secure.retailmenot.com Open in urlscan Pro
2606:4700:4400::6812:2947 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://secure.retailmenot.com/
Effective URL:
https://secure.retailmenot.com/accounts/login
Submission: On July 26 via manual (July 26th 2022, 9:37:30 pm UTC) from US — Scanned from DE

Summary HTTP 77 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 17 IPs in 3 countries across 9 domains to perform 77 HTTP transactions. The main IP is 2606:4700:4400::6812:2947, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure.retailmenot.com. The Cisco Umbrella rank of the primary domain is 54311.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 30th 2022. Valid for: a year.

This is the only time secure.retailmenot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 14	2606:4700:440... 2606:4700:4400::6812:2947	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f00... 2a03:2880:f007:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
9	151.101.194.133 151.101.194.133	54113 (FASTLY) (FASTLY)
20	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
5	151.101.65.21 151.101.65.21	54113 (FASTLY) (FASTLY)
1	34.224.233.89 34.224.233.89	14618 (AMAZON-AES) (AMAZON-AES)
1	143.204.89.96 143.204.89.96	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:828::200d	15169 (GOOGLE) (GOOGLE)
1	3.223.65.139 3.223.65.139	14618 (AMAZON-AES) (AMAZON-AES)
1 2	143.204.89.18 143.204.89.18	16509 (AMAZON-02) (AMAZON-02)
1	54.81.184.157 54.81.184.157	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.65.35 151.101.65.35	54113 (FASTLY) (FASTLY)
5	54.243.108.33 54.243.108.33	14618 (AMAZON-AES) (AMAZON-AES)
77	17

14 2606:4700:4400::6812:2947 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

secure.retailmenot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f007:8:face:b00c:0:1 (Vienna, Austria)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 151.101.194.133 (United States)

ASN54113 (FASTLY, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.65.21 (United States)

ASN54113 (FASTLY, US)

www.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.224.233.89 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-224-233-89.compute-1.amazonaws.com

a.retailmenot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.89.96 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-96.fra50.r.cloudfront.net

2c5de9923d36.cdn4.forter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.223.65.139 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-65-139.compute-1.amazonaws.com

cdn3.forter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.89.18 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-18.fra50.r.cloudfront.net

cdn9.forter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.81.184.157 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-81-184-157.compute-1.amazonaws.com

57afd5819e7b4752a8770796db3b5b8c-2c5de9923d36.cdn.forter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.35 (United States)

ASN54113 (FASTLY, US)

t.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.243.108.33 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-243-108-33.compute-1.amazonaws.com

cdn0.forter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	gstatic.com www.gstatic.com fonts.gstatic.com	796 KB
15	retailmenot.com 1 redirects secure.retailmenot.com — Cisco Umbrella Rank: 54311 a.retailmenot.com — Cisco Umbrella Rank: 26542	221 KB
13	google.com apis.google.com — Cisco Umbrella Rank: 164 www.google.com — Cisco Umbrella Rank: 10 accounts.google.com — Cisco Umbrella Rank: 118	153 KB
10	forter.com 1 redirects 2c5de9923d36.cdn4.forter.com — Cisco Umbrella Rank: 96227 cdn3.forter.com — Cisco Umbrella Rank: 3969 cdn9.forter.com — Cisco Umbrella Rank: 4546 57afd5819e7b4752a8770796db3b5b8c-2c5de9923d36.cdn.forter.com cdn0.forter.com — Cisco Umbrella Rank: 4816	60 KB
9	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 1999	292 KB
6	paypal.com www.paypal.com — Cisco Umbrella Rank: 2205 t.paypal.com — Cisco Umbrella Rank: 3068	11 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 52	20 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 155	86 KB
0	doubleclick.net Failed stats.g.doubleclick.net Failed
77	9

	Domain	Requested by
14	secure.retailmenot.com	1 redirects secure.retailmenot.com www.google-analytics.com
13	www.gstatic.com	www.google.com accounts.google.com www.gstatic.com
9	www.paypalobjects.com	secure.retailmenot.com www.paypal.com www.paypalobjects.com
8	www.google.com	secure.retailmenot.com www.gstatic.com www.google.com
7	fonts.gstatic.com	www.google.com
5	cdn0.forter.com
5	www.paypal.com	secure.retailmenot.com www.paypal.com www.paypalobjects.com
3	accounts.google.com	apis.google.com secure.retailmenot.com www.gstatic.com
2	cdn9.forter.com	1 redirects
2	www.google-analytics.com	secure.retailmenot.com www.google-analytics.com
2	apis.google.com	secure.retailmenot.com apis.google.com
2	connect.facebook.net	secure.retailmenot.com connect.facebook.net
1	t.paypal.com
1	57afd5819e7b4752a8770796db3b5b8c-2c5de9923d36.cdn.forter.com
1	cdn3.forter.com
1	2c5de9923d36.cdn4.forter.com	secure.retailmenot.com
1	a.retailmenot.com	secure.retailmenot.com
0	stats.g.doubleclick.net Failed	www.google-analytics.com
77	18

This site contains links to these domains. Also see Links.

Domain
www.retailmenot.com
help.retailmenot.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-30` - `2023-05-30`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-05-05` - `2022-08-03`	3 months	crt.sh
*.apis.google.com GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2022-04-12` - `2023-04-12`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh
a.retailmenot.com Amazon	`2022-07-03` - `2023-08-01`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh
*.cdn4.forter.com GeoTrust RSA CA 2018	`2021-11-16` - `2022-12-16`	a year	crt.sh
accounts.google.com GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh
cdn3.forter.com GeoTrust RSA CA 2018	`2022-06-27` - `2023-07-04`	a year	crt.sh
*.cdn.forter.com GeoTrust RSA CA 2018	`2022-06-27` - `2023-07-27`	a year	crt.sh
t.paypal.com DigiCert SHA2 Extended Validation Server CA	`2022-03-04` - `2022-11-23`	9 months	crt.sh
cdn0.forter.com GeoTrust RSA CA 2018	`2022-06-27` - `2023-07-07`	a year	crt.sh

This page contains 8 frames:

Primary Page: https://secure.retailmenot.com/accounts/login
Frame ID: 8AEE79E2811C995CAD6B0E6332CE60A1
Requests: 29 HTTP requests in this frame

Frame: https://secure.retailmenot.com/accounts/-/csp-report
Frame ID: C3FB9949CFFE81D886C60EAA076CE42C
Requests: 2 HTTP requests in this frame

Frame: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1
Frame ID: 627993F624A97935C190DF103AD54219
Requests: 14 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&size=invisible&cb=qjmvptd9jvpk
Frame ID: 229720637FA34246626640A693EDCD42
Requests: 7 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&size=invisible&cb=sqattalrsme8
Frame ID: 219CFD2CD7F1611314B4E337A4C5720D
Requests: 7 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: C2EF1C5ABB50B26341BAFE21C736543A
Requests: 5 HTTP requests in this frame

Frame: https://secure.retailmenot.com/accounts/-/csp-report
Frame ID: E23C44B8470C8A4C8ABA324054D92BFF
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
Frame ID: 5EE7EF46DE97035060E572192480EB01
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log inRetailMeNot

Page URL History Show full URLs

http://secure.retailmenot.com/ HTTP 302
https://secure.retailmenot.com/accounts/login Page URL

Detected technologies

Google Sign-in (Social logins) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/platform\.js

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Forter (Analytics) Expand

Overall confidence: 100%
Detected patterns

forter\.com

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

77
Requests

96 %
HTTPS

44 %
IPv6

9
Domains

18
Subdomains

17
IPs

3
Countries

1638 kB
Transfer

4396 kB
Size

22
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.retailmenot.com/
Title: RetailMeNot

Search URL Search Domain Scan URL

URL: http://help.retailmenot.com/
Title: contact support

Search URL Search Domain Scan URL

URL: https://www.retailmenot.com/static/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.retailmenot.com/static/terms/
Title: Terms of Use

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://secure.retailmenot.com/ HTTP 302
https://secure.retailmenot.com/accounts/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 61

https://cdn9.forter.com/vchk2 HTTP 301
https://cdn9.forter.com/vchk2/v1/7bb80bcd684f247a3471b54818a903bda1bb990c2e8f4f63ecb4620dba96ca47ac7f4bcb6b1f50e6ddf449d4a179

77 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login Show response
secure.retailmenot.com/accounts/
Redirect Chain

http://secure.retailmenot.com/
https://secure.retailmenot.com/accounts/login

48 KB
16 KB

291ms
242ms

Document
text/html

2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e1df4ee98d726897f159fbd543ade8021b3619f1d519666751debd891aa0733

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; default-src 'none'; child-src 'self' https://.facebook.com https://.google.com; connect-src 'self' https://.facebook.com https://www.google-analytics.com https://.forter.com https://d2o5idwacg3gyw.cloudfront.net https://.oktapreview.com https://a.retailmenot.com https://owenett.wsmeco.com; font-src; form-action 'self'; frame-src https://.facebook.com https://.google.com https://www.paypal.com; img-src 'self' https://.facebook.com https://.facebook.net https://.fbcdn.net https://www.google-analytics.com https://www.paypalobjects.com https://a.retailmenot.com https://owenett.wsmeco.com; report-uri -/csp-report; script-src 'self' https://.facebook.net https://.facebook.com https://apis.google.com https://www.google-analytics.com https://www.google.com https://www.gstatic.com https://*.forter.com https://d35u1vg1q28b3w.cloudfront.net 'strict-dynamic' 'nonce-cae33c19121146a39c1b38d145ee1542'; style-src 'self' 'unsafe-inline' ; worker-src 'none'
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7310469b0946cc5a-ZRH
content-encoding: br
content-security-policy: block-all-mixed-content; default-src 'none'; child-src 'self' https://*.facebook.com https://*.google.com; connect-src 'self' https://*.facebook.com https://www.google-analytics.com https://*.forter.com https://d2o5idwacg3gyw.cloudfront.net https://*.oktapreview.com https://a.retailmenot.com https://owenett.wsmeco.com; font-src; form-action 'self'; frame-src https://*.facebook.com https://*.google.com https://www.paypal.com; img-src 'self' https://*.facebook.com https://*.facebook.net https://*.fbcdn.net https://www.google-analytics.com https://www.paypalobjects.com https://a.retailmenot.com https://owenett.wsmeco.com; report-uri -/csp-report; script-src 'self' https://*.facebook.net https://*.facebook.com https://apis.google.com https://www.google-analytics.com https://www.google.com https://www.gstatic.com https://*.forter.com https://d35u1vg1q28b3w.cloudfront.net 'strict-dynamic' 'nonce-cae33c19121146a39c1b38d145ee1542'; style-src 'self' 'unsafe-inline' ; worker-src 'none'
content-type: text/html; charset=utf-8
date: Tue, 26 Jul 2022 21:37:18 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
pragma: no-cache
referrer-policy: origin-when-cross-origin
server: cloudflare
strict-transport-security: max-age=31536000;
surrogate-control: no-store
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: deny
x-request-id: QLUYVAJKUZGQXEJUIB2CPM3RMI
x-view-instance-uuid: XSICK6ILWRCV5P3V6JI7U5ZL2A
x-xss-protection: 1; mode=block

Redirect headers

CF-RAY: 7310469a69ab01f8-ZRH
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Date: Tue, 26 Jul 2022 21:37:18 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Location: https://secure.retailmenot.com/accounts/login
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 manifest.7efb7146.js Show response
secure.retailmenot.com/accounts/static/ 1 KB
976 B 58ms
57ms Script
application/javascript 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.retailmenot.com/accounts/static/manifest.7efb7146.js

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0341bc291ed6de27516d9bdf210e251a9122e932da221e8c780c3f41a4976f9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/accounts/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 33420
cf-polished: origSize=1546
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 28 Jun 2022 19:02:23 GMT
server: cloudflare
etag: W/"62bb503f-60a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7310469c9ab6cc5a-ZRH
expires: Wed, 26 Jul 2023 21:37:18 GMT

GET
H2 200 vendor.24390944.js Show response
secure.retailmenot.com/accounts/static/ 621 KB
173 KB 65ms
64ms Script
application/javascript 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.retailmenot.com/accounts/static/vendor.24390944.js

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

861a2b1af40e75080c52ddbc35d0542e75d64b067afd50911ecf5b9e3bbbde8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/accounts/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 33420
cf-polished: origSize=636833
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 28 Jun 2022 19:02:23 GMT
server: cloudflare
etag: W/"62bb503f-9b7a1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7310469c9ab9cc5a-ZRH
expires: Wed, 26 Jul 2023 21:37:18 GMT

GET
H2 200 main.ebde28cb.js Show response
secure.retailmenot.com/accounts/static/ 30 KB
9 KB 51ms
50ms Script
application/javascript 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.retailmenot.com/accounts/static/main.ebde28cb.js

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08a25ddab076e49d9db334a21869820ea22121e525e1af3b0bb0019cc649c9aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/accounts/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 33420
cf-polished: origSize=30727
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 28 Jun 2022 19:02:23 GMT
server: cloudflare
etag: W/"62bb503f-7807"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7310469caac4cc5a-ZRH
expires: Wed, 26 Jul 2023 21:37:18 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 86ms
28ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

308424a3c4595c0446ea959fef403677dc90498feb1f51c3645c0893032e9bbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: SPVNV0erFaWaby9datqMNg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1685
x-fb-rlafr: 0
x-fb-debug: 3nsdLwOgsxsCTddQvilbqwxF3egGQ00cyMQmwDBE9cTF7hK3clrlf260W6dUE5+Pp0+JP0lqCpWpjoCfcUseWQ==
x-fb-trip-id: 720026100
x-fb-content-md5: 68f2cec66d826d85c61e05244fb82f59
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 26 Jul 2022 21:37:18 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "24737d437c0fd5be9d5ddee2cfca4243"
timing-allow-origin: *
expires: Tue, 26 Jul 2022 21:43:24 GMT

GET
H2 200 platform.js Show response
apis.google.com/js/ 52 KB
20 KB 64ms
24ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/platform.js?onload=googleInit

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9be917c80f3871ad2e33cfa0c12e9f39cc43f6d4c2b98d9e158d89649d306ac0

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20332
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
date: Tue, 26 Jul 2022 21:37:18 GMT
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "485722b7e8263bcf"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 21:37:18 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 884 B
1001 B 88ms
35ms Script
text/javascript 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0a91abb4c9c3e3585f0169909f7a931d5cb43f772e38bbe36eff1fad77055046

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 588
x-xss-protection: 1; mode=block
expires: Tue, 26 Jul 2022 21:37:18 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 56ms
16ms Script
text/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 2118
date: Tue, 26 Jul 2022 21:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 26 Jul 2022 23:02:00 GMT

POST
H2 200 csp-report
secure.retailmenot.com/accounts/-/ 2 B
235 B 228ms
228ms Other
text/plain 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.retailmenot.com/accounts/-/csp-report
Requested by: Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://secure.retailmenot.com/accounts/login
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
cf-cache-status: DYNAMIC
x-view-instance-uuid: 23MDWOKFLZBNDHT6KYJPD4P3WQ
x-powered-by: Express
surrogate-control: no-store
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2
x-request-id: I47WDN2PRBF25FE3D6A3YB7GPE
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray: 7310469c9ac0cc5a-ZRH
expires: 0

GET
H2 200 Site_LoginSignup_Illustration.png
secure.retailmenot.com/accounts/static/images/ 17 KB
17 KB 225ms
225ms Image
image/png 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.retailmenot.com/accounts/static/images/Site_LoginSignup_Illustration.png

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a24c9e240563c12a104f7fbfa11a0b80b4cb8abe4891d9edfcd9ff2d3a8ccf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/accounts/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
last-modified: Tue, 28 Jun 2022 19:02:23 GMT
server: cloudflare
etag: "62bb503f-4444"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 7310469caac7cc5a-ZRH
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17476
expires: Wed, 26 Jul 2023 21:37:19 GMT

GET
H2 200 pp_rv_mg.svg
www.paypalobjects.com/digitalassets/c/website/logo/monogram/ 2 KB
1 KB 149ms
28ms Image
image/svg+xml 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/digitalassets/c/website/logo/monogram/pp_rv_mg.svg

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d9ec41ba89b0d508f452de9116c6e24e8521b1b2f0f15911b17100fd36f85aeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT, HIT
paypal-debug-id: 2807fe8bc47e9
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 897
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-sjc10053-SJC, cache-cdg20720-CDG
last-modified: Thu, 12 May 2016 22:18:36 GMT
x-timer: S1658871439.987495,VS0,VE1
etag: W/"5735013c-756"
strict-transport-security: max-age=31557600
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits: 1, 1

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 294 KB
84 KB 56ms
26ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=491b6d3a46946d0e98de09a2df0c4bdb

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e309567a094b5dd7f8f3cba223cf0fc018c0f153090917552214fe55b0eeb537

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://secure.retailmenot.com/
Origin: https://secure.retailmenot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: Q1v4j+//alXWS1oeB6W2Pg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85963
x-fb-rlafr: 0
x-fb-debug: CKdALKbhwes0Gufb/lgoyqIilghffv7GVSUW7IZQ1UBzf4VOYV7g+i6NRltW8k3il9klYTjTmPhR1Ftoq9crLA==
x-fb-content-md5: dd9770f4f9787c8326ec36e68d33d8f9
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 26 Jul 2022 21:37:19 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "12f9b34bbab7a740e38cddc49703193f"
timing-allow-origin: *
priority: u=3,i
expires: Wed, 26 Jul 2023 20:54:20 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/ 365 KB
145 KB 200ms
17ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

64d2c94f105aa89f733e51b81c045de674b47325ef4f04526ec9bb632c44fd91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.retailmenot.com/
Origin: https://secure.retailmenot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:59:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9495
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 147954
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 04:01:20 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jul 2023 18:59:04 GMT

POST
H3 200 csp-report
secure.retailmenot.com/accounts/-/ Frame C3FB 2 B
442 B 227ms
227ms Other
text/plain 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.retailmenot.com/accounts/-/csp-report
Requested by: Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
cf-cache-status: DYNAMIC
x-view-instance-uuid: LPV7BIXHFJBVZA63NPW3QWQ7G4
x-powered-by: Express
surrogate-control: no-store
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2
x-request-id: Y4TERZW3NBECFOVG2QB7HSH62I
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray: 7310469ddd7b23f7-ZRH
expires: 0

POST
H3 200 csp-report
secure.retailmenot.com/accounts/-/ Frame 6279 2 B
406 B 227ms
227ms Other
text/plain 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.retailmenot.com/accounts/-/csp-report
Requested by: Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
cf-cache-status: DYNAMIC
x-view-instance-uuid: STKBC66EZBAXJOSGIMB4TRLT6E
x-powered-by: Express
surrogate-control: no-store
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2
x-request-id: EKZ64JUKS5CGNLDLTHEVOKRD7Y
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray: 7310469ded8023f7-ZRH
expires: 0

GET
H2 200 RETAILMENOT Show response
www.paypal.com/conex/advantage-connect/ Frame 6279 4 KB
4 KB 326ms
259ms Document
text/html 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/static/vendor.24390944.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cb0848295b7a209620dda4440a751ba202e8632e8535ac326f5da4a646a6abd4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'nonce-ijXHhRnLkyBa2icdwaCt79eFyVs6nGcrKc6LXiny42wzO4z1' 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com; frame-src 'self' https://.paypalobjects.com https://.paypal.com https://.qualtrics.com; connect-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure.retailmenot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: none
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-ijXHhRnLkyBa2icdwaCt79eFyVs6nGcrKc6LXiny42wzO4z1' 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; frame-src 'self' https://*.paypalobjects.com https://*.paypal.com https://*.qualtrics.com; connect-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html; charset=utf-8
date: Tue, 26 Jul 2022 21:37:19 GMT
dc: ccg11-origin-www-1.paypal.com
etag: W/W/"11bc-QESouzdq5dMRTWXowl8mqcLBfbk"
paypal-debug-id: f180704e3a26f
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
traceparent: 00-0000000000000000000f180704e3a26f-776e4551d15e383b-01
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-served-by: cache-hhn4023-HHN
x-timer: S1658871439.234352,VS0,VE242
x-xss-protection: 1; mode=block

GET
H3 200 apple Show response
secure.retailmenot.com/accounts/api/auth/callback/ 318 B
723 B 218ms
218ms Fetch
application/json 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.retailmenot.com/accounts/api/auth/callback/apple
Requested by: Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/static/main.ebde28cb.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46777253ee6781f144ffca9a322631052d8ae9c687a2ab9c1b46a38db23264d6

Request headers

Referer: https://secure.retailmenot.com/accounts/login
x-view-instance-uuid: XSICK6ILWRCV5P3V6JI7U5ZL2A
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
content-type: application/json

Response headers

pragma: no-cache
date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
x-view-instance-uuid: XSICK6ILWRCV5P3V6JI7U5ZL2A
surrogate-control: no-store
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/json; charset=utf-8
x-request-id: LDDL5MGGXBEETI7EHDXCXUR6EY
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray: 7310469ded8823f7-ZRH
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expires: 0

POST
H2 200 __wsm.gif
a.retailmenot.com// 35 B
435 B 342ms
108ms Ping
image/gif 34.224.233.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://a.retailmenot.com//__wsm.gif

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/static/vendor.24390944.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.224.233.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-224-233-89.compute-1.amazonaws.com

Software

openresty/1.11.2.5 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

Referer: https://secure.retailmenot.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache, no-cache
date: Tue, 26 Jul 2022 21:37:19 GMT
x-content-type-options: nosniff, nosniff
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: openresty/1.11.2.5
content-type: image/gif
access-control-allow-origin: https://secure.retailmenot.com, https://secure.retailmenot.com
cache-control: no-cache, private, no-cache, no-cache=Set-Cookie, proxy-revalidate
accept-ranges: bytes
content-length: 35
expires: Sat, 28 Jul 2012 21:37:19 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 54ms
22ms XHR
text/plain 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=51398301&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.retailmenot.com%2Faccounts%2Flogin&ul=en-us&de=UTF-8&dt=Log%20in&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABEAAAAC~&jid=667220798&gjid=706147101&cid=2026693559.1658871445&tid=UA-54628-3&_gid=898722645.1658871445&_r=1&cd1=Anonymous&z=893073457

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.retailmenot.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 26 Jul 2022 21:37:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.retailmenot.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pp_rv_mg.svg
www.paypalobjects.com/digitalassets/c/website/logo/monogram/ Frame C3FB 2 KB
991 B 26ms
25ms Image
image/svg+xml 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/digitalassets/c/website/logo/monogram/pp_rv_mg.svg

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d9ec41ba89b0d508f452de9116c6e24e8521b1b2f0f15911b17100fd36f85aeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT, HIT
paypal-debug-id: 2807fe8bc47e9
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 897
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-sjc10053-SJC, cache-cdg20720-CDG
last-modified: Thu, 12 May 2016 22:18:36 GMT
x-timer: S1658871439.184044,VS0,VE1
etag: W/"5735013c-756"
strict-transport-security: max-age=31557600
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits: 1, 2

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.gzNO53US1Eg.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-O-5j3TYHoQz2hPZzUvoU_Frhy2A/ 108 KB
36 KB 51ms
16ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.gzNO53US1Eg.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-O-5j3TYHoQz2hPZzUvoU_Frhy2A/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js?onload=googleInit

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b59c7712e75a6f0bbefd0fefa67e85d464cf14bbd7463331f4ba7e0a963ace1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 08:01:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 480928
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36570
x-xss-protection: 0
last-modified: Tue, 07 Jun 2022 15:25:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 21 Jul 2023 08:01:51 GMT

GET
H2 200 script.js Show response
2c5de9923d36.cdn4.forter.com/sn/2c5de9923d36/ 168 KB
57 KB 69ms
23ms Script
application/javascript 143.204.89.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://2c5de9923d36.cdn4.forter.com/sn/2c5de9923d36/script.js

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/static/main.ebde28cb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.89.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-89-96.fra50.r.cloudfront.net

Software

Resource Hash

718f9d398fbc84391ebc6c1d52ea603b95c3bb1c155846341967b421fbffeb4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Wed, 18 May 2022 09:24:49 GMT
content-encoding: br
vary: Accept-Encoding
age: 6005550
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Wed, 18 May 2022 09:24:49 GMT
x-sourcemap: https://cdn4.forter.com/map/suid/2c5de9923d36/65091377964
strict-transport-security: max-age=86400; includeSubDomains
content-type: application/javascript; charset=utf-8
via: 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
cache-control: private, max-age=300
x-amz-cf-pop: FRA50-C1
timing-allow-origin: *
x-amz-cf-id: cZShTXjmYNKaq2UifE9xG2hiA3hq0DC6t5fZGoqDpSyr7QmTIAXv3A==
expires: Wed, 18 May 2022 09:29:49 GMT

POST
H3 200 csp-report
secure.retailmenot.com/accounts/-/ 2 B
406 B 229ms
228ms Other
text/plain 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.retailmenot.com/accounts/-/csp-report
Requested by: Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://secure.retailmenot.com/accounts/login
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
cf-cache-status: DYNAMIC
x-view-instance-uuid: LFXGJJZLRBBNXBPGR55L2AMGD4
x-powered-by: Express
surrogate-control: no-store
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2
x-request-id: 2EQDFODU6VEMBJIBMZ6HKMLRDE
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray: 7310469f3f1423f7-ZRH
expires: 0

POST collect
stats.g.doubleclick.net/j/ 0
0

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 2297 42 KB
22 KB 70ms
36ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&size=invisible&cb=qjmvptd9jvpk

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a1c64cee4b472c775801ca84a9e60cb3f96fddeb42a7159d14647d9ae93eee82

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ZWwnPnfO9v5MvLi2qif1YA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure.retailmenot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 22083
content-security-policy: script-src 'report-sample' 'nonce-ZWwnPnfO9v5MvLi2qif1YA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 26 Jul 2022 21:37:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 219C 43 KB
22 KB 60ms
35ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&size=invisible&cb=sqattalrsme8

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c535d8ca73796a8ba5162c520f7d35028b109764f478e1641983a726c23f0d6b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-SNYjs3xfh_zCJOQrPwyNUA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure.retailmenot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 22810
content-security-policy: script-src 'report-sample' 'nonce-SNYjs3xfh_zCJOQrPwyNUA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 26 Jul 2022 21:37:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST csp-report
secure.retailmenot.com/accounts/-/ Frame C2EF 0
0

GET
H2 200 iframe Show response
accounts.google.com/o/oauth2/ Frame C2EF 280 B
1 KB 80ms
27ms Document
text/html 2a00:1450:4001:828::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.gzNO53US1Eg.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-O-5j3TYHoQz2hPZzUvoU_Frhy2A/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d1576de226451c3ae29f7ae8b395b56063ba60d90f732b920d2616fa2d1e7753

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport script-src 'report-sample' 'nonce-IebliIZSK18ngWL9qOhDoQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.retailmenot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport script-src 'report-sample' 'nonce-IebliIZSK18ngWL9qOhDoQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin; report-to="IdpIFrameHttp"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Jul 2022 21:37:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"IdpIFrameHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdpIFrameHttp/external"}]}
server: ESF
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 csp-report
secure.retailmenot.com/accounts/-/ 2 B
405 B 223ms
223ms Other
text/plain 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.retailmenot.com/accounts/-/csp-report
Requested by: Host:
URL: (program):2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://secure.retailmenot.com/accounts/login
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
cf-cache-status: DYNAMIC
x-view-instance-uuid: KC5REMBAX5B2FK62F6WXA2PHUU
x-powered-by: Express
surrogate-control: no-store
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2
x-request-id: ZLB42UFQMZHRRKDNGVT6MAIAKU
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray: 7310469fcfe023f7-ZRH
expires: 0

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/ Frame 219C 51 KB
24 KB 58ms
17ms Stylesheet
text/css 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&size=invisible&cb=sqattalrsme8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:01:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12979
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24237
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 04:01:20 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jul 2023 18:01:00 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/ Frame 219C 365 KB
145 KB 56ms
16ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

64d2c94f105aa89f733e51b81c045de674b47325ef4f04526ec9bb632c44fd91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:59:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9495
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 147954
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 04:01:20 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jul 2023 18:59:04 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/ Frame 2297 51 KB
24 KB 34ms
22ms Stylesheet
text/css 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&size=invisible&cb=qjmvptd9jvpk

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:01:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12979
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24237
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 04:01:20 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jul 2023 18:01:00 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/ Frame 2297 365 KB
145 KB 46ms
34ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

64d2c94f105aa89f733e51b81c045de674b47325ef4f04526ec9bb632c44fd91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:59:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9495
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 147954
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 04:01:20 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jul 2023 18:59:04 GMT

POST
H3 400 cspreport
accounts.google.com/_/IdpIFrameHttp/ Frame C2EF 2 KB
847 B 69ms
31ms Other
text/html 2a00:1450:4001:828::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/_/IdpIFrameHttp/cspreport

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c648a0dcddb95c449c2f888e3e99a2d17d84130ede2697bc687b8fba20089b11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 1; mode=block
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 m=base Show response
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.de.ufeVBOb-8cQ.es5.O/d=1/rs=AOaEmlFelNWdsIpuJKfFNjv32bX9KqwiNw/ Frame C2EF 99 KB
34 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.de.ufeVBOb-8cQ.es5.O/d=1/rs=AOaEmlFelNWdsIpuJKfFNjv32bX9KqwiNw/m=base

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0884ae09953bd67552c938bae1ccb7230dd99a8fba61317585027dfea6091b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 05:46:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57046
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34561
x-xss-protection: 0
last-modified: Fri, 15 Jul 2022 01:41:37 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/identity-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/identity-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jul 2023 05:46:33 GMT

GET
H3 200 iframerpc Show response
accounts.google.com/o/oauth2/ Frame C2EF 49 B
96 B 29ms
28ms XHR
application/json 2a00:1450:4001:828::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fsecure.retailmenot.com&client_id=771936173007-u6au73kae344unr8d6fjjtendldufja4.apps.googleusercontent.com

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.de.ufeVBOb-8cQ.es5.O/d=1/rs=AOaEmlFelNWdsIpuJKfFNjv32bX9KqwiNw/m=base

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4836b6031bc4af96767f0121fa458714583340054aea6338ef99a1bc4011f43b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport, script-src 'report-sample' 'nonce-F69hhmRj2NuEzffzTJToTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
X-Requested-With: XmlHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-embedder-policy: require-corp
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: same-site
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
cross-origin-opener-policy: same-origin; report-to="IdpIFrameHttp"
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"IdpIFrameHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdpIFrameHttp/external"}]}
content-type: application/json; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=3600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport, script-src 'report-sample' 'nonce-F69hhmRj2NuEzffzTJToTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
expires: Tue, 26 Jul 2022 21:37:19 GMT

POST
H2 200 csp
www.paypal.com/csplog/api/log/ Frame 6279 2 B
980 B 186ms
185ms Other
text/plain 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/csplog/api/log/csp

Requested by

Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; script-src 'nonce-fkrCpgBIBv2Ty98QVxp/Ey7DP+lCeSaprkFyHqmDEJ0y9ikr' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; img-src https://.paypal.com https://.paypalobjects.com; object-src 'none'; font-src 'self' https://.paypalobjects.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://*.qualtrics.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/csp-report

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-fkrCpgBIBv2Ty98QVxp/Ey7DP+lCeSaprkFyHqmDEJ0y9ikr' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; img-src https://*.paypal.com https://*.paypalobjects.com; object-src 'none'; font-src 'self' https://*.paypalobjects.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com;
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
paypal-debug-id: f396561c64a79
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
etag: W/W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-served-by: cache-hhn4023-HHN
traceparent: 00-0000000000000000000f396561c64a79-de59810fbe97546c-01
x-timer: S1658871440.501950,VS0,VE170
x-frame-options: SAMEORIGIN
date: Tue, 26 Jul 2022 21:37:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: text/plain; charset=utf-8
content-encoding: br
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: none
x-cache-hits: 0

GET
H2 200 polyfill.js Show response
www.paypal.com/polyfill/ Frame 6279 4 KB
2 KB 179ms
177ms Script
application/javascript 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/polyfill/polyfill.js

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

439b453be0952fb5dda4026b3b2ace4e901ba84d13e823d71ec3d4431dc1763b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
via: 1.1 varnish
vary: Accept-Encoding
x-cache: MISS
paypal-debug-id: f396561b78fc5
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-served-by: cache-hhn4023-HHN
traceparent: 00-0000000000000000000f396561b78fc5-851c605d90e60098-01
x-timer: S1658871440.504344,VS0,VE162
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
content-encoding: br
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: none
x-cache-hits: 0

GET
H2 200 main.css
www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/ Frame 6279 8 KB
981 B 27ms
25ms Stylesheet
text/css 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/main.css

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

74be5f36e4dc298d487fbaa38be8363d863db45ac6daf89442515391a8cff4d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT, HIT
paypal-debug-id: d17f344411429
x-cache-hits: 1, 1
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 732
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-sjc10068-SJC, cache-cdg20720-CDG
last-modified: Sat, 02 Oct 2021 05:34:27 GMT
x-timer: S1658871440.508914,VS0,VE1
etag: W/"6157ef63-1e5d"
strict-transport-security: max-age=31557600
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-headers: x-csrf-token
expires: Wed, 14 Jun 2023 13:58:54 GMT

GET
H2 200 fonts-and-normalize.css
www.paypalobjects.com/digitalassets/c/paypal-ui/web/fonts-and-normalize/0-0-5/ Frame 6279 8 KB
2 KB 28ms
26ms Stylesheet
text/css 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/digitalassets/c/paypal-ui/web/fonts-and-normalize/0-0-5/fonts-and-normalize.css

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8248ec7c70e8d925b4ab822fb288dd752a9286b14e19f7d20a5b70fce0a5ce48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT, HIT
paypal-debug-id: d912cacc85cfd
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 2048
x-served-by: cache-sjc10045-SJC, cache-cdg20720-CDG
last-modified: Thu, 21 Feb 2019 23:15:06 GMT
x-timer: S1658871440.509895,VS0,VE1
etag: W/"5c6f30fa-217e"
strict-transport-security: max-age=31557600
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits: 1, 1

GET
H2 200 main.js Show response
www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/ Frame 6279 708 KB
179 KB 52ms
51ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/main.js

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b12139c89ab062728ad4aa415f4a95966f67aeb881e74e48227d02a266e6e6e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT, HIT
paypal-debug-id: 3f91a3004571f
x-cache-hits: 1, 1
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 183469
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-sjc10055-SJC, cache-cdg20720-CDG
last-modified: Sat, 02 Oct 2021 05:34:27 GMT
x-timer: S1658871440.509867,VS0,VE3
etag: W/"6157ef63-b1163"
strict-transport-security: max-age=31557600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-headers: x-csrf-token
expires: Thu, 29 Jun 2023 09:26:42 GMT

GET
H2 200 zoid.min.js Show response
www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/static/js/ Frame 6279 183 KB
47 KB 28ms
27ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/static/js/zoid.min.js

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

492d172e2cb0029309746e695d3b2a5720b4f8d4298667625849ff6067bea6a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT, HIT
paypal-debug-id: 3a558571c415d
x-cache-hits: 1, 1
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 47492
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-sjc10029-SJC, cache-cdg20720-CDG
last-modified: Sat, 02 Oct 2021 05:34:27 GMT
x-timer: S1658871440.509861,VS0,VE2
etag: W/"6157ef63-2dcb8"
strict-transport-security: max-age=31557600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-headers: x-csrf-token
expires: Thu, 25 May 2023 07:13:13 GMT

GET
H2 200 advConnectZoid.js Show response
www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/static/ Frame 6279 52 KB
13 KB 76ms
75ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/static/advConnectZoid.js

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

21ee8f3fa97e9058d358caf1349e3ccda8b8cc7b8351f44ddd89d0abce52dfba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT, HIT
paypal-debug-id: 6653695e88107
x-cache-hits: 49, 1
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 12599
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-sjc10062-SJC, cache-cdg20720-CDG
last-modified: Sat, 02 Oct 2021 05:34:27 GMT
x-timer: S1658871440.509830,VS0,VE3
etag: W/"6157ef63-d038"
strict-transport-security: max-age=31557600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-headers: x-csrf-token
expires: Mon, 15 May 2023 18:38:59 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 2297 2 KB
2 KB 17ms
17ms Image
image/png 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:59:48 GMT
x-content-type-options: nosniff
age: 9451
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Tue, 02 Aug 2022 18:59:48 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 2297 15 KB
15 KB 18ms
17ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 11:18:05 GMT
x-content-type-options: nosniff
age: 37154
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 26 Jul 2023 11:18:05 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 2297 15 KB
15 KB 21ms
21ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:59:48 GMT
x-content-type-options: nosniff
age: 9451
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 26 Jul 2023 18:59:48 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 219C 2 KB
2 KB 15ms
15ms Image
image/png 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:59:48 GMT
x-content-type-options: nosniff
age: 9451
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Tue, 02 Aug 2022 18:59:48 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 219C 15 KB
15 KB 55ms
21ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 11:18:05 GMT
x-content-type-options: nosniff
age: 37154
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 26 Jul 2023 11:18:05 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 219C 15 KB
15 KB 49ms
15ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:59:48 GMT
x-content-type-options: nosniff
age: 9451
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 26 Jul 2023 18:59:48 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 2297 102 B
134 B 26ms
25ms Other
text/javascript 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

613e7703528887ec639fbe5165b22ce6f72768a423ecd698f05e3ece6ce90ff4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc8-8IUAAAAAA7a5z-h43JtTyPgLRtndYB1D4yU&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&size=invisible&cb=qjmvptd9jvpk
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Tue, 26 Jul 2022 21:37:19 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 219C 102 B
134 B 24ms
24ms Other
text/javascript 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

613e7703528887ec639fbe5165b22ce6f72768a423ecd698f05e3ece6ce90ff4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg&co=aHR0cHM6Ly9zZWN1cmUucmV0YWlsbWVub3QuY29tOjQ0Mw..&hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&size=invisible&cb=sqattalrsme8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Tue, 26 Jul 2022 21:37:19 GMT

POST
H3 200 csp-report
secure.retailmenot.com/accounts/-/ Frame E23C 2 B
404 B 230ms
229ms Other
text/plain 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.retailmenot.com/accounts/-/csp-report
Requested by: Host: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
cf-cache-status: DYNAMIC
x-view-instance-uuid: PV644AY3R5CLVK6YRVV57H6QHM
x-powered-by: Express
surrogate-control: no-store
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2
x-request-id: KITPGN5AU5FJPOASMWQD5IL2K4
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray: 731046a1eabe23f7-ZRH
expires: 0

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 5EE7 7 KB
1 KB 29ms
29ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

1b1211aa6136a098cba47962f86724f767a74e153e0c5810cc7ba2010f05b48e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-w7F2Cgr9FF8AA54ayZpCIA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure.retailmenot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 1112
content-security-policy: script-src 'report-sample' 'nonce-w7F2Cgr9FF8AA54ayZpCIA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 26 Jul 2022 21:37:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 200 csp
www.paypal.com/csplog/api/log/ Frame 6279 2 B
2 KB 215ms
214ms Other
text/plain 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/csplog/api/log/csp

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/static/js/zoid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; script-src 'nonce-ilTPAwqHcJ7ozLOpVE9s4uAPzXv1wrQfv6BQelK0xKNE9/WY' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; img-src https://.paypal.com https://.paypalobjects.com; object-src 'none'; font-src 'self' https://.paypalobjects.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://*.qualtrics.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/csp-report

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-ilTPAwqHcJ7ozLOpVE9s4uAPzXv1wrQfv6BQelK0xKNE9/WY' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; img-src https://*.paypal.com https://*.paypalobjects.com; object-src 'none'; font-src 'self' https://*.paypalobjects.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com;
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
paypal-debug-id: f39656198e232
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
etag: W/W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-served-by: cache-hhn4023-HHN
traceparent: 00-0000000000000000000f39656198e232-35ef5d6070c3b3ff-01
x-timer: S1658871440.775422,VS0,VE195
x-frame-options: SAMEORIGIN
date: Tue, 26 Jul 2022 21:37:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: text/plain; charset=utf-8
content-encoding: br
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: none
x-cache-hits: 0

GET
H2 200 pp_rv_mg.svg
www.paypalobjects.com/digitalassets/c/website/logo/monogram/ Frame 6279 2 KB
1 KB 26ms
25ms Image
image/svg+xml 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/digitalassets/c/website/logo/monogram/pp_rv_mg.svg

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/main.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d9ec41ba89b0d508f452de9116c6e24e8521b1b2f0f15911b17100fd36f85aeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT, HIT
paypal-debug-id: 2807fe8bc47e9
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 897
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-sjc10053-SJC, cache-cdg20720-CDG
last-modified: Thu, 12 May 2016 22:18:36 GMT
x-timer: S1658871440.870439,VS0,VE0
etag: W/"5735013c-756"
strict-transport-security: max-age=31557600
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits: 1, 3

GET
H2 200 get-pp-context Show response
www.paypal.com/conex/ac/FZ2R95MHL7BMJ/ Frame 6279 1 KB
2 KB 226ms
226ms XHR
application/json 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/conex/ac/FZ2R95MHL7BMJ/get-pp-context

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4591124a0c4dedd37ad52b0d7b7e4e94b72b630a69c5bd19442b4b129766c076

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'nonce-L77KbeDD9kovfK6OG0L290V3Wc3ncJhlYTYFfnqqkHYaSK7f' 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com; frame-src 'self' https://.paypalobjects.com https://.paypal.com https://.qualtrics.com; connect-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.paypal.com/conex/advantage-connect/RETAILMENOT?uid=1a8b46df92&logLevel=error&version=latest&xcomponent=1
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-L77KbeDD9kovfK6OG0L290V3Wc3ncJhlYTYFfnqqkHYaSK7f' 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; frame-src 'self' https://*.paypalobjects.com https://*.paypal.com https://*.qualtrics.com; connect-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
paypal-debug-id: f396561ca2d07
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4023-HHN
traceparent: 00-0000000000000000000f396561ca2d07-4260276c29bcd052-01
x-timer: S1658871440.872661,VS0,VE204
date: Tue, 26 Jul 2022 21:37:20 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json; charset=utf-8
content-encoding: br
cache-control: max-age=0, no-cache, no-store, must-revalidate
etag: W/W/"54e-kVZv/NKeVj5/TrpyDs7oxaBvfIE"
accept-ranges: none
x-cache-hits: 0

GET
H2 200 PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ Frame 6279 46 KB
47 KB 51ms
16ms Font
font/woff 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Regular.woff

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/main.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.paypalobjects.com/web/res/7c1/c0cd8849ed7075d03b37491253b60/js/client/main.css
Origin: https://www.paypal.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:19 GMT
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
x-cache: HIT, HIT
paypal-debug-id: 3e57b78193ac3
dc: ccg11-origin-www-1.paypal.com
content-length: 47339
x-served-by: cache-sjc10061-SJC, cache-hhn4021-HHN
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
x-timer: S1658871440.907064,VS0,VE0
etag: "560b6e70-b8eb"
strict-transport-security: max-age=31557600
content-type: font/woff
access-control-allow-origin: *
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits: 11343, 222537

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/ Frame 5EE7 51 KB
24 KB 15ms
15ms Stylesheet
text/css 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:01:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12979
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24237
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 04:01:20 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jul 2023 18:01:00 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/ Frame 5EE7 365 KB
145 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

64d2c94f105aa89f733e51b81c045de674b47325ef4f04526ec9bb632c44fd91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:59:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9495
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 147954
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 04:01:20 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jul 2023 18:59:04 GMT

POST
H2 200 events
cdn3.forter.com/ 0
245 B 331ms
107ms Ping
text/plain 3.223.65.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn3.forter.com/events

Requested by

Host:
URL: (program):2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.223.65.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-223-65-139.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Referer: https://secure.retailmenot.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: text/plain; charset=utf-8

Response headers

pragma: no-cache
date: Tue, 26 Jul 2022 21:37:20 GMT
vary: Origin
access-control-allow-origin: https://secure.retailmenot.com
cache-control: private, no-cache, no-store
access-control-allow-credentials: true
strict-transport-security: max-age=86400; includeSubDomains
timing-allow-origin: *
expires: -1

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame 5EE7 39 KB
24 KB 64ms
64ms XHR
application/json 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

be39eb259bbb0976d0425458fb54c63a8acdce47ece71d76e1f4bfcaf395cebe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/bframe?hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Tue, 26 Jul 2022 21:37:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24056
x-xss-protection: 1; mode=block
expires: Tue, 26 Jul 2022 21:37:20 GMT

POST
H3 200 csp-report
secure.retailmenot.com/accounts/-/ 2 B
405 B 223ms
223ms Other
text/plain 2606:4700:4400::6812:2947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.retailmenot.com/accounts/-/csp-report
Requested by: Host:
URL: (program):2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2947 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://secure.retailmenot.com/accounts/login
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 26 Jul 2022 21:37:20 GMT
cf-cache-status: DYNAMIC
x-view-instance-uuid: 6KA6UVOBFFCJFKSZC5RXYRBYSQ
x-powered-by: Express
surrogate-control: no-store
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2
x-request-id: 2TP5PPFTUJHCLMR2PK4MSGOUJQ
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-ray: 731046a42d7823f7-ZRH
expires: 0

GET
H2

200

7bb80bcd684f247a3471b54818a903bda1bb990c2e8f4f63ecb4620dba96ca47ac7f4bcb6b1f50e6ddf449d4a179 Show response
cdn9.forter.com/vchk2/v1/
Redirect Chain

https://cdn9.forter.com/vchk2
https://cdn9.forter.com/vchk2/v1/7bb80bcd684f247a3471b54818a903bda1bb990c2e8f4f63ecb4620dba96ca47ac7f4bcb6b1f50e6ddf449d4a179

0
323 B

127ms
127ms

XHR
text/plain

143.204.89.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn9.forter.com/vchk2/v1/7bb80bcd684f247a3471b54818a903bda1bb990c2e8f4f63ecb4620dba96ca47ac7f4bcb6b1f50e6ddf449d4a179

Protocol

Server

143.204.89.18 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-89-18.fra50.r.cloudfront.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:20 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
strict-transport-security: max-age=86400; includeSubDomains
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: private, s-maxage=0, proxy-revalidate
timing-allow-origin: *
x-amz-cf-id: VvRV-J_StC19ZhIlf-JZnWRHxeg_fwbVmp1my9xzAuG8cx2a54yv1g==

Redirect headers

date: Tue, 26 Jul 2022 21:37:20 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
location: https://cdn9.forter.com/vchk2/v1/7bb80bcd684f247a3471b54818a903bda1bb990c2e8f4f63ecb4620dba96ca47ac7f4bcb6b1f50e6ddf449d4a179
strict-transport-security: max-age=86400; includeSubDomains
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: private, s-maxage=0, proxy-revalidate
timing-allow-origin: *
x-amz-cf-id: 35wqFQxQhUoFLFRqEDjwRxM_QCdDEKu2a_XpiGAmthyBewlYkM0fng==

POST
H/1.1 200
OK prop.json
57afd5819e7b4752a8770796db3b5b8c-2c5de9923d36.cdn.forter.com/ 2 B
630 B 339ms
107ms Ping
application/json 54.81.184.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://57afd5819e7b4752a8770796db3b5b8c-2c5de9923d36.cdn.forter.com/prop.json
Requested by: Host:
URL: (program):2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 54.81.184.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-184-157.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://secure.retailmenot.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 26 Jul 2022 21:37:20 GMT
Connection: close
Content-Length: 2
Pragma: no-cache
Last-Modified: Tue, 26 Jul 2022 12:06:49 GMT
Server: Apache
ETag: "2-5e4b422a1f06c"
Access-Control-Allow-Methods: PUT, GET, POST, DELETE, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://secure.retailmenot.com
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: origin, x-requested-with, content-type, x-csrf-token
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H3 200 refresh_2x.png
www.gstatic.com/recaptcha/api2/ Frame 5EE7 600 B
624 B 16ms
15ms Image
image/png 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/refresh_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Wed, 20 Jul 2022 08:44:59 GMT
x-content-type-options: nosniff
age: 564741
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 600
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Wed, 27 Jul 2022 08:44:59 GMT

GET
H3 200 audio_2x.png
www.gstatic.com/recaptcha/api2/ Frame 5EE7 530 B
554 B 18ms
17ms Image
image/png 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/audio_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Mon, 25 Jul 2022 23:42:15 GMT
x-content-type-options: nosniff
age: 78905
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 530
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Mon, 01 Aug 2022 23:42:15 GMT

GET
H3 200 info_2x.png
www.gstatic.com/recaptcha/api2/ Frame 5EE7 665 B
689 B 18ms
17ms Image
image/png 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/info_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 16:37:52 GMT
x-content-type-options: nosniff
age: 17968
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 665
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Tue, 02 Aug 2022 16:37:52 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5EE7 15 KB
15 KB 19ms
18ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 11:18:05 GMT
x-content-type-options: nosniff
age: 37155
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 26 Jul 2023 11:18:05 GMT

GET
H3 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5EE7 15 KB
15 KB 23ms
22ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Fri, 22 Jul 2022 06:37:10 GMT
x-content-type-options: nosniff
age: 399610
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15340
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:16 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Jul 2023 06:37:10 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5EE7 15 KB
15 KB 19ms
18ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 18:59:48 GMT
x-content-type-options: nosniff
age: 9452
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 26 Jul 2023 18:59:48 GMT

GET
H3 200 payload
www.google.com/recaptcha/api2/ Frame 5EE7 25 KB
25 KB 25ms
25ms Image
image/jpeg 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/recaptcha/api2/payload?p=06ANYolque1rbloImobPDPD4IVrHRSc1hGxO3kdtxcYQ98s6Y3LcvZejFgXNz0LX3O9sWuPI9euxQb4Iqv7rNpOZtUoXm9eGxf7xuNxSnBotm3d0fH5N1ZMBRx_-_yosD1GY9BIYFCkhDxIIgN-SKu9YwKJtMa7_KBlqBAZSZvm9O21ziap8ksRNG2Zasz5rCmszu5tAdOhEQM-D1dAsAZV0hmnpHCq8hWZw&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

af68eb1318f50a111bdd4664742b13deef07b6451da2c3eb80b85789ee87fc62

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/bframe?hl=de&v=CHIHFAf1bjFPOjwwi5Xa4cWR&k=6LeuFDQUAAAAAKVBh2vvsqPm2X_swO6yJUc-9skg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:20 GMT
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: private, max-age=30
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25639
x-xss-protection: 1; mode=block
expires: Tue, 26 Jul 2022 21:37:20 GMT

GET
H2 200 ts
t.paypal.com/ Frame 6279 42 B
769 B 254ms
173ms Image
image/gif 151.101.65.35
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?comp=conexnodeweb&mrid=FZ2R95MHL7BMJ&page=main%3Aconex%3Alogged-out%3A%3Alogin%3Alog-in-with-paypal&pgrp=main%3Aconex%3Alogged-out%3A%3Alogin&s=ci&e=im&userf=FALSE&incc=FALSE&link=&cust=&oten=FALSE&t=1658871445861&g=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.35 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 21:37:20 GMT
via: 1.1 varnish
x-cache: MISS
p3p: policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id: 8a18344f1aa6a
x-cache-hits: 0
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
content-length: 42
x-served-by: cache-hhn4060-HHN
pragma: no-cache
x-timer: S1658871440.206895,VS0,VE158
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: image/gif
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 21:37:20 GMT

GET
H/1.1 200
OK prop.json Show response
cdn0.forter.com/2c5de9923d36/57afd5819e7b4752a8770796db3b5b8c/ 20 B
366 B 483ms
255ms XHR
application/json 54.243.108.33
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn0.forter.com/2c5de9923d36/57afd5819e7b4752a8770796db3b5b8c/prop.json?_=1658871446753
Requested by: Host:
URL: (program):2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.243.108.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-243-108-33.compute-1.amazonaws.com
Software: /
Resource Hash: 912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 26 Jul 2022 21:37:21 GMT
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://secure.retailmenot.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
Transfer-Encoding: chunked
Expires: -1

GET
H/1.1 200
OK prop.json Show response
cdn0.forter.com/2c5de9923d36/57afd5819e7b4752a8770796db3b5b8c/ 20 B
366 B 106ms
106ms XHR
application/json 54.243.108.33
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn0.forter.com/2c5de9923d36/57afd5819e7b4752a8770796db3b5b8c/prop.json?_=1658871447240
Requested by: Host:
URL: (program):2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.243.108.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-243-108-33.compute-1.amazonaws.com
Software: /
Resource Hash: 912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 26 Jul 2022 21:37:21 GMT
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://secure.retailmenot.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
Transfer-Encoding: chunked
Expires: -1

GET
H/1.1 200
OK prop.json Show response
cdn0.forter.com/2c5de9923d36/57afd5819e7b4752a8770796db3b5b8c/ 20 B
366 B 107ms
106ms XHR
application/json 54.243.108.33
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn0.forter.com/2c5de9923d36/57afd5819e7b4752a8770796db3b5b8c/prop.json?_=1658871447501
Requested by: Host:
URL: (program):2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.243.108.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-243-108-33.compute-1.amazonaws.com
Software: /
Resource Hash: 912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure.retailmenot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 26 Jul 2022 21:37:21 GMT
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://secure.retailmenot.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
Transfer-Encoding: chunked
Expires: -1

POST
H/1.1 200
OK wpt.json Show response
cdn0.forter.com/2c5de9923d36/57afd5819e7b4752a8770796db3b5b8c/ 20 B
423 B 107ms
106ms XHR
application/json 54.243.108.33
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn0.forter.com/2c5de9923d36/57afd5819e7b4752a8770796db3b5b8c/wpt.json
Requested by: Host:
URL: (program):2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.243.108.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-243-108-33.compute-1.amazonaws.com
Software: /
Resource Hash: 912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d

Request headers

Referer: https://secure.retailmenot.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 26 Jul 2022 21:37:22 GMT
ETag: W/"14-Y53wuE/mmbSikKcT/WualL1N65U"
Vary: Origin
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://secure.retailmenot.com
Cache-Control: private, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 20
Expires: -1

OPTIONS
H/1.1 204
No Content wpt.json
cdn0.forter.com/2c5de9923d36/57afd5819e7b4752a8770796db3b5b8c/ Frame 0
0 107ms
107ms Preflight 54.243.108.33
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn0.forter.com/2c5de9923d36/57afd5819e7b4752a8770796db3b5b8c/wpt.json
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.243.108.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-243-108-33.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://secure.retailmenot.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 0
Date: Tue, 26 Jul 2022 21:37:22 GMT
Vary: Access-Control-Request-Headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: stats.g.doubleclick.net
URL: https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-54628-3&cid=2026693559.1658871445&jid=667220798&gjid=706147101&_gid=898722645.1658871445&_u=aEBAAEAAEAAAAC~&z=663930708

Domain: secure.retailmenot.com
URL: https://secure.retailmenot.com/accounts/-/csp-report

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

50 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

22 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-20 09:07:03	Name: _GRECAPTCHA Value: 09AMjm62VT2-bttHjLeIiRsA-1L4qXTyol7wPIwLkWJFpCy7ZAmmHttoD-gWCS9zdRrZZ8juux-L6VOXlEt1pI5R4
.retailmenot.com/	1970-01-25 16:17:37	Name: deviceFingerprint Value: JDFL6XII4ZH4LI6J5PPVGFU2SY
.retailmenot.com/	1970-01-20 04:47:53	Name: session Value: BVF5CIBRINGCHKVIKBIFTNHFFY
.retailmenot.com/	1970-01-20 22:19:03	Name: jwt Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ijc4YzA1NWIwLTM2NmYtMTFlNy1iZTY3LWE1NzZiMzBlYWE0MSJ9.eyJhdWQiOiJyZXRhaWxtZW5vdC5jb20iLCJleHAiOjE2OTA0MDc0MzgsImlhdCI6MTY1ODg3MTQzOCwiaXNzIjoic2VjdXJlLnJldGFpbG1lbm90LmNvbSIsImp0aSI6IjA1ZjlkNDY3MWE1OTQ1NmNiNjkxYjI0Y2UyODQxYzBmIiwibmJmIjoxNjU4ODcxNDM4fQ.KZUWYJARN9RLsgB6kLwdcHhLH6eC8cJTCSGCBh3Eon6shFRYAbmV7hNAzD-YIaMvSCczqaXowhfFLjni5ZTC0-auSExTyHlYVWjQwt7hsnfvqT3EkLC6F4rGRKuoDCk_-FxQY7GthiUEqIvMHjPcucQ7KQ8rfLcllN3mKAgYM201j3zGvY7bDL2O_3z58SYA8ql6H38t_9CeZAVVysJOucE3Hr2ojfebBcalqV9cTVgBsxtrQLnc-wpEHjG4sOaKQf-6yvoVz-OZ00FuHOqSPBNc4q_CPFuto0WO6umAiA85pfF78-BQyVjPg0EbDuipd6yni2O5XrzyeIcDC1MSbS4r2O--KIrhGj8jA3spmL4-7IfQhYT_r_Bry2zMh2opbk5dRLRUgeCBq-FyrKLG2ZcWKRb4tbDr4kinhlHcnl5By05IiNxU8mRtJ8p6PRldWCqTD-m2kS-p4x1oqdGkU-6wvdbZZ3s-j_dbLGzsDrTZ1LI2jmgND8Pffe9lrmwV
.secure.retailmenot.com/	1970-01-20 22:19:03	Name: jwts Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ijc4YzA1NWIwLTM2NmYtMTFlNy1iZTY3LWE1NzZiMzBlYWE0MSJ9.eyJhdWQiOiJzZWN1cmUucmV0YWlsbWVub3QuY29tIiwiZXhwIjoxNjU4ODczMjM4LCJpYXQiOjE2NTg4NzE0MzgsImlzcyI6InNlY3VyZS5yZXRhaWxtZW5vdC5jb20iLCJqdGkiOiI2YzY1NDQ2ZmQ3MTE0ZWM0YTYwZTY3ODVkN2MxNTlkMiIsIm5iZiI6MTY1ODg3MTQzOCwicm1uX2NzcmYiOiIyOTg5YmQ0N2NmZmQ0YmJjYWIwNDJmMGYzNzhlYTI3MCJ9.Sn9EDlSsuSZxn0e_X42ZEU9iLTZD2mOi2mS_gC6uq0W9C_9CHzcnw6Vv6-De55a5sEVCJ7mocPDh3ItitSpONC9bG-Z0Jo8Iq7FZYzSJ33K0OrdycGZ4c6X4yiwNNpXS0d_Lbf0bTcHAQG_Ztit7bUGMCftejK-LPqQK7m7s9sQljgL-EpqGPoLgpvclREFEFv_0LFFvzHYtaC8Y-szaO5Xj3cofM4tuQOizefxEgft3KVTqJ4AWE-WkA-jeV-_c-QsRcg5zU4hV2y7wHozLuoHLDq4mdUp0kh1wBZ7O8g8eRzGd55iyhNqEQkjGcwo5E0XLRfWqE5I9UaG64vPyc9n7_b5Tmr9MHlU9Vj7LGyq4PBFbaVXNzwLInpti7lkQaElGlUhosymN7GNZBrE5WLhdIwc9NuMapVA-7J54R3GhXcC4zadzc_xYdDYs1apPk1pKiQa8YU7SEunyVG713iUA_7o0KIigDbIoYcVQ59eYmECZ4in2Z43d2YxN2xis
.retailmenot.com/	1970-01-22 00:37:17	Name: userQualifier Value: BLUF5UDHBRCXJG626DMJ6DNIP4
.retailmenot.com/	1969-12-31 23:59:59	Name: overlord_viewInstanceUuid Value: X4X6TXV3TBA25KEI5HRBXHVZWU
.retailmenot.com/	1970-01-20 22:19:03	Name: _ga Value: GA1.2.2026693559.1658871445
.retailmenot.com/	1970-01-20 04:49:17	Name: _gid Value: GA1.2.898722645.1658871445
.retailmenot.com/	1970-01-20 04:47:51	Name: _gat Value: 1
.secure.retailmenot.com/	1978-01-11 21:30:57	Name: G_ENABLED_IDPS Value: google
.paypal.com/	1970-01-20 13:33:27	Name: enforce_policy Value: gdpr_v2.1
.paypal.com/	1970-01-20 04:48:23	Name: LANG Value: de_DE%3BDE
www.paypal.com/	1969-12-31 23:59:59	Name: nsid Value: s%3Ak76EDMIjpbVPWRD_h3p6HtdHa3d-7iot.oqr7057zhXgDwD1CsQyXVr4WXY2hRlYnpFc0UTH91Fo
.paypal.com/	1970-01-20 04:47:53	Name: l7_az Value: dcg14.slc
.paypal.com/	1970-01-21 07:06:05	Name: ts_c Value: vr%3D3c715fd31820a1d2d45c3c0bffcee9f9%26vt%3D3c715fd31820a1d2d45c3c0bffcee9f8
.google.com/	1970-01-20 09:11:22	Name: NID Value: 511=QIaKE2OGcojsFKHHJDOlWgIWhs_0owutMGmCMZ3cNbNedrnw6Ic7ELptXs7WAddapnveBDCABIOr5ct862enIG3_IuGu39lpI7KcYvDzNBR1T3eb2RhsKBMLPXa0ioVX7bcH4GdYjUkQajpy5M3X51He2WcDxqF0W0JZPh78yhA
.retailmenot.com/	1970-01-22 00:35:51	Name: ftr_ncd Value: 6
.retailmenot.com/	1970-01-22 00:35:51	Name: forterToken Value: 57afd5819e7b4752a8770796db3b5b8c_1658871444913__UDF43_9ck
.paypal.com/	1970-01-20 04:52:10	Name: tsrce Value: conexnodeweb
.paypal.com/	1969-12-31 23:59:59	Name: x-pp-s Value: eyJ0IjoiMTY1ODg3MTQ0MDAwMSIsImwiOiIwIiwibSI6IjAifQ
.paypal.com/	1970-01-21 07:06:05	Name: ts Value: vreXpYrS%3D1753565840%26vteXpYrS%3D1658873240%26vr%3D3c715fd31820a1d2d45c3c0bffcee9f9%26vt%3D3c715fd31820a1d2d45c3c0bffcee9f8%26vtyp%3Dnew

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.google-analytics.com/analytics.js(Line 43) Message: Refused to connect to 'https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-54628-3&cid=2026693559.1658871445&jid=667220798&gjid=706147101&_gid=898722645.1658871445&_u=aEBAAEAAEAAAAC~&z=663930708' because it violates the following Content Security Policy directive: "connect-src 'self' https://.facebook.com https://www.google-analytics.com https://.forter.com https://d2o5idwacg3gyw.cloudfront.net https://*.oktapreview.com https://a.retailmenot.com https://owenett.wsmeco.com".
security	error	URL: (program):2 Message: Refused to create a worker from 'blob:https://secure.retailmenot.com/7f93d755-f253-46ca-b664-0fbf68bae55f' because it violates the following Content Security Policy directive: "worker-src 'none'".
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://accounts.google.com/_/IdpIFrameHttp/cspreport Message: Failed to load resource: the server responded with a status of 400 ()
security	error	URL: (program):2 Message: Refused to create a worker from 'blob:https://secure.retailmenot.com/3aada7fa-82b3-4e95-8346-d16d17682e02' because it violates the following Content Security Policy directive: "worker-src 'none'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	block-all-mixed-content; default-src 'none'; child-src 'self' https://.facebook.com https://.google.com; connect-src 'self' https://.facebook.com https://www.google-analytics.com https://.forter.com https://d2o5idwacg3gyw.cloudfront.net https://.oktapreview.com https://a.retailmenot.com https://owenett.wsmeco.com; font-src; form-action 'self'; frame-src https://.facebook.com https://.google.com https://www.paypal.com; img-src 'self' https://.facebook.com https://.facebook.net https://.fbcdn.net https://www.google-analytics.com https://www.paypalobjects.com https://a.retailmenot.com https://owenett.wsmeco.com; report-uri -/csp-report; script-src 'self' https://.facebook.net https://.facebook.com https://apis.google.com https://www.google-analytics.com https://www.google.com https://www.gstatic.com https://*.forter.com https://d35u1vg1q28b3w.cloudfront.net 'strict-dynamic' 'nonce-cae33c19121146a39c1b38d145ee1542'; style-src 'self' 'unsafe-inline' ; worker-src 'none'
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2c5de9923d36.cdn4.forter.com
57afd5819e7b4752a8770796db3b5b8c-2c5de9923d36.cdn.forter.com
a.retailmenot.com
accounts.google.com
apis.google.com
cdn0.forter.com
cdn3.forter.com
cdn9.forter.com
connect.facebook.net
fonts.gstatic.com
secure.retailmenot.com
stats.g.doubleclick.net
t.paypal.com
www.google-analytics.com
www.google.com
www.gstatic.com
www.paypal.com
www.paypalobjects.com
secure.retailmenot.com
stats.g.doubleclick.net
143.204.89.18
143.204.89.96
151.101.194.133
151.101.65.21
151.101.65.35
2606:4700:4400::6812:2947
2a00:1450:4001:809::2004
2a00:1450:4001:810::200e
2a00:1450:4001:811::200e
2a00:1450:4001:812::2003
2a00:1450:4001:828::200d
2a03:2880:f007:8:face:b00c:0:1
3.223.65.139
34.224.233.89
54.243.108.33
54.81.184.157
0341bc291ed6de27516d9bdf210e251a9122e932da221e8c780c3f41a4976f9e
08a25ddab076e49d9db334a21869820ea22121e525e1af3b0bb0019cc649c9aa
0a91abb4c9c3e3585f0169909f7a931d5cb43f772e38bbe36eff1fad77055046
1b1211aa6136a098cba47962f86724f767a74e153e0c5810cc7ba2010f05b48e
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
21ee8f3fa97e9058d358caf1349e3ccda8b8cc7b8351f44ddd89d0abce52dfba
2a24c9e240563c12a104f7fbfa11a0b80b4cb8abe4891d9edfcd9ff2d3a8ccf8
308424a3c4595c0446ea959fef403677dc90498feb1f51c3645c0893032e9bbd
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
439b453be0952fb5dda4026b3b2ace4e901ba84d13e823d71ec3d4431dc1763b
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
4591124a0c4dedd37ad52b0d7b7e4e94b72b630a69c5bd19442b4b129766c076
46777253ee6781f144ffca9a322631052d8ae9c687a2ab9c1b46a38db23264d6
4836b6031bc4af96767f0121fa458714583340054aea6338ef99a1bc4011f43b
492d172e2cb0029309746e695d3b2a5720b4f8d4298667625849ff6067bea6a2
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
613e7703528887ec639fbe5165b22ce6f72768a423ecd698f05e3ece6ce90ff4
64d2c94f105aa89f733e51b81c045de674b47325ef4f04526ec9bb632c44fd91
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
718f9d398fbc84391ebc6c1d52ea603b95c3bb1c155846341967b421fbffeb4e
74be5f36e4dc298d487fbaa38be8363d863db45ac6daf89442515391a8cff4d7
8248ec7c70e8d925b4ab822fb288dd752a9286b14e19f7d20a5b70fce0a5ce48
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
861a2b1af40e75080c52ddbc35d0542e75d64b067afd50911ecf5b9e3bbbde8a
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d
9be917c80f3871ad2e33cfa0c12e9f39cc43f6d4c2b98d9e158d89649d306ac0
9e1df4ee98d726897f159fbd543ade8021b3619f1d519666751debd891aa0733
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1c64cee4b472c775801ca84a9e60cb3f96fddeb42a7159d14647d9ae93eee82
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
af68eb1318f50a111bdd4664742b13deef07b6451da2c3eb80b85789ee87fc62
b0884ae09953bd67552c938bae1ccb7230dd99a8fba61317585027dfea6091b3
b12139c89ab062728ad4aa415f4a95966f67aeb881e74e48227d02a266e6e6e3
b59c7712e75a6f0bbefd0fefa67e85d464cf14bbd7463331f4ba7e0a963ace1d
be39eb259bbb0976d0425458fb54c63a8acdce47ece71d76e1f4bfcaf395cebe
c535d8ca73796a8ba5162c520f7d35028b109764f478e1641983a726c23f0d6b
c648a0dcddb95c449c2f888e3e99a2d17d84130ede2697bc687b8fba20089b11
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
cb0848295b7a209620dda4440a751ba202e8632e8535ac326f5da4a646a6abd4
d1576de226451c3ae29f7ae8b395b56063ba60d90f732b920d2616fa2d1e7753
d9ec41ba89b0d508f452de9116c6e24e8521b1b2f0f15911b17100fd36f85aeb
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e309567a094b5dd7f8f3cba223cf0fc018c0f153090917552214fe55b0eeb537
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48

secure.retailmenot.com Open in urlscan Pro 2606:4700:4400::6812:2947 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

77 Requests

96 %HTTPS

44 %IPv6

9 Domains

18 Subdomains

17 IPs

3 Countries

1638 kBTransfer

4396 kBSize

22 Cookies

4 Outgoing links

Page URL History

Redirected requests

77 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

secure.retailmenot.com Open in urlscan Pro
2606:4700:4400::6812:2947 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

77
Requests

96 %
HTTPS

44 %
IPv6

9
Domains

18
Subdomains

17
IPs

3
Countries

1638 kB
Transfer

4396 kB
Size

22
Cookies

77 HTTP transactions
0 data transactions