gfs3.glb.kworld.kpmg.com Open in urlscan Pro
51.136.9.217  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://kpmg.thanks.com/app/redeem Page URL
2. https://gfs3.glb.kworld.kpmg.com/adfs/ls/?SAMLRequest=fZHNTsMwEITvPEXke%2B3EaUtjNUGFCqj4q2jgwAXZiUmtOnbwOi28PSFtBVw4rjQ7s%2FvN9Oyj1sFWOlDWpCjCIQqkKWypTJWip%2FxyMEFn2ckUeK1pw2atX5tH%2Bd5K8MEMQDrf7V1YA20t3Uq6rSrk0%2BNtitbeN8AI4Y3C9Wcj3QawMmQbEQBLklGXM%2B9MlOG%2BTz7qqzeIcaUF3uys0yXeNHWFC1sTXr4B0UBQsJin6LVM6Kk4LeNQxFSIJBaiiIZhMo4nsRSjYdnJAFq5MOC58SmiIaWDKByENI8mLB4zOsSTMHlBwdJZbwurz5XZf906wywHBczwWgLzBVvN7m4ZxSETexGw6zxfDpYPq7w32KpSuvtOnaKbXcdvHVxpK7gOclmsjdW2UhJQ8HzkTL85d%2BQNsD3Z%2F1Obw4ko2xfB%2Bt%2Fcb4f%2FDfixKpQdQfdgf5qZkt%2FO2WH823j2BQ%3D%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=l7wdhYeLVCOPAuaycs0f%2F8DgvNRXO94%2BwOHuxVFmcpFYzJW7XVn%2FIzUVw4BrGVlQjsjHHQAJg8uJl7kp9t7X46kFmvX5xBTSZJhnhrEojZN2hptdanGxk%2FuvyYrJxunrn0%2F%2BDVKit07sq4S21O%2BFLRpnKbtYmZbs81FmL1dzGum%2F60NaOLeiLKemBDU%2Bn8rI%2FIKQd9NtmJcY1e4UWwGMO0uc%2Fex9Hsw9AJ6HawGX37FMLm0GqqvFP8uN9cd2XU1945ej3sBznqwfcMtgSIiCMB7SbiWbaojvRvx%2BhS2TKAFQ%2FsKBiWfYdQhCABNk9jCuJrWC13UGbR8BgDgylW225g%3D%3D Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	redeem Show response kpmg.thanks.com/app/	2 KB 1 KB	1421ms 1367ms	Document text/html	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/redeem Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 61cf6b69bdbf69890d9488b93b0344588478e5447086842b0af675803a38eb60 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=0,no-cache,no-store,must-revalidate content-encoding gzip content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-type text/html date Sun, 02 Oct 2022 18:36:24 GMT etag W/"0575ea4b1cc0813282ad6e9636737b77" last-modified Sun, 02 Oct 2022 16:51:35 GMT server AmazonS3 strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-amz-cf-id J7HWEd6G5Sgb-raowStAFHqDBuHNslIo5reM7qvZ6xsfV-XS4gyqqQ== x-amz-cf-pop FRA53-C1 x-amz-server-side-encryption AES256 x-cache Error from cloudfront x-content-type-options nosniff x-xss-protection 1; mode=block
GET H2	200	css fonts.googleapis.com/	7 KB 1 KB	61ms 22ms	Stylesheet text/css	2a00:1450:4001:829::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Poppins:300,400,400i,500,600,700,800&display=swap Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/redeem Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 00ee00b7eee20b58ad04fca87e58a08e056a51f4994869919c8ac3fa9a345ba3 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Sun, 02 Oct 2022 18:36:23 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sun, 02 Oct 2022 18:17:51 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sun, 02 Oct 2022 18:36:23 GMT
GET H2	200	styles.a18cc91fb333c9a6356e.css kpmg.thanks.com/app/	664 KB 120 KB	21ms 18ms	Stylesheet text/css	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/styles.a18cc91fb333c9a6356e.css Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/redeem Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 17a1cccfc2f74b2dfeb8b79c6107d289608bbcce40787a204c26e4a98b69418f Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/app/redeem User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Sun, 02 Oct 2022 17:18:52 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-encoding gzip x-amz-cf-pop FRA53-C1 age 4651 x-amz-server-side-encryption AES256 via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Sun, 02 Oct 2022 16:51:32 GMT server AmazonS3 etag W/"843bcd49a58660e258fccca3759a3897" vary Accept-Encoding content-type text/css cache-control max-age=2592000,public x-amz-cf-id Zlj3trH717gN9k0fXKwv2k_odVBiNXsI_oqfeNCSEqJNE-fa_Gmq-A==
GET H2	200	runtime-es2015.62e658b3c1728801e623.js Show response kpmg.thanks.com/app/	6 KB 4 KB	36ms 33ms	Script application/javascript	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/runtime-es2015.62e658b3c1728801e623.js Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/redeem Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 2d30ef41aa1ac8d18a9fac08c0b81fddb8fa4b51ec9c2b83303e3bf285d07a76 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://kpmg.thanks.com/app/redeem Origin https://kpmg.thanks.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Sun, 02 Oct 2022 17:18:53 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-encoding gzip x-amz-cf-pop FRA53-C1 age 4651 x-amz-server-side-encryption AES256 via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Sun, 02 Oct 2022 16:51:32 GMT server AmazonS3 etag W/"b4ed45ef8eb7559400647a93d756606e" vary Accept-Encoding content-type application/javascript cache-control max-age=2592000,public x-amz-cf-id CUaWy-P6xC7cGlA1SXdozlpDyvWje8t6zRpPttHnY_8H07eZerv_KQ==
GET H2	200	polyfills-es2015.3c8080bdceb582a570a2.js Show response kpmg.thanks.com/app/	218 KB 72 KB	36ms 34ms	Script application/javascript	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/polyfills-es2015.3c8080bdceb582a570a2.js Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/redeem Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 38ebaa39fcd9938c64fb6f337aa6c2075ea674fe2f5fd7ff6a52980e6328d0de Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://kpmg.thanks.com/app/redeem Origin https://kpmg.thanks.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Thu, 22 Sep 2022 23:07:06 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-encoding gzip x-amz-cf-pop FRA53-C1 age 847758 x-amz-server-side-encryption AES256 via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Wed, 14 Sep 2022 08:13:43 GMT server AmazonS3 etag W/"4959b0694f9b5b57fbc8d728136ee348" vary Accept-Encoding content-type application/javascript cache-control max-age=2592000,public x-amz-cf-id Rbr07QMrousQEAEk8iJPMJ1g71mSCsGYOTtGhwsMNXgMgI4ezgMSbQ==
GET H2	200	scripts.addc24f90f036c266652.js Show response kpmg.thanks.com/app/	582 KB 184 KB	26ms 26ms	Script application/javascript	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/scripts.addc24f90f036c266652.js Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/redeem Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash b27e6caa0b1d172de809e83b8de9a76cf2bd0999b23fc86a49474b11f6d38f02 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/app/redeem User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Tue, 27 Sep 2022 05:39:59 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-encoding gzip x-amz-cf-pop FRA53-C1 age 478584 x-amz-server-side-encryption AES256 via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Wed, 14 Sep 2022 08:13:43 GMT server AmazonS3 etag W/"e745d724427c80c379fce5a5f8a8717c" vary Accept-Encoding content-type application/javascript cache-control max-age=2592000,public x-amz-cf-id hqstCLwKRxguw218L6AVp-0YSQiaryO4SbMLwmty3OBbtJpB9hPgjw==
GET H2	200	main-es2015.36dd36415d184ff92858.js Show response kpmg.thanks.com/app/	2 MB 571 KB	36ms 34ms	Script application/javascript	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/main-es2015.36dd36415d184ff92858.js Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/redeem Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 6940a71b7ee7e298d8e85f464c2db190ac51915668d7e9190c30a487120d738e Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://kpmg.thanks.com/app/redeem Origin https://kpmg.thanks.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Sun, 02 Oct 2022 17:18:53 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-encoding gzip x-amz-cf-pop FRA53-C1 age 4651 x-amz-server-side-encryption AES256 via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Sun, 02 Oct 2022 16:51:32 GMT server AmazonS3 etag W/"95da43c6feb3b3fd858c376827f2af8c" vary Accept-Encoding content-type application/javascript cache-control max-age=2592000,public x-amz-cf-id xiTuTo4RR7A7cEUY41uB-NufopMpnoRxtg5wydVjCsDyNXI0EPDdkg==
GET H2	200	js Show response www.googletagmanager.com/gtag/	106 KB 42 KB	138ms 58ms	Script application/javascript	2a00:1450:400d:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-151543413-2 Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/redeem Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash aa73b5e04952e7890f2185c7902503e7e4c0ce484c325357aba06e6b545237e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Sun, 02 Oct 2022 18:36:23 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42366 x-xss-protection 0 last-modified Sun, 02 Oct 2022 18:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sun, 02 Oct 2022 18:36:23 GMT
GET H2	200	pxiEyp8kv8JHgFVrJJfecg.woff2 fonts.gstatic.com/s/poppins/v20/	8 KB 8 KB	52ms 15ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Poppins:300,400,400i,500,600,700,800&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://kpmg.thanks.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Wed, 28 Sep 2022 19:25:00 GMT x-content-type-options nosniff age 342683 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7884 x-xss-protection 0 last-modified Wed, 27 Apr 2022 17:03:52 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 28 Sep 2023 19:25:00 GMT
GET H2	200	144-es2015.1ccc0d292222850f5850.js Show response kpmg.thanks.com/app/	28 KB 10 KB	14ms 14ms	Script application/javascript	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/144-es2015.1ccc0d292222850f5850.js Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/runtime-es2015.62e658b3c1728801e623.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash a2e0364705d95981d487a1a9eb2a69d03d84c18e7129a9081185db1c2873c5e3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/app/redeem User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Sun, 02 Oct 2022 17:19:02 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-encoding gzip x-amz-cf-pop FRA53-C1 age 4642 x-amz-server-side-encryption AES256 via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Sun, 02 Oct 2022 16:51:30 GMT server AmazonS3 etag W/"7b262a47ef85e305b1afe97ce19646fd" vary Accept-Encoding content-type application/javascript cache-control max-age=2592000,public x-amz-cf-id 4v4csNzfHVDU5-EsGVWslZPutnbiq0SDz21qRPyzE0W2-yrhS8QGJA==
GET H2	200	129-es2015.a568832ce481190f53b8.js Show response kpmg.thanks.com/app/	28 KB 8 KB	30ms 30ms	Script application/javascript	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/129-es2015.a568832ce481190f53b8.js Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/runtime-es2015.62e658b3c1728801e623.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 59aad6554bf3e83c947ede084693b4db22a838e4b5e1ed8a8f55057d8df9d44e Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/app/redeem User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Sun, 02 Oct 2022 17:19:02 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-encoding gzip x-amz-cf-pop FRA53-C1 age 4642 x-amz-server-side-encryption AES256 via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Sun, 02 Oct 2022 16:51:29 GMT server AmazonS3 etag W/"81a6db2ffb6003bd121c0521d29f5144" vary Accept-Encoding content-type application/javascript cache-control max-age=2592000,public x-amz-cf-id IZxHXefy1rIPBoeQIJruPE1NhK47saS73DHcnRPOIhZFzt-tmZBM9w==
GET H2	200	common-es2015.812810d8c4d0102552bd.js Show response kpmg.thanks.com/app/	74 KB 20 KB	55ms 55ms	Script application/javascript	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/common-es2015.812810d8c4d0102552bd.js Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/runtime-es2015.62e658b3c1728801e623.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 461895597b9f444087ec4ae42b7b54d1a55e1c43c8ed28e95e046e5986800900 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/app/redeem User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Sun, 02 Oct 2022 17:19:03 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-encoding gzip x-amz-cf-pop FRA53-C1 age 4641 x-amz-server-side-encryption AES256 via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Sun, 02 Oct 2022 16:51:31 GMT server AmazonS3 etag W/"003311d116171e339d0667450ad37e22" vary Accept-Encoding content-type application/javascript cache-control max-age=2592000,public x-amz-cf-id huzCo0lQDqT7B7ugBxT1uaabxUf6jTGnbtN4NILdmbXGcLmlZOMumg==
GET H2	200	123-es2015.245930fb0480f2e7cf34.js Show response kpmg.thanks.com/app/	17 KB 5 KB	22ms 22ms	Script application/javascript	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/123-es2015.245930fb0480f2e7cf34.js Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/runtime-es2015.62e658b3c1728801e623.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash d84fc3e0453cdba1a4081b76aa589ae58ed0474d82880511cf79ba17bba3859b Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/app/redeem User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Sun, 02 Oct 2022 17:35:23 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-encoding gzip x-amz-cf-pop FRA53-C1 age 3661 x-amz-server-side-encryption AES256 via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Sun, 02 Oct 2022 16:51:29 GMT server AmazonS3 etag W/"6de7fc0ea319e37e6c46eb36900b4493" vary Accept-Encoding content-type application/javascript cache-control max-age=2592000,public x-amz-cf-id fPFlcGH8qpgAmbPlPJd5DN5uv3Qh3AkvimDIZfND3Emk-jOmNraIOQ==
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	74ms 34ms	Script text/javascript	2001:4860:4802:32::178 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-151543413-2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Sun, 02 Oct 2022 17:29:14 GMT last-modified Sun, 11 Sep 2022 13:50:09 GMT server Golfe2 age 4029 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19826 expires Sun, 02 Oct 2022 19:29:14 GMT
OPTIONS H2	200	theme api.myperks.in/v1/company/	0 0	882ms 807ms	Preflight	2606:4700:10::6814:f6a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.myperks.in/v1/company/theme?domain=kpmg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:f6a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Headers access-token,r-id Access-Control-Request-Method GET Origin https://kpmg.thanks.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, accessToken, access-token, If-Modified-Since, signed-request, r-id access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS access-control-allow-origin * access-control-expose-headers Content-Disposition, r-id cache-control no-store cf-cache-status DYNAMIC cf-ray 753f8b18197a9162-FRA content-length 0 date Sun, 02 Oct 2022 18:36:24 GMT server cloudflare strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff x-frame-options SAMEORIGIN x-ua-compatible IE=Edge x-xss-protection 1; mode=block
GET H2	200	134-es2015.2fd46b92c9344ea0e2c4.js Show response kpmg.thanks.com/app/	3 KB 2 KB	22ms 21ms	Script application/javascript	143.204.215.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://kpmg.thanks.com/app/134-es2015.2fd46b92c9344ea0e2c4.js Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/runtime-es2015.62e658b3c1728801e623.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-43.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 7c7cf2628259c5c93b60852f955df9964e38bb655ad8ad1040b013f93e6b43bc Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/app/login User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Sun, 02 Oct 2022 17:19:07 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com content-encoding gzip x-amz-cf-pop FRA53-C1 age 4637 x-amz-server-side-encryption AES256 via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Sun, 02 Oct 2022 16:51:30 GMT server AmazonS3 etag W/"60f3c3fc5d801a147a7ed909b084f9f7" vary Accept-Encoding content-type application/javascript cache-control max-age=2592000,public x-amz-cf-id kO3q2cU94li_iuHgbqJi8Ef_78ELMpE5OgLChzMZQf5tsTb2sCVvig==
GET H2	200	theme api.myperks.in/v1/company/	2 KB 1 KB	487ms 486ms	XHR application/json	2606:4700:10::6814:f6a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.myperks.in/v1/company/theme?domain=kpmg Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/polyfills-es2015.3c8080bdceb582a570a2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:f6a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/plain, */* Referer https://kpmg.thanks.com/ r-id 4e50310c-a6f4-d1b5-1cd0-6b7432048a3d-622 accept-language de-DE,de;q=0.9 access-token User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Sun, 02 Oct 2022 18:36:24 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC content-encoding gzip x-xss-protection 1; mode=block x-ua-compatible IE=Edge server cloudflare vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/json access-control-allow-origin * access-control-expose-headers Content-Disposition, r-id cache-control no-store r-id 4e50310c-a6f4-d1b5-1cd0-6b7432048a3d-622 cf-ray 753f8b1d2df89162-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, accessToken, access-token, If-Modified-Since, signed-request, r-id x-frame-options SAMEORIGIN
GET H2	200	thanks_icon_128.png cdn.kwench.com/thanks/logo/	4 KB 5 KB	332ms 69ms	Image image/png	2600:9000:20d7:ee00:0:2f04:f240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.kwench.com/thanks/logo/thanks_icon_128.png Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20d7:ee00:0:2f04:f240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 998c13619d7525fbcc8f879bc6a85748fa004f76caf2178a3f69268368c187e3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers x-amz-version-id ccRiE8DM2IKdAzi0xVok3nwEX9WEgB_3 strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com via 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront) date Sun, 02 Oct 2022 02:53:29 GMT x-amz-cf-pop ZAG50-C1 age 56575 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 4511 x-xss-protection 1; mode=block last-modified Fri, 13 Mar 2020 05:29:50 GMT server AmazonS3 etag "d45f52a12e7d50b6b3573ad7eff9e5b9" content-type image/png accept-ranges bytes x-amz-cf-id Dthq-Wb14sMDOz6S5w7mCY0Qlo2Ha07RuU4dbF11Lj-NgcZu3U4c3A==
POST H2	200	collect Show response www.google-analytics.com/j/	2 B 207 B	19ms 18ms	XHR text/plain	2001:4860:4802:32::178 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j97&a=1419233687&t=pageview&_s=1&dl=https%3A%2F%2Fkpmg.thanks.com%2Fapp%2Flogin&ul=en-us&de=UTF-8&dt=Thanks&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=2029197956&gjid=344138098&cid=2102655900.1664735784&tid=UA-151543413-2&_gid=1647514607.1664735784&_r=1&gtm=2ou9s0&z=1329715657 Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/polyfills-es2015.3c8080bdceb582a570a2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://kpmg.thanks.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Sun, 02 Oct 2022 18:36:23 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://kpmg.thanks.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 442 B	65ms 21ms	XHR text/plain	2a00:1450:400c:c07::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j97&tid=UA-151543413-2&cid=2102655900.1664735784&jid=2029197956&gjid=344138098&_gid=1647514607.1664735784&_u=YEBAAUAAAAAAAC~&z=2075687215 Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/polyfills-es2015.3c8080bdceb582a570a2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://kpmg.thanks.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Sun, 02 Oct 2022 18:36:23 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://kpmg.thanks.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 501 B	90ms 53ms	Image image/gif	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-151543413-2&cid=2102655900.1664735784&jid=2029197956&_u=YEBAAUAAAAAAAC~&z=1729644303 Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers pragma no-cache date Sun, 02 Oct 2022 18:36:23 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 501 B	112ms 54ms	Image image/gif	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-151543413-2&cid=2102655900.1664735784&jid=2029197956&_u=YEBAAUAAAAAAAC~&z=1729644303 Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://kpmg.thanks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers pragma no-cache date Sun, 02 Oct 2022 18:36:23 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	403 Forbidden	Primary Request / Show response gfs3.glb.kworld.kpmg.com/adfs/ls/	581 B 916 B	343ms 25ms	Document text/html	51.136.9.217 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://gfs3.glb.kworld.kpmg.com/adfs/ls/?SAMLRequest=fZHNTsMwEITvPEXke%2B3EaUtjNUGFCqj4q2jgwAXZiUmtOnbwOi28PSFtBVw4rjQ7s%2FvN9Oyj1sFWOlDWpCjCIQqkKWypTJWip%2FxyMEFn2ckUeK1pw2atX5tH%2Bd5K8MEMQDrf7V1YA20t3Uq6rSrk0%2BNtitbeN8AI4Y3C9Wcj3QawMmQbEQBLklGXM%2B9MlOG%2BTz7qqzeIcaUF3uys0yXeNHWFC1sTXr4B0UBQsJin6LVM6Kk4LeNQxFSIJBaiiIZhMo4nsRSjYdnJAFq5MOC58SmiIaWDKByENI8mLB4zOsSTMHlBwdJZbwurz5XZf906wywHBczwWgLzBVvN7m4ZxSETexGw6zxfDpYPq7w32KpSuvtOnaKbXcdvHVxpK7gOclmsjdW2UhJQ8HzkTL85d%2BQNsD3Z%2F1Obw4ko2xfB%2Bt%2Fcb4f%2FDfixKpQdQfdgf5qZkt%2FO2WH823j2BQ%3D%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=l7wdhYeLVCOPAuaycs0f%2F8DgvNRXO94%2BwOHuxVFmcpFYzJW7XVn%2FIzUVw4BrGVlQjsjHHQAJg8uJl7kp9t7X46kFmvX5xBTSZJhnhrEojZN2hptdanGxk%2FuvyYrJxunrn0%2F%2BDVKit07sq4S21O%2BFLRpnKbtYmZbs81FmL1dzGum%2F60NaOLeiLKemBDU%2Bn8rI%2FIKQd9NtmJcY1e4UWwGMO0uc%2Fex9Hsw9AJ6HawGX37FMLm0GqqvFP8uN9cd2XU1945ej3sBznqwfcMtgSIiCMB7SbiWbaojvRvx%2BhS2TKAFQ%2FsKBiWfYdQhCABNk9jCuJrWC13UGbR8BgDgylW225g%3D%3D Requested by Host: kpmg.thanks.com URL: https://kpmg.thanks.com/app/main-es2015.36dd36415d184ff92858.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.136.9.217 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a7ef7c5be94813c9e0e1426d6bc6225ce5244f58a1b21e747dd36ec049db64a8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://kpmg.thanks.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store Connection keep-alive Content-Length 581 Content-Type text/html Date Sun, 02 Oct 2022 18:36:25 GMT Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-XSS-Protection 1; mode=block

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.thanks.com/	1970-01-20 06:25:36	Name: redirectUrl Value: %2Fredeem
			.thanks.com/	1970-01-20 16:01:35	Name: _ga Value: GA1.2.2102655900.1664735784
			.thanks.com/	1970-01-20 06:27:02	Name: _gid Value: GA1.2.1647514607.1664735784
			.thanks.com/	1970-01-20 06:25:35	Name: _gat_gtag_UA_151543413_2 Value: 1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://gfs3.glb.kworld.kpmg.com/adfs/ls/?SAMLRequest=fZHNTsMwEITvPEXke%2B3EaUtjNUGFCqj4q2jgwAXZiUmtOnbwOi28PSFtBVw4rjQ7s%2FvN9Oyj1sFWOlDWpCjCIQqkKWypTJWip%2FxyMEFn2ckUeK1pw2atX5tH%2Bd5K8MEMQDrf7V1YA20t3Uq6rSrk0%2BNtitbeN8AI4Y3C9Wcj3QawMmQbEQBLklGXM%2B9MlOG%2BTz7qqzeIcaUF3uys0yXeNHWFC1sTXr4B0UBQsJin6LVM6Kk4LeNQxFSIJBaiiIZhMo4nsRSjYdnJAFq5MOC58SmiIaWDKByENI8mLB4zOsSTMHlBwdJZbwurz5XZf906wywHBczwWgLzBVvN7m4ZxSETexGw6zxfDpYPq7w32KpSuvtOnaKbXcdvHVxpK7gOclmsjdW2UhJQ8HzkTL85d%2BQNsD3Z%2F1Obw4ko2xfB%2Bt%2Fcb4f%2FDfixKpQdQfdgf5qZkt%2FO2WH823j2BQ%3D%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=l7wdhYeLVCOPAuaycs0f%2F8DgvNRXO94%2BwOHuxVFmcpFYzJW7XVn%2FIzUVw4BrGVlQjsjHHQAJg8uJl7kp9t7X46kFmvX5xBTSZJhnhrEojZN2hptdanGxk%2FuvyYrJxunrn0%2F%2BDVKit07sq4S21O%2BFLRpnKbtYmZbs81FmL1dzGum%2F60NaOLeiLKemBDU%2Bn8rI%2FIKQd9NtmJcY1e4UWwGMO0uc%2Fex9Hsw9AJ6HawGX37FMLm0GqqvFP8uN9cd2XU1945ej3sBznqwfcMtgSIiCMB7SbiWbaojvRvx%2BhS2TKAFQ%2FsKBiWfYdQhCABNk9jCuJrWC13UGbR8BgDgylW225g%3D%3D Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' chrome-extension: moz-extension: *.workplace.com outlook.office365.com outlook.office.com teams.microsoft.com *.teams.microsoft.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.myperks.in
cdn.kwench.com
fonts.googleapis.com
fonts.gstatic.com
gfs3.glb.kworld.kpmg.com
kpmg.thanks.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
143.204.215.43
2001:4860:4802:32::178
2600:9000:20d7:ee00:0:2f04:f240:93a1
2606:4700:10::6814:f6a
2a00:1450:4001:800::2003
2a00:1450:4001:802::2003
2a00:1450:4001:829::200a
2a00:1450:4001:82a::2004
2a00:1450:400c:c07::9d
2a00:1450:400d:80e::2008
51.136.9.217
00ee00b7eee20b58ad04fca87e58a08e056a51f4994869919c8ac3fa9a345ba3
17a1cccfc2f74b2dfeb8b79c6107d289608bbcce40787a204c26e4a98b69418f
2d30ef41aa1ac8d18a9fac08c0b81fddb8fa4b51ec9c2b83303e3bf285d07a76
38ebaa39fcd9938c64fb6f337aa6c2075ea674fe2f5fd7ff6a52980e6328d0de
461895597b9f444087ec4ae42b7b54d1a55e1c43c8ed28e95e046e5986800900
59aad6554bf3e83c947ede084693b4db22a838e4b5e1ed8a8f55057d8df9d44e
61cf6b69bdbf69890d9488b93b0344588478e5447086842b0af675803a38eb60
6940a71b7ee7e298d8e85f464c2db190ac51915668d7e9190c30a487120d738e
7c7cf2628259c5c93b60852f955df9964e38bb655ad8ad1040b013f93e6b43bc
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
998c13619d7525fbcc8f879bc6a85748fa004f76caf2178a3f69268368c187e3
9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f
a2e0364705d95981d487a1a9eb2a69d03d84c18e7129a9081185db1c2873c5e3
a7ef7c5be94813c9e0e1426d6bc6225ce5244f58a1b21e747dd36ec049db64a8
aa73b5e04952e7890f2185c7902503e7e4c0ce484c325357aba06e6b545237e2
b27e6caa0b1d172de809e83b8de9a76cf2bd0999b23fc86a49474b11f6d38f02
d84fc3e0453cdba1a4081b76aa589ae58ed0474d82880511cf79ba17bba3859b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629