URL: https://www.cn.customer.leapco.app/
Submission: On April 16 via automatic, source certstream-suspicious — Scanned from FR

Summary

This website contacted 5 IPs in 3 countries across 3 domains to perform 14 HTTP transactions. The main IP is 51.91.212.195, located in France and belongs to OVH, FR. The main domain is www.cn.customer.leapco.app.
TLS certificate: Issued by R3 on April 16th 2024. Valid for: 3 months.
This is the only time www.cn.customer.leapco.app was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 51.91.212.195 16276 (OVH)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 172.217.16.131 15169 (GOOGLE)
14 5
Domain Requested by
10 www.cn.customer.leapco.app www.cn.customer.leapco.app
2 www.gstatic.com www.cn.customer.leapco.app
www.gstatic.com
1 fonts.gstatic.com www.cn.customer.leapco.app
0 www.googletagmanager.com Failed www.cn.customer.leapco.app
14 4

This site contains no links.

Subject Issuer Validity Valid
cn.customer.leapco.app
R3
2024-04-16 -
2024-07-15
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2024-03-04 -
2024-05-27
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.cn.customer.leapco.app/
Frame ID: 3BF72B4C1CD3C7BE456A622B6F1E3BD4
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

Customer Feedback

Page Statistics

14
Requests

93 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

5
IPs

3
Countries

3366 kB
Transfer

15685 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.cn.customer.leapco.app/
5 KB
3 KB
Document
General
Full URL
https://www.cn.customer.leapco.app/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.91.212.195 , France, ASN16276 (OVH, FR),
Reverse DNS
cl389k.mundiserver.com
Software
Apache /
Resource Hash
7ab250e8dd9ddb48f53bb32493dbc656a2285d99f7ca9bdf59587cb0dc1e219b
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
fr-FR,fr;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type,Authorization,X-XSRF-TOKEN,X-Requested-With
Access-Control-Allow-Methods
GET,POST,OPTIONS,DELETE,PUT
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
1980
Content-Security-Policy
default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Content-Type
text/html
Date
Tue, 16 Apr 2024 11:38:35 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Tue, 16 Apr 2024 11:35:37 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Vary
Accept-Encoding,User-Agent
X-Frame-Options
SAMEORIGIN
loading.gif
www.cn.customer.leapco.app/images/
13 KB
14 KB
Image
General
Full URL
https://www.cn.customer.leapco.app/images/loading.gif
Requested by
Host: www.cn.customer.leapco.app
URL: https://www.cn.customer.leapco.app/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.91.212.195 , France, ASN16276 (OVH, FR),
Reverse DNS
cl389k.mundiserver.com
Software
Apache /
Resource Hash
0544e29a3eceb31646d216dff0ed290463017429eb95ff9abbde51a0b5ac83c0
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 16 Apr 2024 11:38:35 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Security-Policy
default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Last-Modified
Tue, 16 Apr 2024 11:35:37 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET,POST,OPTIONS,DELETE,PUT
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type,Authorization,X-XSRF-TOKEN,X-Requested-With
Content-Length
13643
Keep-Alive
timeout=5, max=99
js
www.googletagmanager.com/gtag/
0
0

favicon.png
www.cn.customer.leapco.app/
1 KB
2 KB
Other
General
Full URL
https://www.cn.customer.leapco.app/favicon.png
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.91.212.195 , France, ASN16276 (OVH, FR),
Reverse DNS
cl389k.mundiserver.com
Software
Apache /
Resource Hash
47b919a4edb21a2c5c922a502f20a18e38d780bdf4eed8676bfb69a1dc53e7f1
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 16 Apr 2024 11:38:35 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Security-Policy
default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Last-Modified
Tue, 16 Apr 2024 11:35:35 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET,POST,OPTIONS,DELETE,PUT
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type,Authorization,X-XSRF-TOKEN,X-Requested-With
Content-Length
1499
Keep-Alive
timeout=5, max=98
main.dart.js
www.cn.customer.leapco.app/
10 MB
2 MB
Script
General
Full URL
https://www.cn.customer.leapco.app/main.dart.js?v=3187326494
Requested by
Host: www.cn.customer.leapco.app
URL: https://www.cn.customer.leapco.app/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.91.212.195 , France, ASN16276 (OVH, FR),
Reverse DNS
cl389k.mundiserver.com
Software
Apache /
Resource Hash
731e0503f24f33ae5b87dc560bf907a3a3a522edca0a10a5b71f6cb75eec1fec
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 16 Apr 2024 11:38:35 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Encoding
gzip
Content-Security-Policy
default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Transfer-Encoding
chunked
Connection
Keep-Alive
Last-Modified
Tue, 16 Apr 2024 11:35:38 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET,POST,OPTIONS,DELETE,PUT
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Vary
Accept-Encoding,User-Agent
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type,Authorization,X-XSRF-TOKEN,X-Requested-With
Keep-Alive
timeout=5, max=96
canvaskit.js
www.gstatic.com/flutter-canvaskit/e76c956498841e1ab458577d3892003e553e4f3c/chromium/
91 KB
26 KB
Script
General
Full URL
https://www.gstatic.com/flutter-canvaskit/e76c956498841e1ab458577d3892003e553e4f3c/chromium/canvaskit.js
Requested by
Host: www.cn.customer.leapco.app
URL: https://www.cn.customer.leapco.app/main.dart.js?v=3187326494
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ed7899cf1ba7169981ba66817b913f303bd7f8cfa8f99c9997ba98b4e404a00f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 12 Apr 2024 18:39:07 GMT
content-encoding
br
x-content-type-options
nosniff
age
320369
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/flutter-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26009
x-xss-protection
0
last-modified
Wed, 27 Mar 2024 21:06:13 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="flutter-team"
vary
Accept-Encoding
report-to
{"group":"flutter-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/flutter-team"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 12 Apr 2025 18:39:07 GMT
FontManifest.json
www.cn.customer.leapco.app/assets/
391 B
1 KB
Fetch
General
Full URL
https://www.cn.customer.leapco.app/assets/FontManifest.json
Requested by
Host: www.cn.customer.leapco.app
URL: https://www.cn.customer.leapco.app/main.dart.js?v=3187326494
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.91.212.195 , France, ASN16276 (OVH, FR),
Reverse DNS
cl389k.mundiserver.com
Software
Apache /
Resource Hash
fe0cda520281ff18faf054ace7ddc9025a491271cf83954b2f12c868ab0ece51
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 16 Apr 2024 11:38:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Encoding
gzip
Content-Security-Policy
default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Connection
Keep-Alive
Content-Length
169
Last-Modified
Tue, 16 Apr 2024 11:35:27 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET,POST,OPTIONS,DELETE,PUT
Content-Type
application/json
Access-Control-Allow-Origin
*
Vary
Accept-Encoding,User-Agent
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type,Authorization,X-XSRF-TOKEN,X-Requested-With
Keep-Alive
timeout=5, max=95
MaterialIcons-Regular.otf
www.cn.customer.leapco.app/assets/fonts/
8 KB
5 KB
Fetch
General
Full URL
https://www.cn.customer.leapco.app/assets/fonts/MaterialIcons-Regular.otf
Requested by
Host: www.cn.customer.leapco.app
URL: https://www.cn.customer.leapco.app/main.dart.js?v=3187326494
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.91.212.195 , France, ASN16276 (OVH, FR),
Reverse DNS
cl389k.mundiserver.com
Software
Apache /
Resource Hash
e586fb28275ec37e95b162b4535ec3c53d052da7c2c6e473690be2f0e4b72755
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 16 Apr 2024 11:38:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Encoding
gzip
Content-Security-Policy
default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Connection
Keep-Alive
Content-Length
4034
Last-Modified
Tue, 16 Apr 2024 11:35:28 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET,POST,OPTIONS,DELETE,PUT
Content-Type
font/otf
Access-Control-Allow-Origin
*
Vary
Accept-Encoding,User-Agent
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type,Authorization,X-XSRF-TOKEN,X-Requested-With
Keep-Alive
timeout=5, max=94
NeueHelveticaforZara-BoldCn.ttf
www.cn.customer.leapco.app/assets/assets/fonts/
51 KB
24 KB
Fetch
General
Full URL
https://www.cn.customer.leapco.app/assets/assets/fonts/NeueHelveticaforZara-BoldCn.ttf
Requested by
Host: www.cn.customer.leapco.app
URL: https://www.cn.customer.leapco.app/main.dart.js?v=3187326494
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.91.212.195 , France, ASN16276 (OVH, FR),
Reverse DNS
cl389k.mundiserver.com
Software
Apache /
Resource Hash
6c3e71144fb440c4aad726841e43feadef9435c334afe9fc0bca437ff638cf70
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 16 Apr 2024 11:38:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Encoding
gzip
Content-Security-Policy
default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Connection
Keep-Alive
Content-Length
23660
Last-Modified
Tue, 16 Apr 2024 11:35:29 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET,POST,OPTIONS,DELETE,PUT
Content-Type
font/ttf
Access-Control-Allow-Origin
*
Vary
Accept-Encoding,User-Agent
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type,Authorization,X-XSRF-TOKEN,X-Requested-With
Keep-Alive
timeout=5, max=100
NeueHelveticaforZara-MdCn.ttf
www.cn.customer.leapco.app/assets/assets/fonts/
52 KB
24 KB
Fetch
General
Full URL
https://www.cn.customer.leapco.app/assets/assets/fonts/NeueHelveticaforZara-MdCn.ttf
Requested by
Host: www.cn.customer.leapco.app
URL: https://www.cn.customer.leapco.app/main.dart.js?v=3187326494
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.91.212.195 , France, ASN16276 (OVH, FR),
Reverse DNS
cl389k.mundiserver.com
Software
Apache /
Resource Hash
f932d6492a9839d81ac03f96b7e11408a329f048ca283cbae7d6d265ef245a0b
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 16 Apr 2024 11:38:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Encoding
gzip
Content-Security-Policy
default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Connection
Keep-Alive
Content-Length
23388
Last-Modified
Tue, 16 Apr 2024 11:35:29 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET,POST,OPTIONS,DELETE,PUT
Content-Type
font/ttf
Access-Control-Allow-Origin
*
Vary
Accept-Encoding,User-Agent
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type,Authorization,X-XSRF-TOKEN,X-Requested-With
Keep-Alive
timeout=5, max=93
NeueHelveticaforZara-Cn.ttf
www.cn.customer.leapco.app/assets/assets/fonts/
50 KB
24 KB
Fetch
General
Full URL
https://www.cn.customer.leapco.app/assets/assets/fonts/NeueHelveticaforZara-Cn.ttf
Requested by
Host: www.cn.customer.leapco.app
URL: https://www.cn.customer.leapco.app/main.dart.js?v=3187326494
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.91.212.195 , France, ASN16276 (OVH, FR),
Reverse DNS
cl389k.mundiserver.com
Software
Apache /
Resource Hash
789613ae677f1ff1e226690d24733b0c16fa9e52871eae3688f89aef1b6cfc83
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 16 Apr 2024 11:38:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Encoding
gzip
Content-Security-Policy
default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Connection
Keep-Alive
Content-Length
23996
Last-Modified
Tue, 16 Apr 2024 11:35:30 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET,POST,OPTIONS,DELETE,PUT
Content-Type
font/ttf
Access-Control-Allow-Origin
*
Vary
Accept-Encoding,User-Agent
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type,Authorization,X-XSRF-TOKEN,X-Requested-With
Keep-Alive
timeout=5, max=100
NeueHelveticaforZara-LtCn.ttf
www.cn.customer.leapco.app/assets/assets/fonts/
49 KB
24 KB
Fetch
General
Full URL
https://www.cn.customer.leapco.app/assets/assets/fonts/NeueHelveticaforZara-LtCn.ttf
Requested by
Host: www.cn.customer.leapco.app
URL: https://www.cn.customer.leapco.app/main.dart.js?v=3187326494
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.91.212.195 , France, ASN16276 (OVH, FR),
Reverse DNS
cl389k.mundiserver.com
Software
Apache /
Resource Hash
43680f6a9af3e9de6d1ecee17304420108d353f2dbbea1cdc950165ee4d9a233
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 16 Apr 2024 11:38:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Encoding
gzip
Content-Security-Policy
default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Connection
Keep-Alive
Content-Length
23357
Last-Modified
Tue, 16 Apr 2024 11:35:29 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET,POST,OPTIONS,DELETE,PUT
Content-Type
font/ttf
Access-Control-Allow-Origin
*
Vary
Accept-Encoding,User-Agent
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type,Authorization,X-XSRF-TOKEN,X-Requested-With
Keep-Alive
timeout=5, max=100
KFOmCnqEu92Fr1Me5WZLCzYlKw.ttf
fonts.gstatic.com/s/roboto/v20/
167 KB
90 KB
Fetch
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Me5WZLCzYlKw.ttf
Requested by
Host: www.cn.customer.leapco.app
URL: https://www.cn.customer.leapco.app/main.dart.js?v=3187326494
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
017c0be9aaa6d0359737e1fa762ad304c0e0107927faff5a6c1f415c7f5244ed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 13 Apr 2024 04:26:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
285103
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
91230
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:18:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
vary
Accept-Encoding
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 13 Apr 2025 04:26:53 GMT
canvaskit.wasm
www.gstatic.com/flutter-canvaskit/e76c956498841e1ab458577d3892003e553e4f3c/chromium/
5 MB
1 MB
Fetch
General
Full URL
https://www.gstatic.com/flutter-canvaskit/e76c956498841e1ab458577d3892003e553e4f3c/chromium/canvaskit.wasm
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/flutter-canvaskit/e76c956498841e1ab458577d3892003e553e4f3c/chromium/canvaskit.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.16.131 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s06-in-f131.1e100.net
Software
sffe /
Resource Hash
f48a5148fbb35eea35ccbdbaa4cbf2f3bcffd1fa87cf6c21ac134e4a203914a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.cn.customer.leapco.app/
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 12 Apr 2024 20:13:54 GMT
content-encoding
br
x-content-type-options
nosniff
age
314682
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/flutter-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1519369
x-xss-protection
0
last-modified
Wed, 27 Mar 2024 21:06:32 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="flutter-team"
vary
Accept-Encoding
report-to
{"group":"flutter-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/flutter-team"}]}
content-type
application/wasm
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 12 Apr 2025 20:13:54 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=G-5LGHDY2VQ2

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| gtag object| dataLayer boolean| scriptLoaded function| loadMainDartJs function| CanvasKitInit object| flutterCanvasKit

0 Cookies

1 Console Messages

Source Level URL
Text
security error URL: https://www.cn.customer.leapco.app/
Message:
Refused to load the script 'https://www.googletagmanager.com/gtag/js?id=G-5LGHDY2VQ2' because it violates the following Content Security Policy directive: "default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' *.leapco.app leapco.app *.leapco.pro leapco.pro *.inditex.cn inditex.cn *.googleapis.com *.gstatic.com *.unpkg.com unpkg.com sentry.pumpun.com:8443 *.vimeo.com *.vimeocdn.com *.cloudflare.com api.mapbox.com *.learningcloud.me *.leapandco.info 'unsafe-inline' 'unsafe-eval' data: *.leapco.app leapco.app *.inditex.cn inditex.cn blob: *.leapco.app leapco.app *.inditex.cn inditex.cn;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN