www.refundscam.com Open in urlscan Pro
2606:4700:3037::6815:51eb  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

51 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.refundscam.com/	50 KB 7 KB	255ms 230ms	Document text/html	2606:4700:3037::6815:51eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:51eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bd62b469cf40c18fd37b0a4bc21f9847c14d9b6bf6677b3a22542ca1dcf02c9b Request headers :method GET :authority www.refundscam.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:28 GMT content-type text/html set-cookie __cfduid=de3eaad859020ccbbbb5fab1b73e301771611777448; expires=Fri, 26-Feb-21 19:57:28 GMT; path=/; domain=.refundscam.com; HttpOnly; SameSite=Lax; Secure last-modified Tue, 27 Oct 2020 08:42:39 GMT vary Accept-Encoding cf-cache-status DYNAMIC cf-request-id 07e705324a00002bcee3983000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FdKuMMzlqY9Z59GsxjYH1S3wJ9jMfOz5C%2BNxbdA2Kzs%2FnBtZBtubPw2MFsvGDAbf%2Bk%2FPL9ZBpPmQyqcvm7C1VHlq3Vs0R%2FBnRCiMKGYFO21DU%2BUz47DyOLSZRovMvxo%3D"}],"max_age":604800} nel {"max_age":604800,"report_to":"cf-nel"} server cloudflare cf-ray 61850afd4daf2bce-FRA content-encoding br
GET H2	200	css2 fonts.googleapis.com/	2 KB 902 B	36ms 17ms	Stylesheet text/css	2a00:1450:4001:812::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ba76edb43d3f178a00aa4f704ad4518599d1338cd10e6d1355fa1ee5c2538227 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 27 Jan 2021 19:57:28 GMT server ESF date Wed, 27 Jan 2021 19:57:28 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 27 Jan 2021 19:57:28 GMT
GET H2	200	fbf4xbx.css use.typekit.net/	1 KB 781 B	47ms 15ms	Stylesheet text/css	2a02:26f0:6c00::210:ba0a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/fbf4xbx.css Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:ba0a , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 47416fde59d0c486aba6898f0939daa521b289a1b56904dfd1dd257e1b302248 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip server nginx date Wed, 27 Jan 2021 19:57:28 GMT vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 timing-allow-origin * content-length 581
GET H2	200	47fa7.css lp.oakfortrecovery.net/wp-content/cache/minify/	95 KB 13 KB	365ms 109ms	Stylesheet text/css	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Full URL https://lp.oakfortrecovery.net/wp-content/cache/minify/47fa7.css Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash 58ebe520510b7ca2d637b8e82fb2dcbe28aa54d2229616cc44d00e15a12de82c Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade last-modified Mon, 31 Aug 2020 05:08:32 GMT server LiteSpeed etag "3120-5f4c85d0-0;gz" vary Accept-Encoding content-type text/css cache-control public, max-age=18609063 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000 content-length 12576 expires Tue, 31 Aug 2021 05:08:32 GMT
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/	86 KB 30 KB	25ms 8ms	Script application/javascript	2001:4de0:ac19::1:b:3a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:28 GMT content-encoding gzip last-modified Wed, 01 May 2019 21:14:27 GMT server nginx etag W/"5cca0c33-15851" vary Accept-Encoding x-hw 1611777448.dop223.fr8.t,1611777448.cds236.fr8.hn,1611777448.cds236.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30638
GET H2	200	d7e82.css www.refundscam.com/wp-content/cache/minify/	22 KB 5 KB	204ms 204ms	Stylesheet text/css	2606:4700:3037::6815:51eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.refundscam.com/wp-content/cache/minify/d7e82.css Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:51eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 42611bbd9ae8bc8e749807c607a212ca1a977b5afa5e7dd852db7c764723a01c Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:28 GMT content-encoding br cf-cache-status MISS last-modified Mon, 28 Sep 2020 08:16:09 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=LhGV4vln5rL7C%2BuV60t6dNi%2Fzb0YuitjlbBhe%2FUCvZBnR%2Fxzhywxoa%2FsIQtVLXwNhyHCptVGLNy59cKNdL1GEPyzXDkY1lZZahBfavPlZLYRdb1vyGOFQ33MlFvJZ2w%3D"}],"max_age":604800} content-type text/css cache-control public, max-age=604800 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 61850afeba1a2bce-FRA cf-request-id 07e705333700002bce0f861000000001 expires Wed, 03 Feb 2021 19:57:28 GMT
GET H2	200	logo.png www.refundscam.com/	58 KB 59 KB	436ms 435ms	Image image/png	2606:4700:3037::6815:51eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.refundscam.com/logo.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:51eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8b3c7e674a1c5835de892fb419d633a0d80ba865cc88c10a197857671bb23a1d Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT cf-cache-status MISS last-modified Tue, 29 Sep 2020 10:42:02 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=zdt1z5wQZUyg6tA0rjbZdZ%2F392QKlBf%2FK0J6%2B0ahTdBI4wp6NLGQ9EW7uyS%2BmVRJJkfvbVLmybk3uqI%2FIwn%2F%2FtApFtabccGmVzDhodDGrkWQ5%2FkU7ccOIKfasxsqIGQ%3D"}],"max_age":604800} content-type image/png cache-control public, max-age=604800 nel {"max_age":604800,"report_to":"cf-nel"} accept-ranges bytes cf-ray 61850b0128be2bce-FRA content-length 59506 cf-request-id 07e70534b700002bcefb8bc000000001 expires Wed, 03 Feb 2021 19:57:29 GMT
GET H2	200	d7297.js Show response lp.oakfortrecovery.net/wp-content/cache/minify/	51 KB 17 KB	236ms 186ms	Script application/x-javascript	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Full URL https://lp.oakfortrecovery.net/wp-content/cache/minify/d7297.js Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash 992a9e092b3e1b3d25508d12e3f964f0e382458ec75214f70e74dfb0cc9b8968 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade last-modified Mon, 31 Aug 2020 05:08:37 GMT server LiteSpeed etag "41b1-5f4c85d5-0;gz" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=18609068 accept-ranges bytes content-length 16817 expires Tue, 31 Aug 2021 05:08:37 GMT
GET H2	200	dfacc.js Show response lp.oakfortrecovery.net/wp-content/cache/minify/	10 KB 4 KB	117ms 116ms	Script application/x-javascript	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Full URL https://lp.oakfortrecovery.net/wp-content/cache/minify/dfacc.js Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash b10d4805bfd37702e61c9c03f784ed6ea227bca02c58fd8b139fbfc62f68df08 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade last-modified Mon, 31 Aug 2020 05:08:32 GMT server LiteSpeed etag "1063-5f4c85d0-0;gz" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=18609063 accept-ranges bytes content-length 4195 expires Tue, 31 Aug 2021 05:08:32 GMT
GET H2	200	api.js Show response www.google.com/recaptcha/	884 B 1003 B	48ms 27ms	Script text/javascript	2a00:1450:4001:82b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js?render=6LdO6NsZAAAAAEzrhqh47GbuGyVmd1TK95kYhH3o Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 2858dc8f2d9f3b52a1d6dbaaea2b092a928c4dcfa5f17fb881234e6df2e38d76 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin content-security-policy frame-ancestors 'self' alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 586 x-xss-protection 1; mode=block expires Wed, 27 Jan 2021 19:57:29 GMT
GET H2	200	13d7d.js Show response lp.oakfortrecovery.net/wp-content/cache/minify/	1 KB 891 B	123ms 122ms	Script application/x-javascript	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Full URL https://lp.oakfortrecovery.net/wp-content/cache/minify/13d7d.js Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade last-modified Mon, 31 Aug 2020 05:08:38 GMT server LiteSpeed etag "301-5f4c85d6-0;gz" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=18609069 accept-ranges bytes content-length 769 expires Tue, 31 Aug 2021 05:08:38 GMT
GET H2	200	p.css p.typekit.net/	5 B 149 B	29ms 9ms	Stylesheet text/css	2a02:26f0:10c:581::19fd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=fbf4xbx&ht=tk&f=6846&a=44726086&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/fbf4xbx.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:581::19fd , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers Referer https://use.typekit.net/fbf4xbx.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:28 GMT last-modified Wed, 02 Sep 2020 04:00:22 GMT server nginx etag "5f4f18d6-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 accept-ranges bytes content-length 5
GET H2	200	gtm.js Show response www.googletagmanager.com/	143 KB 49 KB	65ms 45ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-WLBNN93 Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 95df0cae9730f349c3b4458744ca382e4b458589be234008c65403b1798dee01 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 50184 x-xss-protection 0 last-modified Wed, 27 Jan 2021 18:29:35 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 27 Jan 2021 19:57:29 GMT
GET H2	200	S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	27ms 6ms	Font font/woff2	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.refundscam.com Referer https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 25 Jan 2021 16:27:51 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:25 GMT server sffe age 185378 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14176 x-xss-protection 0 expires Tue, 25 Jan 2022 16:27:51 GMT
GET H2	200	S6uyw4BMUTPHjx4wXiWtFCc.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	27ms 11ms	Font font/woff2	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXiWtFCc.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.refundscam.com Referer https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 25 Jan 2021 13:34:51 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:59 GMT server sffe age 195758 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14044 x-xss-protection 0 expires Tue, 25 Jan 2022 13:34:51 GMT
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/gif
GET H2	404	tree.png www.refundscam.com/wp-content/themes/sinan/assets/images/	1 KB 1 KB	199ms 199ms	Image text/html	2606:4700:3037::6815:51eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.refundscam.com/wp-content/themes/sinan/assets/images/tree.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/wp-content/cache/minify/d7e82.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:51eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc3e8af1112c309af78b659ec6d49684784cd0facf83e21d69dd7d0f1bd6df08 Request headers Referer https://www.refundscam.com/wp-content/cache/minify/d7e82.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 27 Jan 2021 19:57:29 GMT content-encoding br cf-cache-status BYPASS nel {"max_age":604800,"report_to":"cf-nel"} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=QWKbC82p6fcm1OB6g5np9m8FZbOU397GMJiqMPrynf5%2BQ2GEsz5%2FQ6QWwXFGbW1hKQ2FA5%2B8diY%2BtTqmBaUGF3%2FUGAkLYUR5grMX%2FTAhbruUBnophuEQCzmsl9ZOPWM%3D"}],"max_age":604800} content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 cf-ray 61850b0149322bce-FRA cf-request-id 07e70534d100002bce4a8da000000001
GET H2	200	dots.png www.refundscam.com/wp-content/themes/sinan/assets/images/	448 B 770 B	203ms 202ms	Image image/png	2606:4700:3037::6815:51eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.refundscam.com/wp-content/themes/sinan/assets/images/dots.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/wp-content/cache/minify/d7e82.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:51eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2fc10e05023249cbf3c064dc2775975191c800dc4e093382454cd84b598054ea Request headers Referer https://www.refundscam.com/wp-content/cache/minify/d7e82.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT cf-cache-status MISS last-modified Mon, 31 Aug 2020 05:02:50 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gRZMoXctOH3N0tH2xye60I4HjjH0NvIwzrihl3qsgOOjhuGCfMMZKZ7dPi1KjYaa0%2F4Tv8905PNAJf9rJ0Wmq8GANE1ma85WxDTDxnewFMxQ9wnmsUuF2iMQY7YrI8M%3D"}],"max_age":604800} content-type image/png cache-control public, max-age=604800 nel {"max_age":604800,"report_to":"cf-nel"} accept-ranges bytes cf-ray 61850b0159492bce-FRA content-length 448 cf-request-id 07e70534d700002bcefebb0000000001 expires Wed, 03 Feb 2021 19:57:29 GMT
GET H2	200	spr.png www.refundscam.com/wp-content/themes/sinan/assets/images/	1 KB 2 KB	200ms 199ms	Image image/png	2606:4700:3037::6815:51eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.refundscam.com/wp-content/themes/sinan/assets/images/spr.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/wp-content/cache/minify/d7e82.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:51eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7da429c0483fd763e447d5b3fa7c8a434b9fda8e7b51327c6db732dbc00a793a Request headers Referer https://www.refundscam.com/wp-content/cache/minify/d7e82.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT cf-cache-status MISS last-modified Mon, 31 Aug 2020 05:02:55 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Ant72f7HLl21%2BbKSBsXk0WTIWLAb%2Bnl1SSrS4HN21IBa3jwnxw4FgfEaBgGggXMFUbreu7Qu8J%2BWdO34E4uua04CUsJtwlODELj0FYvrgr7284zPU1rn5NTjUbANxL8%3D"}],"max_age":604800} content-type image/png cache-control public, max-age=604800 nel {"max_age":604800,"report_to":"cf-nel"} accept-ranges bytes cf-ray 61850b01594f2bce-FRA content-length 1477 cf-request-id 07e70534da00002bcecd33a000000001 expires Wed, 03 Feb 2021 19:57:29 GMT
GET H2	200	spr2.png www.refundscam.com/wp-content/themes/sinan/assets/images/	2 KB 2 KB	198ms 198ms	Image image/png	2606:4700:3037::6815:51eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.refundscam.com/wp-content/themes/sinan/assets/images/spr2.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/wp-content/cache/minify/d7e82.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:51eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6ebd76ffab51ce757fabe408bacf693449f72191e23c54ccea7b1283d7083df4 Request headers Referer https://www.refundscam.com/wp-content/cache/minify/d7e82.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT cf-cache-status MISS last-modified Mon, 31 Aug 2020 05:02:55 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=QKQPdBhMiWWh4SOlrYQPdpXatuVzWk180HpHrU0SkALegPxHmuzlMsU%2BBWku9752HsnWL4HY2cNNzlZv6IMBAuDMjcjjeUfb6X70oal002r%2F%2FdDm5nLbdSeWUGAekUQ%3D"}],"max_age":604800} content-type image/png cache-control public, max-age=604800 nel {"max_age":604800,"report_to":"cf-nel"} accept-ranges bytes cf-ray 61850b0159502bce-FRA content-length 1902 cf-request-id 07e70534d800002bce13120000000001 expires Wed, 03 Feb 2021 19:57:29 GMT
GET H2	200	check.png www.refundscam.com/wp-content/themes/sinan/assets/images/	631 B 948 B	201ms 200ms	Image image/png	2606:4700:3037::6815:51eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.refundscam.com/wp-content/themes/sinan/assets/images/check.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/wp-content/cache/minify/d7e82.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:51eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 60c40425a9f1ce36aa0414d0a216561cf890aa1f3da7944ddd2c3f01dc1fd9e5 Request headers Referer https://www.refundscam.com/wp-content/cache/minify/d7e82.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT cf-cache-status MISS last-modified Mon, 31 Aug 2020 05:02:48 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=qXWnXCE0KC9wHkLDmgco%2FF7HJB%2FLXX%2BzNfN1FKo1XZR4J3Z84OT1fZXB3iWWrRb5XrQlzc8W1PglLhxHCGiJYIq2TxcLP8yyD3Hg2dp2IO%2FCn7ic9lTjsUOsWQxXiqA%3D"}],"max_age":604800} content-type image/png cache-control public, max-age=604800 nel {"max_age":604800,"report_to":"cf-nel"} accept-ranges bytes cf-ray 61850b0159522bce-FRA content-length 631 cf-request-id 07e70534d800002bcef4ac1000000001 expires Wed, 03 Feb 2021 19:57:29 GMT
GET H2	200	bg3.jpg www.refundscam.com/wp-content/themes/sinan/assets/images/	760 KB 761 KB	404ms 404ms	Image image/jpeg	2606:4700:3037::6815:51eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.refundscam.com/wp-content/themes/sinan/assets/images/bg3.jpg Requested by Host: www.refundscam.com URL: https://www.refundscam.com/wp-content/cache/minify/d7e82.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:51eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e9b6a746110265d3796071d8b7d7c3830752eb17647a7194dd616a066f51a096 Request headers Referer https://www.refundscam.com/wp-content/cache/minify/d7e82.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT cf-cache-status MISS last-modified Mon, 31 Aug 2020 05:02:35 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2BxDmd2m5IhxpwTzpouOcpd12CsrrCHdByE8cHdh1MLaWupqUDSZnH5pcvsaR0eerXDz%2Bzz75xmEC0v9xfMyI6XPon1m6uxdeJMjSGGWKnvetnDCG3Cy4%2BZ23wdTEBcw%3D"}],"max_age":604800} content-type image/jpeg cache-control public, max-age=604800 nel {"max_age":604800,"report_to":"cf-nel"} accept-ranges bytes cf-ray 61850b01595e2bce-FRA content-length 778471 cf-request-id 07e70534db00002bceeaa63000000001 expires Wed, 03 Feb 2021 19:57:29 GMT
GET H2	200	S6u9w4BMUTPHh50XSwiPGQ3q5d0.woff2 fonts.gstatic.com/s/lato/v17/	13 KB 14 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh50XSwiPGQ3q5d0.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 973ebbead06df6ace22a88d2856663d37845792bdf1b40ff69df2e20912fedef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.refundscam.com Referer https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 25 Jan 2021 16:20:29 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:10:30 GMT server sffe age 185820 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13732 x-xss-protection 0 expires Tue, 25 Jan 2022 16:20:29 GMT
GET H2	200	l use.typekit.net/af/1b1b1e/00000000000000000001709e/27/	24 KB 24 KB	43ms 13ms	Font application/font-woff2	2a02:26f0:6c00::210:ba0a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/1b1b1e/00000000000000000001709e/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/fbf4xbx.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:ba0a , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 6d7866613a48e1d880b7cfacc00c4e2849a767bacfc93871d558e443c3129054 Request headers Origin https://www.refundscam.com Referer https://use.typekit.net/fbf4xbx.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT server nginx etag "f507d4945327bf77fa226b6fef0f1c6a6af3bf09" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 timing-allow-origin * content-length 24140
GET H2	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/releases/_KUxfxvAoJ4k7SaKyLbja4Mi/	331 KB 130 KB	25ms 6ms	Script text/javascript	2a00:1450:4001:81a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/_KUxfxvAoJ4k7SaKyLbja4Mi/recaptcha__en.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js?render=6LdO6NsZAAAAAEzrhqh47GbuGyVmd1TK95kYhH3o Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2ab2ee6c6698b57f2f3c79839a574a6808197ac57b7fbc6295b1be3ab8a4d279 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.refundscam.com Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:30:09 GMT content-encoding gzip x-content-type-options nosniff age 1640 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 132786 x-xss-protection 0 last-modified Sun, 17 Jan 2021 15:08:17 GMT server sffe vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 27 Jan 2022 19:30:09 GMT
GET H3-Q050	200	top.jpg lp.oakfortrecovery.net/wp-content/themes/sinan/assets/images/	247 KB 248 KB	139ms 138ms	Image image/jpeg	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Show image Full URL https://lp.oakfortrecovery.net/wp-content/themes/sinan/assets/images/top.jpg Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash ff58c941e89dfeec78060950a2d3b63327f5b0ac2670c3967e361683f5711153 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT referrer-policy no-referrer-when-downgrade last-modified Mon, 31 Aug 2020 05:02:55 GMT server LiteSpeed etag "3ddc0-5f4c847f-0;;;" content-type image/jpeg cache-control max-age=2628000, public accept-ranges bytes content-length 253376 expires Thu, 27 Jan 2022 19:57:29 GMT
GET H3-Q050	200	icon_file@2x.png lp.oakfortrecovery.net/wp-content/uploads/2020/05/	4 KB 4 KB	140ms 139ms	Image image/png	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Show image Full URL https://lp.oakfortrecovery.net/wp-content/uploads/2020/05/icon_file@2x.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash 3b426e566174b10429f85fe03366549f0f8f768ae670be2418f5ef264df36614 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT referrer-policy no-referrer-when-downgrade last-modified Tue, 09 Jun 2020 12:18:06 GMT server LiteSpeed etag "1135-5edf7dfe-0;;;" content-type image/png cache-control max-age=2628000, public accept-ranges bytes content-length 4405 expires Thu, 27 Jan 2022 19:57:29 GMT
GET H3-Q050	200	icon_analyze@2x-1.png lp.oakfortrecovery.net/wp-content/uploads/2020/05/	4 KB 4 KB	140ms 139ms	Image image/png	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Show image Full URL https://lp.oakfortrecovery.net/wp-content/uploads/2020/05/icon_analyze@2x-1.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash a33c2525cf7e3c5071c70e122e7c9c85070ae2f860d0522503423f9e7b6587d4 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT referrer-policy no-referrer-when-downgrade last-modified Tue, 09 Jun 2020 12:18:08 GMT server LiteSpeed etag "fe3-5edf7e00-0;;;" content-type image/png cache-control max-age=2628000, public accept-ranges bytes content-length 4067 expires Thu, 27 Jan 2022 19:57:29 GMT
GET H3-Q050	200	icon_dispute@2x.png lp.oakfortrecovery.net/wp-content/uploads/2020/05/	4 KB 4 KB	140ms 139ms	Image image/png	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Show image Full URL https://lp.oakfortrecovery.net/wp-content/uploads/2020/05/icon_dispute@2x.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash 3bc3cfb481fccbc301f68a785768faea1b93d455a3399ec00b73e24379d59293 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT referrer-policy no-referrer-when-downgrade last-modified Tue, 09 Jun 2020 12:18:05 GMT server LiteSpeed etag "1066-5edf7dfd-0;;;" content-type image/png cache-control max-age=2628000, public accept-ranges bytes content-length 4198 expires Thu, 27 Jan 2022 19:57:29 GMT
GET H3-Q050	200	icon_money@2x-1.png lp.oakfortrecovery.net/wp-content/uploads/2020/05/	5 KB 5 KB	140ms 139ms	Image image/png	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Show image Full URL https://lp.oakfortrecovery.net/wp-content/uploads/2020/05/icon_money@2x-1.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash 57ffbaa1ff1cde4ccea0b7c9b4ddbc88e16925d7206f0991281000c97746a7fb Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT referrer-policy no-referrer-when-downgrade last-modified Tue, 09 Jun 2020 12:18:09 GMT server LiteSpeed etag "13bf-5edf7e01-0;;;" content-type image/png cache-control max-age=2628000, public accept-ranges bytes content-length 5055 expires Thu, 27 Jan 2022 19:57:29 GMT
GET H2	200	/ Show response ipapi.co/json/	717 B 998 B	218ms 202ms	XHR application/json	2606:4700:20::681a:92c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ipapi.co/json/ Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:20::681a:92c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22d59b58ad3287268b1c6be6e0dd786263b7bacf09da2b87c178c3d85f4c28bd Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT content-encoding br allow OPTIONS, OPTIONS, HEAD, POST, GET cf-cache-status DYNAMIC nel {"max_age":604800,"report_to":"cf-nel"} server cloudflare x-frame-options SAMEORIGIN expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Host, Origin report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2B5WdVAGga2WiA0MRht7RIq%2BxjplGPzSTFt8uR3O1XJXxPjXNRDnhI%2BTDqWFzrIPDKdX5MM%2FlKYVpgox0DLj5galA%2F54u2X1ftU9tt1el0WkxklU0ZQ%3D%3D"}],"max_age":604800} content-type application/json access-control-allow-origin https://www.refundscam.com cf-ray 61850b0228354a5b-FRA cf-request-id 07e705355800004a5b1302e000000001
GET H2	200	analytics.js Show response www.google-analytics.com/	46 KB 19 KB	26ms 6ms	Script text/javascript	2a00:1450:4001:827::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-WLBNN93 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 23 Oct 2020 03:00:57 GMT server Golfe2 age 5470 date Wed, 27 Jan 2021 18:26:19 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18817 expires Wed, 27 Jan 2021 20:26:19 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	30 KB 13 KB	155ms 70ms	Script text/javascript	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-WLBNN93 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash 34fcae3cf94e02d46c230a5b7dd3827d612587164e048dcfe146518da1cb4ab0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 12189 x-xss-protection 0 server cafe etag 8926089356025331971 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Wed, 27 Jan 2021 19:57:29 GMT
GET H2	200	hotjar-1835620.js Show response static.hotjar.com/c/	3 KB 2 KB	265ms 98ms	Script application/javascript	13.225.80.113 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-1835620.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-WLBNN93 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.113 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-113.fra2.r.cloudfront.net Software / Resource Hash 05fe48264f0a5b8735f08a5a4f52aafbe6f9fd1a7a6ed794c75b764915329edf Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT content-encoding br x-content-type-options nosniff cache-control max-age=60 x-amz-cf-pop FRA2-C2 etag W/51b82a25e105df4df6480fced8c53a51 vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript access-control-allow-origin * x-cache-hit 1 content-length 1539 via 1.1 03d509e8374e9f42668961b5e0201349.cloudfront.net (CloudFront) x-amz-cf-id Kp6sAHAYjvZmFQqS-Io-bvuEIqgCSWpFz-4sm0i0xbJeyFLfphRB-Q==
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	91 KB 24 KB	19ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 23762 x-fb-rlafr 0 pragma public x-fb-debug rOhwepBrCEa+lzbdMu2n8xXRHiTNayRIDdWcJXV3bwYr8URPrUl1tAB3IEQg5OvDC+WbG3/ep3zeZ4UOzFSJYg== x-fb-trip-id 686109401 x-frame-options DENY cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Wed, 27 Jan 2021 19:57:29 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3-Q050	200	anchor www.google.com/recaptcha/api2/ Frame 6E4A	0 0	190ms 176ms	Document text/html	2a00:1450:4001:82b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdO6NsZAAAAAEzrhqh47GbuGyVmd1TK95kYhH3o&co=aHR0cHM6Ly93d3cucmVmdW5kc2NhbS5jb206NDQz&hl=en&v=_KUxfxvAoJ4k7SaKyLbja4Mi&size=invisible&cb=7n5346sil9yn Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/_KUxfxvAoJ4k7SaKyLbja4Mi/recaptcha__en.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-CJHtu2rpJWkf9Vsi1BaMhw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.google.com :scheme https :path /recaptcha/api2/anchor?ar=1&k=6LdO6NsZAAAAAEzrhqh47GbuGyVmd1TK95kYhH3o&co=aHR0cHM6Ly93d3cucmVmdW5kc2NhbS5jb206NDQz&hl=en&v=_KUxfxvAoJ4k7SaKyLbja4Mi&size=invisible&cb=7n5346sil9yn pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.refundscam.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.refundscam.com/ Response headers content-type text/html; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate pragma no-cache expires Mon, 01 Jan 1990 00:00:00 GMT date Wed, 27 Jan 2021 19:57:29 GMT content-security-policy script-src 'report-sample' 'nonce-CJHtu2rpJWkf9Vsi1BaMhw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 10403 server GSE alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	2079953098815042 Show response connect.facebook.net/signals/config/	241 KB 70 KB	69ms 69ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/2079953098815042?v=2.9.33&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 96e6bfb8f7aa113d81d82874bb62fc4ece35e60a4b8e36c34a5705e97297f823 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 x-fb-rlafr 0 pragma public x-fb-debug TMSHr6lWpE5tt3I3fOxjBwLi5VYa9RDaX2YfC8CrOuRLFnvjRZNHbD6eJzWZ6fVFJiUpApYZ9MZRM0+1f/E9EQ== x-fb-trip-id 686109401 x-frame-options DENY cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Wed, 27 Jan 2021 19:57:29 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-content-id 1084888515 expires Sat, 01 Jan 2000 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 448 B	40ms 14ms	XHR text/plain	2a00:1450:400c:c00::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-168115788-1&cid=996372631.1611777449&jid=2083421740&gjid=762730692&_gid=1404844029.1611777449&_u=YGBAgEABAAAAAE~&z=530486173 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Wed, 27 Jan 2021 19:57:29 GMT content-type text/plain access-control-allow-origin https://www.refundscam.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	collect www.google-analytics.com/	35 B 384 B	34ms 20ms	Image image/gif	2a00:1450:4001:827::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j87&a=856014263&t=pageview&_s=1&dl=https%3A%2F%2Fwww.refundscam.com%2F&ul=en-us&de=UTF-8&dt=Report%20Scams&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEAB~&jid=2083421740&gjid=762730692&cid=996372631.1611777449&tid=UA-168115788-1&_gid=1404844029.1611777449&gtm=2wg1k0WLBNN93&z=588853861 Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 26 Jan 2021 20:26:27 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 84662 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	scam_forex@2x.png lp.oakfortrecovery.net/wp-content/uploads/2020/05/	3 KB 4 KB	120ms 120ms	Image image/png	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Show image Full URL https://lp.oakfortrecovery.net/wp-content/uploads/2020/05/scam_forex@2x.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash dd79198f5531fdc589de0e7af68ab4bdfa51487871f0b9274ca94341eb7db4d8 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT referrer-policy no-referrer-when-downgrade last-modified Sun, 31 May 2020 05:57:40 GMT server LiteSpeed etag "ddb-5ed34754-0;;;" content-type image/png cache-control max-age=2628000, public accept-ranges bytes content-length 3547 expires Thu, 27 Jan 2022 19:57:29 GMT
GET H3-Q050	200	scam_options@2x.png lp.oakfortrecovery.net/wp-content/uploads/2020/05/	7 KB 8 KB	121ms 120ms	Image image/png	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Show image Full URL https://lp.oakfortrecovery.net/wp-content/uploads/2020/05/scam_options@2x.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash db213be44261d66829aa3965ae22aed722eb9f76eff4336e60d7319319ee80f1 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT referrer-policy no-referrer-when-downgrade last-modified Sun, 31 May 2020 05:57:40 GMT server LiteSpeed etag "1de4-5ed34754-0;;;" content-type image/png cache-control max-age=2628000, public accept-ranges bytes content-length 7652 expires Thu, 27 Jan 2022 19:57:29 GMT
GET H3-Q050	200	scam_crypto@2x.png lp.oakfortrecovery.net/wp-content/uploads/2020/05/	6 KB 6 KB	123ms 123ms	Image image/png	185.56.75.50 JETSERVER-LTD
General Check archive.org Show headers Download Go to Show image Full URL https://lp.oakfortrecovery.net/wp-content/uploads/2020/05/scam_crypto@2x.png Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 185.56.75.50 , Israel, ASN201660 (JETSERVER-LTD, IL), Reverse DNS israel163.jetserver.net Software LiteSpeed / Resource Hash 25d56c1aca0e1ae7e4878c5d07b7f239b0bec50345a0b243ed826ba0fb1b2104 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT referrer-policy no-referrer-when-downgrade last-modified Sun, 31 May 2020 05:57:39 GMT server LiteSpeed etag "17b2-5ed34753-0;;;" content-type image/png cache-control max-age=2628000, public accept-ranges bytes content-length 6066 expires Thu, 27 Jan 2022 19:57:29 GMT
GET H3-Q050	200	ga-audiences www.google.com/ads/	42 B 483 B	30ms 29ms	Image image/gif	2a00:1450:4001:82b::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-168115788-1&cid=996372631.1611777449&jid=2083421740&_u=YGBAgEABAAAAAE~&z=1254083568 Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 27 Jan 2021 19:57:29 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 505 B	61ms 40ms	Image image/gif	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-168115788-1&cid=996372631.1611777449&jid=2083421740&_u=YGBAgEABAAAAAE~&z=1254083568 Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 27 Jan 2021 19:57:29 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/641533589/	2 KB 2 KB	50ms 31ms	Script text/javascript	2a00:1450:4001:811::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/641533589/?random=1611777449467&cv=9&fst=1611777449467&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg1k0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.refundscam.com%2F&tiba=Report%20Scams&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 930cb79f060daf0dd99fe6afde4a06a9288977dde83865cafc2fd644428d9843 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 27 Jan 2021 19:57:29 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 989 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 409 B	19ms 6ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=2079953098815042&ev=PageView&dl=https%3A%2F%2Fwww.refundscam.com%2F&rl=&if=false&ts=1611777449506&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1611777449504.293232411&it=1611777449409&coo=false&rqm=GET Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 27 Jan 2021 19:57:29 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Wed, 27 Jan 2021 19:57:29 GMT
GET H3-Q050	200	/ www.google.com/pagead/1p-user-list/641533589/	42 B 112 B	21ms 21ms	Image image/gif	2a00:1450:4001:82b::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/641533589/?random=1611777449467&cv=9&fst=1611774000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg1k0&sendb=1&frm=0&url=https%3A%2F%2Fwww.refundscam.com%2F&tiba=Report%20Scams&async=1&fmt=3&is_vtc=1&random=46390599&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 27 Jan 2021 19:57:29 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/641533589/	42 B 154 B	21ms 21ms	Image image/gif	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/641533589/?random=1611777449467&cv=9&fst=1611774000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg1k0&sendb=1&frm=0&url=https%3A%2F%2Fwww.refundscam.com%2F&tiba=Report%20Scams&async=1&fmt=3&is_vtc=1&random=46390599&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: www.refundscam.com URL: https://www.refundscam.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 27 Jan 2021 19:57:29 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	modules.59fae23e8e8310b9fca6.js Show response script.hotjar.com/	223 KB 59 KB	295ms 142ms	Script application/javascript	13.224.194.56 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.59fae23e8e8310b9fca6.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1835620.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.194.56 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-194-56.fra2.r.cloudfront.net Software / Resource Hash 05cd215b7b218de7ab7c87c2b051c3be0d336780bbd627df696563580d5de2c7 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 22 Jan 2021 16:25:48 GMT content-encoding br x-content-type-options nosniff age 444701 x-cache Hit from cloudfront content-length 59724 access-control-allow-origin * last-modified Fri, 22 Jan 2021 16:22:44 GMT etag "474bf4f62df1bb58f039e2f05cbd9062" vary Accept-Encoding content-type application/javascript via 1.1 cdcb559c2f25d8ad2ccf0419bee33b03.cloudfront.net (CloudFront) cache-control max-age=31536000 x-amz-cf-pop FRA2-C1 accept-ranges bytes x-robots-tag none x-amz-cf-id y3V6jhbBIHhdOVY3Lav281gkP1rY3BRW_jXQjB-rNuAiah5b6y6INg==
GET H2	200	box-469cf41adb11dc78be68c1ae7f9457a4.html vars.hotjar.com/ Frame 2D2D	0 0	232ms 99ms	Document text/html	13.224.194.11 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1835620.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.194.11 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-194-11.fra2.r.cloudfront.net Software / Resource Hash Request headers :method GET :authority vars.hotjar.com :scheme https :path /box-469cf41adb11dc78be68c1ae7f9457a4.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.refundscam.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.refundscam.com/ Response headers content-type text/html content-length 851 date Mon, 23 Nov 2020 17:01:03 GMT accept-ranges bytes cache-control max-age=31536000 content-encoding br etag "d594f1d4c3e5dbd6b556c60d34e0daea" last-modified Mon, 23 Nov 2020 15:41:01 GMT x-robots-tag none vary Accept-Encoding x-cache Hit from cloudfront via 1.1 dde0b4b1e223fa23670e93078a04c116.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 x-amz-cf-id KAcKRjerVmBVSoxxDPuSSJI3co3sypqi2HDwtgphxyfVHUT9Taw1hg== age 5626586
POST H2	200	visit-data Show response in.hotjar.com/api/v2/client/sites/1835620/	152 B 305 B	151ms 56ms	XHR application/json	54.171.249.106 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://in.hotjar.com/api/v2/client/sites/1835620/visit-data?sv=7 Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.59fae23e8e8310b9fca6.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.249.106 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-249-106.eu-west-1.compute.amazonaws.com Software / Resource Hash c4dc799d09b15e57ee98e3c3866ca16f53354cb79838d3aa6c9c961292151858 Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain; charset=UTF-8 Response headers access-control-allow-origin * date Wed, 27 Jan 2021 19:57:30 GMT content-encoding br access-control-allow-credentials true vary Accept-Encoding access-control-max-age 86400 content-type application/json
POST H2	200	/ www.facebook.com/tr/	0 109 B	6ms 6ms	Other text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.refundscam.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryZBQ6pL59ayznBzWS Response headers strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt date Wed, 27 Jan 2021 19:57:30 GMT content-type text/plain access-control-allow-origin https://www.refundscam.com access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 0