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTFzckFBQUFBR0QtZHdOLQ==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTFzckFBQUFBR0QtZHdOLQ==
Protocol
H3
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:09 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by
cache-hhn4054-HHN
pragma
no-cache
date
Fri, 28 Oct 2022 01:06:09 GMT
via
1.1 varnish
server
Varnish
x-timer
S1666919170.546710,VS0,VE0
x-cache
HIT
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTFzckFBQUFBR0QtZHdOLQ==
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
CoreModule.js
siteintercept.qualtrics.com/dxjsmodule/ 		102 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web&Q_BRANDID=fmrpi
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20ee45b17985faa6172dc3930d47bb56303e3e9f4452e72e2c0feb9d562a081d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
22589
cf-polished
origSize=105331
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 10 Oct 2022 17:00:14 GMT
cf-bgj
minify
server
cloudflare
etag
W/"19b73-183c2d70130"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46a2819bbe9-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
tap.php
pixel.rubiconproject.com/ Frame 30CD
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
  • https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y1srAAAAAGD-dwN-&expires=90
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y1srAAAAAGD-dwN-&expires=90
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
704c1e4d3fcc922a3031d436b584678b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by
cache-hhn4054-HHN
pragma
no-cache
date
Fri, 28 Oct 2022 01:06:09 GMT
via
1.1 varnish
server
Varnish
x-timer
S1666919170.647421,VS0,VE0
x-cache
HIT
location
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y1srAAAAAGD-dwN-&expires=90
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
4.3b9b4addd065f99c38ba.chunk.js
siteintercept.qualtrics.com/dxjsmodule/ 		2 KB
897 B 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/4.3b9b4addd065f99c38ba.chunk.js?Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web&Q_BRANDID=fmrpi
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d427be16bb613ac2143ccfc846c52ed07b52640e8271757e260f9d4071ab66f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
22589
cf-polished
origSize=2539
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 10 Oct 2022 17:00:14 GMT
cf-bgj
minify
server
cloudflare
etag
W/"9eb-183c2d70130"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b1aebbbe9-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
1.abd4c1d883bf4b225b59.chunk.js
siteintercept.qualtrics.com/dxjsmodule/ 		28 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/1.abd4c1d883bf4b225b59.chunk.js?Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web&Q_BRANDID=fmrpi
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c75818fa24700b4e5db803928119c17500f98e3d0f7fb33f07db6cbd5f7b203
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
22589
cf-polished
origSize=29568
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 10 Oct 2022 17:00:14 GMT
cf-bgj
minify
server
cloudflare
etag
W/"7380-183c2d70130"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b1af0bbe9-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
FeedbackLinkModule.js
siteintercept.qualtrics.com/dxjsmodule/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/FeedbackLinkModule.js?Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web&Q_BRANDID=fmrpi
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
90c8c49df9363f906709ff1407e338b965b70a1eed9f3e573a4306fd267f1c0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
22533
cf-polished
origSize=3552
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 10 Oct 2022 17:00:14 GMT
cf-bgj
minify
server
cloudflare
etag
W/"de0-183c2d70130"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b1af2bbe9-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
PopUpModule.js
siteintercept.qualtrics.com/dxjsmodule/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/PopUpModule.js?Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web&Q_BRANDID=fmrpi
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ff88b1e9e5b074a18cb830a6eee6e1713df09d4f3e8b8514cbd2a9f42925578
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
22343
cf-polished
origSize=4746
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 10 Oct 2022 17:00:14 GMT
cf-bgj
minify
server
cloudflare
etag
W/"128a-183c2d70130"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b1af4bbe9-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
EmbeddedTargetModule.js
siteintercept.qualtrics.com/dxjsmodule/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/EmbeddedTargetModule.js?Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web&Q_BRANDID=fmrpi
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a68d55d5edf25c0baea3cd150e155c1c64eadbdc52a44ec5f239b8f27e250c8e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
22588
cf-polished
origSize=8462
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 10 Oct 2022 17:00:14 GMT
cf-bgj
minify
server
cloudflare
etag
W/"210e-183c2d70130"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b1af6bbe9-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
PopOverModule.js
siteintercept.qualtrics.com/dxjsmodule/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/PopOverModule.js?Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web&Q_BRANDID=fmrpi
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d67fb1e900ac570b160aaf2200d35ab1d41f00d0979ade72034289e9d3ab262
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
22588
cf-polished
origSize=10440
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 10 Oct 2022 17:00:14 GMT
cf-bgj
minify
server
cloudflare
etag
W/"28c8-183c2d70130"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b1afabbe9-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		5 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AsPpi6JZXIjgMZ&Version=65&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
600d7ca8124e15df776c701868b82a0282b14f3ca64ffac4152b8c419f203b1c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b7fcb920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		328 B
300 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_0ia68TaWR1dbtn7&Version=4&Q_InterceptID=SI_0AsPpi6JZXIjgMZ&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1953b94ba034ab9ad857a51e0b28bb70b57a73a7fe51753d05df1cbdf0fb775b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b7fd0920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_9Abf3gre87Bgb4i&Version=4&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
61a7adddba7d096b4fa5ea4ef4e774c372f4169f870b0533e3cc4b708d43ba95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b7fcf920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		289 B
270 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_eFBXElNuwIHb8W2&Version=1&Q_InterceptID=SI_9Abf3gre87Bgb4i&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b42c3e71681366cd6ec743a3bcc6d8f739f09415dc72875e539d98ff05cb35c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b7fd2920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		6 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_38gbTVRzn9rMkaq&Version=3&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
01b456b63ccf637be190ab22598ded353dfe8a2f49d4b589450d5f4e44d53c85
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9850920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		289 B
278 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_eFBXElNuwIHb8W2&Version=1&Q_InterceptID=SI_38gbTVRzn9rMkaq&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b42c3e71681366cd6ec743a3bcc6d8f739f09415dc72875e539d98ff05cb35c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:09 GMT
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9851920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		5 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_bmvqwK4G0RfqFHn&Version=6&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9a169cc782012d9a5ece8cf798f618fdb59bcbd85da9576b80fd419399c1c225
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9842920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		290 B
327 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_er32JI1gjlcuQRf&Version=3&Q_InterceptID=SI_bmvqwK4G0RfqFHn&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55e2b2ab595e0c192f763ad2c2a237f3f92ecc51e843da550393ffb51a7f115b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9844920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		5 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_6tg8PWOi1frIFut&Version=3&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
053f6f7de2dc83b0efa801d03de4f0f1b15cc6c43146f2f97484ee7384e05f21
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9846920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		290 B
269 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_er32JI1gjlcuQRf&Version=3&Q_InterceptID=SI_6tg8PWOi1frIFut&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55e2b2ab595e0c192f763ad2c2a237f3f92ecc51e843da550393ffb51a7f115b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9848920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		5 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_aWusZd3gjeTf5gq&Version=4&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d62ca817b668e2e7fe40448059352566ecf10985548312f7a24a9c8b83fa3813
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b984a920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		289 B
271 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_eFBXElNuwIHb8W2&Version=1&Q_InterceptID=SI_aWusZd3gjeTf5gq&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b42c3e71681366cd6ec743a3bcc6d8f739f09415dc72875e539d98ff05cb35c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:09 GMT
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b984d920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		5 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_aYqf0yaiHxFK3tQ&Version=4&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84694d83725e88328f1e12e509d9fd4244bbf60162859af52dee3e89917a5dd2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9821920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		289 B
276 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_eFBXElNuwIHb8W2&Version=1&Q_InterceptID=SI_aYqf0yaiHxFK3tQ&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b42c3e71681366cd6ec743a3bcc6d8f739f09415dc72875e539d98ff05cb35c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:09 GMT
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9827920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		5 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_8lgMP25Ikgjv0we&Version=4&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc8721a1adc4924783894d6a7ffc53ec2b6a9f1d434f6105fe0bfe632de8eb2b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9828920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		289 B
269 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_eFBXElNuwIHb8W2&Version=1&Q_InterceptID=SI_8lgMP25Ikgjv0we&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b42c3e71681366cd6ec743a3bcc6d8f739f09415dc72875e539d98ff05cb35c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:09 GMT
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b982c920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_dgsx9hrWB3K6913&Version=2&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b376e7247f7b6432d3bd4f87c3598250819e31dfac7b17fa11f14ad568c35be1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9832920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		298 B
276 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_bOXDLte5ExB3fcV&Version=1&Q_InterceptID=SI_dgsx9hrWB3K6913&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d17ea77190820fb8045de841be49d7ca27100343608eddfc073513d676d932b3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9835920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_6JrOieTJRaQjNt3&Version=2&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
80215e4d119951a2bdbb49d39524be4f7c8af7daeb0cd692ab70a90c9691889a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b981b920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		295 B
292 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_9tyxYsdHImRttqd&Version=1&Q_InterceptID=SI_6JrOieTJRaQjNt3&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33f544d59c46dc9e521b38e634b51cbdfc4c010e92aa2bb00a75b31681859873
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b981c920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_aavOQmPi2QSZKE5&Version=3&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c057703e7565118ba2084013ce7b26196eb48eb1103925bc9f703b2b251fbbb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b981d920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		304 B
279 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_9zBaZSEe4Cd5tiJ&Version=1&Q_InterceptID=SI_aavOQmPi2QSZKE5&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3a8c79033d6f51d9221602443e34d42e174fd3d9fedd49be51747a5217ac01d7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b981f920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_9slyRRmuwUZ9tfT&Version=2&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb55d122ba0e3370c1d5c52c60f16db655f997c045402c2e52187615ce580477
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9862920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		290 B
269 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_er32JI1gjlcuQRf&Version=3&Q_InterceptID=SI_9slyRRmuwUZ9tfT&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55e2b2ab595e0c192f763ad2c2a237f3f92ecc51e843da550393ffb51a7f115b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9863920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		2 KB
937 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_9NSjltynMtHhMFf&Version=1&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f6b4a6124675203780f1883d16d012e98448f6dceec35da99e980c073fcf1e71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9864920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		2 KB
990 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_cRTya5i3wiaWo4Z&Version=6&Q_InterceptID=SI_9NSjltynMtHhMFf&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
916f83f2e81b458e401fc26b0733372778fa05289ef0aec0cafab025ab47b23f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9865920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_6KILeGGAuPslJ7n&Version=2&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e07bd958925ada74f41859021ac752ddc2c7da287a426e8e5ebf8ae3d3073abe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9866920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		290 B
270 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_er32JI1gjlcuQRf&Version=3&Q_InterceptID=SI_6KILeGGAuPslJ7n&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55e2b2ab595e0c192f763ad2c2a237f3f92ecc51e843da550393ffb51a7f115b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b986b920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_20upoDg7GIYGuyh&Version=3&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
459da4c8a9f2a70da8e894d10a363dea41b4d4cdb435af95186da4031da26464
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b7fd4920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		290 B
271 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_er32JI1gjlcuQRf&Version=3&Q_InterceptID=SI_20upoDg7GIYGuyh&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55e2b2ab595e0c192f763ad2c2a237f3f92ecc51e843da550393ffb51a7f115b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b7fd7920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_aYq2S2L9WYVHefz&Version=2&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
06938dd593b945d6da6fe382a54eb2f8798be00d2f67281c8c16529a35bf9193
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b7fdb920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		290 B
277 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_er32JI1gjlcuQRf&Version=3&Q_InterceptID=SI_aYq2S2L9WYVHefz&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55e2b2ab595e0c192f763ad2c2a237f3f92ecc51e843da550393ffb51a7f115b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b7fde920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_9YUbswnCF6g4k05&Version=2&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2451f78cdf73cb2817ec2a124bc1a77b9c7100f5c30bdb521b824a83677c83a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9815920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		290 B
289 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_er32JI1gjlcuQRf&Version=3&Q_InterceptID=SI_9YUbswnCF6g4k05&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55e2b2ab595e0c192f763ad2c2a237f3f92ecc51e843da550393ffb51a7f115b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b981a920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0qryPRAlBXczdTD&Version=6&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b2502073850d32d0771c4f2c5c405d7855e61fad3719bd4efc12687523e3402
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9853920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		290 B
271 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_er32JI1gjlcuQRf&Version=3&Q_InterceptID=SI_0qryPRAlBXczdTD&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55e2b2ab595e0c192f763ad2c2a237f3f92ecc51e843da550393ffb51a7f115b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9856920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0vaYdwthIHVvh6R&Version=11&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ef8b37a63474996a7a2a5f1b20464bdcfda70740b292737fd1369a4c814b155
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9859920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		2 KB
990 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_cRTya5i3wiaWo4Z&Version=6&Q_InterceptID=SI_0vaYdwthIHVvh6R&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
916f83f2e81b458e401fc26b0733372778fa05289ef0aec0cafab025ab47b23f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b985a920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_5ndFaivuSQRQAmh&Version=6&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8596f3beb992852b9e2f1bf8bb2460a8b416637203316575786f7efbf9894829
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b985b920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		290 B
269 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_er32JI1gjlcuQRf&Version=3&Q_InterceptID=SI_5ndFaivuSQRQAmh&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55e2b2ab595e0c192f763ad2c2a237f3f92ecc51e843da550393ffb51a7f115b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9837920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_2oDT1dKLOgeFIGN&Version=2&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0efcff5e42f48dc59be55debd3f3debb3258a7c37b7d71bb22adb50ab10b450
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9838920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		2 KB
990 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_cRTya5i3wiaWo4Z&Version=6&Q_InterceptID=SI_2oDT1dKLOgeFIGN&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
916f83f2e81b458e401fc26b0733372778fa05289ef0aec0cafab025ab47b23f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b983a920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_bw1hblXpnxk5GYZ&Version=9&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e72d30c589782e1029538ee2906d6c5f28f30f877e49e617002a16a434a7d6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b983e920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		2 KB
1023 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_cRTya5i3wiaWo4Z&Version=6&Q_InterceptID=SI_bw1hblXpnxk5GYZ&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
916f83f2e81b458e401fc26b0733372778fa05289ef0aec0cafab025ab47b23f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b983c920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_eUPgeLMEq5Uop2B&Version=7&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fac61e050d5eb05f5b913840d0d65423757b34191c2dd41f434f4256dc54aa86
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b985d920e-FRA
expires
Mon, 25 Oct 2032 01:06:09 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		2 KB
990 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_cRTya5i3wiaWo4Z&Version=6&Q_InterceptID=SI_eUPgeLMEq5Uop2B&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
916f83f2e81b458e401fc26b0733372778fa05289ef0aec0cafab025ab47b23f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b985c920e-FRA
servershortname
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_bgaRAZcFBOJ6zwV&Version=9&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
75130c88fd45f06e63bc933339fde630f4d3aa270150e5f07ebc0934f1c98295
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

servershortname
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b983f920e-FRA
expires
Mon, 25 Oct 2032 01:06:10 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		2 KB
992 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_cRTya5i3wiaWo4Z&Version=6&Q_InterceptID=SI_bgaRAZcFBOJ6zwV&Q_ORIGIN=https://item1.club&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
916f83f2e81b458e401fc26b0733372778fa05289ef0aec0cafab025ab47b23f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires
Mon, 25 Oct 2032 01:06:10 GMT
date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
0
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 28 Oct 2022 01:06:10 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
760fc46b9860920e-FRA
servershortname
rum
dsum-sec.casalemedia.com/ Frame 30CD
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y1srAAAAAGD-dwN-
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y1srAAAAAGD-dwN-&C=1
43 B
766 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y1srAAAAAGD-dwN-&C=1
Protocol
HTTP/1.1
Server
185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 28 Oct 2022 01:06:09 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

Pragma
no-cache
Date
Fri, 28 Oct 2022 01:06:09 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
/rum?cm_dsp_id=88&external_user_id=Y1srAAAAAGD-dwN-&C=1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
0
Expires
0
setuid
ib.adnxs.com/ Frame 30CD
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
  • https://ib.adnxs.com/setuid?entity=158&code=Y1srAAAAAGD-dwN-
43 B
1023 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=158&code=Y1srAAAAAGD-dwN-
Protocol
HTTP/1.1
Server
37.252.173.27 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 28 Oct 2022 01:06:09 GMT
AN-X-Request-Uuid
cfa68172-4041-4c32-aa8c-2a64adfd1f9c
Server
nginx/1.21.3
Content-Type
image/gif
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
217.114.218.23; 217.114.218.23; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

x-served-by
cache-hhn4054-HHN
pragma
no-cache
date
Fri, 28 Oct 2022 01:06:09 GMT
via
1.1 varnish
server
Varnish
x-timer
S1666919170.897198,VS0,VE0
x-cache
HIT
location
https://ib.adnxs.com/setuid?entity=158&code=Y1srAAAAAGD-dwN-
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
sd
us-u.openx.net/w/1.0/ Frame 30CD
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y1srAAAAAGD-dwN-
43 B
273 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y1srAAAAAGD-dwN-
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Oct 2022 01:06:10 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

x-served-by
cache-hhn4054-HHN
pragma
no-cache
date
Fri, 28 Oct 2022 01:06:10 GMT
via
1.1 varnish
server
Varnish
x-timer
S1666919170.002498,VS0,VE0
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y1srAAAAAGD-dwN-
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
Pug
image2.pubmatic.com/AdServer/ Frame 30CD
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y1srAAAAAGD-dwN-
1 B
449 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y1srAAAAAGD-dwN-
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Fri, 28 Oct 2022 01:06:08 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

x-served-by
cache-hhn4054-HHN
pragma
no-cache
date
Fri, 28 Oct 2022 01:06:10 GMT
via
1.1 varnish
server
Varnish
x-timer
S1666919170.098702,VS0,VE0
x-cache
HIT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y1srAAAAAGD-dwN-
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
partner
sync.search.spotxchange.com/ Frame 30CD
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y1srAAAAAGD-dwN-&img=1
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y1srAAAAAGD-dwN-&img=1&__user_check__=1&sync_id=b5d87f5c-565c-11ed-a239-1d66682b0106
43 B
549 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y1srAAAAAGD-dwN-&img=1&__user_check__=1&sync_id=b5d87f5c-565c-11ed-a239-1d66682b0106
Protocol
HTTP/1.1
Server
185.94.180.126 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Fri, 28 Oct 2022 01:06:10 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
109
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Fri, 28 Oct 2022 01:06:10 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Location
/partner?adv_id=6409&uid=Y1srAAAAAGD-dwN-&img=1&__user_check__=1&sync_id=b5d87f5c-565c-11ed-a239-1d66682b0106
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
19
Connection
keep-alive
Content-Length
0
b.php
www.facebook.com/fr/ Frame 30CD
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
  • https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y1srAAAAAGD-dwN-&t=2592000&o=0
43 B
553 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y1srAAAAAGD-dwN-&t=2592000&o=0
Protocol
H2
Server
2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fidelity.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Thu, 27 Oct 2022 18:06:10 PDT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; preload
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-fb-rlafr
0
pragma
public
x-fb-debug
qCodbAnllsri55+W5l+ZRfnThEvcvKrC8Deu6zCUCEsS7KL76kUnlw1wijoPn0vYU7YY0PDrf4GnW8Zs1A85Jw==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
report-to
{"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type
image/gif
cache-control
public, max-age=0
expires
Thu, 27 Oct 2022 18:06:10 PDT

Redirect headers

x-served-by
cache-hhn4054-HHN
pragma
no-cache
date
Fri, 28 Oct 2022 01:06:10 GMT
via
1.1 varnish
server
Varnish
x-timer
S1666919170.300472,VS0,VE0
x-cache
HIT
location
https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y1srAAAAAGD-dwN-&t=2592000&o=0
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
r.rnc
dmt.fidelity.com/privacy/v1/b/ 		0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dmt.fidelity.com/privacy/v1/b/r.rnc?n=1&c=65&i=4u838w&p=prod&s=15437&d=8BV7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNTcUAPAcY2xpZW50SWQiOjY1LCJwdWJsaXNoUGF0aCI6InByb2QiLCJpbnN0YW5jZSUA8lgiNHU4Mzh3IiwicGFja2V0IjoxLCJtb2RlIjoib2JzZXJ2ZSIsImNvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IkFsbG93ZWQgRG9tYWluIiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0uADxOmh0dHBzOi8vZHBtLmRlbWRleC5uZXQvaWQ_ZF92aXNpZF92ZXI9My4xLjImZF9maWVsZGdyb3VwPU1DJmRfcnRiZD1qc29uJmQoAAAkAPA6b3JnaWQ9RURDRjAxQUM1MTJEMkI3NzBBNDkwRDRDJTQwQWRvYmVPcmcmZF9uc2lkPTAmdHM9MTY2NjkxOTE2ODI4NyIsInR5cPAAoHhociIsInN0YXIHAQckABA49QA4ZCI6OACAOCwic291cmM5ALJYSFJfTUFOQUdFUkEAgXR1cyI6ImFsGwEBFAFAYXNvbhMB1F0sImRhdGFQYXR0ZXISALJsaXN0IjpbXSwiaWYAzzcwNzg3MjQ2MTF9LEUBtR85RQEAHzlFAVIfMkUBB2B3d3cuZ2wNAzFjZG6NAqNjb2Jyb3dzZS9DCQCCSlMuYXNoeD-KArAxOTc3MiZzaXRlPU4DMHVjdNsCFCxDAmJzY3JpcHQFAgtGAi05MgEBKDMwRgKgYXBwZW5kQ2hpbKUDMnN0YUYCMGxvYRAAL3JlQwIbrzYxMDI5NTczNDP-AHMfM_4ADDFtdXQnBBJPdQQyckNMRgEPBQEzHzQFAQvxAmZpZGVsaXR5LmNvbS9iaW4tOAWkYy8wNjBfd3d3XyAAEF8gAPYEanMvbmF2LTA3LjE4Lm1pbi5qc0QEDwECBz4zMjYDASczMwIDDwMBQq81ODY5MjUzMDI1AwEH9glpdGVtMS5jbHViL3ByaXZhdGUvMS5wbmfXACBpbQ0ADRsFPzMzNNQAAB811ABOjzAyNzE3Nzgx2gMIB9QAD9EBEJ9ocC10YWJzZXTNARUvMzX5AAAfNvkAFkBlcnJvbQYP1gMdnzgzMzM1NDg2OdECCA_6AE0PxwIBD_oAWA_IAhMP9AENtGltYWdlcy93aHkt3QP_AS93aGl0ZS1jaGVjay1uZXcCAxQeNwkCGDbXBQ_WAwsPCQImnzYyMDYwMjU0NtcDEg8PAVcOLAkfMw8BWR83DwE532hvbWVwYWdlL2dyYXkZApSvNjIxMzk4NjA1OQoBdw8UAmMECgEvNjAKAQcAyQmUY2F0YWx5c3QuCQQBBggPlQwPT0EmbWOADBf6G21pZD00Mzg1MzkxNTM3MDM5NTE0ODExMDcwNDY3MDkyMDYzNzE2MzIwMqIMNjQ4NocHD6IMBC40OJQFARQAD6IMSG83OTEzMDlnAgoPXQG1DuIFNzQ4N-sHD_8NPwNdAQ-6AgkPugwIQWpzL0fUDP8HUHJlc2VuY2VWaXNpdG9yXzUuNi4zTeMIFQ-xDAAQNfAJBVUCD7EMO685MDA0NzI3NTc4rwMHD_UAUA6oDAr1AA_PBwsPrQ0kBfwAD7UFOg_dCC8eNt8LNzU0MfsCDw4BCw_dCC0fN7wOCA_mChgP7Ak2AFITImVuoxEDQRIPDwFaD_ULMwMPAQ_dCCsOzhE_NTUyGQJOBdMHDxgTCA8ZAh8PCgEqDyMDAQ8KAVgfOAAMOg8KASsOEw8PFAJZHzj7CwgrZG3eCQTrCRAvxRMRL-cW8BFyQ29tcG9uZW50LnBocD9uYW1lc3BhY2U9Qm9vdHN0cu4GIHImlxNAaWNKc1IXHz1XAAxhY29kZS8mSxLxF3NoZWRPbj1UaHUlMjBPY3QlMjAyMCUyMDA2OjUwOjE0JTIwR01UFgBCMjImQ8QXwUQ9NjUmUGFnZUlEPTsXliUzQSUyRiUyRuQCMyUyRrMRNiUyRikKD4cSCB4wLAovNTe7AxcP4gYknzg4MzY4MDk5MLACCA9PARHwGmM0ZDUzYzUxOGZhNGJkMTAwMmM1YjllMzkyZTJhYmFmLmpzP2NvbmRpmBWnSWQwPTQ2MjE1JhMAjzE9NDIyNjg0LQERPTU3Md4PNzY2MOgEsGluc2VydEJlZm9yKRkAHwIB_BcPJwEknzcxODEzOTQwOQUJCA8nAYEO3BYKJwEPKAgLDy0BLQ82CQgE6QMIcBoAlRp0NS5odG1sPxYaHyNgAxxTaWZyYW3xAQroFy40OEIKKDcx5xUASQQP6Bc3nzU3MDAxODQ3MVkDCA8FAWAONA0KBQEPEQJCBAwBHzLyDwjwCXpuY3Znamg4bG1qeGJreWxuLWZtcnBpLq0O8QRpbnRlcmNlcHQucXVhbHRyaWNzDBB0V1JTaXRlSR4A8gdFbmdpbmUvP1FfWklEPVpOX2N2R0pIUgCvS3lsbiZRX0xPQ7MFEyYmdI4cNzkwMuwPD8MFBgAnAAyWBDg5MTmSDg9jAjufNDkzOTEzNjg4aAMID1cBsg2oEgtXAQ-1AkIEXgEfOdQKCA-dAh-RVGFyZ2V0aW5nzQhQUV9ab25HCA-tAgLyCENMSUVOVFZFUlNJT049MS43OS4wJlFfFwCGVFlQRT13ZWIvBw-FEgM9OTMw9AMCFAAFMBAPKBE-nzg0NzQxNzg1NfsJCA87Af9F8BlkeGpzbW9kdWxlLzExLjExNjNmOTNhMWIwMzI4M2RjZWNkLmNodW5rkAkESwIPYgIMtiZRX0JSQU5ESUQ94AoGdwIPEAUHAfwECpgPGjlbHw-5A0KfODQ2ODIzNjk5bgYIsWNsaXhxYTQuZm1ySgYAEAAG0wAPSgMFHTF2CiA5MxQAD0oDS181MzUwM3IRCAC8AA_MALUAFgQP-BcDVGIvc3MvMQkA7x_yajEwL0pTLTIuOS4wL3M0NjE0MzA0MTIzMTMwND9BUUI9MSZuZGg9MSZwZj0xJmNhbGxiYWNrPXNfY19pbFsxXS5kb1Bvc3RiYWNrcyZldD0xJnQ9MjglMkY5JTJGMjAyMiUyMDElM0E2JTNBOSUyMDUlMjAwJmQuJm6vJADxJGl2PTEmLmQYGC85JlEYGPQFYWFtbGg9NiZjZT1VVEYtOCZucz3jABAm4RpHTmFtZXUDCVUOLyZnyggUsWMuJmJvdD0wJm1jzSUP7xgVMHB0czYA8CJzaGFyZVlvdXJTY3JlZW49dHJ1ZSZ0bXM9MyZlbnNfbG9jPWJvZHkmZDgwPTAmZDgzBgDwBGF0ZURldGFpbD00MyU3QzUlN0NNAfERMDAlN0M2JmxpbG89TG8mcDk9Tm8lMjBOYXZCYXIlMjDLCRFhvCMwJnJtkSWBPXJOQSU3Q2c6ACBlaUAAoGNpTkEmc3ViZG_aJgIfAbMmVlNTT1VSQ0U9RjMi8A0mU0VDPU5vdENvbmZpZ3VyZWQmVlNDSEFOTkVMJQAA9wP7GSUyMHdlYiZjaGFubmVsTWFuYWdlcj1UeXBlZCUyRkJvb2ttYXJrZWQiAAPaAFZ0YiU3QxIFCp0BClQA20tleXdvcmQ9biUyRmFOAI9TdGFja2luZ3gAAfEGcDg9JTdDJTdDJlZTRk9STUFUPTE2CwEQTEgIMSU3Q0AB0kFwcCUyMEZvcm1hdCaNBEBFbnY9RBHfJmVjaWRNSUREZWJ1Z_oBFYBjc0VuYWJsZZcn8j4uYyZhYW1iPTZHMXluWWNMUHVpUXhZWnJzel9wa3FmTEc5eU1YQnBiMnpYNWR2SmRZUUp6UFhJbWRqMHkmdjE2PUQlM0RjMTEmdjE4PQwAoDYmdjIxPUZpcnNwEQEFGeAmdjc1PTIwMjItMTAtMuYBIVMu2wNwJTdDVE1TJhwoQDAweDGEA_EGYz0yNCZqPTEuNiZ2PU4maz1ZJmJ3GAFBJmJoPSMADwEcGVZBUUU9MfwFD88GCB8z_wUBD6IRTo83Mjc5MDUxNEkOCQA3BQ8lDQUHEghRQ29yZU0dCA__ByMBkg0PKwERLjYxswsoNzKgEQ8KDTufNjEyMzgwMjc2Cg0IDyQBfw2sFxo5JAEPHglCBCsBHzceCQgPKwEJD3QPAyBBc6QlAKAVAmAC8gY9U0lfMEFzUHBpNkpaWElqZ01aJlYoLQA9FYJRX09SSUdJTsIGNjovL0cFBeEMD5YKDAaHAg-uCQQtNzclGxE5FAACIQU_Ijoi-Aw-jzczMzgyOTkzkQ8JD1wB_431A0NSXzBpYTY4VGFXUjFkYnRuN7gCQTQmUV-hCACKEi9JROMCAQ_YAsSfODMwNjg0OTU46RwID9gCMA98Af9q-QNTSV85QWJmM2dyZTg3QmdiNGn4Ag-vBVENpxw4OTc3sywPrwU-MDQ3OaspLzYz4hM6DwsHAQ9bAf9G9QNDUl9lRkJYRWxOdXdJSGI4VzK2Ah4xrgUMhgEPrgVTD9cCXp81MDc3OTAyNDKuBU4PfAH_Z_UDU0lfMzhnYlRWUnpuOXJNa2Fx-AIvMybXAsWPODg3NzYwMzkLFQgPhQgwD1sB_0kPrgUbDOECD9cCUw2FIzg5NzdFMw-FCD7QNzg4NzkyNzk0MH1dfQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.186.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-211.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:10 GMT
cache-control
no-cache, no-store
server
nginx
x-amz-cf-pop
LHR50-C1
x-amz-cf-id
yuQrbhbRhft5F23kgvQUcDRT-S6v3nmJsxMpvBVJNBAiXK-SfEgDkg==
expires
Fri, 28 Oct 2022 01:06:09 GMT
r.rnc
dmt.fidelity.com/privacy/v1/b/ 		0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dmt.fidelity.com/privacy/v1/b/r.rnc?n=2&c=65&i=4u838w&p=prod&s=15795&d=8BV7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNTcUAPAcY2xpZW50SWQiOjY1LCJwdWJsaXNoUGF0aCI6InByb2QiLCJpbnN0YW5jZSUA8lgiNHU4Mzh3IiwicGFja2V0IjoxLCJtb2RlIjoib2JzZXJ2ZSIsImNvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IkFsbG93ZWQgRG9tYWluIiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0uAD0HGh0dHBzOi8vc2l0ZWludGVyY2VwdC5xdWFsdHJpY3MuY29tL1dSU2l0ZUkeAPIdRW5naW5lL0Fzc2V0LnBocD9Nb2R1bGU9Q1JfZUZCWEVsTnV3SUhiOFcyJlYgAVU9MSZRX0AA9BBJRD1TSV8zOGdiVFZSem45ck1rYXEmUV9PUklHSU49kgD1Eml0ZW0xLmNsdWImUV9DTElFTlRWRVJTSU9OPTEuNzkuMBcA4FRZUEU9d2ViIiwidHlwJwGgeGhyIiwic3Rhcj4BwDY2NjkxOTE2OTc3NiwBSmQiOjEUAFBzb3VyYzkAslhIUl9NQU5BR0VSQQCBdHVzIjoiYWxSAQFLAUBhc29uSgHUXSwiZGF0YVBhdHRlchIAsmxpc3QiOltdLCJpZgDPNzg4NzkyNzk0MH0sfAFI9QNTSV9ibXZxd0s0RzBSZnFGSG58AR82WwHFnzgxMDYzMDA2NlsB_6cAMgTlcjMySkkxZ2psY3VRUma2Ah4zMgQM4QIPMgTErzQ4OTMzMDQyNTEyBEoPfAH_avkDU0lfNnRnOFBXT2kxZnJJRnV0-AIPCQfCrzY4MzA4MzI1ODTXAkoPWwH_SQ8yBBsM4QIPrgVTHzfgCQA_Nywi4AlHrzgxNDI5NzM5MDfXAkoPfAH_avUDU0lfYVd1c1pkM2dqZVRmNWdxrgUfNFwLVA_XAl6vNjg5NTM3NjkyOdcCSg9bAf9JADIED44PFwzhAg-uBcSfNzIyNDg4MjAxMw5LD3wB_2oAUwTvWXFmMHlhaUh4RkszdFGuBV4fOIUIAB84hQhJIDU4CBFPMzc3Na4FTg9bAf9FDzIEHAuGAQ-uBVMP1wJfnzI2ODYwOTA0ONcCSg98Af9q_wNTSV84bGdNUDI1SWtnanYwd2WuBc-PNzUwNDA1NTW4Fk8PWwH_Rg8yBBsMhgEPrgXErzg3MTEzMDI1OTOuBXgPfAH_PPUDU0lfZGdzeDlocldCM0s2OTEzrgUfMgoRVB85XAsAHzlcC0mfNzU2NTYyMzA0uBZOD1sB_0b1A0NSX2JPWERMdGU1RXhCM2ZjVrYCD5ggAAyGAQ-uBVMP1wJenzgzNzUyMTgwMa4FTg98Af9nAAsb30pyT2llVEpSYVFqTnSuBdCfNTM4MDA1OTgxPR9LD1sB_0n_A0NSXzl0eXhZc2RISW1SdHRxZK4FCRs24QIPrgXEnzY2MDE2MTQ1MY8ZSw98Af9qALgW5WF2T1FtUGkyUVNaS0U1-AIADCUPFCJQLjgwXAsAFAAPPR9HnzU1ODcxMzM4M1wLTh9hWwH_RQAyBOV6QmFaU0VlNENkNXRpSrYCD1wLAAyGAQ-uBVIAwwIiZW6OKwQILAAUAA_XAkl_NDAwMTY3MdcCSw98Af9q9QNTSV85c2x5UlJtdXdVWjl0ZlT4Ag8KEVQAwwIP1wJbnzc5ODE5OTQ2OD0fSw9bAf9JALgWD3AtFwzhAg-uBcR_ODg4NzEwOXAtew98Af88AFME1k5Tamx0eW5NdEhoTUZoMACmCA9cC8OPNjYwMjY4MDmFCEsPWwFwHzG3DAAfMRMYSRQ1WwEPbyNL9QNDUl9jUlR5YTVpM3dpYVdvNFpkCADUNQtQNxs54QIPrgVTD3wBX385MzAxNjY4uBZPD3wB_2cAXRXWS0lMZUdHQXVQc2xKN8w4D1wLVQ_XAl6PNzk3OTIyMzcnOk8fNlsB3sA5NzkyMjM3NDB9XX0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.186.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-211.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:10 GMT
cache-control
no-cache, no-store
server
nginx
x-amz-cf-pop
LHR50-C1
x-amz-cf-id
G4EsifK0Y3qxU31cO03_13J5tkEsvRob4X9wiJQG26CWw_TBGuQJ9w==
expires
Fri, 28 Oct 2022 01:06:09 GMT
r.rnc
dmt.fidelity.com/privacy/v1/b/ 		0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dmt.fidelity.com/privacy/v1/b/r.rnc?n=3&c=65&i=4u838w&p=prod&s=15793&d=8BV7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNTcUAPAcY2xpZW50SWQiOjY1LCJwdWJsaXNoUGF0aCI6InByb2QiLCJpbnN0YW5jZSUA8lgiNHU4Mzh3IiwicGFja2V0IjoxLCJtb2RlIjoib2JzZXJ2ZSIsImNvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IkFsbG93ZWQgRG9tYWluIiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0uAD0HGh0dHBzOi8vc2l0ZWludGVyY2VwdC5xdWFsdHJpY3MuY29tL1dSU2l0ZUkeAPIdRW5naW5lL0Fzc2V0LnBocD9Nb2R1bGU9Q1JfZXIzMkpJMWdqbGN1UVJmJlYgAVU9MyZRX0AA9BBJRD1TSV82S0lMZUdHQXVQc2xKN24mUV9PUklHSU49kgD1Eml0ZW0xLmNsdWImUV9DTElFTlRWRVJTSU9OPTEuNzkuMBcA4FRZUEU9d2ViIiwidHlwJwGgeGhyIiwic3Rhcj4BwDY2NjkxOTE2OTc4MSwBSmQiOjEUAFBzb3VyYzkAslhIUl9NQU5BR0VSQQCBdHVzIjoiYWxSAQFLAUBhc29uSgHUXSwiZGF0YVBhdHRlchIAsmxpc3QiOltdLCJpZgDPNTUzOTU1MDc5MX0sfAH_xfkDU0lfMjB1cG9EZzdHSVlHdXlo-AIP1wJlPzIsItcCSJ8zOTY1ODA0NDLXAkoPWwFwHzIyBAAPWwFTHzNbAUoPrgUbDOECD64FUw98AV6vNDk2NTkxMzc2NXwB_8f1A1NJX2FZcTJTMkw5V1lWSGVmeq4FHzKFCFQP1wJenzYwMDUzNjQxM64FTg9bAf9GD64FGwyGAQ-uBcSvNjk1NTYxNTcyN64FeA98Af88_wNTSV85WVVic3duQ0Y2ZzRrMDWuBc-fNTU2NDU2MjMyMw5LD1sB_0kPrgUbDOECD64FUx8z2AwAHzMzDkmfNDc4MjM3NDk01wJLD3wB_2r1A1NJXzBxcnlQUkFsQlhjemRURK4FHzZcC1QP1wJenzU4NzEzMTUwNoUISw9bAf9JDzIEGwzhAg-uBcSvODQ1OTcyMTAyNlwLeA98Af88AFME5XZhWWR3dGhJSFZ2aDZSrgUvMTGvBcWvNzU3NDg4NzQ4OdgCSg9cAf9K9QNDUl9jUlR5YTVpM3dpYVdvNFq4AgBmCAtoHBsw4wIPsAVTHzReCwAfNF4LSZ84NzYyMzY0NzPYAksPfAH_avYCU0lfNW5kRmFpdnVTUVJRQW1oHAD4Ag9oHFEP1wJejzQ5ODA4OTYz4xNMD1sB_0kPXgsbDOECD64FxCA2MxIiPzA4NpEZSw98Af9qALsg5W9EVDFkS0xPZ2VGSUdOpggPaBxVD64FXq83NDM1NDY1Nzg4XQtNHzJbAf9FD-AJGwyGAQ-uBVMfNVwLAB81XAtJrzc3ODE4MTMyMTDXAkoPfAH_avYCU0lfYncxaGJsWHBueGs1R1lUDh85CxFUD9cCXp81MDUxMjA0ODWFCEsPWwH_SQ8yBBsM4QIPrgXEnzYwMjk1NTI2Na4FeQ98Af889QNTSV9lVVBnZUxNRXE1VW9wMkJcCx83rgXFnzc4NTc3MjUxNtcCSw9bAf9JD64FGwzhAg-uBcWPNDI3NjA3MTYzDksPfAH_agABCuVnYVJBWmNGQk9KNnp3Vq4FD1wLxo84NjU5MjYzMwoRTx9iWwGAHzaOD0kPWwFUDzIEGwyGAQ-uBVMfNgoRAA98AUt_MTQxOTI4No8ZTA98Af9DUWR4anNtqjv_Ei8xLmFiZDRjMWQ4ODNiZjRiMjI1YjU5LmNodW5rLmpzP3A7FPYBJlFfQlJBTkRJRD1mbXJwaYA7YnNjcmlwdEI7C4M7Hjf-Mig4M3kqoGFwcGVuZENoaWwZPTJzdGGDOzBsb2EQAC9yZYA7G9A2MjM4NTU1MDE3fV19
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.16.186.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-211.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 01:06:10 GMT
cache-control
no-cache, no-store
server
nginx
x-amz-cf-pop
LHR50-C1
x-amz-cf-id
fOl7ui4aFhCnrD9VIGKp8LinEcMEKefAwQgxuypT92QBH_FV4AejWw==
expires
Fri, 28 Oct 2022 01:06:09 GMT
/
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		45 B
384 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_0ia68TaWR1dbtn7&Q_SIID=SI_0AsPpi6JZXIjgMZ&Q_ASID=AS_0AqVa5fIQp7ktXT&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web&r=1666919170801
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/fidelity/prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://item1.club/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Fri, 28 Oct 2022 01:06:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
strict-origin-when-cross-origin
cf-cache-status
DYNAMIC
content-encoding
br
x-content-type-options
nosniff
server
cloudflare
vary
Accept-Encoding
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://item1.club
cache-control
no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
permissions-policy
camera=(), geolocation=(), microphone=()
trace-id
e329b177479e8a3a
cf-ray
760fc4718a40920e-FRA
Graphic.php
sjc1.qualtrics.com/WRQualtricsSiteIntercept/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sjc1.qualtrics.com/WRQualtricsSiteIntercept/Graphic.php?IM=IM_3yKp2nFO4GPtXrD
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.232.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-232-194.deploy.static.akamaitechnologies.com
Software
envoy /
Resource Hash
261810b2a67fd59ab5e89584961e97a6ba419d5db0811ee5baf8b98affb49aa0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://item1.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
170
date
Fri, 28 Oct 2022 01:06:11 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
x-edgeconnect-midmile-rtt
0
content-security-policy-report-only
report-uri https://sjc1.qualtrics.com/csp-report
x-envoy-upstream-service-time
36
content-disposition
inline; filename=Feedback+tab+small
content-length
1595
x-request-id
6e996f18-d06c-4bf5-94a4-14affe59e52b
referrer-policy
strict-origin-when-cross-origin
server
envoy
etag
"a97234fecb8fb711964fd6941188e385"
content-type
image/png
access-control-allow-origin
*
x-transaction-id
51dafcce-0a14-4a00-b664-12902fe56fdf
cache-control
public, max-age=22
permissions-policy
camera=(), geolocation=(), microphone=()
x-robots-tag
noindex
expires
Fri, 28 Oct 2022 01:06:33 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
clixqa4.fmr.com
URL
https://clixqa4.fmr.com/clix

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fidelity (Banking)

177 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| GLANCE object| ttMETA function| ttMBX object| ensBootstraps object| Bootstrapper string| dmt_privacypathname function| _pageLoadApp function| variableListCallback function| $defineData object| ensClientConfig function| dmtParseCookie undefined| dmtPropertiesAudiences object| dmtLifeStageSegment object| dmtAllowLocalytics object| dmtWLPendo object| dmtAllowSalesforceIS object| dmtAllowSidecar object| dmtPropertiesWhitelist object| dmtConfig object| dmtData function| dmtStatus function| vendorStatus object| dmtEtaCDVScope object| dmtEtaContextDataVars object| dmtETAPageName object| dmtFloodLight object| dmtFloodlightActions object| dmtGoogleAds object| dmtGoogleAdsActions object| dmtVariables object| regeneratorRuntime function| callTarget function| _buildTransaction function| neustar_response object| _dmt function| startMeasurement function| paintContent object| FidMsmt boolean| _adobeProfileUpdate function| _log object| _console number| perfTestInitTime object| _enslog function| $data function| $globals function| $getData boolean| disableLegacyTags object| tmsConfig function| tmsGetCookieValue function| tmsSetCookieValue function| resetCVI function| tmsStripNBSuites function| tmsStripCustomerOnlySuite string| val function| asyncLibsTest object| msConfig function| onContentMeasurementLoaded function| _trackAnalytics function| tmsTrackAnalyticsSendData function| trackAnalyticsEvent object| targetResponses object| targetCardMsmt object| targetCardCatMsmt object| targetCardState object| targetCardOrder function| targetPageParamsAll object| allowed_list object| adobe function| mboxCreate function| mboxDefine function| mboxUpdate object| mboxFactories function| fidMboxCreate function| tntWriteTridionCampaign function| tntWriteTridionCampaignWhenReady string| csExpCall object| obfDPExpMetaData undefined| getExperienceData object| targetResponsesClone function| tntMiddlewareTryAgain function| tntMiddlewareMNO function| tntMiddleWareMNODisplay function| trackClickEvent function| tntMiddleware function| tntMiddlewareWhenReady function| tntMiddlewareGlobalMbox function| tntMiddlewareWhenGlobalMboxReady function| changeTitleTCMID function| getCreativeMiddleware function| creativeMiddlewareWhenReady function| tntValidateCreativeURI function| tntMiddlewareCreativeURL boolean| ensBrowserSupported object| gateway function| Visitor object| s_c_il number| s_c_in object| visitor object| targetExperiences object| GLANCE_COBROWSE string| PIGlobalNav_WWWHOST string| PIGlobalNav_ACTIVEQUOTE_HOST string| PIGlobalNav_ERESEARCH_HOST string| PIGlobalNav_RESEARCHTOOLS_HOST object| PGNBProperties undefined| $ undefined| jQuery object| NavBar function| $nav object| jQuery110009740799297569582 function| tmsSendIEventTag function| tmsSendIPageTag function| tmsSendCustomIEventTag function| tmsSendCustomIEventTagNew object| ivs object| dl_names object| var_names object| o function| AppMeasurement_Module_AudienceManagement function| AppMeasurement number| s_objectID number| s_giq string| s_account object| s function| s_gi function| tmsReadCVI function| tmsTrackInitialPageView function| tmsResetSelectContextData function| tmsRebuildSCPageName function| tmsNavBarInteraction function| tmsTrackCustomLinks function| tmsTrackCustomLinksWithEvents function| trackPageView function| tmsTrackPageView function| tmsTrackGenericContentChangeAsPV function| tmsTrackGenericContentChangeAsExitPV function| tmsTrackContentChangeAsPV function| tmsTrackGenericInteraction function| tmsTrackInteraction function| tmsTrackSocialShare function| tmsTrackContacts function| tmsTrackContentInteraction function| tmsTrackCustomGenericContentChangeAsPV function| tmsTrackCustomContentChangeAsPV function| tmsTrackCustomPermGenericContentChangeAsPV function| tmsTrackCustomPermContentChangeAsPV function| tmsTrackSearchResultInteraction function| tmsTrackSearchModuleInteraction function| tmsTrackInvestorCenter function| tmsTrackInvestorCenterCTC function| DIL string| key number| a string| qp object| targetMeasurementNames function| tmsTrackCustomQuotePV function| tmsSetupLegacyTracking number| perfTestLoadedTime function| old_write function| trackVideo string| s_tnt function| addTransactionsToProduct function| _csIntegeration object| s_i_fidelitycom object| QSI object| WAFQualtricsWebpackJsonP-cloud-1.79.0 object| _qsie

23 Cookies

Domain/Path Name / Value
item1.club/ Name: PHPSESSID
Value: d8de8170abaa1395c0ecb8b0a6aa6aaa
www.fidelity.com/ Name: akaalb_www_binpublic_alb
Value: ~op=EAST_AWS_WWW:WWW-EAST|~rv=20~m=WWW-EAST:0|~os=f1162b9d355bd32846e2d2dc4b3e9a05~id=b8d35ec73486209ab8ec68cbba6c8740
.demdex.net/ Name: demdex
Value: 37834629693295341820115681406568758943
item1.club/ Name: AMCVS_EDCF01AC512D2B770A490D4C%40AdobeOrg
Value: 1
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~Y1srAAAAAGD-dwN-
.dpm.demdex.net/ Name: dpm
Value: 37834629693295341820115681406568758943
.adnxs.com/ Name: uuid2
Value: 2319289887296085200
item1.club/ Name: AMCV_EDCF01AC512D2B770A490D4C%40AdobeOrg
Value: -330454231%7CMCIDTS%7C19294%7CMCMID%7C43853915370395148110704670920637163202%7CMCAAMLH-1667523968%7C6%7CMCAAMB-1667523968%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1666926368s%7CNONE%7CMCSYNCSOP%7C411-19301%7CMCAID%7CNONE%7CvVersion%7C3.1.2
.item1.club/ Name: s_pers
Value: %20visitStart%3D1666919168688%7C1698455168688%3B%20gpv_c11%3Ditem1.club%252Fprivate%252F%7C1666920969124%3B
.item1.club/ Name: s_sess
Value: %20s_cc%3Dtrue%3B
.doubleclick.net/ Name: IDE
Value: AHWqTUkQIXSu8cXNluAiQtsZUgeKSEBmzsEDWuA3PDcGJHkA5QaRdqxILV7shH69QCs
.item1.club/ Name: AAMC_fidelity_0
Value: REGION%7C6
.item1.club/ Name: aam_uuid
Value: 37834629693295341820115681406568758943
.twitter.com/ Name: personalization_id
Value: "v1_ipgKGtmT6W5MAt6PHJD/yQ=="
.bing.com/ Name: MUID
Value: 1B6AEE97F63E6F383DE2FCDCF7556E65
.casalemedia.com/ Name: CMID
Value: Y1srAYYuCbKOpNU7BwFJ2wAA
.casalemedia.com/ Name: CMPS
Value: 5213
.casalemedia.com/ Name: CMPRO
Value: 5213
.adnxs.com/ Name: anj
Value: dTM7k!M4.FErk#WF']wIg2Hb:p5tah!@wnfH)iR8PMp-v=0H_jaF$9gll/$$g8LHh+V%nFeCwH7cd#A^/kM_F]s.hL(Fl6Hvpc+-+6gxY1Qw2pXKKnV
.pubmatic.com/ Name: KRTBCOOKIE_218
Value: 4056-Y1srAAAAAGD-dwN-&KRTB&22978-Y1srAAAAAGD-dwN-&KRTB&23194-Y1srAAAAAGD-dwN-&KRTB&23209-Y1srAAAAAGD-dwN-
.pubmatic.com/ Name: PugT
Value: 1666919168
.demdex.net/ Name: dextp
Value: 60-1-1666919168714|358-1-1666919168815|477-1-1666919168916|771-1-1666919169034|1123-1-1666919169135|1957-1-1666919169236|144228-1-1666919169337|144229-1-1666919169438|144230-1-1666919169539|144231-1-1666919169639|144232-1-1666919169789|144233-1-1666919169889|144234-1-1666919169990|144235-1-1666919170091|144236-1-1666919170192|144237-1-1666919170292
.spotxchange.com/ Name: audience
Value: b5d87f0f-565c-11ed-a239-1d66682b0106

19 Console Messages

Source Level URL
Text
network error URL: https://item1.club/bin-public/060_www_fidelity_com/css/HP_Master-CSS%5B1%5D.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/bin-public/060_www_fidelity_com/css/hp-tabset.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/bin-public/060_www_fidelity_com/css/hp_table-styles.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/bin-public/060_www_fidelity_com/js/hp-tabset.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/bin-public/060_www_fidelity_com/css/hp_ratings-style.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/bin-public/060_www_fidelity_com/images/why-fidelity/white-check-new.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/bin-public/060_www_fidelity_com/css/seo-footer.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/bin-public/060_www_fidelity_com/css/hp_ret-score-style.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/bin-public/060_www_fidelity_com/images/homepage/gray-check-new.png
Message:
Failed to load resource: the server responded with a status of 404 ()
javascript warning URL: https://item1.club/private/(Line 193)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://nexus.ensighten.com/fidelity/prod/Bootstrap.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://item1.club/private/(Line 193)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://nexus.ensighten.com/fidelity/prod/Bootstrap.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://item1.club/bin-public/060_www_fidelity_com/images/why-fidelity/white-check-new.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/bin-public/060_www_fidelity_com/images/homepage/gray-check-new.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/images/css/grey-pipe-sm.gif
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/images/css/popup.gif
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://item1.club/images/css/Footer_BG.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://idsync.rlcdn.com/365868.gif?partner_uid=37834629693295341820115681406568758943
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://idsync.rlcdn.com/365868.gif?partner_uid=37834629693295341820115681406568758943
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://clixqa4.fmr.com/clix
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
assets.fidelity.com
c.bing.com
clixqa4.fmr.com
cm.everesttech.net
cm.g.doubleclick.net
dmt.fidelity.com
dpm.demdex.net
dsum-sec.casalemedia.com
fidelity.demdex.net
ib.adnxs.com
idsync.rlcdn.com
image2.pubmatic.com
item1.club
nexus.ensighten.com
pixel.rubiconproject.com
rtd-tm.everesttech.net
rtd.tubemogul.com
sitecatalyst.fidelity.com
siteintercept.qualtrics.com
sjc1.qualtrics.com
storage.glancecdn.net
sync-tm.everesttech.net
sync.search.spotxchange.com
us-u.openx.net
www.facebook.com
www.fidelity.com
www.glancecdn.net
zncvgjh8lmjxbkyln-fmrpi.siteintercept.qualtrics.com
clixqa4.fmr.com
104.17.208.240
104.17.209.240
104.244.42.67
13.224.189.22
142.250.185.98
151.101.194.49
151.101.2.49
162.0.215.23
185.64.189.110
185.80.39.216
185.94.180.126
2.16.186.162
2.16.186.195
2.16.186.211
2.18.232.194
2600:9000:21f3:7e00:d:addc:2400:93a1
2620:1ec:c11::200
2a03:2880:f11c:8083:face:b00c:0:25de
34.195.10.198
34.98.64.218
35.244.174.68
37.252.173.27
52.211.12.99
54.155.40.229
54.74.40.111
69.173.144.139
01b456b63ccf637be190ab22598ded353dfe8a2f49d4b589450d5f4e44d53c85
021ecc4b40ba6752d0770862fecd74029b1e4ebfa770d21b568c73fbe2cffe7f
053f6f7de2dc83b0efa801d03de4f0f1b15cc6c43146f2f97484ee7384e05f21
06938dd593b945d6da6fe382a54eb2f8798be00d2f67281c8c16529a35bf9193
0a878fdce40dc36bc9d054d5f27db7f1ef9d33bea49cc66fb6fadaa10e9d4aff
0b2502073850d32d0771c4f2c5c405d7855e61fad3719bd4efc12687523e3402
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d67fb1e900ac570b160aaf2200d35ab1d41f00d0979ade72034289e9d3ab262
10da41dd4e5e3cf00a64e86e92fa625bc6e6b3cb97714815f260e165598ce37e
1953b94ba034ab9ad857a51e0b28bb70b57a73a7fe51753d05df1cbdf0fb775b
1a66ddf47eed0d8b3967e6dac81c875341345ac95af542ef34a10ace5d900278
1e37b248a85a3ba711b5dfe3d3c0b9efd2f361d41a28601acda628013c6a20d3
1ef8b37a63474996a7a2a5f1b20464bdcfda70740b292737fd1369a4c814b155
20ee45b17985faa6172dc3930d47bb56303e3e9f4452e72e2c0feb9d562a081d
21e48e923af6d9f3c2696ea5040575cf91c41c76e417f8e0a384bb077b372583
2451f78cdf73cb2817ec2a124bc1a77b9c7100f5c30bdb521b824a83677c83a0
25aac3c0244fdf4d9f9ddae3db3049ca21dffef72043f769fcde8fb4fda14245
261810b2a67fd59ab5e89584961e97a6ba419d5db0811ee5baf8b98affb49aa0
3280a25a3c82cd2a29b6c5e18aee0c341e10b5cc381b59eef1bd4ea01219e54c
33f544d59c46dc9e521b38e634b51cbdfc4c010e92aa2bb00a75b31681859873
3a8c79033d6f51d9221602443e34d42e174fd3d9fedd49be51747a5217ac01d7
3f4826d4308fd8ea2faf844cc5983f913e7207fa00ac5e938700f0cb6ec71366
414ed8003ce4f1835e33a296fb2a54f52b9e646da2f8fac4caf765893749909f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44e033b4ca419dbf36f29ffd31977b4b47eecc9b7590e219bb82f982fc4fc153
459da4c8a9f2a70da8e894d10a363dea41b4d4cdb435af95186da4031da26464
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5084b706ae83d254fd5bf6ddc95c2ee4e5a37fc656f0448076778f99e732d5e5
512570b4ec9948dc4b498fec9fa7728edd56b486247af9806b3d3e70c9536554
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55e2b2ab595e0c192f763ad2c2a237f3f92ecc51e843da550393ffb51a7f115b
600d7ca8124e15df776c701868b82a0282b14f3ca64ffac4152b8c419f203b1c
61a7adddba7d096b4fa5ea4ef4e774c372f4169f870b0533e3cc4b708d43ba95
61e233f08ebab372d508a9a4142b590add10284482a71c7603ffe094ffd8669f
61fbcc82f876d63e9d0ddd1251d638646510ae157cd8ccc839144773ec53982c
6e72d30c589782e1029538ee2906d6c5f28f30f877e49e617002a16a434a7d6b
6eea4b52809599360ba8959dee02d7feacbd62403f6ed2297b987b5154708fd8
75130c88fd45f06e63bc933339fde630f4d3aa270150e5f07ebc0934f1c98295
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
80215e4d119951a2bdbb49d39524be4f7c8af7daeb0cd692ab70a90c9691889a
84694d83725e88328f1e12e509d9fd4244bbf60162859af52dee3e89917a5dd2
8596f3beb992852b9e2f1bf8bb2460a8b416637203316575786f7efbf9894829
90c8c49df9363f906709ff1407e338b965b70a1eed9f3e573a4306fd267f1c0c
916f83f2e81b458e401fc26b0733372778fa05289ef0aec0cafab025ab47b23f
93a1d42da9ee3e7b25f8bbdba4a361560ab25043f5be40761a94685868aae7c9
9a169cc782012d9a5ece8cf798f618fdb59bcbd85da9576b80fd419399c1c225
9b42c3e71681366cd6ec743a3bcc6d8f739f09415dc72875e539d98ff05cb35c
9c75818fa24700b4e5db803928119c17500f98e3d0f7fb33f07db6cbd5f7b203
9c8bfd8259efea6b16083370b31670a300d462917b7fd663928a4bfcb2943328
9ff88b1e9e5b074a18cb830a6eee6e1713df09d4f3e8b8514cbd2a9f42925578
a458e7d5f78e768334824e9f97f2d362e10a86ee84b3fc9fb9d0441d65f9266d
a68d55d5edf25c0baea3cd150e155c1c64eadbdc52a44ec5f239b8f27e250c8e
a828564dc10e2df640964a2c97a3c7c1eb4de8a096de0e5ce478caa8eb310473
a8b1e52e4907bc4f0905763b905eada0d2c668138282f92829390579d8a94574
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b376e7247f7b6432d3bd4f87c3598250819e31dfac7b17fa11f14ad568c35be1
c057703e7565118ba2084013ce7b26196eb48eb1103925bc9f703b2b251fbbb7
cc8721a1adc4924783894d6a7ffc53ec2b6a9f1d434f6105fe0bfe632de8eb2b
d11e22c6d94650a1c16bd54e1cb9e48ddccbb5d2b7699a091750948c888c4f6a
d17ea77190820fb8045de841be49d7ca27100343608eddfc073513d676d932b3
d427be16bb613ac2143ccfc846c52ed07b52640e8271757e260f9d4071ab66f6
d62ca817b668e2e7fe40448059352566ecf10985548312f7a24a9c8b83fa3813
e07bd958925ada74f41859021ac752ddc2c7da287a426e8e5ebf8ae3d3073abe
e0efcff5e42f48dc59be55debd3f3debb3258a7c37b7d71bb22adb50ab10b450
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e90598ea92620b5e2df2b055f3f50ed64a70aaada4266a3914d8822f514b6095
eaaa914edfaa2eb9cde3f6291e6ad070046eecb5058a5baa97bfaf440310de2b
eb55d122ba0e3370c1d5c52c60f16db655f997c045402c2e52187615ce580477
ec1a416ecdb7b44747a62f6c9d629dcfa941419484fad7d37e3cf720054c676e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2039afe1f42eebdc7774eccc3ba81e44541eb0936357bf2088846dd96cffd4d
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f55b9d9ac7bc2eb4528447bd8928c9469428956b6bbc9759656e517a44dea2ab
f6b4a6124675203780f1883d16d012e98448f6dceec35da99e980c073fcf1e71
fac61e050d5eb05f5b913840d0d65423757b34191c2dd41f434f4256dc54aa86
fcc99bc542379c45755d2d0dda5263aecbac09227b828b070b891af45c61bf7a