Submitted URL: https://sailthru.perkspot.com/click/24831941.9083437/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xNDIwMjYyP21lc...
Effective URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC...
Submission: On August 24 via api from US

Summary

This website contacted 79 IPs in 5 countries across 56 domains to perform 209 HTTP transactions. The main IP is 2606:4700:10::ac43:1a84, located in United States and belongs to CLOUDFLARENET, US. The main domain is page.firstleaf.club.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 13th 2021. Valid for: a year.
This is the only time page.firstleaf.club was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 3.226.166.212 14618 (AMAZON-AES)
2 18 23.96.203.178 8075 (MICROSOFT...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
5 2620:1ec:bdf::45 8068 (MICROSOFT...)
1 13.224.102.72 16509 (AMAZON-02)
1 13.224.89.80 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 13.224.102.59 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:2800:233... 15133 (EDGECAST)
1 3 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 142.250.184.194 15169 (GOOGLE)
9 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 31 104.18.70.113 13335 (CLOUDFLAR...)
4 52.1.91.246 14618 (AMAZON-AES)
3 104.18.72.113 13335 (CLOUDFLAR...)
8 104.16.51.111 13335 (CLOUDFLAR...)
2 13.69.106.216 8075 (MICROSOFT...)
3 3 89.207.16.72 41041 (VCLK-EU-SE)
7 2606:4700:10:... 13335 (CLOUDFLAR...)
5 35.244.137.202 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:215... 16509 (AMAZON-02)
1 1 104.111.232.231 16625 (AKAMAI-AS)
18 192.229.133.208 15133 (EDGECAST)
4 35.222.120.150 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 34.120.27.38 15169 (GOOGLE)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
1 151.101.12.157 54113 (FASTLY)
2 151.101.13.140 54113 (FASTLY)
1 13.224.102.2 16509 (AMAZON-02)
1 13.224.102.6 16509 (AMAZON-02)
1 2 52.206.179.19 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f01... 32934 (FACEBOOK)
5 159.203.152.45 14061 (DIGITALOC...)
1 143.204.98.89 16509 (AMAZON-02)
2 104.111.239.203 16625 (AKAMAI-AS)
1 167.172.228.26 14061 (DIGITALOC...)
1 104.244.42.69 13414 (TWITTER)
1 34.120.253.250 15169 (GOOGLE)
1 13.224.102.68 16509 (AMAZON-02)
1 151.101.13.44 54113 (FASTLY)
2 18.219.93.205 16509 (AMAZON-02)
1 216.239.38.21 15169 (GOOGLE)
1 143.204.98.31 16509 (AMAZON-02)
2 2600:9000:215... 16509 (AMAZON-02)
4 54.165.186.74 14618 (AMAZON-AES)
1 2600:9000:215... 16509 (AMAZON-02)
3 35.201.112.186 15169 (GOOGLE)
1 2600:9000:215... 16509 (AMAZON-02)
2 4 54.237.157.181 14618 (AMAZON-AES)
3 35.186.226.184 15169 (GOOGLE)
2 34.98.72.95 15169 (GOOGLE)
1 13.224.102.123 16509 (AMAZON-02)
1 13.224.102.79 16509 (AMAZON-02)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 13.224.89.17 16509 (AMAZON-02)
1 2600:9000:215... 16509 (AMAZON-02)
1 2600:9000:219... 16509 (AMAZON-02)
1 2a03:2880:f11... 32934 (FACEBOOK)
2 2600:9000:215... 16509 (AMAZON-02)
1 35.186.228.232 15169 (GOOGLE)
1 107.178.245.27 15169 (GOOGLE)
1 35.190.83.84 15169 (GOOGLE)
1 1 2600:1f18:730... 14618 (AMAZON-AES)
1 34.206.124.188 14618 (AMAZON-AES)
3 35.186.194.58 15169 (GOOGLE)
3 52.22.146.11 14618 (AMAZON-AES)
1 130.211.47.17 15169 (GOOGLE)
1 2a03:2880:f12... 32934 (FACEBOOK)
1 34.117.4.53 15169 (GOOGLE)
1 34.107.221.36 15169 (GOOGLE)
1 3.8.243.222 16509 (AMAZON-02)
1 1 54.225.68.204 14618 (AMAZON-AES)
1 2600:1f18:444... 14618 (AMAZON-AES)
1 104.244.42.131 13414 (TWITTER)
209 79
Apex Domain
Subdomains
Transfer
33 zdassets.com
static.zdassets.com
ekr.zdassets.com
1 MB
23 fastcdn.co
g.fastcdn.co
v.fastcdn.co
3 MB
19 perkspot.com
sailthru.perkspot.com
email.perkspot.com
jacobs.perkspot.com
791 KB
13 firstleaf.club
page.firstleaf.club
www.firstleaf.club
rbv9j7km.firstleaf.club
images.firstleaf.club
ct.firstleaf.club
fbapi.firstleaf.club Failed
258 KB
9 zendesk.com
assets.zendesk.com
perkspot.zendesk.com
penrosehill.zendesk.com
6 KB
9 google-analytics.com
www.google-analytics.com
84 KB
6 fullstory.com
edge.fullstory.com
rs.fullstory.com
190 KB
6 cloudfront.net
d1hdjv7b05hja2.cloudfront.net
d2hrivdxn8ekm8.cloudfront.net
dvqigh9b7wa32.cloudfront.net
d330aiyvva2oww.cloudfront.net
d1lu3pmaz2ilpx.cloudfront.net
13 KB
5 liadm.com
b-code.liadm.com
rp.liadm.com
rp4.liadm.com
i.liadm.com
i6.liadm.com
12 KB
5 sundaysky.com
cdn1-res.sundaysky.com
s-vop.sundaysky.com
6 KB
5 heapanalytics.com
cdn.heapanalytics.com
heapanalytics.com
44 KB
5 doubleclick.net
stats.g.doubleclick.net
googleads.g.doubleclick.net
18 KB
5 azureedge.net
psprods3ep.azureedge.net
25 KB
4 stackadapt.com
tags.srv.stackadapt.com
6 KB
4 datasteam.io
cdn.datasteam.io
api.datasteam.io
25 KB
4 trkn.us
trkn.us
aa.trkn.us
2 KB
3 cdnbasket.net
data.cdnbasket.net
page.cdnbasket.net
view.cdnbasket.net
1 KB
3 bounceexchange.com
assets.bounceexchange.com
api.bounceexchange.com
144 KB
3 snapchat.com
tr.snapchat.com
434 B
3 chtbl.com
ext.chtbl.com
web.chtbl.com
5 KB
3 hotjar.com
static.hotjar.com
script.hotjar.com
vars.hotjar.com
63 KB
3 bing.com
bat.bing.com
9 KB
3 instapagemetrics.com
cdn.instapagemetrics.com
ec.instapagemetrics.com
23 KB
3 google.de
www.google.de
234 B
3 google.com
www.google.com
326 B
3 googletagmanager.com
www.googletagmanager.com
164 KB
2 cdnwidget.com
ids.cdnwidget.com
e.cdnwidget.com
238 B
2 facebook.com
www.facebook.com
235 B
2 tvsquared.com
collector-7547.tvsquared.com
9 KB
2 facebook.net
connect.facebook.net
99 KB
2 instapage.com
heatmap-events-collector.instapage.com
anthill.instapage.com
9 KB
2 visualstudio.com
dc.services.visualstudio.com
235 B
1 twitter.com
analytics.twitter.com
658 B
1 agkn.com
aa.agkn.com
391 B
1 mdhv.io
jelly.mdhv.io
235 B
1 taboola.com
cdn.taboola.com
25 KB
1 wknd.ai
tag.wknd.ai
5 KB
1 t.co
t.co
453 B
1 reddit.com
alb.reddit.com
125 B
1 stdomi.com
stdomi.com
202 B
1 gstatic.com
fonts.gstatic.com
19 KB
1 sc-static.net
sc-static.net
6 KB
1 blackcrow.ai
init.blackcrow.ai
385 B
1 redditstatic.com
www.redditstatic.com
7 KB
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 cloudflareinsights.com
static.cloudflareinsights.com
5 KB
1 typography.com
cloud.typography.com
438 B
1 googleapis.com
fonts.googleapis.com
678 B
1 emjcd.com
www.emjcd.com
1 KB
1 dotomi.com
cj.dotomi.com
1 KB
1 anrdoezrs.net
www.anrdoezrs.net
617 B
1 googleadservices.com
www.googleadservices.com
14 KB
1 msecnd.net
az416426.vo.msecnd.net
39 KB
1 rollbar.com
cdn.rollbar.com
23 KB
1 sail-horizon.com
ak.sail-horizon.com
43 KB
1 myfonts.net
hello.myfonts.net
154 B
209 56
Domain Requested by
30 static.zdassets.com jacobs.perkspot.com
assets.zendesk.com
static.zdassets.com
www.googletagmanager.com
page.firstleaf.club
18 v.fastcdn.co page.firstleaf.club
17 jacobs.perkspot.com 1 redirects jacobs.perkspot.com
9 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
jacobs.perkspot.com
page.firstleaf.club
5 penrosehill.zendesk.com static.zdassets.com
5 rbv9j7km.firstleaf.club jacobs.perkspot.com
rbv9j7km.firstleaf.club
page.firstleaf.club
5 g.fastcdn.co page.firstleaf.club
5 psprods3ep.azureedge.net jacobs.perkspot.com
4 s-vop.sundaysky.com 2 redirects page.firstleaf.club
4 tags.srv.stackadapt.com jacobs.perkspot.com
tags.srv.stackadapt.com
4 page.firstleaf.club jacobs.perkspot.com
page.firstleaf.club
static.cloudflareinsights.com
4 heapanalytics.com jacobs.perkspot.com
4 stats.g.doubleclick.net 1 redirects jacobs.perkspot.com
az416426.vo.msecnd.net
www.google-analytics.com
3 api.datasteam.io cdn.datasteam.io
3 rs.fullstory.com edge.fullstory.com
3 tr.snapchat.com page.firstleaf.club
3 edge.fullstory.com jacobs.perkspot.com
edge.fullstory.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
page.firstleaf.club
3 perkspot.zendesk.com assets.zendesk.com
static.zdassets.com
3 ekr.zdassets.com assets.zendesk.com
static.zdassets.com
3 www.google.de jacobs.perkspot.com
3 www.google.com 1 redirects jacobs.perkspot.com
3 www.googletagmanager.com jacobs.perkspot.com
www.googletagmanager.com
page.firstleaf.club
2 ec.instapagemetrics.com cdn.instapagemetrics.com
2 web.chtbl.com ext.chtbl.com
2 www.facebook.com page.firstleaf.club
2 ct.firstleaf.club images.firstleaf.club
2 assets.bounceexchange.com tag.wknd.ai
assets.bounceexchange.com
2 d2hrivdxn8ekm8.cloudfront.net jacobs.perkspot.com
d2hrivdxn8ekm8.cloudfront.net
2 collector-7547.tvsquared.com jacobs.perkspot.com
page.firstleaf.club
2 aa.trkn.us jacobs.perkspot.com
2 connect.facebook.net jacobs.perkspot.com
connect.facebook.net
2 trkn.us 1 redirects page.firstleaf.club
2 dc.services.visualstudio.com az416426.vo.msecnd.net
1 analytics.twitter.com static.ads-twitter.com
1 i6.liadm.com page.firstleaf.club
1 i.liadm.com 1 redirects
1 aa.agkn.com cdn.datasteam.io
1 e.cdnwidget.com page.firstleaf.club
1 api.bounceexchange.com assets.bounceexchange.com
1 ids.cdnwidget.com assets.bounceexchange.com
1 rp4.liadm.com page.firstleaf.club
1 rp.liadm.com 1 redirects
1 view.cdnbasket.net assets.bounceexchange.com
1 page.cdnbasket.net assets.bounceexchange.com
1 data.cdnbasket.net assets.bounceexchange.com
1 d1lu3pmaz2ilpx.cloudfront.net d2hrivdxn8ekm8.cloudfront.net
1 d330aiyvva2oww.cloudfront.net d2hrivdxn8ekm8.cloudfront.net
1 dvqigh9b7wa32.cloudfront.net d2hrivdxn8ekm8.cloudfront.net
1 vars.hotjar.com static.hotjar.com
1 script.hotjar.com static.hotjar.com
1 ext.chtbl.com jacobs.perkspot.com
1 b-code.liadm.com www.googletagmanager.com
1 images.firstleaf.club jacobs.perkspot.com
1 cdn.datasteam.io www.googletagmanager.com
1 jelly.mdhv.io page.firstleaf.club
1 cdn.taboola.com jacobs.perkspot.com
1 static.hotjar.com jacobs.perkspot.com
1 tag.wknd.ai jacobs.perkspot.com
1 t.co page.firstleaf.club
1 alb.reddit.com page.firstleaf.club
1 anthill.instapage.com page.firstleaf.club
1 stdomi.com page.firstleaf.club
1 cdn1-res.sundaysky.com www.googletagmanager.com
1 fonts.gstatic.com fonts.googleapis.com
1 sc-static.net www.googletagmanager.com
1 init.blackcrow.ai www.googletagmanager.com
1 www.redditstatic.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 cdn.instapagemetrics.com page.firstleaf.club
1 static.cloudflareinsights.com page.firstleaf.club
1 heatmap-events-collector.instapage.com page.firstleaf.club
1 www.firstleaf.club page.firstleaf.club
1 cloud.typography.com 1 redirects
1 d1hdjv7b05hja2.cloudfront.net page.firstleaf.club
1 fonts.googleapis.com page.firstleaf.club
1 www.emjcd.com 1 redirects
1 cj.dotomi.com 1 redirects
1 www.anrdoezrs.net 1 redirects
1 assets.zendesk.com 1 redirects
1 googleads.g.doubleclick.net www.googleadservices.com
1 www.googleadservices.com www.googletagmanager.com
1 az416426.vo.msecnd.net jacobs.perkspot.com
1 cdn.heapanalytics.com jacobs.perkspot.com
1 cdn.rollbar.com jacobs.perkspot.com
1 ak.sail-horizon.com jacobs.perkspot.com
1 hello.myfonts.net jacobs.perkspot.com
1 email.perkspot.com 1 redirects
1 sailthru.perkspot.com 1 redirects
0 fbapi.firstleaf.club Failed connect.facebook.net
209 90

This site contains links to these domains. Also see Links.

Domain
www.firstleaf.club
firstleaf.club
Subject Issuer Validity Valid
*.perkspot.com
Go Daddy Secure Certificate Authority - G2
2021-07-22 -
2022-08-02
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-07-10 -
2022-07-09
a year crt.sh
*.azureedge.net
Microsoft Azure TLS Issuing CA 02
2021-08-21 -
2022-08-16
a year crt.sh
ak.sail-horizon.com
Amazon
2021-01-07 -
2022-02-04
a year crt.sh
cdn.rollbar.com
Amazon
2021-07-11 -
2022-08-09
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-07-26 -
2021-10-18
3 months crt.sh
cdn.heapanalytics.com
Amazon
2020-09-24 -
2021-10-26
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2021-07-26 -
2021-10-18
3 months crt.sh
sni1e6ffgl.wpc.edgecastcdn.net
DigiCert SHA2 Secure Server CA
2020-04-16 -
2022-04-21
2 years crt.sh
www.google.de
GTS CA 1C3
2021-07-26 -
2021-10-18
3 months crt.sh
www.googleadservices.com
GTS CA 1C3
2021-07-26 -
2021-10-18
3 months crt.sh
*.google.com
GTS CA 1C3
2021-07-26 -
2021-10-18
3 months crt.sh
*.google.de
GTS CA 1C3
2021-07-26 -
2021-10-18
3 months crt.sh
ssl1036557.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2021-07-08 -
2022-07-07
a year crt.sh
heapanalytics.com
Amazon
2020-12-24 -
2022-01-22
a year crt.sh
perkspot.zendesk.com
Cloudflare Inc ECC CA-3
2021-06-16 -
2022-06-15
a year crt.sh
in.applicationinsights.azure.com
Microsoft RSA TLS CA 01
2021-07-22 -
2022-07-22
a year crt.sh
g.fastcdn.co
GTS CA 1D4
2021-06-29 -
2021-09-27
3 months crt.sh
upload.video.google.com
GTS CA 1O1
2021-07-26 -
2021-10-18
3 months crt.sh
*.cloudfront.net
Amazon
2021-03-19 -
2022-03-17
a year crt.sh
v.fastcdn.co
DigiCert TLS RSA SHA256 2020 CA1
2021-05-11 -
2022-05-16
a year crt.sh
heatmap-events-collector.instapage.com
R3
2021-06-26 -
2021-09-24
3 months crt.sh
cdn.instapagemetrics.com
GTS CA 1D4
2021-06-29 -
2021-09-27
3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2021-07-06 -
2022-01-06
6 months crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2021-07-21 -
2022-07-26
a year crt.sh
www.redditstatic.com
DigiCert TLS RSA SHA256 2020 CA1
2021-05-23 -
2021-11-18
6 months crt.sh
*.blackcrow.ai
Amazon
2021-01-20 -
2022-02-18
a year crt.sh
sc-static.net
DigiCert TLS RSA SHA256 2020 CA1
2021-02-11 -
2022-02-15
a year crt.sh
trkn.us
Go Daddy Secure Certificate Authority - G2
2021-01-19 -
2022-02-20
a year crt.sh
*.gstatic.com
GTS CA 1C3
2021-07-26 -
2021-10-18
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-07-20 -
2021-10-18
3 months crt.sh
rbv9j7km.firstleaf.club
R3
2021-07-24 -
2021-10-22
3 months crt.sh
*.sundaysky.com
DigiCert TLS RSA SHA256 2020 CA1
2021-05-26 -
2022-06-26
a year crt.sh
cert1.a1.atm.aqfer.net
R3
2021-07-26 -
2021-10-24
3 months crt.sh
www.stdomi.com
Sectigo RSA Domain Validation Secure Server CA
2020-11-09 -
2021-11-14
a year crt.sh
anthill.instapage.com
R3
2021-07-12 -
2021-10-10
3 months crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2021-05-23 -
2021-11-18
6 months crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1
2021-02-05 -
2022-02-04
a year crt.sh
tag.wknd.ai
R3
2021-07-26 -
2021-10-24
3 months crt.sh
*.hotjar.com
Amazon
2020-12-25 -
2022-01-23
a year crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1
2020-11-25 -
2021-12-26
a year crt.sh
*.tvsquared.com
Amazon
2020-10-16 -
2021-11-14
a year crt.sh
jelly.mdhv.io
GTS CA 1D4
2021-06-30 -
2021-09-28
3 months crt.sh
cdn.datasteam.io
Amazon
2020-11-19 -
2021-12-18
a year crt.sh
*.srv.stackadapt.com
Amazon
2020-12-09 -
2022-01-07
a year crt.sh
*.liadm.com
Amazon
2021-03-02 -
2022-03-31
a year crt.sh
edge.fullstory.com
GTS CA 1D4
2021-08-22 -
2021-11-20
3 months crt.sh
ext.chtbl.com
Amazon
2021-01-25 -
2022-02-22
a year crt.sh
tr.snapchat.com
DigiCert TLS RSA SHA256 2020 CA1
2021-01-19 -
2022-01-23
a year crt.sh
assets.bounceexchange.com
GTS CA 1D4
2021-06-30 -
2021-09-28
3 months crt.sh
web.chtbl.com
Amazon
2021-02-28 -
2022-03-29
a year crt.sh
penrosehill.zendesk.com
Cloudflare Inc ECC CA-3
2021-06-16 -
2022-06-15
a year crt.sh
*.cdnbasket.net
Go Daddy Secure Certificate Authority - G2
2020-07-29 -
2021-09-27
a year crt.sh
*.fullstory.com
R3
2021-07-27 -
2021-10-25
3 months crt.sh
*.datasteam.io
Amazon
2021-07-31 -
2022-08-29
a year crt.sh
ids.cdnwidget.com
GTS CA 1D4
2021-06-29 -
2021-09-27
3 months crt.sh
*.wunderkind.co
R3
2021-08-16 -
2021-11-14
3 months crt.sh
e.cdnwidget.com
GTS CA 1D4
2021-06-28 -
2021-09-26
3 months crt.sh
*.agkn.com
RapidSSL RSA CA 2018
2020-07-25 -
2022-09-18
2 years crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2021-02-05 -
2022-02-04
a year crt.sh
ec.instapagemetrics.com
R3
2021-08-17 -
2021-11-15
3 months crt.sh

This page contains 10 frames:

Primary Page: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Frame ID: 84DE9188EFEDF506350F86CB75072597
Requests: 173 HTTP requests in this frame

Frame: https://static.zdassets.com/ekr/asset_composer.js
Frame ID: 24A49CBDCD3707D2F06946D005890174
Requests: 3 HTTP requests in this frame

Frame: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Frame ID: 3FE77D0497B59794AF11DBA69139CF74
Requests: 12 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=c20b9c7f-d0c3-4f4d-94a3-2a2c5fad8834
Frame ID: 9E3FE0E37383841A1745DDC9A0F26759
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-25a418976ea02a6f393fbbe77cec94bb.html
Frame ID: B19C6854B5D794AB63E311AABEAC0688
Requests: 1 HTTP requests in this frame

Frame: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Frame ID: B67E0B6CACA8FDC9572117021A1158A8
Requests: 11 HTTP requests in this frame

Frame: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Frame ID: C8135C0113B1CB7FABF209279703CCED
Requests: 10 HTTP requests in this frame

Frame: https://assets.bounceexchange.com/assets/bounce/local_storage_frame16.min.html
Frame ID: 840AC65863A11CF8C6AC60E677D71BCE
Requests: 1 HTTP requests in this frame

Frame: https://edge.fullstory.com/s/fs.js
Frame ID: 96EFDAEA02202A23DD70DE6D8FE1AA2A
Requests: 1 HTTP requests in this frame

Frame: https://edge.fullstory.com/s/fs.js
Frame ID: BA89539415BD9566D2BC1E04F78A1E55
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Buying Award-Winning Wine Is Simple With Firstleaf

Page URL History Show full URLs

  1. https://sailthru.perkspot.com/click/24831941.9083437/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZ... HTTP 302
    https://email.perkspot.com/e/v3/click/offer/1420262?merchantName=FirstleafWineClub&assetType=Small&cmpn... HTTP 302
    https://jacobs.perkspot.com/auth/email?sid=fde50262-b02b-4d72-a5d2-4e00cb680328&auth=62159646368ee68e048... HTTP 302
    https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast Page URL
  2. https://www.anrdoezrs.net/click-2097062-13552845?&sid=PEJ3Q6TIIVT5BHL32 HTTP 302
    https://cj.dotomi.com/5a100mu21K/u05/JLNNKQMN/KIRPIOK/I/I/I?j=v5vq%3DcRWGdJgVVigIOUYGF%3c%3cu6625%... HTTP 302
    https://www.emjcd.com/87117gv32N/v16/KMOOLRNO/LJSQJPL/J/NJJNJNLROKKQLOLMLK:LnHTem02WPfp/vyxyPNQyJN... HTTP 302
    https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=185077... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
  • script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

209
Requests

99 %
HTTPS

37 %
IPv6

56
Domains

90
Subdomains

79
IPs

5
Countries

6731 kB
Transfer

17385 kB
Size

33
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://sailthru.perkspot.com/click/24831941.9083437/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xNDIwMjYyP21lcmNoYW50TmFtZT1GaXJzdGxlYWZXaW5lQ2x1YiZhc3NldFR5cGU9U21hbGwmY21wbmlkPTEyNiZwcD0xMSZwdD1zc3MmYXQ9cyZhcD0yJnBrPTExJmR0PXMmYW89MTQyMDI2MiYxPTEvJmVtYWlsPXNoYW5pc2Vfd2lsbGlhbXMlNDBqYWJpbC5jb20mZW1haWxCbGFzdElkPTI0ODMxOTQxJmVudGl0eUVtYWlsVHlwZUNvZGU9d2Vla2x5Ymxhc3QmdXNlcklkPTIzOTUzNDE1JmNvbW11bml0eWlkPTE5NiZhdXRoPTAyYzg0ZWUzOWQ3MTA2MjRhOWYxM2Q2YWM5YjUzODY1JmNvbW11bml0eW5hbWU9SmFjb2JzJnJlY29tbWlkPSZtc2dpZD0yNDgzMTk0MS45MDgzNDM3/61084837a319dd2d0a1f292dBe367e6a6 HTTP 302
    https://email.perkspot.com/e/v3/click/offer/1420262?merchantName=FirstleafWineClub&assetType=Small&cmpnid=126&pp=11&pt=sss&at=s&ap=2&pk=11&dt=s&ao=1420262&1=1/&email=shanise_williams%40jabil.com&emailBlastId=24831941&entityEmailTypeCode=weeklyblast&userId=23953415&communityid=196&auth=02c84ee39d710624a9f13d6ac9b53865&communityname=Jacobs&recommid=&msgid=24831941.9083437 HTTP 302
    https://jacobs.perkspot.com/auth/email?sid=fde50262-b02b-4d72-a5d2-4e00cb680328&auth=62159646368ee68e0481881e10689a3e&redirectUrl=%2foffer%2f1420262%2fnone%3futm_medium%3demail%26utm_id%3dweeklyblast&furtherRedirect= HTTP 302
    https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast Page URL
  2. https://www.anrdoezrs.net/click-2097062-13552845?&sid=PEJ3Q6TIIVT5BHL32 HTTP 302
    https://cj.dotomi.com/5a100mu21K/u05/JLNNKQMN/KIRPIOK/I/I/I?j=v5vq%3DcRWGdJgVVigIOUYGF%3c%3cu6625%3A%2F%2F999.n04q1rC45.0r6%3ALD%2Fpyvpx-FDMKDJF-EGIIFLHI%3c%3cT%3cu6625%3A%2F%2Fwnp1o5.2r4x5216.p1z%2F%3c%3cE%3cE%3cD%3cD%3c HTTP 302
    https://www.emjcd.com/87117gv32N/v16/KMOOLRNO/LJSQJPL/J/NJJNJNLROKKQLOLMLK:LnHTem02WPfp/vyxyPNQyJNyLKKxvRJQOJMLvJtKRJOJy?i=u4up%3DbQVFcIfUUhfHNTXFE%3cov0!9E1B-5xx2zD5m%3ct5514%3A%2F%2F888.mz3p0qB34.zq5%3AKC%2Foxuow-ECLJCIE-DFHHEKGH%3c%3cS%3ct5514%3A%2F%2Fvmo0n4.1q3w4105.o0y%2F%3cCrFGCEIm-LKJm-GGpr-KFGE-EmCFIrqrIKLI%3cD%3cD%3cC%3cC%3c HTTP 302
    https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://sailthru.perkspot.com/click/24831941.9083437/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xNDIwMjYyP21lcmNoYW50TmFtZT1GaXJzdGxlYWZXaW5lQ2x1YiZhc3NldFR5cGU9U21hbGwmY21wbmlkPTEyNiZwcD0xMSZwdD1zc3MmYXQ9cyZhcD0yJnBrPTExJmR0PXMmYW89MTQyMDI2MiYxPTEvJmVtYWlsPXNoYW5pc2Vfd2lsbGlhbXMlNDBqYWJpbC5jb20mZW1haWxCbGFzdElkPTI0ODMxOTQxJmVudGl0eUVtYWlsVHlwZUNvZGU9d2Vla2x5Ymxhc3QmdXNlcklkPTIzOTUzNDE1JmNvbW11bml0eWlkPTE5NiZhdXRoPTAyYzg0ZWUzOWQ3MTA2MjRhOWYxM2Q2YWM5YjUzODY1JmNvbW11bml0eW5hbWU9SmFjb2JzJnJlY29tbWlkPSZtc2dpZD0yNDgzMTk0MS45MDgzNDM3/61084837a319dd2d0a1f292dBe367e6a6 HTTP 302
  • https://email.perkspot.com/e/v3/click/offer/1420262?merchantName=FirstleafWineClub&assetType=Small&cmpnid=126&pp=11&pt=sss&at=s&ap=2&pk=11&dt=s&ao=1420262&1=1/&email=shanise_williams%40jabil.com&emailBlastId=24831941&entityEmailTypeCode=weeklyblast&userId=23953415&communityid=196&auth=02c84ee39d710624a9f13d6ac9b53865&communityname=Jacobs&recommid=&msgid=24831941.9083437 HTTP 302
  • https://jacobs.perkspot.com/auth/email?sid=fde50262-b02b-4d72-a5d2-4e00cb680328&auth=62159646368ee68e0481881e10689a3e&redirectUrl=%2foffer%2f1420262%2fnone%3futm_medium%3demail%26utm_id%3dweeklyblast&furtherRedirect= HTTP 302
  • https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Request Chain 25
  • https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=498008824&utmhn=jacobs.perkspot.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&utmhid=486039241&utmr=-&utmp=%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&utmht=1629820142867&utmac=UA-652375-6&utmcc=__utma%3D64858676.660937558.1629820143.1629820143.1629820143.1%3B%2B__utmz%3D64858676.1629820143.1.1.utmcid%3Dweeklyblast%7Cutmccn%3D(not%2520set)%7Cutmcmd%3Demail%3B&utmjid=2103738012&utmredir=3&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=660937558.1629820143&jid=2103738012&_v=5.7.2dc&z=498008824 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=660937558.1629820143&jid=2103738012&_v=5.7.2dc&z=498008824&slf_rd=1&random=2694769629
Request Chain 40
  • https://assets.zendesk.com/embeddable_framework/main.js HTTP 301
  • https://static.zdassets.com/ekr/asset_composer.js
Request Chain 71
  • https://cloud.typography.com/7410416/6307592/css/fonts.css HTTP 302
  • https://www.firstleaf.club/fonts/687751/007ADF49EA9D333D0.css
Request Chain 91
  • https://trkn.us/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=1893797462 HTTP 302
  • https://trkn.us/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=1893797462;ip=159.48.55.4;cuidchk=1
Request Chain 140
  • https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&cb=1790363202&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&udt.segment=visitor HTTP 302
  • https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&cb=1790363202&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&udt.segment=visitor&_cvt=t&timestamp=1629820148098&nonce=ms17hkusp0t2baeq9ooe6lulh&signature=a2e34435cf6a9bf3cdf264ea7097524552abe864
Request Chain 154
  • https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&cb=1605776153&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&udt.segment=visitor HTTP 302
  • https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&cb=1605776153&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&udt.segment=visitor&_cvt=t&timestamp=1629820148098&nonce=3iqr30k19taoqre7maafg5j688&signature=690e42326fecd521b29e032c8be1099ff0b8d92f
Request Chain 176
  • https://rp.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&refr=https%3A%2F%2Fjacobs.perkspot.com%2F&duid=a0b8fe163af0--01fdwdkp0ewf817j4tc940cszd&se=e30&dtstmp=1629820147856 HTTP 302
  • https://rp4.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&refr=https%3A%2F%2Fjacobs.perkspot.com%2F&duid=a0b8fe163af0--01fdwdkp0ewf817j4tc940cszd&se=e30&dtstmp=1629820147856&i6=MmEwMTo0Zjg6MTIxOjEzMWE6OjI%3D&n3pc=true
Request Chain 205
  • https://i.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-0152A23C-AE3C-4017-800D-99E93EC5A637 HTTP 303
  • https://i6.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-0152A23C-AE3C-4017-800D-99E93EC5A637

209 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Cookie set none
jacobs.perkspot.com/offer/1420262/
Redirect Chain
  • https://sailthru.perkspot.com/click/24831941.9083437/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xNDIwMjYyP21lcmNoYW50TmFtZT1GaXJzdGxlYWZXaW5lQ2x1YiZhc3NldFR5cGU9U21hbGwmY21wbmlkPTEy...
  • https://email.perkspot.com/e/v3/click/offer/1420262?merchantName=FirstleafWineClub&assetType=Small&cmpnid=126&pp=11&pt=sss&at=s&ap=2&pk=11&dt=s&ao=1420262&1=1/&email=shanise_williams%40jabil.com&em...
  • https://jacobs.perkspot.com/auth/email?sid=fde50262-b02b-4d72-a5d2-4e00cb680328&auth=62159646368ee68e0481881e10689a3e&redirectUrl=%2foffer%2f1420262%2fnone%3futm_medium%3demail%26utm_id%3dweeklybla...
  • https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
59 KB
20 KB
Document
General
Full URL
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
f03d501be0c66306ee87d7b0a268787aafa368221c9a50f5feabc9e73cc1a0ba
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Host
jacobs.perkspot.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
sailthru_hid=8cd921ee025d30c3a186703f663d647661084837a319dd2d0a1f292d85ee6188a4f7924d178c53ea0616263e; sailthru_bid=24831941.9083437; TiPMix=66.8059813635452; x-ms-routing-name=self; PerkSpot4=CAFD7BEB10082B21B9271130BF0DE8BC128361699ACAC4780777FBF33262A3023FD692FD43C17A8DB16873FC3A9D7F3845EDB92C47385575C2C3C7EC71553313E474C3890D30382F899974FF5733CCF10E6E7057BFEB919265223E23B21A1A87B1A2D6913E0CC92F36EA7D46DFB4F14EC5B7086325869EDF0D833DB008E5FB363213F4D96FFA13764A6AE4BD90CAD6D972DA9EF9E39C867D305C80ED2EE6EB6BCFED0D2869EFBA42852287C294071C0A565DA5A860DB96DAF115336FB7F50391; SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; ARRAffinity=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6; ARRAffinitySameSite=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Cache-Control
private
Content-Length
19231
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Set-Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; expires=Tue, 24-Aug-2021 16:09:02 GMT; path=/; secure; HttpOnly ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; expires=Tue, 24-Aug-2021 16:09:02 GMT; path=/; secure; HttpOnly SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; expires=Tue, 24-Aug-2021 16:09:02 GMT; path=/; secure; HttpOnly ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; expires=Tue, 24-Aug-2021 16:09:02 GMT; path=/; secure; HttpOnly
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
X-Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Security-Policy
frame-ancestors *.perkspot.com
Date
Tue, 24 Aug 2021 15:49:01 GMT

Redirect headers

Cache-Control
private
Content-Length
203
Content-Type
text/html; charset=utf-8
Location
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Set-Cookie
TiPMix=66.8059813635452; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure PerkSpot4=CAFD7BEB10082B21B9271130BF0DE8BC128361699ACAC4780777FBF33262A3023FD692FD43C17A8DB16873FC3A9D7F3845EDB92C47385575C2C3C7EC71553313E474C3890D30382F899974FF5733CCF10E6E7057BFEB919265223E23B21A1A87B1A2D6913E0CC92F36EA7D46DFB4F14EC5B7086325869EDF0D833DB008E5FB363213F4D96FFA13764A6AE4BD90CAD6D972DA9EF9E39C867D305C80ED2EE6EB6BCFED0D2869EFBA42852287C294071C0A565DA5A860DB96DAF115336FB7F50391; domain=.perkspot.com; path=/ SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; expires=Tue, 24-Aug-2021 16:09:01 GMT; path=/; secure; HttpOnly ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; expires=Tue, 24-Aug-2021 16:09:01 GMT; path=/; secure; HttpOnly ARRAffinity=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
X-Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Security-Policy
frame-ancestors *.perkspot.com
Date
Tue, 24 Aug 2021 15:49:01 GMT
2b1ecf
hello.myfonts.net/count/
0
154 B
Stylesheet
General
Full URL
https://hello.myfonts.net/count/2b1ecf
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:f349 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:02 GMT
server
cloudflare
age
1
expect-ct
null
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
683dba70ff3d4e6d-FRA
content-length
0
expires
Wed, 24 Aug 2022 15:49:02 GMT
core
jacobs.perkspot.com/Content/css/
198 KB
54 KB
Stylesheet
General
Full URL
https://jacobs.perkspot.com/Content/css/core?v=21.8.28093.1
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
94c6483dadce933e499cc7f0a7cbd22d2565bbaf160f19086d55bd2e2df69f7b
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Cookie
sailthru_hid=8cd921ee025d30c3a186703f663d647661084837a319dd2d0a1f292d85ee6188a4f7924d178c53ea0616263e; sailthru_bid=24831941.9083437; TiPMix=66.8059813635452; x-ms-routing-name=self; PerkSpot4=CAFD7BEB10082B21B9271130BF0DE8BC128361699ACAC4780777FBF33262A3023FD692FD43C17A8DB16873FC3A9D7F3845EDB92C47385575C2C3C7EC71553313E474C3890D30382F899974FF5733CCF10E6E7057BFEB919265223E23B21A1A87B1A2D6913E0CC92F36EA7D46DFB4F14EC5B7086325869EDF0D833DB008E5FB363213F4D96FFA13764A6AE4BD90CAD6D972DA9EF9E39C867D305C80ED2EE6EB6BCFED0D2869EFBA42852287C294071C0A565DA5A860DB96DAF115336FB7F50391; SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; ARRAffinity=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6; ARRAffinitySameSite=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6
Connection
keep-alive
Referer
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:01 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Expires
-1
Cache-Control
no-cache
Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Length
55078
X-Content-Security-Policy
frame-ancestors *.perkspot.com
perxcss.css
jacobs.perkspot.com/Content/sass/
481 KB
53 KB
Stylesheet
General
Full URL
https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e14b6036972fd446c62212fe39351614667c28fa0de47e41e836b45d35ee6366
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Cookie
sailthru_hid=8cd921ee025d30c3a186703f663d647661084837a319dd2d0a1f292d85ee6188a4f7924d178c53ea0616263e; sailthru_bid=24831941.9083437; TiPMix=66.8059813635452; x-ms-routing-name=self; PerkSpot4=CAFD7BEB10082B21B9271130BF0DE8BC128361699ACAC4780777FBF33262A3023FD692FD43C17A8DB16873FC3A9D7F3845EDB92C47385575C2C3C7EC71553313E474C3890D30382F899974FF5733CCF10E6E7057BFEB919265223E23B21A1A87B1A2D6913E0CC92F36EA7D46DFB4F14EC5B7086325869EDF0D833DB008E5FB363213F4D96FFA13764A6AE4BD90CAD6D972DA9EF9E39C867D305C80ED2EE6EB6BCFED0D2869EFBA42852287C294071C0A565DA5A860DB96DAF115336FB7F50391; SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; ARRAffinity=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6; ARRAffinitySameSite=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6
Connection
keep-alive
Referer
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Encoding
gzip
ETag
"8039e4e46598d71:0"
Last-Modified
Mon, 23 Aug 2021 21:29:03 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Date
Tue, 24 Aug 2021 15:49:02 GMT
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
54044
X-Content-Security-Policy
frame-ancestors *.perkspot.com
Cookie set community-css
jacobs.perkspot.com/
49 KB
10 KB
Stylesheet
General
Full URL
https://jacobs.perkspot.com/community-css
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
c4a07a396ffa057bcc0ca3da5adb8ffc76619e7246b4d8d13b327427fa00709c
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Cookie
sailthru_hid=8cd921ee025d30c3a186703f663d647661084837a319dd2d0a1f292d85ee6188a4f7924d178c53ea0616263e; sailthru_bid=24831941.9083437; TiPMix=66.8059813635452; x-ms-routing-name=self; PerkSpot4=CAFD7BEB10082B21B9271130BF0DE8BC128361699ACAC4780777FBF33262A3023FD692FD43C17A8DB16873FC3A9D7F3845EDB92C47385575C2C3C7EC71553313E474C3890D30382F899974FF5733CCF10E6E7057BFEB919265223E23B21A1A87B1A2D6913E0CC92F36EA7D46DFB4F14EC5B7086325869EDF0D833DB008E5FB363213F4D96FFA13764A6AE4BD90CAD6D972DA9EF9E39C867D305C80ED2EE6EB6BCFED0D2869EFBA42852287C294071C0A565DA5A860DB96DAF115336FB7F50391; SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; ARRAffinity=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6; ARRAffinitySameSite=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6
Connection
keep-alive
Referer
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Encoding
gzip
Vary
Accept-Encoding
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Cache-Control
private
Date
Tue, 24 Aug 2021 15:49:02 GMT
Content-Disposition
attachment; filename=global.css
Set-Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; expires=Tue, 24-Aug-2021 16:09:02 GMT; path=/; secure; HttpOnly ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; expires=Tue, 24-Aug-2021 16:09:02 GMT; path=/; secure; HttpOnly
Content-Length
9333
X-Content-Security-Policy
frame-ancestors *.perkspot.com
insights
jacobs.perkspot.com/bundles/
4 KB
3 KB
Script
General
Full URL
https://jacobs.perkspot.com/bundles/insights?v=BYC8KfJNNFadC6mBN8WA9SN_bH3bqkPFtSQg0hXgWI01
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
5efd1cdc9fe57d8ee4c5ee8839c2deb5a4c0a6f0eae362825bf0c94785c01632
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://jacobs.perkspot.com/
Cookie
sailthru_hid=8cd921ee025d30c3a186703f663d647661084837a319dd2d0a1f292d85ee6188a4f7924d178c53ea0616263e; sailthru_bid=24831941.9083437; TiPMix=66.8059813635452; x-ms-routing-name=self; PerkSpot4=CAFD7BEB10082B21B9271130BF0DE8BC128361699ACAC4780777FBF33262A3023FD692FD43C17A8DB16873FC3A9D7F3845EDB92C47385575C2C3C7EC71553313E474C3890D30382F899974FF5733CCF10E6E7057BFEB919265223E23B21A1A87B1A2D6913E0CC92F36EA7D46DFB4F14EC5B7086325869EDF0D833DB008E5FB363213F4D96FFA13764A6AE4BD90CAD6D972DA9EF9E39C867D305C80ED2EE6EB6BCFED0D2869EFBA42852287C294071C0A565DA5A860DB96DAF115336FB7F50391; SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; ARRAffinity=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6; ARRAffinitySameSite=67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6
Connection
keep-alive
Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:02 GMT
Content-Encoding
gzip
Vary
User-Agent,Accept-Encoding
Last-Modified
Tue, 24 Aug 2021 15:49:02 GMT
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/javascript; charset=utf-8
Expires
Wed, 24 Aug 2022 15:49:02 GMT
Cache-Control
public
Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Length
2610
X-Content-Security-Policy
frame-ancestors *.perkspot.com
logo_196.png
psprods3ep.azureedge.net/cdn.perkspot.com/images/communities/
8 KB
9 KB
Image
General
Full URL
https://psprods3ep.azureedge.net/cdn.perkspot.com/images/communities/logo_196.png
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8fd170635383b0c3166c17896a4b975f48d4d76d8f1a1d603d0481442f052d84

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-meta-createdby
not-implemented
date
Tue, 24 Aug 2021 15:49:02 GMT
x-amz-meta-uploader
S3StorageService
last-modified
Wed, 11 Nov 2020 00:55:59 GMT
server
AmazonS3
x-amz-request-id
WFFG1J2AHM3QXCP6
etag
"9afdaf7aa9cb64c0e7084de27fff461c"
x-azure-ref
07hQlYQAAAABOyJnw9CqKRb//9xkLS/HIRlJBRURHRTEwMTEANzA3ZDAxY2MtZTQ0NC00MTliLTg3NTktMDhjMjdlNDJkMjU2
x-cache
TCP_HIT
content-type
image/png
cache-control
public, max-age=18000
x-azure-ref-originshield
0zRElYQAAAADP6a8y1sShSJsp6oKYQpIDTE9OMjFFREdFMDIxNwA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
accept-ranges
bytes
content-length
8563
x-amz-id-2
zVCc7HRd1UF4W/A2UjcMrxsuwu1HG9d4vL5PKBEAXataJ9uWDq6sSegI9uKmS9hnDJ+++PCnQ1w=
logo_44971.jpg
psprods3ep.azureedge.net/cdn.perkspot.com/images/merchants/
16 KB
16 KB
Image
General
Full URL
https://psprods3ep.azureedge.net/cdn.perkspot.com/images/merchants/logo_44971.jpg
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7a58cec4842503db6949177b80ece47d5f5aba937676400675bfea596bc7492b

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-meta-createdby
not-implemented
date
Tue, 24 Aug 2021 15:49:02 GMT
x-amz-meta-uploader
api
last-modified
Thu, 16 Jul 2020 16:31:14 GMT
server
AmazonS3
x-amz-request-id
Y9Z6TDMQ7QQ0S9D9
etag
"eea31b3902773b178a36ba617964cafb"
x-azure-ref
07hQlYQAAAABH0OHYXxFHSLpZF+06syU3RlJBRURHRTEwMTEANzA3ZDAxY2MtZTQ0NC00MTliLTg3NTktMDhjMjdlNDJkMjU2
x-cache
TCP_HIT
content-type
image/jpeg
cache-control
public, max-age=172800
x-azure-ref-originshield
0iwolYQAAAADz4Y1ul6gTSLHGRvo11KLXTE9OMjFFREdFMDIwNwA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
accept-ranges
bytes
content-length
16032
x-amz-id-2
bh9HRqq67fZY04EGdCMWZC+NiY7iIX2EEL1UTkb4Wj8gG4bZzUWXXMvQCcGPRcNtkqJylrnPxx0=
Cookie set video.min.js
jacobs.perkspot.com/Scripts/libraries/
507 KB
141 KB
Script
General
Full URL
https://jacobs.perkspot.com/Scripts/libraries/video.min.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d9aeeae782fdde78411155839930b81c16fa4154002c1573462fa61806910409
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://jacobs.perkspot.com/
Connection
keep-alive
Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Encoding
gzip
ETag
"0fdade66598d71:0"
Last-Modified
Mon, 23 Aug 2021 21:29:06 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-javascript
Date
Tue, 24 Aug 2021 15:49:02 GMT
Set-Cookie
TiPMix=76.2345208675761; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=2bb9db0fc1f15806c34e6e3dcd35d19105172686523f20adf76a792565b6cb06;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=2bb9db0fc1f15806c34e6e3dcd35d19105172686523f20adf76a792565b6cb06;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
143375
X-Content-Security-Policy
frame-ancestors *.perkspot.com
Cookie set video-js.min.css
jacobs.perkspot.com/Content/css/libraries/
39 KB
11 KB
Stylesheet
General
Full URL
https://jacobs.perkspot.com/Content/css/libraries/video-js.min.css
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
fdf5dfab742b9d6c8c626174cd7e8899d2350d3ada34202ad6f3e87dadabb36c
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://jacobs.perkspot.com/
Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65
Connection
keep-alive
Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Encoding
gzip
ETag
"05710e96598d71:0"
Last-Modified
Mon, 23 Aug 2021 21:29:10 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Date
Tue, 24 Aug 2021 15:49:02 GMT
Set-Cookie
TiPMix=6.49392097559474; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=8da8a02a13a3cdde53ad6aafcd4eb717ca00dd6bc65ff07378d74a0cd859e1c0;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=8da8a02a13a3cdde53ad6aafcd4eb717ca00dd6bc65ff07378d74a0cd859e1c0;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
10275
X-Content-Security-Policy
frame-ancestors *.perkspot.com
Cookie set jquery
jacobs.perkspot.com/bundles/
823 KB
313 KB
Script
General
Full URL
https://jacobs.perkspot.com/bundles/jquery?v=3ipa0WhHW-L5DOvoOlXydtzjaB6j3dI5pZnH2Ri9bp01
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
8459ec0213bcf434156ac2e810c8ad3f800e2fadef7b41950c4399d0ed0c1e1e
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://jacobs.perkspot.com/
Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65
Connection
keep-alive
Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Encoding
gzip
Vary
User-Agent,Accept-Encoding
Last-Modified
Tue, 24 Aug 2021 15:49:02 GMT
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/javascript; charset=utf-8
Expires
Wed, 24 Aug 2022 15:49:02 GMT
Cache-Control
public
Transfer-Encoding
chunked
Set-Cookie
TiPMix=69.6418124109701; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=2bb9db0fc1f15806c34e6e3dcd35d19105172686523f20adf76a792565b6cb06;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=2bb9db0fc1f15806c34e6e3dcd35d19105172686523f20adf76a792565b6cb06;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Date
Tue, 24 Aug 2021 15:49:02 GMT
X-Content-Security-Policy
frame-ancestors *.perkspot.com
Cookie set jqueryval
jacobs.perkspot.com/bundles/
40 KB
16 KB
Script
General
Full URL
https://jacobs.perkspot.com/bundles/jqueryval?v=YzRBe6gfD164-CLYW2zoB8py-eOZPLHUgoPct44VgDo1
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
40f2d552c0db3ead874ec52bf624d9ec88007d8b659cd7189fecc3ff19d3d248
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://jacobs.perkspot.com/
Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65
Connection
keep-alive
Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:02 GMT
Content-Encoding
gzip
Vary
User-Agent,Accept-Encoding
Last-Modified
Tue, 24 Aug 2021 15:49:02 GMT
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/javascript; charset=utf-8
Expires
Wed, 24 Aug 2022 15:49:02 GMT
Cache-Control
public
Content-Security-Policy
frame-ancestors *.perkspot.com
Set-Cookie
TiPMix=46.7059406203711; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=c7078a757149e3321a691d292f9f97be997f1edf73e5f3a8fd1e31f44a5ef4e5;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=c7078a757149e3321a691d292f9f97be997f1edf73e5f3a8fd1e31f44a5ef4e5;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Content-Length
15663
X-Content-Security-Policy
frame-ancestors *.perkspot.com
Cookie set bootstrap
jacobs.perkspot.com/bundles/
41 KB
15 KB
Script
General
Full URL
https://jacobs.perkspot.com/bundles/bootstrap?v=7jtbseVPa_P_wxk-ANB0JbEiqz4vMc1fIXNwp0ieQEk1
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
60035f8d3292fc0b3155089baabc76fce2178f8d104ef606e4e31cbe0a2803b2
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://jacobs.perkspot.com/
Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65
Connection
keep-alive
Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:02 GMT
Content-Encoding
gzip
Vary
User-Agent,Accept-Encoding
Last-Modified
Tue, 24 Aug 2021 15:49:03 GMT
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/javascript; charset=utf-8
Expires
Wed, 24 Aug 2022 15:49:03 GMT
Cache-Control
public
Content-Security-Policy
frame-ancestors *.perkspot.com
Set-Cookie
TiPMix=93.0224081003212; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=67b0e6bfebc7137d8f7ea2c80d29000b10bbc6561d2086700d36b7fdb48f25ba;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=67b0e6bfebc7137d8f7ea2c80d29000b10bbc6561d2086700d36b7fdb48f25ba;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Content-Length
14262
X-Content-Security-Policy
frame-ancestors *.perkspot.com
Cookie set modernizr
jacobs.perkspot.com/bundles/
11 KB
6 KB
Script
General
Full URL
https://jacobs.perkspot.com/bundles/modernizr?v=K-FFpFNtIXPUlQamnX3qHX_A5r7TM2xbAgcuEmpm3O41
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
9f0fab72c8a1fea1df1d6c5d128115031a8c44ccbc7f37e314acee6acb98779b
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://jacobs.perkspot.com/
Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65
Connection
keep-alive
Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:02 GMT
Content-Encoding
gzip
Vary
User-Agent,Accept-Encoding
Last-Modified
Tue, 24 Aug 2021 15:49:03 GMT
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/javascript; charset=utf-8
Expires
Wed, 24 Aug 2022 15:49:03 GMT
Cache-Control
public
Content-Security-Policy
frame-ancestors *.perkspot.com
Set-Cookie
TiPMix=12.2115936652811; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=dd27f47c0b676ed78610c4a5f44061be57d641105ae0b12a295befcee007674c;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=dd27f47c0b676ed78610c4a5f44061be57d641105ae0b12a295befcee007674c;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Content-Length
5284
X-Content-Security-Policy
frame-ancestors *.perkspot.com
perkspot.interstitial
jacobs.perkspot.com/bundles/
285 B
754 B
Script
General
Full URL
https://jacobs.perkspot.com/bundles/perkspot.interstitial?v=t7AmW2sLYmtuXd_Ef0RYYqquwW8mSfQBRb6_PPlosA41
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
89c69b70386c8e4a1be1f0dfe4b485807c2ac88bfe195de3a254a855f36d8c0c
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://jacobs.perkspot.com/
Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; x-ms-routing-name=self; ai_user=37cxbwGv1KWiLl9f35PmCS|2021-08-24T15:49:02.854Z; __utma=64858676.660937558.1629820143.1629820143.1629820143.1; __utmc=64858676; __utmz=64858676.1629820143.1.1.utmcid=weeklyblast|utmccn=(not%20set)|utmcmd=email; __utmt=1; __utmb=64858676.1.10.1629820143; _gcl_au=1.1.2115073214.1629820143; _ga=GA1.3.660937558.1629820143; _gid=GA1.3.661655204.1629820143; sailthru_pageviews=1; ai_session=V5l3X8bnW3xcuEzZU8my81|1629820142936|1629820142936; _dc_gtm_UA-652375-6=1; _ga_8J161FED5Z=GS1.1.1629820142.1.0.1629820142.0; _ga=GA1.1.660937558.1629820143; TiPMix=93.5053863532401; ARRAffinity=1d5fb298951795712d54b2df0c89d185153c650eca2a3f79345b380a30442d23; ARRAffinitySameSite=1d5fb298951795712d54b2df0c89d185153c650eca2a3f79345b380a30442d23
Connection
keep-alive
Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:02 GMT
Content-Encoding
gzip
Vary
User-Agent,Accept-Encoding
Last-Modified
Tue, 24 Aug 2021 15:49:03 GMT
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/javascript; charset=utf-8
Expires
Wed, 24 Aug 2022 15:49:03 GMT
Cache-Control
public
Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Length
296
X-Content-Security-Policy
frame-ancestors *.perkspot.com
addtohomescreen
jacobs.perkspot.com/bundles/
9 KB
4 KB
Script
General
Full URL
https://jacobs.perkspot.com/bundles/addtohomescreen?v=dQY7ReEN3P6AvpTV4mVTeWSR8WQitK0nH1fxax2VNoA1
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
65e4d18477e0e194ae2b3848fe053621a40508eeb817ab8c832b8005edd2c6af
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://jacobs.perkspot.com/
Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65; x-ms-routing-name=self; ai_user=37cxbwGv1KWiLl9f35PmCS|2021-08-24T15:49:02.854Z; __utma=64858676.660937558.1629820143.1629820143.1629820143.1; __utmc=64858676; __utmz=64858676.1629820143.1.1.utmcid=weeklyblast|utmccn=(not%20set)|utmcmd=email; __utmt=1; __utmb=64858676.1.10.1629820143; _gcl_au=1.1.2115073214.1629820143; _ga=GA1.3.660937558.1629820143; _gid=GA1.3.661655204.1629820143; sailthru_pageviews=1; ai_session=V5l3X8bnW3xcuEzZU8my81|1629820142936|1629820142936; _dc_gtm_UA-652375-6=1; _ga_8J161FED5Z=GS1.1.1629820142.1.0.1629820142.0; _ga=GA1.1.660937558.1629820143; TiPMix=91.3125797600078; ARRAffinity=e7e1969df33e17c68a9fbf7f7b0f85f7fdcbd40069a23b82adb55402439d750f; ARRAffinitySameSite=e7e1969df33e17c68a9fbf7f7b0f85f7fdcbd40069a23b82adb55402439d750f
Connection
keep-alive
Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:02 GMT
Content-Encoding
gzip
Vary
User-Agent,Accept-Encoding
Last-Modified
Tue, 24 Aug 2021 15:49:03 GMT
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
text/javascript; charset=utf-8
Expires
Wed, 24 Aug 2022 15:49:03 GMT
Cache-Control
public
Content-Security-Policy
frame-ancestors *.perkspot.com
Content-Length
3536
X-Content-Security-Policy
frame-ancestors *.perkspot.com
spm.v1.min.js
ak.sail-horizon.com/spm/
121 KB
43 KB
Script
General
Full URL
https://ak.sail-horizon.com/spm/spm.v1.min.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.102.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-72.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d06ae5e97e495832fc4526c3e93d7e9440f1faf5f77669b41678c9d564a25faf

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:43:41 GMT
content-encoding
gzip
last-modified
Tue, 08 Jun 2021 04:22:34 GMT
server
AmazonS3
age
324
etag
W/"b22b4f4738e8722be1636447be239da2"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
cache-control
max-age=600; must-revalidate
x-amz-cf-pop
ZRH50-C1
x-amz-cf-id
r2JbCfM78EthYR4F8Q3bvoo11JgBZMhEH8cqlNY1tEq3CDfXLSIkLw==
rollbar.min.js
cdn.rollbar.com/rollbarjs/refs/tags/v2.21.1/
75 KB
23 KB
Script
General
Full URL
https://cdn.rollbar.com/rollbarjs/refs/tags/v2.21.1/rollbar.min.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.224.89.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-89-80.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
eee2bc6e4edf311a6a0337c339dbd85d0d8d4040b25e390ab18237e2fa84f1c9

Request headers

Origin
https://jacobs.perkspot.com
Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:35:42 GMT
Content-Encoding
gzip
Age
801
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Access-Control-Allow-Origin
*
Last-Modified
Wed, 17 Mar 2021 15:55:23 GMT
Server
AmazonS3
ETag
W/"62dacaf8a5369242def33a2dcc503021"
Vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Via
1.1 d4ab4520827d99650a0d233539c37425.cloudfront.net (CloudFront)
Cache-Control
max-age=30672000,public
X-Amz-Cf-Pop
ZRH50-C1
X-Amz-Cf-Id
GpugtjtTazeWhZxZr2cPTsASGN8H3VbG1zPRnx8JSf8KYjTuwdrNhw==
dc.js
stats.g.doubleclick.net/
45 KB
17 KB
Script
General
Full URL
https://stats.g.doubleclick.net/dc.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 13 Jul 2021 18:24:06 GMT
server
Golfe2
age
6945
date
Tue, 24 Aug 2021 13:53:17 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17093
expires
Tue, 24 Aug 2021 15:53:17 GMT
heap-1214792821.js
cdn.heapanalytics.com/js/
114 KB
43 KB
Script
General
Full URL
https://cdn.heapanalytics.com/js/heap-1214792821.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.102.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-59.zrh50.r.cloudfront.net
Software
nginx /
Resource Hash
d45a6e3aadb9377c77af81e0a242fc627c1826bd877235d8a75614e5547f0eae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:47:12 GMT
content-encoding
gzip
server
nginx
age
110
etag
W/"1c88d-PRYsQobARUFPFW9LyFERlg"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
via
1.1 c07945b00aad28e34fbfebb3d3907061.cloudfront.net (CloudFront)
cache-control
public, max-age=120
x-amz-cf-pop
ZRH50-C1
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-id
xv5I_GRH1Bt67Oqhjt8c_dbqC6ymqHmkie-jv5vtw1qBEzIX0jMX-A==
gtm.js
www.googletagmanager.com/
112 KB
42 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-578DK6
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a01e4ff4f213411c091723504a716e822ca36538464759af29ba56ffe0f0c310
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:02 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43065
x-xss-protection
0
last-modified
Tue, 24 Aug 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 24 Aug 2021 15:49:02 GMT
Cookie set 35A1AD_0_0.woff2
jacobs.perkspot.com/Content/fonts/
28 KB
29 KB
Font
General
Full URL
https://jacobs.perkspot.com/Content/fonts/35A1AD_0_0.woff2
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
42ae1eb8cc55b4e2382e02323c96a40e80432d3e810bce85f10c75ddacbd2e2b
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://jacobs.perkspot.com
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
font
Referer
https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65
Connection
keep-alive
Origin
https://jacobs.perkspot.com
Referer
https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors *.perkspot.com
Last-Modified
Mon, 23 Aug 2021 21:29:01 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"94c88e46598d71:0"
X-Frame-Options
SAMEORIGIN
Content-Type
font/woff2
Date
Tue, 24 Aug 2021 15:49:02 GMT
Set-Cookie
TiPMix=93.5053863532401; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=1d5fb298951795712d54b2df0c89d185153c650eca2a3f79345b380a30442d23;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=1d5fb298951795712d54b2df0c89d185153c650eca2a3f79345b380a30442d23;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Accept-Ranges
bytes
Content-Length
28718
X-Content-Security-Policy
frame-ancestors *.perkspot.com
Cookie set fontawesome-webfont.woff2
jacobs.perkspot.com/Content/fonts/
69 KB
70 KB
Font
General
Full URL
https://jacobs.perkspot.com/Content/fonts/fontawesome-webfont.woff2?v=4.6.1
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/Content/css/core?v=21.8.28093.1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://jacobs.perkspot.com
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
font
Referer
https://jacobs.perkspot.com/Content/css/core?v=21.8.28093.1
Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65
Connection
keep-alive
Origin
https://jacobs.perkspot.com
Referer
https://jacobs.perkspot.com/Content/css/core?v=21.8.28093.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors *.perkspot.com
Last-Modified
Mon, 23 Aug 2021 21:29:01 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"b44141e46598d71:0"
X-Frame-Options
SAMEORIGIN
Content-Type
font/woff2
Date
Tue, 24 Aug 2021 15:49:02 GMT
Set-Cookie
TiPMix=91.3125797600078; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=e7e1969df33e17c68a9fbf7f7b0f85f7fdcbd40069a23b82adb55402439d750f;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=e7e1969df33e17c68a9fbf7f7b0f85f7fdcbd40069a23b82adb55402439d750f;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Accept-Ranges
bytes
Content-Length
70728
X-Content-Security-Policy
frame-ancestors *.perkspot.com
Cookie set 35A1AD_3_0.woff2
jacobs.perkspot.com/Content/fonts/
41 KB
42 KB
Font
General
Full URL
https://jacobs.perkspot.com/Content/fonts/35A1AD_3_0.woff2
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
255733aa26ecbe1a2608fc086d6b510fafce3647ad1ddf22392c390a1306e640
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://jacobs.perkspot.com
Accept-Encoding
gzip, deflate, br
Host
jacobs.perkspot.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
font
Referer
https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
Cookie
SessionHolder=5576372f-67b6-4255-ba2c-ca57e8d56c65; ps_sid=5576372f-67b6-4255-ba2c-ca57e8d56c65
Connection
keep-alive
Origin
https://jacobs.perkspot.com
Referer
https://jacobs.perkspot.com/Content/sass/perxcss.css?v=21.8.28093.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors *.perkspot.com
Last-Modified
Mon, 23 Aug 2021 21:29:01 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"d1d015e46598d71:0"
X-Frame-Options
SAMEORIGIN
Content-Type
font/woff2
Date
Tue, 24 Aug 2021 15:49:02 GMT
Set-Cookie
TiPMix=9.09527549943667; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure x-ms-routing-name=self; path=/; HttpOnly; Domain=jacobs.perkspot.com; Max-Age=3600; Secure ARRAffinity=316e9038b96fd8455073cce422b826e7e338b02a5edae98480ec66624c5d9125;Path=/;HttpOnly;Secure;Domain=jacobs.perkspot.com ARRAffinitySameSite=316e9038b96fd8455073cce422b826e7e338b02a5edae98480ec66624c5d9125;Path=/;HttpOnly;SameSite=None;Secure;Domain=jacobs.perkspot.com
Accept-Ranges
bytes
Content-Length
42010
X-Content-Security-Policy
frame-ancestors *.perkspot.com
ai.2.min.js
az416426.vo.msecnd.net/scripts/b/
118 KB
39 KB
Script
General
Full URL
https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/bundles/insights?v=BYC8KfJNNFadC6mBN8WA9SN_bH3bqkPFtSQg0hXgWI01
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F5B) /
Resource Hash
9052548b73711c81589b805f3ef741747fca42bb7c6760bd1ded1bddd5c7823c

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Aug 2021 15:49:02 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-07 00:07:47
content-md5
Er/k8oDkj+t0VHFKHxmzMw==
age
1174
x-cache
HIT
x-ms-meta-aijssdksrc
[cdn]/scripts/b/ai.2.6.5.min.js
content-length
39108
x-ms-lease-status
unlocked
last-modified
Mon, 09 Aug 2021 17:30:47 GMT
server
ECAcc (frc/8F5B)
x-ms-meta-aijssdkver
2.6.5
etag
0x8D95B5B6CA52C66
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
x-ms-request-id
0724ec12-101e-0004-6cfc-986572000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800, immutable, no-transform
x-ms-version
2009-09-19
expires
Tue, 24 Aug 2021 16:19:02 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=498008824&utmhn=jacobs.perkspot.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=...
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=660937558.1629820143&jid=2103738012&_v=5.7.2dc&z=498008824
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=660937558.1629820143&jid=2103738012&_v=5.7.2dc&z=498008824&slf_rd=1&random=2694769629
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=660937558.1629820143&jid=2103738012&_v=5.7.2dc&z=498008824&slf_rd=1&random=2694769629
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:02 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=660937558.1629820143&jid=2103738012&_v=5.7.2dc&z=498008824&slf_rd=1&random=2694769629
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/
128 KB
50 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-8J161FED5Z&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-578DK6
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d0f6bf2305f367f3f41e105e5a2ae6bba3a1a7b342da063e236d2522680ad523
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:02 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
51630
x-xss-protection
0
expires
Tue, 24 Aug 2021 15:49:02 GMT
conversion_async.js
www.googleadservices.com/pagead/
36 KB
14 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-578DK6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
cafe /
Resource Hash
1c3bd00be556bf95f92a2ab1119b8b26544a1997ab0c09f86490bc32339ad32e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13981
x-xss-protection
0
server
cafe
etag
6132654052448080839
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 24 Aug 2021 15:49:02 GMT
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-578DK6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 13 Jul 2021 18:24:06 GMT
server
Golfe2
age
2121
date
Tue, 24 Aug 2021 15:13:41 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19672
expires
Tue, 24 Aug 2021 17:13:41 GMT
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
890 B
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:01:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
2852
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Tue, 24 Aug 2021 16:01:30 GMT
collect
stats.g.doubleclick.net/j/
4 B
25 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-652375-6&cid=660937558.1629820143&jid=64754962&uid=23953415&gjid=1569671772&_gid=661655204.1629820143&_u=aSBCgAAjAAAAAE~&z=30899391
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 24 Aug 2021 15:49:02 GMT
content-type
text/plain
access-control-allow-origin
https://jacobs.perkspot.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
64 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j92&a=486039241&t=pageview&_s=1&dl=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&ul=en-us&de=UTF-8&dt=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=64858676.660937558.1629820143.1629820143.1629820143.1&_utmz=64858676.1629820143.1.1.utmcid%3Dweeklyblast%7Cutmccn%3D(not%2520set)%7Cutmcmd%3Demail&_utmht=1629820142950&_u=aSBCgAAj~&jid=64754962&gjid=1569671772&cid=660937558.1629820143&uid=23953415&tid=UA-652375-6&_gid=661655204.1629820143&gtm=2wg8n0578DK6&z=660866720
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 12:14:13 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
12889
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/978685899/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/978685899/?random=1629820142956&cv=9&fst=1629820142956&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg8n0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&tiba=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5143cdd9667ebdd0a8d068d11aade5a818924eb03c8c9381deea5c46a1603c38
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1112
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/g/
0
24 B
Ping
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-8J161FED5Z&gtm=2oe8n0&_p=486039241&sr=1600x1200&ul=en-us&cid=660937558.1629820143&_s=1&dl=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&dt=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&sid=1629820142&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8J161FED5Z&l=dataLayer&cx=c
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:02 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://jacobs.perkspot.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
70 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-652375-6&cid=660937558.1629820143&jid=64754962&_u=aSBCgAAjAAAAAE~&z=518163333
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-652375-6&cid=660937558.1629820143&jid=64754962&_u=aSBCgAAjAAAAAE~&z=518163333
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/978685899/
42 B
71 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/978685899/?random=1629820142956&cv=9&fst=1629817200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg8n0&sendb=1&frm=0&url=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&tiba=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&async=1&fmt=3&is_vtc=1&random=1341152332&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/978685899/
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/978685899/?random=1629820142956&cv=9&fst=1629817200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg8n0&sendb=1&frm=0&url=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&tiba=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&async=1&fmt=3&is_vtc=1&random=1341152332&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
b7051551-58d0-4a13-bb78-99d7da0d348a
https://jacobs.perkspot.com/
31 B
0
Other
General
Full URL
blob:https://jacobs.perkspot.com/b7051551-58d0-4a13-bb78-99d7da0d348a
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Length
31
Content-Type
application/javascript
SD+540p%2C+PerkSpot+Welcome+Video.mp4
psprods3ep.azureedge.net/cdn.perkspot.com/video/
3 MB
0
Media
General
Full URL
https://psprods3ep.azureedge.net/cdn.perkspot.com/video/SD+540p%2C+PerkSpot+Welcome+Video.mp4
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://jacobs.perkspot.com/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range
bytes=0-

Response headers

date
Tue, 24 Aug 2021 15:49:02 GMT
etag
"6db36f0719fb6eec8d73c45a6d5a9580"
last-modified
Fri, 29 Jan 2021 15:21:43 GMT
server
AmazonS3
x-amz-request-id
SQ3JVGWCTVTFND0T
x-amz-meta-cb-modifiedtime
Wed, 23 Dec 2020 12:28:12 GMT
x-azure-ref
07xQlYQAAAADpxggX+EoUTKG7tOAjV6L5RlJBRURHRTEwMTEANzA3ZDAxY2MtZTQ0NC00MTliLTg3NTktMDhjMjdlNDJkMjU2
x-cache
TCP_HIT
content-type
video/mp4
Content-Range
bytes 0-5324711/5324712
cache-control
public, max-age=172800
x-azure-ref-originshield
0+oskYQAAAAAsWVM61B2NTrVgqwKw5bCKTE9OMjFFREdFMTUwNwA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
accept-ranges
bytes
Content-Length
5324712
x-amz-id-2
N62zfBFc2JI9o5FuphGXEWI3cWN2z4n4SXUopr0hNRXvwHwAaW2/9wbGl9FNTdJCUUNZ0Lp8b8A=
asset_composer.js
static.zdassets.com/ekr/ Frame 24A4
Redirect Chain
  • https://assets.zendesk.com/embeddable_framework/main.js
  • https://static.zdassets.com/ekr/asset_composer.js
20 KB
6 KB
Script
General
Full URL
https://static.zdassets.com/ekr/asset_composer.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16cc547456ffa0052c3679e6c5ece2e14ad57c92b93562deb7bcb5829b7afcb7
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
VY26HSM6YSEZXBY5
x-amz-id-2
pwnUJJ9vS+VJLkJAIM/1QBVJ5FGdAzEWlm69LSz41CLquIaw4kgXJcSh/N73qd010d5JDfK4BF4=
last-modified
Wed, 09 Jun 2021 00:08:58 GMT
server
cloudflare
etag
W/"cc904f41324148b571599b3b02fdec0b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BxQLECkmVtV%2FGAFOcBNh1LhVwRIW9WdsQtkgZG88Apssx4WW2tZAJhRMzcICfMaIxi57u5KPj%2FrELcBc3BEjbXBu6U%2BVh0lODnDSB5P3a%2Fu%2B3VU6ap0I8JlULu358M4WuIlimNM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=3600, s-maxage=60
x-amz-version-id
K3SnbkxF6hLvuoHLDwjJyrnNVVhjkbLm
cf-ray
683dba78adc74c86-AMS

Redirect headers

date
Tue, 24 Aug 2021 15:49:03 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y9Zut4kUdoxk55GEP8SLPzayQTCvCXCL1LieSa675yNcM3oHLeh8Uo8uzdi8JW3PYZKcBA%2BIT9M6Bf8NHvlj9Tegrtj0rvKX4xDNrnhF5kddx9UQzcqp23MYCJvuCMjLEG28Rw%3D%3D"}],"group":"cf-nel","max_age":604800}
location
https://static.zdassets.com/ekr/asset_composer.js
cache-control
max-age=3600
strict-transport-security
max-age=0
cf-ray
683dba77be980bfd-AMS
expires
Tue, 24 Aug 2021 16:49:03 GMT
telemetry
heapanalytics.com/api/
37 B
258 B
Image
General
Full URL
https://heapanalytics.com/api/telemetry?a=1214792821&te=type&te=data&te=cm&te=eventPropertiesTelemetry%20-%20added%20new%20properties&te=val&te=2&st=1629820143282&hv=4.14.1
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.1.91.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-1-91-246.compute-1.amazonaws.com
Software
nginx /
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:03 GMT
server
nginx
etag
W/"25-PqzQEyMQ6kTK11azeKO8Bw"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length
37
h
heapanalytics.com/
37 B
258 B
Image
General
Full URL
https://heapanalytics.com/h?a=1214792821&u=5476589717111914&v=6778616115046566&s=4411673280647857&b=web&tv=4.0&z=0&h=%2Foffer%2F1420262%2Fnone&q=%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&d=jacobs.perkspot.com&t=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&um=email&k=CommunityId&k=196&k=StatusId&k=8&ts=1629820143373&st=1629820143377
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.1.91.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-1-91-246.compute-1.amazonaws.com
Software
nginx /
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:03 GMT
server
nginx
etag
W/"25-PqzQEyMQ6kTK11azeKO8Bw"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length
37
identify_v3
heapanalytics.com/api/
37 B
259 B
Image
General
Full URL
https://heapanalytics.com/api/identify_v3?a=1214792821&u=5476589717111914&v=6778616115046566&s=4411673280647857&i=23953415&b=web&tv=4.0&z=0&st=1629820143378
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.1.91.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-1-91-246.compute-1.amazonaws.com
Software
nginx /
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:03 GMT
server
nginx
etag
W/"25-PqzQEyMQ6kTK11azeKO8Bw"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length
37
add_user_properties_v3
heapanalytics.com/api/
37 B
258 B
Image
General
Full URL
https://heapanalytics.com/api/add_user_properties_v3?a=1214792821&u=5476589717111914&v=6778616115046566&s=4411673280647857&i=23953415&b=web&tv=4.0&_CommunityId=196&_StatusId=8&st=1629820143378
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.1.91.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-1-91-246.compute-1.amazonaws.com
Software
nginx /
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:03 GMT
server
nginx
etag
W/"25-PqzQEyMQ6kTK11azeKO8Bw"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length
37
SD+540p%2C+PerkSpot+Welcome+Video.mp4
psprods3ep.azureedge.net/cdn.perkspot.com/video/
64 KB
0
Media
General
Full URL
https://psprods3ep.azureedge.net/cdn.perkspot.com/video/SD+540p%2C+PerkSpot+Welcome+Video.mp4
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://jacobs.perkspot.com/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range
bytes=0-

Response headers

date
Tue, 24 Aug 2021 15:49:02 GMT
etag
"6db36f0719fb6eec8d73c45a6d5a9580"
last-modified
Fri, 29 Jan 2021 15:21:43 GMT
server
AmazonS3
x-amz-request-id
SQ3JVGWCTVTFND0T
x-amz-meta-cb-modifiedtime
Wed, 23 Dec 2020 12:28:12 GMT
x-azure-ref
07xQlYQAAAACCXyT/520tSao59IpCwLcCRlJBRURHRTEwMTEANzA3ZDAxY2MtZTQ0NC00MTliLTg3NTktMDhjMjdlNDJkMjU2
x-cache
TCP_HIT
content-type
video/mp4
Content-Range
bytes 0-5324711/5324712
cache-control
public, max-age=172800
x-azure-ref-originshield
0+oskYQAAAAAsWVM61B2NTrVgqwKw5bCKTE9OMjFFREdFMTUwNwA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
accept-ranges
bytes
Content-Length
5324712
x-amz-id-2
N62zfBFc2JI9o5FuphGXEWI3cWN2z4n4SXUopr0hNRXvwHwAaW2/9wbGl9FNTdJCUUNZ0Lp8b8A=
SD+540p%2C+PerkSpot+Welcome+Video.mp4
psprods3ep.azureedge.net/cdn.perkspot.com/video/
128 KB
0
Media
General
Full URL
https://psprods3ep.azureedge.net/cdn.perkspot.com/video/SD+540p%2C+PerkSpot+Welcome+Video.mp4
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://jacobs.perkspot.com/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range
bytes=3145728-

Response headers

date
Tue, 24 Aug 2021 15:49:03 GMT
etag
"6db36f0719fb6eec8d73c45a6d5a9580"
last-modified
Fri, 29 Jan 2021 15:21:43 GMT
server
AmazonS3
x-amz-request-id
SQ3JVGWCTVTFND0T
x-amz-meta-cb-modifiedtime
Wed, 23 Dec 2020 12:28:12 GMT
x-azure-ref
07xQlYQAAAADg0PGvra4/R7zxSFjuV8MkRlJBRURHRTEwMTEANzA3ZDAxY2MtZTQ0NC00MTliLTg3NTktMDhjMjdlNDJkMjU2
x-cache
TCP_HIT
content-type
video/mp4
Content-Range
bytes 3145728-5324711/5324712
cache-control
public, max-age=172800
x-azure-ref-originshield
0+oskYQAAAAAsWVM61B2NTrVgqwKw5bCKTE9OMjFFREdFMTUwNwA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
accept-ranges
bytes
Content-Length
2178984
x-amz-id-2
N62zfBFc2JI9o5FuphGXEWI3cWN2z4n4SXUopr0hNRXvwHwAaW2/9wbGl9FNTdJCUUNZ0Lp8b8A=
perkspot.zendesk.com
ekr.zdassets.com/compose/web_widget/ Frame 24A4
718 B
1 KB
XHR
General
Full URL
https://ekr.zdassets.com/compose/web_widget/perkspot.zendesk.com
Requested by
Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a825805da94e038e12f102f89e46f27ad9646d7ab7057753fb82786431ecc64e
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:03 GMT
content-encoding
br
vary
Origin, Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
30
status
200 OK
access-control-allow-methods
GET, POST, OPTIONS
strict-transport-security
max-age=0
x-request-id
97efd24c-b6c5-4285-a087-bf5328b31652
x-runtime
0.003613
server
cloudflare
etag
W/"a825805da94e038e12f102f89e46f27a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
7200
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kNEBN7OtDyvogeSN9WPYEbNYnGMZu%2F%2F5eNG4RM%2BhG%2BrLycuW1%2B2Km%2B2HZLyEnKifz6v5Nv2D%2By%2BmGzgp%2Bxv1AXh62akR0mmczVBS74Ihm8dM27Z64kt4ILsyZYsO2SDPIfw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
max-age=600, public, s-maxage=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray
683dba794b094242-AMS
web-widget-preload-d9d81488360f65d03f84.js
static.zdassets.com/web_widget/latest/ Frame 3FE7
88 KB
32 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Requested by
Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbb99457e56765ea4bea432267ab799598687f0a3cedf17ca67efb913ee9d9ec
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
397781
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
4Q3JEDADYY0YPQ6M
x-amz-id-2
4GcTnFjmyHh3ukA5HgP+mpHvxmHRUMbz5oX9lww43RO2u0TOj9KzlUuDAKyWmqJUz14i4TmrZ4s=
last-modified
Thu, 19 Aug 2021 06:56:54 GMT
server
cloudflare
etag
W/"344f0fe59e0f077ebeeeef03607601ac"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pu%2BGSBEFOT5IwO%2FQDpaCJYnBOYdJuOFrbrQLLl3u7r2G3tnMwOEfXm3LUCDvYzn%2BN07l%2B5Zq8OxDccoqaY9nsE6OjvZM2l3WCRtzQUmJZHgphL1hTmLVwqhK0kDmoFnQgI8bC%2BE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
57Ip39pR3YbL9FqP79r8Y7su0sTb6uxl
cf-ray
683dba798edd4c86-AMS
expires
Fri, 19 Aug 2022 06:56:53 GMT
web-widget-framework-97edc71e1362291b402d.js
static.zdassets.com/web_widget/latest/ Frame 3FE7
184 KB
59 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js
Requested by
Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eeaf2e313228f5fa957d5cf730e42df5cf45b7e2132a594d470576a88736a481
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
397781
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
4Q3VZ42PDHS8X1TT
x-amz-id-2
S2uEwZHGl+E6BzLxDC5n2Ea33S0aubhUaQxKIPVDmw2r+5eGV2GKZhSQ5p5RWMX17kKg+U4xJSU=
last-modified
Thu, 19 Aug 2021 06:56:54 GMT
server
cloudflare
etag
W/"e374a6019f706d78fc0110673a8149b4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8FRPv3HwSPwH0Uw5pR9LX7Yr7j%2F5888upl9ji6DMneNPclWO9FBeljPIBlrLOPkSxGIFrF8kXmdvqamtoWg1bdXxYf6E4tSqAafAwbZ2VxuMt7uVCO0V%2FMD1Fs0Kh%2FKaPLrZJ%2BE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
Wk53zNM1BfAU488Z5dqm0HEqnFW4uGAe
cf-ray
683dba798ede4c86-AMS
expires
Fri, 19 Aug 2022 06:56:53 GMT
web-widget-chat-sdk-ad0bca0cd862985f164f.js
static.zdassets.com/web_widget/latest/ Frame 3FE7
203 KB
52 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-chat-sdk-ad0bca0cd862985f164f.js
Requested by
Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a77ebced88a45b7146f3e8b0359f37d658f0f6e0eb481583ee9319cb601d893
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3078293
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
31A3BAY1ZH9GD1BV
x-amz-id-2
tfFkqroZKroq+pqLI+M3idv/nOENLrOjrlitzrzbLnFwRXLmuGoNzapA4k4INMPdjWyRcioA/K8=
last-modified
Mon, 19 Jul 2021 02:04:04 GMT
server
cloudflare
etag
W/"093f405bc41723c43486a657a0e1a173"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F0bpPU9SfNrdEtHGWAKtIFVuZZfjXDs8RSC0J92qqk1auaTmHC%2FbUzJHx6s2fgTJgmxVqG2GjF0sOx9doVZKdIx7Q7P4UBUD4kJqODoLa4H8%2Bkeu6Y0E6WhDCUOddLWWkGysrW0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
6nLy1oZDiI0GDEsA2cGfRKjp8Mm1fRS8
cf-ray
683dba798edf4c86-AMS
expires
Tue, 19 Jul 2022 02:04:03 GMT
web-widget-talk-sdk-5e847fafdc66ec0a9823.js
static.zdassets.com/web_widget/latest/ Frame 3FE7
69 KB
19 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-talk-sdk-5e847fafdc66ec0a9823.js
Requested by
Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f16b41c0ac3d3c2b732a3c136d94a34ccaef99f0d8cce5f3ef244b78c03e036
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3078295
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
R064DQSZ403AP051
x-amz-id-2
R5ertjBhTM/j6o/rN9MgeARg9Gwrs6A+ju3/SuSEZgkScn8eOrrlbL/FtAhr5HM3IMnEYptAM6Q=
last-modified
Mon, 19 Jul 2021 02:04:04 GMT
server
cloudflare
etag
W/"d4b8963176acde642459d5c5c574e025"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=StHznxUreY12Id%2BlnM36f71YEH9GIzDhP99SVXTdjdqIhqOAzIfyKUwEb6bTXaGHaV%2F0axCj3Z3%2FjG2OtB3V27aPyUrLfB3lHgkYkOd42OCWKfniPQbI9WHNt8OggJiAHBk%2FsTk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
bUjsjS7lefrgeymz3edNwHG1NF59pyb1
cf-ray
683dba798ee14c86-AMS
expires
Tue, 19 Jul 2022 02:04:03 GMT
config
perkspot.zendesk.com/embeddable/ Frame 24A4
767 B
1 KB
XHR
General
Full URL
https://perkspot.zendesk.com/embeddable/config
Requested by
Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
89d2b04a6542b3cfa82cce050c54aa0039de047b27072f7c1dc1b9b82ab2e5a8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://jacobs.perkspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:04 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-zendesk-zorg
yes
x-zendesk-origin-server
embeddable-app-server-69746d8d9-p8d2f
access-control-allow-methods
GET
vary
Origin, Accept-Encoding
x-cached
MISS
x-request-id
683dba7a38e3f3ff-LHR, 683dba7a38e3f3ff-LHR
x-runtime
0.001499
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
1728000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HnQlW0b5MEOrGwSkDUgXGKGuKLxdIXi6acr4IU3pEpxRljlNdEt88ClwhHSwaQxBVR75NhJFGg1iZkWrBnplRBhQ%2BxAptcqMdykQgca5aaJio8xBdtOudZw0cZSkZRS%2Bs0oXBcSV"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
public, max-age=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray
683dba7a38e3f3ff-LHR
track
dc.services.visualstudio.com/v2/ Frame
0
0
Preflight
General
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Server
13.69.106.216 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,sdk-context
Origin
https://jacobs.perkspot.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-methods
POST
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin
*
access-control-max-age
3600
x-content-type-options
nosniff
date
Tue, 24 Aug 2021 15:49:02 GMT
content-length
0
track
dc.services.visualstudio.com/v2/
96 B
235 B
XHR
General
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.216 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
bbf7c43612543660ff95df57151eeca1a83e4dc59ff40df67fde5c3e20d7b71f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://jacobs.perkspot.com/
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
46511CE2-1213-49E8-B0B1-DE43295E530A
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
date
Tue, 24 Aug 2021 15:49:04 GMT
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
content-length
96
en-us-json-c92f040571c86c5604a4.js
static.zdassets.com/web_widget/latest/web-widget-locales/ Frame 3FE7
33 KB
7 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-locales/en-us-json-c92f040571c86c5604a4.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6eb4e5bf06118c495126b1cf6f5f370f94bc7651c6525d6c606877170afbf53a
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:04 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
738501
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
0TBV60A79Z96NHFA
x-amz-id-2
nmsb3c7vCzxhDfkxWWx0UqPrGt9Ibcee3mnut3akBqyyz7Vljdn5Esz75cUqy1/6V2OaALxHsZg=
last-modified
Fri, 13 Aug 2021 00:23:14 GMT
server
cloudflare
etag
W/"38e7cc9c495c12720eec3517509bd5e3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XAqB%2F7scwyo%2F1wXXP4Sjs%2BGHwg2X2TV3ROaRK5Z0qIm6VrHMzpvrYcOXT6Ud7KnHl7L3m9B9SHWZDgwowMwwWzKsI3Kbv6DTGzuYrqXt%2Bd%2F4c1MLnsvFO%2F2jDlOWVdIx5sTPAuE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
nxyhPh39LbwqesfRpjKXUZuzYoFcnoU5
cf-ray
683dba7e9ee34c86-AMS
expires
Sat, 13 Aug 2022 00:23:13 GMT
web-widget-218-a0e6bddf78f556c0ba98.js
static.zdassets.com/web_widget/latest/ Frame 3FE7
330 KB
100 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-218-a0e6bddf78f556c0ba98.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9dcaeb939318effbb2db3a742e54dba4b1d31e84858207fb43b75a4b6a576dd7
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:04 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1291447
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
NMMVGY97EERBT9S0
x-amz-id-2
yEYoF4CZYjClgh5qy89ifZQokaoi3D/qINbwHHlxPlRqrHZsOv+e9iMxDa720RZb7GemgmHLX3Y=
last-modified
Mon, 09 Aug 2021 15:03:50 GMT
server
cloudflare
etag
W/"d270a189c9839f5d9d7f3e49bbeae2d8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IuKD69%2BpcjWoCVHR4bMJEulqSkE%2FGneKAhLbrEx5VlKNRSNUP56%2BY1j%2FYFlDy6WPvJrWJX0Q%2BD6oLj69v5dWb0B%2B74PUIonBlqguy06QkjaNGst0iVbJZ4s9YYm%2BzLk%2BLUL3xRk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
3sjv5e8lvY6f4Mm3flRDrq1MhhcZeVSU
cf-ray
683dba7e9ee84c86-AMS
expires
Tue, 09 Aug 2022 15:03:49 GMT
web-widget-9829-5f3c12ec148288f64210.js
static.zdassets.com/web_widget/latest/ Frame 3FE7
91 KB
25 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-9829-5f3c12ec148288f64210.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0987ab417187ff28db7f13e2ba5a66623e2b2cc83ba11308c8735df9a9db2792
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:04 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
738501
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
0TBS30EW49BDBRCH
x-amz-id-2
iDatlsCNBJN8nIaPicGQQ6pq0JwTtFoqW3HGYnfv7bIPfxwXqnL8iRXm7mr01+gjJVm43b5waSs=
last-modified
Fri, 13 Aug 2021 00:23:50 GMT
server
cloudflare
etag
W/"c416333951b19b5a604bb7f65785650e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jjsw6ZlY1%2BgqfEzDXYlXFJMzv4N0GOyuudGE2ZyRu9VWGowIK98Z49maT0g%2FDjBChLiRs%2F0rsroEMXCnxpZGdaqO6HyBr%2F1QTkRrD1RikdF%2FvbJ%2F2JM08rk4ppzkuQaCKN%2F7nOI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
49ot3h21npFAkxmz5L51VOsC2.m1cZtL
cf-ray
683dba7e9eec4c86-AMS
expires
Sat, 13 Aug 2022 00:23:49 GMT
web_widget-0eb90e308aa2a8387460.js
static.zdassets.com/web_widget/latest/web-widget-lazy/ Frame 3FE7
417 KB
89 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-lazy/web_widget-0eb90e308aa2a8387460.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eccbf3fae72a87817cd2d39cca489de2c2d9f73b130d223882a1c36b88919da0
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:04 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
397782
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
4Q3PJANJ74DCJSP8
x-amz-id-2
rJAlNUnAKoWbvjG2rA8uHKnOF1igvPVlukSSDMgbr82cfxCprmheqMA5RqzaThCFfNLMpAmLHa4=
last-modified
Thu, 19 Aug 2021 06:55:13 GMT
server
cloudflare
etag
W/"9fb8b7e9cc7e6cea49362f07cb92834c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F6nDuzrbk7wXii4YXKN9yM0IMVI5Kr%2FLdLc2cvCuVbjCfOP5yENbHJ6B7sKD2i4FLJWD7ffKRz%2F4OgVzWLeimwzDKDjgruhC0cO2G%2BTrruGnDVtthyzMhpKJRybUXvSTkizWfyo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
ZZZrJnthwO1ZQ_GxukaRr7aoxAPsnxhT
cf-ray
683dba7e9eed4c86-AMS
expires
Fri, 19 Aug 2022 06:55:12 GMT
embeddable_blip
perkspot.zendesk.com/ Frame 3FE7
0
280 B
XHR
General
Full URL
https://perkspot.zendesk.com/embeddable_blip?type=settings&data=eyJzZXR0aW5ncyI6eyJ3ZWJXaWRnZXQiOnsib2Zmc2V0Ijp7Imhvcml6b250YWwiOiI1cHgiLCJ2ZXJ0aWNhbCI6IjVweCIsIm1vYmlsZSI6eyJob3Jpem9udGFsIjoiNXB4IiwidmVydGljYWwiOiI1cHgifX0sInpJbmRleCI6MTk5OX19LCJidWlkIjoiNDdjNjRlNDM5ODFhZjY1YTYwODM5N2M3OTI4MWI3MTIiLCJzdWlkIjoiNDRkMTk2ZGQyNGFkZTZlMmIxMjRjZmJjODE5MWQ3MzgiLCJ2ZXJzaW9uIjoiMGJkNjBhYjZkIiwidGltZXN0YW1wIjoiMjAyMS0wOC0yNFQxNTo0OTowNC41MzBaIiwidXJsIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tIn0%3D
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:04 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-zendesk-zorg
yes
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BWhVPvQdJPdOsCDl4kJhkY9FE5fMfKWJ3Cxjj8Q4VM8qTbdj%2B1gm1xRC9tLXvWG7sDVGmrEK2sohbrl1Q9Xx4co%2BXsJQVD6zd2TJqghxsIMUuta3w2CkFngsLip7m3rAnVqTKoHr"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://jacobs.perkspot.com
accept-ranges
bytes
cf-ray
683dba7f584cf3ff-LHR
vary
Accept-Encoding
content-length
0
x-request-id
ad00b514ba4bf0e22cd73f6adadbe931
embeddable_blip
perkspot.zendesk.com/ Frame 3FE7
0
325 B
XHR
General
Full URL
https://perkspot.zendesk.com/embeddable_blip?type=pageView&data=eyJjaGFubmVsIjoid2ViX3dpZGdldCIsInBhZ2VWaWV3Ijp7InJlZmVycmVyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tIiwidGltZSI6MjcsImxvYWRUaW1lIjpudWxsLCJuYXZpZ2F0b3JMYW5ndWFnZSI6ImVuLVVTIiwicGFnZVRpdGxlIjoiWW91J3JlIG9uIHlvdXIgd2F5IHRvIHNhdmluZyBhdCBGaXJzdGxlYWYgV2luZSBDbHViIHwgSmFjb2JzIEVtcGxveWVlIERpc2NvdW50IFByb2dyYW0iLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjE1OSBTYWZhcmkvNTM3LjM2IiwiaXNNb2JpbGUiOmZhbHNlLCJpc1Jlc3BvbnNpdmUiOnRydWUsInZpZXdwb3J0TWV0YSI6IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xIiwiaGVscENlbnRlckRlZHVwIjpmYWxzZX0sImJ1aWQiOiI2YWZmZmEzOGM0N2Y4MGI3NWZhMmU5YmE5MGRmNGRjNyIsInN1aWQiOiI4Mzk5ZmJiZDMzMmU2MzU2YWMyYmE0NzU4NmE4OWU5MCIsInZlcnNpb24iOiIwYmQ2MGFiNmQiLCJ0aW1lc3RhbXAiOiIyMDIxLTA4LTI0VDE1OjQ5OjA0LjU1MVoiLCJ1cmwiOiJodHRwczovL2phY29icy5wZXJrc3BvdC5jb20ifQ%3D%3D
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:04 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-zendesk-zorg
yes
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aMx6fSzAxG3DUdSh44EpZN4oY5kmDmDzQFIlornKd0w%2Bieq4aMEkE794KAyIoGeOmvypF9yHJSgN4EcO5Znt0mWd%2F3Y0x%2BcpV9Wxj8eH8zgtZ5wWqYqTpU7iAQxkxnQziH8Q6IUm"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://jacobs.perkspot.com
accept-ranges
bytes
cf-ray
683dba7f7883f3ff-LHR
vary
Accept-Encoding
content-length
0
x-request-id
720d90a64fb802d4ef5250734716b3cf
web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js
static.zdassets.com/web_widget/latest/ Frame 3FE7
337 B
928 B
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3a3ab89bc8d4feb680748ba773ff13a07c2db610c1308ec9c12040aa9b65d46b
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:04 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3078299
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
R0EMPM7SV24WKMWR
x-amz-id-2
aWz5ad5XM0iHyU++SxDxGYjYuW1Z0JSzwBoxQMyjMvXiyFhtmx5owXFlv1YsrrZfAiWHdGssAI4=
last-modified
Mon, 19 Jul 2021 02:04:04 GMT
server
cloudflare
etag
W/"200371227ff3b0fb85badb2d2faef3b5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yOJXfPUh6lmyCCR5GSyXVkTmdpHLWxMwm7Z%2BHwAoeF3aSeONc9Ck8u9oeHbYJnUQEsezqmZum4GCfHqUxYshb64qgCeTXVBn3TE%2FTF4h46TdKTi42G7KEVhQhs%2F4XjMiNwF6FK0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
___O_wFiyDX4A56Xq4fDhtClHpW0qk0i
cf-ray
683dba814a7b4c86-AMS
expires
Tue, 19 Jul 2022 02:04:03 GMT
fda6cd35495c75f83508d9d2e77ee33d.mp3
static.zdassets.com/web_widget/latest/ Frame 3FE7
19 KB
20 KB
Media
General
Full URL
https://static.zdassets.com/web_widget/latest/fda6cd35495c75f83508d9d2e77ee33d.mp3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
97e5b0b6cfc2ba9815028429c069631ba12b294aa7419d1ea130accd0adc2d46
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range
bytes=0-

Response headers

date
Tue, 24 Aug 2021 15:49:04 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
XMVGH60YD25GE5S6
x-amz-server-side-encryption
AES256
cf-ray
683dba816ab24c86-AMS
Content-Range
bytes 0-19697/19698
x-amz-replication-status
COMPLETED
Content-Length
19698
x-amz-id-2
d74IC9IzBlPQvNPQcr18Gg5vfZrDjPukSfob0KMfiCTloUSFonL2zBc8bOL1IlQmP9bT704w75w=
last-modified
Mon, 23 Aug 2021 23:28:35 GMT
server
cloudflare
etag
"f11ce9e8f40a392830217253fe75d6de"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aT9ZZfBycbZbBo0Zcd%2FhSeX4ibWKvUhLG3u3kHOkPqtn8Hrv5Y1Zpyqbo1cG2PHdrpycxO9xPtNVSUyGdHaspkK8lOWESL2PEnJ6q1VqDNmNedm5Ux7cJGKeRuBT9nuiH1VJ33g%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
O7Ps8bp437FYfPdbGZPcf1VBhcf9ZiJE
cache-control
public, max-age=31536000
accept-ranges
bytes
content-type
audio/mpeg; charset=utf-8
expires
Tue, 23 Aug 2022 23:28:34 GMT
Primary Request quiz
page.firstleaf.club/
Redirect Chain
  • https://www.anrdoezrs.net/click-2097062-13552845?&sid=PEJ3Q6TIIVT5BHL32
  • https://cj.dotomi.com/5a100mu21K/u05/JLNNKQMN/KIRPIOK/I/I/I?j=v5vq%3DcRWGdJgVVigIOUYGF%3c%3cu6625%3A%2F%2F999.n04q1rC45.0r6%3ALD%2Fpyvpx-FDMKDJF-EGIIFLHI%3c%3cT%3cu6625%3A%2F%2Fwnp1o5.2r4x5216.p1z%...
  • https://www.emjcd.com/87117gv32N/v16/KMOOLRNO/LJSQJPL/J/NJJNJNLROKKQLOLMLK:LnHTem02WPfp/vyxyPNQyJNyLKKxvRJQOJMLvJtKRJOJy?i=u4up%3DbQVFcIfUUhfHNTXFE%3cov0!9E1B-5xx2zD5m%3ct5514%3A%2F%2F888.mz3p0qB34...
  • https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shi...
146 KB
20 KB
Document
General
Full URL
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d5345db796d43e4a5c561a4c5d99d9c06a73709b0b47e1f580b6d315f1c9212
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
GET
:authority
page.firstleaf.club
:scheme
https
:path
/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://jacobs.perkspot.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
content-type
text/html; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 google, 1.1 google
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
683dba887dcb5b44-FRA
content-encoding
br

Redirect headers

Server
Server
Set-Cookie
S=400404285117252321:2UzALTikD6MW; Max-Age=34041593; Domain=.emjcd.com; Path=/; Secure; SameSite=None LCLK=cjo!x2pz-tllqn1ta; Max-Age=34041593; Domain=.emjcd.com; Path=/; Secure; SameSite=None CJSession=0f34026a-987a-44df-8342-2a036fef6896; Max-Age=-1; Domain=.emjcd.com; Path=/; Secure; SameSite=None S=400404285117252321:2UzALTikD6MW; Max-Age=34041593; Domain=.emjcd.com; Path=/; Secure; SameSite=None
P3P
policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
Cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Expires
Tue, 24 Aug 2021 15:49:05 GMT
Location
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Content-Type
text/html; charset=UTF-8
Connection
close
Transfer-Encoding
chunked
Date
Tue, 24 Aug 2021 15:49:05 GMT
collect
www.google-analytics.com/g/
0
0

utils.4307b753f6f392018c32.js
g.fastcdn.co/js/
47 KB
16 KB
Script
General
Full URL
https://g.fastcdn.co/js/utils.4307b753f6f392018c32.js
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.137.202 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
202.137.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
b96b4f9b3146047939f342700eb43b54b7ab687d070048efa199320fc250844e

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 14:53:14 GMT
content-encoding
gzip
age
1040152
x-guploader-uploadid
ADPycdst0w66MIo0YtmNj1tyU-NPs3L7C8XpLM7RWWws04AVopLZGb_Xd3x07cm0OPd13uYZ1nlWz3SaYuUROR1Stp_SIKSWzA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
16045
last-modified
Wed, 11 Aug 2021 22:41:27 GMT
server
UploadServer
etag
"3041b91068c7b521817389d49ee88aa6"
vary
Accept-Encoding
x-goog-hash
crc32c=DMZQJg==, md5=MEG5EGjHtSGBc4nUnuiKpg==
x-goog-generation
1628721687684722
cache-control
public, max-age=31536000
x-goog-stored-content-length
16045
accept-ranges
bytes
content-type
application/javascript
expires
Fri, 12 Aug 2022 14:53:14 GMT
Cradle.4dac59f2328b0387640d.js
g.fastcdn.co/js/
20 KB
6 KB
Script
General
Full URL
https://g.fastcdn.co/js/Cradle.4dac59f2328b0387640d.js
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.137.202 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
202.137.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
871a395274807a496ca51c603b7320eca9fc11a7949c0df992be96f29dcb7211

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 15 Aug 2021 20:30:08 GMT
content-encoding
gzip
age
760738
x-guploader-uploadid
ADPycdtOYIPCXqVe5cno0XL-ycQ1apRUIzFVTH67-pMZ7ra5OpPwcTdsrUCDNDnLTtZOKMD-BrcNj_1j2KQh0-GVLXmQhO2UOg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
5581
last-modified
Sun, 15 Aug 2021 09:35:26 GMT
server
UploadServer
etag
"e65424f8c2aaa7264ae3eaf852934882"
vary
Accept-Encoding
x-goog-hash
crc32c=MHgq+w==, md5=5lQk+MKqpyZK4+r4UpNIgg==
x-goog-generation
1629020126781791
cache-control
public, max-age=31536000
x-goog-stored-content-length
5581
accept-ranges
bytes
content-type
application/javascript
expires
Mon, 15 Aug 2022 20:30:08 GMT
LazyImage.b311ea858a228d7bc9b2.js
g.fastcdn.co/js/
3 KB
2 KB
Script
General
Full URL
https://g.fastcdn.co/js/LazyImage.b311ea858a228d7bc9b2.js
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.137.202 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
202.137.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
7e7c84efcf8e336f390d7a51a24cba3873782769b33470b31d2cef95b2f01cee

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 03 Aug 2021 13:19:18 GMT
content-encoding
gzip
age
1823388
x-guploader-uploadid
ADPycdt10aDJ89G8DzHpACOtP5EitKGqzIb7MjUC-pO6RE1T9Tyn3G3uiqpcuHIwNnNDMGG2FO0q-RIFMabpaWjQHhhPVaPFAA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
1563
last-modified
Tue, 03 Aug 2021 10:57:50 GMT
server
UploadServer
etag
"4fada7192ed3976ed69f137f5aaeab12"
vary
Accept-Encoding
x-goog-hash
crc32c=FGzgaA==, md5=T62nGS7Tl27WnxN/Wq6rEg==
x-goog-generation
1627988269950468
cache-control
public, max-age=31536000
x-goog-stored-content-length
1563
accept-ranges
bytes
content-type
application/javascript
expires
Wed, 03 Aug 2022 13:19:18 GMT
css
fonts.googleapis.com/
3 KB
678 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Montserrat:400,700
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
162a3eebb385684e99a8b624b77189f9b5c38cb51d1b814c1c3a84fc17c324a7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 24 Aug 2021 14:59:48 GMT
server
ESF
date
Tue, 24 Aug 2021 15:49:06 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 24 Aug 2021 15:49:06 GMT
gtm.js
www.googletagmanager.com/
253 KB
72 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a6238c15d9a3deae4e52b398e99b7e9b1dc9ac26ffd6604baa8a9640c3a459c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
73252
x-xss-protection
0
last-modified
Tue, 24 Aug 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 24 Aug 2021 15:49:06 GMT
LegacyVendors.d341954906ae69acee39.js
g.fastcdn.co/js/
95 KB
33 KB
Script
General
Full URL
https://g.fastcdn.co/js/LegacyVendors.d341954906ae69acee39.js
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.137.202 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
202.137.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
95bdb8a3cd90e91621c9e68d4b157dd7fedab021ee89e9e173d17f93f0f03305

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 21 Aug 2021 21:08:10 GMT
content-encoding
gzip
age
240056
x-guploader-uploadid
ADPycdtmYB88AAFpc8_vtUx64816kwxxt2nN0MKk3CDdyOmalJXdO0uG-KMaEFURsuB6VwpBe8yQUAn3WDhxOd0ufzFMztQstA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
33710
last-modified
Sun, 15 Aug 2021 09:35:27 GMT
server
UploadServer
etag
"fc551ad7e347bf019785e719fab1ba31"
vary
Accept-Encoding
x-goog-hash
crc32c=MgUolg==, md5=/FUa1+NHvwGXhecZ+rG6MQ==
x-goog-generation
1626975713677005
cache-control
public, max-age=31536000
x-goog-stored-content-length
33710
accept-ranges
bytes
content-type
application/javascript
expires
Sun, 21 Aug 2022 21:08:10 GMT
caslon.css
d1hdjv7b05hja2.cloudfront.net/fonts/
2 KB
1 KB
Stylesheet
General
Full URL
https://d1hdjv7b05hja2.cloudfront.net/fonts/caslon.css
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:e600:b:dc44:3680:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c77d5979a9eb0e45bd243053b0724ea63b2d3381a0b43a3ec80ad58df66cf781

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 19 Aug 2021 09:22:40 GMT
content-encoding
gzip
last-modified
Tue, 10 Oct 2017 18:11:11 GMT
server
AmazonS3
age
455187
etag
W/"b57f1c931d356c98dde8a5d98c98605d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 b83a899c16a2f53127e152fe5fc783a4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
z1f7tej_alvOL-hzWssDwcGIVC2emQ_ZwM7oUry1EBmT80ysuo-91Q==
007ADF49EA9D333D0.css
www.firstleaf.club/fonts/687751/
Redirect Chain
  • https://cloud.typography.com/7410416/6307592/css/fonts.css
  • https://www.firstleaf.club/fonts/687751/007ADF49EA9D333D0.css
250 KB
186 KB
Stylesheet
General
Full URL
https://www.firstleaf.club/fonts/687751/007ADF49EA9D333D0.css
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7160bf300aedb0d16945e3ee5e15851ac0f21c571e2d4632e121eb6f1ab1d9aa

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
via
1.1 debe291145dc27044f50d04bac101cd9.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
455529
cf-polished
origSize=257416
x-cache
Hit from cloudfront
content-encoding
br
last-modified
Mon, 28 Oct 2019 20:45:31 GMT
server
cloudflare
etag
W/"07e30349aeb157501123c221264ec810"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000, immutable
x-amz-cf-pop
FRA2-C2
cf-ray
683dba903b355b44-FRA
x-amz-cf-id
_lCEIUFytqQfOFB124RPL8LzXf6VFeASasU-eYwrbkU6SkQXDurD9A==
cf-bgj
minify

Redirect headers

Date
Tue, 24 Aug 2021 15:49:07 GMT
Last-Modified
Fri, 21 Sep 2018 14:37:41 GMT
Server
AkamaiNetStorage
ETag
"a71d9ac9ba4b6206174d8d4e5688ba41:1537540658"
Content-Type
text/html
Location
https://www.firstleaf.club/fonts/687751/007ADF49EA9D333D0.css
Cache-Control
must-revalidate, private
Connection
keep-alive
X-HCo-pid
16
Content-Length
154
Expires
Tue, 24 August 2021 15:49:06 GMT
api.js
page.firstleaf.club/cdn-cgi/bm/cv/669835187/
35 KB
9 KB
Script
General
Full URL
https://page.firstleaf.club/cdn-cgi/bm/cv/669835187/api.js
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/cdn-cgi/bm/cv/669835187/api.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
page.firstleaf.club
referer
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=604800, public
cf-ray
683dba89f8995b44-FRA
54813432-0-arrow-white.png
v.fastcdn.co/u/814df80e/
636 B
1 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/54813432-0-arrow-white.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6712) /
Resource Hash
e4ebb4fc0904aae6b08aaa40be3f5d6d1bc00794ef5f3bb0d608b3e2428f4ec4

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
x-goog-stored-content-length
636
age
11875091
x-guploader-uploadid
ABg5-Uw6OAkNnfczOOTrevJpPzo7Uh7HHsurjL3Pra2oYiPu26K02kJnBjM9VfcVrONCRjxZ8k03_DRGEUFIyV0CAFdPgwyv_g
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Sun, 06 Feb 2022 06:12:49 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
636
last-modified
Wed, 16 Dec 2020 14:12:49 GMT
server
ECS (frb/6712)
etag
"9b3ce0934e7db12b851b49e29a3e07f5"
x-goog-hash
crc32c=/4dFFw==, md5=mzzgk059sSuFG0nimj4H9Q==
content-type
image/png
x-goog-generation
1608127969121144
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:06 GMT
23347456-0-FL-Logotype-Purple.png
v.fastcdn.co/u/814df80e/
17 KB
17 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/23347456-0-FL-Logotype-Purple.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6713) /
Resource Hash
9fd678871d5c502175e5233f33bb7c2cb09eda96eebfa139f527b72683f8b92b

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
x-goog-stored-content-length
17202
age
11875091
x-guploader-uploadid
ABg5-Uxvy_IMg5flLVuEqZUMBQG-RNlkbwlE1A3w6NclD7lzBNwvuEOBdWENizspp1x8A3KWR_OB5lW_iKAGQi0Y7KY
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Fri, 07 Dec 2018 11:23:21 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17202
last-modified
Mon, 16 Oct 2017 19:23:22 GMT
server
ECS (frb/6713)
etag
"91be8ccb9b70cd700493193ba595a315"
x-goog-hash
crc32c=Gxw+uA==, md5=kb6My5twzXAEkxk7pZWjFQ==
content-type
image/png
x-goog-generation
1508181802058066
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:06 GMT
57204196-0-business-insider.png
v.fastcdn.co/u/814df80e/
28 KB
29 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/57204196-0-business-insider.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/673A) /
Resource Hash
c151d0f1c12c1ca6dc262f901b62a2e595d7da89411a6a43101d869f015d666e

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
x-goog-stored-content-length
29171
age
4840597
x-guploader-uploadid
ADPycdvc1ozm4w6PXTXidQKrrz2_5dThhRru3-G-Yx8_IqhkOZpxZN16aLYbWrY_LpzhY0nig4hkeGiB4ZHp3uZJF3BfahyN1g
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Tue, 05 Jul 2022 09:05:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29171
last-modified
Fri, 14 May 2021 17:05:09 GMT
server
ECS (frb/673A)
etag
"5216af290f0c54de89ea433971372a83"
x-goog-hash
crc32c=SmLmag==, md5=UhavKQ8MVN6J6kM5cTcqgw==
content-type
image/png
x-goog-generation
1621011909303979
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:06 GMT
57204191-0-vogue.png
v.fastcdn.co/u/814df80e/
17 KB
18 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/57204191-0-vogue.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/673A) /
Resource Hash
5f9fdb61e50cacfa4aeb8191d50c647ce1507ab13801d8848d4d00be1ad6bf1d

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
x-goog-stored-content-length
17875
age
4663998
x-guploader-uploadid
ADPycdvmCFfc3ip1qxcy3bvoK6m72JR09TvemuIojMW-J2rePWSVHTCP81C1sBOhXBWkEH_nBCUXKIaBFBheEwOaafk
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Tue, 05 Jul 2022 09:05:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17875
last-modified
Fri, 14 May 2021 17:05:09 GMT
server
ECS (frb/673A)
etag
"3432492be420658e97b2ba4ceb1eea7c"
x-goog-hash
crc32c=u8wyRA==, md5=NDJJK+QgZY6XsrpM6x7qfA==
content-type
image/png
x-goog-generation
1621011909066491
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:06 GMT
57204171-0-gq.png
v.fastcdn.co/u/814df80e/
9 KB
9 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/57204171-0-gq.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668B) /
Resource Hash
bafaf035161ee03b515d06003c1c5559b047e4ab9f72302843850618740482a8

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
x-goog-stored-content-length
9386
age
4840607
x-guploader-uploadid
ADPycds3PVM9eNW2jbwEtst518amu9kX0elGSMbp8DkzQjSjwQ9-vqrsh2wCGsiCkevNsVUvglkRhGHKMZrgS3FvTlg
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Tue, 05 Jul 2022 09:05:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9386
last-modified
Fri, 14 May 2021 17:05:09 GMT
server
ECS (frb/668B)
etag
"7f99b37bf6bdc29c1a9ee3e816ceb3d5"
x-goog-hash
crc32c=t04dTA==, md5=f5mze/a9wpwanuPoFs6z1Q==
content-type
image/png
x-goog-generation
1621011908989260
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:06 GMT
57204206-0-delish.png
v.fastcdn.co/u/814df80e/
17 KB
17 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/57204206-0-delish.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D3) /
Resource Hash
db398ae2a6bcdac2506e0b532026b62c4058013a757d28b613a1188de22a066b

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
x-goog-stored-content-length
16921
age
4840596
x-guploader-uploadid
ADPycdstH3_HghGhRrKrA53HwMA5itZfJqQVHoSULmzK321qekjJxKewFYqPr4Ss8FjUVxM2cTpfioUGHYadrGK6hw
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Tue, 05 Jul 2022 09:05:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16921
last-modified
Fri, 14 May 2021 17:05:09 GMT
server
ECS (frb/67D3)
etag
"1ce57fe4062960f2d21bdf90690e69d2"
x-goog-hash
crc32c=q9l9Rw==, md5=HOV/5AYpYPLSG9+QaQ5p0g==
content-type
image/png
x-goog-generation
1621011909228430
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:06 GMT
57204176-0-et.png
v.fastcdn.co/u/814df80e/
4 KB
5 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/57204176-0-et.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6711) /
Resource Hash
1a764c2e4e6cc6808b49bff5d27d1db28790d291c525f3849e12fc492fb62076

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
x-goog-stored-content-length
4423
age
8803095
x-guploader-uploadid
ABg5-UztS6QC8lMfTTnrzCyO3g_IcoLxENBxETtvLJblL8gyqk_8IvQmkDecYkCltIKCoxfgk-b1VXfUXrknZPIcmQ
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Tue, 05 Jul 2022 09:05:08 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4423
last-modified
Fri, 14 May 2021 17:05:09 GMT
server
ECS (frb/6711)
etag
"bfc4ce6c42752f3d3616129a3b786dcf"
x-goog-hash
crc32c=cEXsAQ==, md5=v8TObEJ1Lz02FhKaO3htzw==
content-type
image/png
x-goog-generation
1621011909008666
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:06 GMT
56646297-0-Small-D2-1.png
v.fastcdn.co/u/814df80e/
63 KB
63 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/56646297-0-Small-D2-1.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
55a72ceec0d570523aea5267ed47bbefe802949f7c3b7426554f277f96b1344f

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
x-goog-stored-content-length
64658
age
11329674
x-guploader-uploadid
ABg5-UzF7MaQjmdDj3bthNmu4xSWymVdVPmwX0GHoeg3uphNINUVKEmlFOCJxWOrnHW2kAPA-58RLv3DahsL0JLXqBOw_aWCAw
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Fri, 03 Jun 2022 06:23:13 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
64658
last-modified
Mon, 12 Apr 2021 14:23:13 GMT
server
ECS (frb/674D)
etag
"0e0d30cbebfadb32c097023f27d28561"
x-goog-hash
crc32c=X+uUSA==, md5=Dg0wy+v62zLAlwI/J9KFYQ==
content-type
image/png
x-goog-generation
1618237393811889
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:06 GMT
lib.js
heatmap-events-collector.instapage.com/static/
24 KB
9 KB
Script
General
Full URL
https://heatmap-events-collector.instapage.com/static/lib.js
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.222.120.150 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
150.120.222.35.bc.googleusercontent.com
Software
/
Resource Hash
9f4331078abd467835bcf0b2367872f497045d37ebfb32fe7d9f82cf6843d282
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=315360000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
strict-transport-security
max-age=315360000; includeSubDomains
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Wed, 18 Aug 2021 00:15:07 GMT
x-frame-options
SAMEORIGIN
date
Tue, 24 Aug 2021 15:49:06 GMT
expect-ct
max-age=0
vary
Accept-Encoding, Accept-Encoding
x-download-options
noopen
content-type
application/javascript; charset=UTF-8
cache-control
public, must-revalidate, public
access-control-allow-credentials
true
accept-ranges
bytes
expires
Tue, 24 Aug 2021 15:54:06 GMT
beacon.min.js
static.cloudflareinsights.com/
13 KB
5 KB
Script
General
Full URL
https://static.cloudflareinsights.com/beacon.min.js
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e567066985125e7974f68b42914dcb134e3c38373a4a3d668bdb38a3e55f299

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
gzip
last-modified
Wed, 18 Aug 2021 21:41:27 GMT
server
cloudflare
etag
W/2021.5.3
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
683dba8f0f772bad-FRA
it.js
cdn.instapagemetrics.com/t/js/3/
70 KB
23 KB
Script
General
Full URL
https://cdn.instapagemetrics.com/t/js/3/it.js
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.27.38 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
38.27.120.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
6038138cc175775b42f31d117e20be6d12d56bc495b4ccac86f2db8ca6b1240b

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 10 Aug 2021 12:06:55 GMT
content-encoding
gzip
age
1222932
x-guploader-uploadid
ADPycdtE5RoNgEVJVVUSkL9o6KWGfiOwVLIE21ySUz6PAOWGM0t8ted4le84jY9Tx1TkVX6VMgMSvgn-3vjthS0clA0
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
x-goog-meta-tracker-version
3
alt-svc
clear
content-length
22752
last-modified
Tue, 10 Aug 2021 12:06:52 GMT
server
UploadServer
etag
"0a9dbbebc38c034f126f15aea8be1281"
x-goog-hash
crc32c=DGiIsw==, md5=Cp2768OMA08SbxWuqL4SgQ==
x-goog-generation
1628597212109848
cache-control
no-transform
x-goog-stored-content-length
22752
accept-ranges
bytes
content-type
application/javascript
expires
Wed, 10 Aug 2022 12:06:55 GMT
sptw.3.js
g.fastcdn.co/js/
9 KB
3 KB
Script
General
Full URL
https://g.fastcdn.co/js/sptw.3.js
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.137.202 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
202.137.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
ee59049a77ecefd16b8b808229676b9f061ca97da27d3daf1271ef59dd5268e2

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 10 Aug 2021 11:11:20 GMT
content-encoding
gzip
age
1226267
x-guploader-uploadid
ADPycds-sSDkVn9OU2mNjXceR-W--EDkO8QrePvSqQF0BK1Y_GnkY51bk62-BZMCaylkKEAbqVGFudzhu3D0kACotzU
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
2984
last-modified
Tue, 10 Aug 2021 11:10:24 GMT
server
UploadServer
etag
"63285d34126a5466b0deebb6536b4545"
vary
Accept-Encoding
x-goog-hash
crc32c=++isQw==, md5=YyhdNBJqVGaw3uu2U2tFRQ==
x-goog-generation
1628593824250788
cache-control
public, max-age=31536000
x-goog-stored-content-length
2984
accept-ranges
bytes
content-type
application/javascript
expires
Wed, 10 Aug 2022 11:11:20 GMT
bat.js
bat.bing.com/
30 KB
9 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5c1282fb121104f5a505ecbfd7194e64c98db6b830684450dcfc478021d05257

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:06 GMT
content-encoding
gzip
last-modified
Wed, 28 Jul 2021 18:27:37 GMT
x-msedge-ref
Ref A: 28BF39D71AAA4C53B65A1905D111E958 Ref B: FRAEDGE1220 Ref C: 2021-08-24T15:49:07Z
etag
"80f2963dde83d71:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
9024
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
via
1.1 varnish
last-modified
Mon, 12 Jul 2021 21:25:31 GMT
age
45748
etag
"65cf0c0ceb852397f0d1e6732cd3c533+gzip"
vary
Accept-Encoding,Host
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding
gzip
cache-control
no-cache
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
1958
x-timer
S1629820147.286520,VS0,VE0
x-served-by
cache-fra19132-FRA
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 13 Jul 2021 18:24:06 GMT
server
Golfe2
age
2126
date
Tue, 24 Aug 2021 15:13:41 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19672
expires
Tue, 24 Aug 2021 17:13:41 GMT
pixel.js
www.redditstatic.com/ads/
22 KB
7 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
7125a66456daa35dd3e3e8cca4b9523e05caf0b4fa5bd5874676e7c6db40f3aa

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
via
1.1 varnish, 1.1 varnish
last-modified
Wed, 14 Jul 2021 17:50:00 GMT
server
snooserv
etag
"912f60c72fda50b2f21068c65115175d"
vary
Accept-Encoding,Origin
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-encoding
gzip
content-length
7018
firstleaf.js
init.blackcrow.ai/js/core/
0
385 B
Script
General
Full URL
https://init.blackcrow.ai/js/core/firstleaf.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.102.2 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-2.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:10:21 GMT
via
1.1 e96895e7fdc48b58a3d95d2e8e23a8b0.cloudfront.net (CloudFront)
last-modified
Tue, 24 Aug 2021 15:10:03 GMT
server
AmazonS3
age
2327
etag
"d41d8cd98f00b204e9800998ecf8427e"
x-cache
Error from cloudfront
x-amz-version-id
fNm6S42Y0ayC1Eb5E6duBLgIS2f_8Tvk
cache-control
max-age=600
x-amz-cf-pop
ZRH50-C1
accept-ranges
bytes
content-type
application/javascript
content-length
0
x-amz-cf-id
MImjVtxQ-WAs8jV0ObEg3QO3M8O3MVu_xfHT9rpdLJ2AZtpB0cf3GA==
scevent.min.js
sc-static.net/
15 KB
6 KB
Script
General
Full URL
https://sc-static.net/scevent.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.102.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-6.zrh50.r.cloudfront.net
Software
CloudFront /
Resource Hash
a92b99b413aa8afe65e9a4943c148fdedab142e7b913dafc52a040d850a5b197

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
gzip
server
CloudFront
x-amz-cf-pop
ZRH50-C1
x-cache
LambdaGeneratedResponse from cloudfront
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
private, s-maxage=0, max-age=600
access-control-allow-headers
Content-Type
content-length
5873
via
1.1 e96895e7fdc48b58a3d95d2e8e23a8b0.cloudfront.net (CloudFront)
x-amz-cf-id
40mocqOtVHOOGjrPq9d7XIa3TdNQ88al3oo_H-WM_YUI39PjEOoGEw==
ppt=8312;g=sitewide;gid=27870;ord=undefined
trkn.us/pixel/conv/
Redirect Chain
  • https://trkn.us/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=1893797462
  • https://trkn.us/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=1893797462;ip=159.48.55.4;cuidchk=1
42 B
780 B
Image
General
Full URL
https://trkn.us/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=1893797462;ip=159.48.55.4;cuidchk=1
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.206.179.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-206-179-19.compute-1.amazonaws.com
Software
Apache /
Resource Hash
b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:07 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sun, 9 Nov 1980 12:59:00 GMT
Server
Apache
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Sun, 9 Nov 1980 12:58:00 GMT

Redirect headers

Date
Tue, 24 Aug 2021 15:49:07 GMT
X-Content-Type-Options
nosniff
Server
Apache
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location
/pixel/conv/ppt=8312;g=sitewide;gid=27870;ord=undefined?gtmcb=1893797462;ip=159.48.55.4;cuidchk=1
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
0
5565374.js
bat.bing.com/p/action/
0
92 B
Script
General
Full URL
https://bat.bing.com/p/action/5565374.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 24 Aug 2021 15:49:06 GMT
cache-control
private,max-age=86400
x-msedge-ref
Ref A: D6A5C2F77F314149993E313CE7A96781 Ref B: FRAEDGE1220 Ref C: 2021-08-24T15:49:07Z
x-cache
CONFIG_NOCACHE
truncated
/
68 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bdeda331b720b33bf5b8bc88d52d16a1c40da840b41f4692e3ed70253fed9486

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
image/png
54990801-0-bottle-lite.jpg
v.fastcdn.co/u/814df80e/
128 KB
129 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/54990801-0-bottle-lite.jpg
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67BE) /
Resource Hash
d96709da01a87621fce7114b4f51beabccde158af5ddb2e4de80ef900f10bd59

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
x-goog-stored-content-length
131274
age
4840607
x-guploader-uploadid
ADPycdvTqSILtn1AlJ5aP7zX3I4kkdUP8H8NDXBRBVJmCa-N-Ld9NrnmjpcyZpii8jHgP3ttXXBhREt3JevmpW58znh2jZKBjQ
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Fri, 25 Feb 2022 06:41:15 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
131274
last-modified
Mon, 04 Jan 2021 14:41:15 GMT
server
ECS (frb/67BE)
etag
"99be48c2c3bac4ed61960bd9b8e222af"
x-goog-hash
crc32c=3LkmBw==, md5=mb5IwsO6xO1hlgvZuOIirw==
content-type
image/jpeg
x-goog-generation
1609771275144629
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:07 GMT
57204186-0-paste.png
v.fastcdn.co/u/814df80e/
31 KB
31 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/57204186-0-paste.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6731) /
Resource Hash
200d01f0cd516bfaff8f477ceb07b4eb083cf7e56ac403153175071990d53380

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
x-goog-stored-content-length
31603
age
4840606
x-guploader-uploadid
ADPycdvB6yzn04wowZJZYwpYzqjrgl8NzrxUAI72JalZ-zu54BDbE7N6lfKgVDuaKBPaP6jDAJz67ULYA5i-AQ4XCXg
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Tue, 05 Jul 2022 09:05:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31603
last-modified
Fri, 14 May 2021 17:05:09 GMT
server
ECS (frb/6731)
etag
"9278f8b4a78cd46142d945adcefff7a0"
x-goog-hash
crc32c=f60Q6g==, md5=knj4tKeM1GFC2UWtzv/3oA==
content-type
image/png
x-goog-generation
1621011909001396
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:07 GMT
57204201-0-refinery29.png
v.fastcdn.co/u/814df80e/
40 KB
41 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/57204201-0-refinery29.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67E0) /
Resource Hash
437a1672bb11b8d01e8867a7cbe9f16fb1b6217b3849f15f4247ab19cb5d6a34

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
x-goog-stored-content-length
41331
age
5316798
x-guploader-uploadid
ABg5-Uz7tc8w_N1fAX4GmvnDXwSPX6w2YSciMyxfp0QQQjKnGlIJrv3Wuihy-FW80l6W5ToogfDi5hNI9XwD5K7AZoU
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Tue, 05 Jul 2022 09:05:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41331
last-modified
Fri, 14 May 2021 17:05:09 GMT
server
ECS (frb/67E0)
etag
"c8e016856d74d6259c41be0e86645823"
x-goog-hash
crc32c=yjX0Uw==, md5=yOAWhW101iWcQb4OhmRYIw==
content-type
image/png
x-goog-generation
1621011909071940
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:07 GMT
57204181-0-foodandwine.png
v.fastcdn.co/u/814df80e/
35 KB
36 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/57204181-0-foodandwine.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D6) /
Resource Hash
364571a2f5be79b1b7cd8ed5e011ac1d62d3c05326b879582018d4bed97cac49

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
x-goog-stored-content-length
36135
age
8803097
x-guploader-uploadid
ABg5-UznSNprCKrlbLE4CzlFL50RGFA3duomh_DEhe3SvhKra4ZOouhuG5sXCR2k2nL-3kNvH5hdIJvIDPoMZMDjN98PggLSAw
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Tue, 05 Jul 2022 09:05:08 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36135
last-modified
Fri, 14 May 2021 17:05:09 GMT
server
ECS (frb/67D6)
etag
"8c1f2a774ccff73bdbf2e04246b92a9b"
x-goog-hash
crc32c=fS7Rqw==, md5=jB8qd0zP9zvb8uBCRrkqmw==
content-type
image/png
x-goog-generation
1621011908988696
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:07 GMT
56049276-0-BI-LOGO.png
v.fastcdn.co/u/814df80e/
12 KB
12 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/56049276-0-BI-LOGO.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668A) /
Resource Hash
c3060cd252f0a0a5f81a15fbef41b596d2db68cefe3de3e0a8c16fdc7177da0f

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
x-goog-stored-content-length
11913
age
11875090
x-guploader-uploadid
ABg5-UzBWcyfuOjTO-t8kow6X4hybx6BeQgJCso-g2VP0CwVhjo2TilIQ264UXmf4qyd7EdUgCrIOrqV_S-YK9J0XoU
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Fri, 29 Apr 2022 08:16:26 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11913
last-modified
Mon, 08 Mar 2021 16:16:26 GMT
server
ECS (frb/668A)
etag
"39667f4eb045b98dfec8064b4bdb4304"
x-goog-hash
crc32c=FNkYpw==, md5=OWZ/TrBFuY3+yAZLS9tDBA==
content-type
image/png
x-goog-generation
1615220186183268
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:07 GMT
52332085-0-bottle-bg-1.jpg
v.fastcdn.co/u/814df80e/
66 KB
67 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/52332085-0-bottle-bg-1.jpg
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6711) /
Resource Hash
e62bc837007999cb7c58bb6aab499ba2d02bd49c40149db8bc60936e982564e4

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
x-goog-stored-content-length
67756
age
11867331
x-guploader-uploadid
ABg5-UysOa5jHy2zFVIwdpAtxyqqNDGgRX5lrt1pYqN6FrJqeWaU_Iy_BCIZx7NCpcijJ8cE4zIdGJBt8TVhagsMyzj5DJX_Rw
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Tue, 14 Sep 2021 11:15:19 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
67756
last-modified
Fri, 24 Jul 2020 19:15:19 GMT
server
ECS (frb/6711)
etag
"18a3af3f9355df6af36b15c272b650b5"
x-goog-hash
crc32c=hNIVng==, md5=GKOvP5NV32rzaxXCcrZQtQ==
content-type
image/jpeg
x-goog-generation
1595618119206778
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:07 GMT
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a899a0398bbfbb8343c67e83098446254c1609aae412962cff6929087135a51c

Request headers

Origin
https://page.firstleaf.club
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393

Request headers

Origin
https://page.firstleaf.club
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
16 KB
16 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
01af466f48d14857d97a67cd7025ce67c8a0b9ca83ddb6d3f313c7369c432868

Request headers

Origin
https://page.firstleaf.club
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c

Request headers

Origin
https://page.firstleaf.club
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
1508181802-23347456-150x150-FL-Logotype-Purple.png
v.fastcdn.co/t/thumbnail/20171016/
47 KB
47 KB
Image
General
Full URL
https://v.fastcdn.co/t/thumbnail/20171016/1508181802-23347456-150x150-FL-Logotype-Purple.png
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67BA) /
Resource Hash
f201df44d5c747fcb0e34380d77409cd02be1f6e8810138d75394674b057a929

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
x-goog-stored-content-length
48123
age
4840605
x-guploader-uploadid
ADPycdudRVV7pr7jtL0JLOaLqlNRF4zy3Hn4BqNoBroR-a_1aIqsfGwfmSOeSoKWu7_v5HQfgfBcLVI779GmIkyn3IXI1ANnow
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Fri, 07 Dec 2018 11:23:26 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
48123
last-modified
Mon, 16 Oct 2017 19:23:26 GMT
server
ECS (frb/67BA)
etag
"ce787594c24907600a864463e0a96b8e"
x-goog-hash
crc32c=M5S3hg==, md5=znh1lMJJB2AKhkRj4Klrjg==
content-type
image/png
x-goog-generation
1508181806504663
cache-control
max-age=315360000, public
x-goog-meta-content-length
48123
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:07 GMT
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/
19 KB
19 KB
Font
General
Full URL
https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://page.firstleaf.club
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 00:32:15 GMT
x-content-type-options
nosniff
age
55012
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19844
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:20:10 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Aug 2022 00:32:15 GMT
fbevents.js
connect.facebook.net/en_US/
98 KB
25 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
525f091870c1282bb4823f9e64192983f1652a3bbc84c97ca5e6c4f063ca6e82
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
25940
x-xss-protection
0
pragma
public
x-fb-debug
UtJgrwKe6ogSFdfS8NtjNEh8bg2Bjjmo8qvBxDv4ksirVq01lJSSumvIilIrPWmoV67UwV7c66twM9YVhsgUpQ==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Tue, 24 Aug 2021 15:49:07 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
snippet.js
static.zdassets.com/ekr/
20 KB
6 KB
Script
General
Full URL
https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16cc547456ffa0052c3679e6c5ece2e14ad57c92b93562deb7bcb5829b7afcb7
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
40
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
NRDNPYMMZ4S18PZE
x-amz-id-2
dVvIcGiItj+FCXRbr8R9Cjzga2b7f4HYvsNabDq92dxyCx7E6N2w1OADyK2ZNSFGQkVQ2iO2uKo=
last-modified
Wed, 09 Jun 2021 00:08:59 GMT
server
cloudflare
etag
W/"cc904f41324148b571599b3b02fdec0b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IhB%2B%2BGYonU%2Fs3bMluCovEf9%2F3Quo2frqql0NmZx63ThR%2FCBQUKLrgsbPOWgcNfrSFaCiERQTBx2rdy7C8LAO0nAqexB3o32rjC2cEx6ga3Vegt0eSyFvZQsqNmCwPmGr6hPyWls%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=3600, s-maxage=60
x-amz-version-id
VFukQxfz8SFs4LT0u8yzm_CAm2zq09sT
cf-ray
683dba911e814c86-AMS
wxyz.js
rbv9j7km.firstleaf.club/assets/
43 KB
10 KB
Script
General
Full URL
https://rbv9j7km.firstleaf.club/assets/wxyz.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.203.152.45 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
openresty /
Resource Hash
779ea318ca1aa1b8d459103115b7ed6ce64ccc1e411a816ca7806b09e3f03bc5

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:07 GMT
Content-Encoding
gzip
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
application/javascript
t.js
cdn1-res.sundaysky.com/vop/v2/
3 KB
2 KB
Script
General
Full URL
https://cdn1-res.sundaysky.com/vop/v2/t.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.89 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-89.fra50.r.cloudfront.net
Software
/
Resource Hash
f7c20d02ef54341b1562afe8db32d1bc701bb7974db2ffc0a560097e3875c1be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 03:50:43 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
43103
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
X-XSS-Protection
1; mode=block
Last-Modified
Mon, 02 Aug 2021 11:33:50 GMT
X-Frame-Options
DENY
ETag
W/"2603-1627904030000"
Vary
Accept-Encoding
Content-Type
application/javascript
Via
1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront)
Cache-Control
public, max-age=604800
X-Amz-Cf-Pop
FRA50-C1
X-Amz-Cf-Id
u-b3l4LhO851TUGgeFN6NAjSA49W9TNjonSSJfcS71sPZLMvUPbZZQ==
cs.js
aa.trkn.us/1/e/
0
192 B
Script
General
Full URL
https://aa.trkn.us/1/e/cs.js?cid=c013&evid=5713e69f-ed70-4bb9-9079-619171b397f7&suu=1&dmn=page.firstleaf.club
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.239.203 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-239-203.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:07 GMT
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Expires
Tue, 24 Aug 2021 15:49:07 GMT
/
stdomi.com/
49 B
202 B
Image
General
Full URL
https://stdomi.com/?prdid={provided_by_intango}&subid={pass_back_intango_click_id_here}
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.172.228.26 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:07 GMT
server
nginx/1.16.1
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
content-length
49
expires
Thu, 01 Jan 1970 00:00:00 GMT
visit
anthill.instapage.com/projects/56c2f3d796773d0a7e96a536/events/
35 B
293 B
Image
General
Full URL
https://anthill.instapage.com/projects/56c2f3d796773d0a7e96a536/events/visit?api_key=59eced3c9e2499feeda1cf120d4e37ac7fb15414707dea630b3c54012cecf6ce1d6361ae6a7c5544eaafd7f58c62cca77bf31a344bc16a86ccbff5be7c1e687d705eea03715509e1cf1baab8ff4906f01a9cfdfa305a410fba501eda309f760e3e4aad9ae9f3eb5921bbf73da1a369d53f3ab5ebae0ec99acc4b2ab4dbda8c26bbb9a92e4f14890510d6c84ddd2cad56&data=eyJwYWdlX3VybCI6Imh0dHBzOi8vcGFnZS5maXJzdGxlYWYuY2x1Yi9xdWl6P3V0bV9zb3VyY2U9Y2pfYWZmaWxpYXRlJmZyaWVuZHM9dHJ1ZSZ1dG1fbWVkaXVtPWNwYSZ1dG1fY2FtcGFpZ249MTg1MDc3MV8xMitJbnRlcmFjdGl2ZStMTENfMjA5NzA2MiZ1dG1fdGVybT0mdXRtX2NvbnRlbnQ9MTM1NTI4NDVfNitCb3R0bGVzK2ZvcislMjQ0MCtQbHVzK0ZyZWUrU2hpcHBpbmcrZm9yK2ErWWVhciZ1dG1fc3ViY2FtcGFpZ249MjA5NzA2MiZjamV2ZW50PWNmZWY2NDdmMDRmMjExZWM4MDc1MDMyYzBhMTgwNTBmIiwib3duZXJfaWQiOjE5NzM0NzYsImN1c3RvbWVyX2lkIjoyMzQ0MDkxLCJwYWdlX2lkIjoyMTQyNzUzNiwicHVibGlzaGVkX3ZlcnNpb24iOjI1OSwidmFyaWF0aW9uX25hbWUiOiJFRiIsInZhcmlhdGlvbl9pZCI6MjczLCJsaW5rZWRfdmFyaWF0aW9uX2lkIjoyNzQsInZhcmlhdGlvbiI6IkVGIiwicXVhbnRpdHkiOjEsImluaXRpYWxfcmVzcG9uc2l2ZV9tb2RlIjpudWxsLCJzdGF0aWNfcGFnZSI6ZmFsc2UsImphdmFzY3JpcHQiOnRydWUsInZpZXdwb3J0X2hlaWdodCI6MTIwMCwidmlld3BvcnRfd2lkdGgiOjE2MDAsImNhbXBhaWduX2lkIjpmYWxzZSwiYWRfaWQiOmZhbHNlLCJjYW1wYWlnbl9zb3VyY2UiOmZhbHNlLCJ2aXNpdGVkIjowLCJyZXNwb25zaXZlX21vZGUiOm51bGwsInJlZiI6Imh0dHBzOi8vamFjb2JzLnBlcmtzcG90LmNvbS8ifQ==&t=1629820147367
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.222.120.150 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
150.120.222.35.bc.googleusercontent.com
Software
/ Express
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
referrer-policy
same-origin
x-powered-by
Express
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
x-xss-protection
1; mode=block
x-content-type-options
nosniff
strict-transport-security
max-age=315360000; includeSubDomains
vary
Accept-Encoding, Origin
content-length
35
etag
W/"23-X71HIiL+uKIs9biqXcW44Tr4jis"
0
bat.bing.com/action/
0
94 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5565374&tm=gtm002&Ver=2&mid=842b6a89-9e77-4044-b4ae-9ae8a8de56fe&sid=d0d539e004f211ecb7fd63f68c885fdc&vid=d0d55f4004f211ec975e07ffc4eff880&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf&kw=wine,%20wine%20club&p=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&r=https%3A%2F%2Fjacobs.perkspot.com%2F&lt=2091&evt=pageLoad&msclkid=N&sv=1&rn=967004
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 24 Aug 2021 15:49:06 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 4213FD545E7544A0A4010DCB92DD0B88 Ref B: FRAEDGE1220 Ref C: 2021-08-24T15:49:07Z
x-cache
CONFIG_NOCACHE
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dddf04d190be2e7006f807221d5f5852bf45a97c2aad4c66b1f0a1661efa7dda

Request headers

Origin
https://page.firstleaf.club
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c

Request headers

Origin
https://page.firstleaf.club
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
5 KB
5 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
51b06909334339bd5f4027e70f4d2fd30a2a3977ee44cce7385b908ec8f51903

Request headers

Origin
https://page.firstleaf.club
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70

Request headers

Origin
https://page.firstleaf.club
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
54280096-0-FIRSTLEAF-4-20-18-SH.jpg
v.fastcdn.co/u/814df80e/
636 KB
636 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/54280096-0-FIRSTLEAF-4-20-18-SH.jpg
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6760) /
Resource Hash
7084ebbefbe4e68b8d66c66b4f05795676a2c51bd8e7fffc47a7c2e015aa0544

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
x-goog-stored-content-length
650889
age
11875089
x-guploader-uploadid
ABg5-UxoFQANdFgiZk7LaYNPpqCIOyJhO1A-REjsUMsznpYU3_CEyV-P9vK7Mz3g-ndDyoFQsBtcOYIeJ2FB_WwCPoExLJ_DTA
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Fri, 07 Jan 2022 08:53:50 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
650889
last-modified
Mon, 16 Nov 2020 16:53:51 GMT
server
ECS (frb/6760)
etag
"5126564702f93f64c73860dab71c20a1"
x-goog-hash
crc32c=m4NYAw==, md5=USZWRwL5P2THOGDatxwgoQ==
content-type
image/jpeg
x-goog-generation
1605545631140587
cache-control
max-age=315360000, public
x-goog-meta-content-length
650889
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:07 GMT
54280086-0-FIRSTLEAF-4-20-18-SH.jpg
v.fastcdn.co/u/814df80e/
1 MB
1 MB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/54280086-0-FIRSTLEAF-4-20-18-SH.jpg
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6711) /
Resource Hash
d88d643839a4133a341acdbb486111679804cbce0b2d9af9cf7423a3bc62450d

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
x-goog-stored-content-length
1270572
age
11876096
x-guploader-uploadid
ABg5-Uy1asbH3RMV_F_lzhFWRksJlPulw0oKufSoFgECnaMicOtJT5qmMplnBD-yb1NeoiIWIIv3wlshwaNA0aRFjnA
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Fri, 07 Jan 2022 08:53:39 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1270572
last-modified
Mon, 16 Nov 2020 16:53:39 GMT
server
ECS (frb/6711)
etag
"dcafc1dd8bd8c7cf4e28646fff779dea"
x-goog-hash
crc32c=/HvrnQ==, md5=3K/B3YvYx89OKGRv/3ed6g==
content-type
image/jpeg
x-goog-generation
1605545619410205
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:07 GMT
54280111-0-firstleaf-weareyou-4.jpg
v.fastcdn.co/u/814df80e/
826 KB
826 KB
Image
General
Full URL
https://v.fastcdn.co/u/814df80e/54280111-0-firstleaf-weareyou-4.jpg
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.133.208 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6711) /
Resource Hash
449319f85e3e51826d1452e7dfe201765992eeb42366d5b862c497af03721d4b

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
x-goog-stored-content-length
845370
age
11875086
x-guploader-uploadid
ABg5-UwJyBM5mBnh0Ab--pKpCtEM6c3Hf8Bd62rq26F5F0IATi4tB5miIC17t-I_cqJZGVV45Oq3yI0TZyv5Uyz41w6tE9VLaA
x-cache
HIT
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-meta-expires
Fri, 07 Jan 2022 08:54:06 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
845370
last-modified
Mon, 16 Nov 2020 16:54:06 GMT
server
ECS (frb/6711)
etag
"8c284c026ab433627f62598f9fec01db"
x-goog-hash
crc32c=hQRsSg==, md5=jChMAmq0M2J/YlmPn+wB2w==
content-type
image/jpeg
x-goog-generation
1605545646916845
cache-control
max-age=315360000, public
x-goog-meta-content-length
0
accept-ranges
bytes
expires
Wed, 24 Aug 2022 15:49:07 GMT
ec.js
www.google-analytics.com/plugins/ua/
3 KB
1 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:40:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
517
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1306
x-xss-protection
0
expires
Tue, 24 Aug 2021 16:40:30 GMT
js
www.google-analytics.com/gtm/
113 KB
43 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/js?id=OPT-WRCDBFX&t=gtm6&cid=210538565.1629820147
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
63d4ae54784e36c3b76b2bc6384fd489c10f4ff55572af5c83657686a6ae2a46
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43613
x-xss-protection
0
expires
Tue, 24 Aug 2021 15:49:07 GMT
rp.gif
alb.reddit.com/
42 B
125 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1629820147428&id=t2_154evxdq&event=PageVisit&m.itemCount=&m.value=&m.currency=&m.transactionId=&m.customEventName=&uuid=d43da7b5-b0d3-4546-b9ea-08e6cecad634&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_a797b96e
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
via
1.1 varnish
server
Varnish
accept-ranges
bytes
content-length
42
retry-after
0
content-type
image/gif
1669030446688031
connect.facebook.net/signals/config/
264 KB
74 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1669030446688031?v=2.9.44&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0255458c627efd907d6313000cabccc2af24fbebd5c14cc112d3eaf6d1649f11
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
XlWgRxJltK1Lt4IRbzfQpz2D7h7YSTJcE9VVfCDldXXIYebwuBNI5N5K73IjSlV47CiA62kUmu2vLT2xEG7R9w==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 24 Aug 2021 15:49:07 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
adsct
t.co/i/
43 B
453 B
Image
General
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=nzfyd&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
pragma
no-cache
last-modified
Tue, 24 Aug 2021 15:49:07 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
c4c4e197d1674f60bc22c0e1a0b35022e0b53553ce8a303581af355ab184b0b2
x-transaction
1b0bc27250165fae
expires
Tue, 31 Mar 1981 05:00:00 GMT
i.js
tag.wknd.ai/4263/
17 KB
5 KB
Script
General
Full URL
https://tag.wknd.ai/4263/i.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.253.250 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
250.253.120.34.bc.googleusercontent.com
Software
fasthttp /
Resource Hash
5bf2b2b83890a96d19a0e1380220b43f046d88a4f3710b74cf6d69b72198fad1

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 10:59:16 GMT
content-encoding
gzip
server
fasthttp
age
17391
etag
c4b96549ad8c65
content-type
text/plain; charset=utf-8
via
1.1 google
cache-control
public,max-age=60
x-region
us-central1
timing-allow-origin
*
alt-svc
clear
content-length
4756
hotjar-465352.js
static.hotjar.com/c/
5 KB
2 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-465352.js?sv=7
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.102.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-68.zrh50.r.cloudfront.net
Software
/
Resource Hash
d3852f0df9e3b203b5b90779457995a07c7b2e15028aada14edfcd34030f7da3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
x-content-type-options
nosniff
cache-control
max-age=60
x-amz-cf-pop
ZRH50-C1
etag
W/6767c882c7fc1053d53acfa74f5406d0
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
x-amz-cf-id
9KZ0kMijcNR0e8CcCGVzSCtQw29xvMvW-51qeM_xUDoTIYK9DoEFNQ==
via
1.1 4e0fd86f7afa735e772d6f7fe5e91f5b.cloudfront.net (CloudFront)
tfa.js
cdn.taboola.com/libtrc/unip/1046601/
74 KB
25 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/unip/1046601/tfa.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2066a5c2ea3def6ac7eb16471ef8c07c031e70970d70275185fbe53d0ae85bac

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id
7gesz5nXiQgTjQ7ODNoxBwVIlEYePgPi
content-encoding
gzip
etag
"cbe162c1677acea51cbda01d4b18b8ba"
age
0
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
24762
x-amz-id-2
1TT6Ccm/O+ZYOxyZtd6BAhOPLfZbyJdVLmmI0Zn5DPDCg8FAnoJMniBF+SQU7WM+XEN93dtljkQ=
x-served-by
cache-fra19148-FRA
last-modified
Mon, 09 Aug 2021 10:25:28 GMT
server
AmazonS3
x-timer
S1629820148.529328,VS0,VE105
date
Tue, 24 Aug 2021 15:49:07 GMT
vary
Accept-Encoding
x-amz-request-id
T47NNEZ0SKPFTZ7Z
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
69
x-cache-hits
1
tv2track.js
collector-7547.tvsquared.com/
20 KB
9 KB
Script
General
Full URL
https://collector-7547.tvsquared.com/tv2track.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.219.93.205 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-219-93-205.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:08 GMT
Content-Encoding
gzip
Last-Modified
Fri, 02 Jul 2021 14:21:37 GMT
Server
nginx
ETag
"60df20f1-2133"
Content-Type
application/javascript
Cache-Control
max-age=600
Connection
keep-alive
X-Robots-Tag
noindex
Content-Length
8499
Expires
Tue, 24 Aug 2021 15:59:08 GMT
star.gif
jelly.mdhv.io/v1/
43 B
235 B
Image
General
Full URL
https://jelly.mdhv.io/v1/star.gif?pid=S1QWtdGepedvdhZ2jCn2PVKP4IsF&src=mh&evt=hi&url=/quiz&ifa=[device_id]&uid=undefined&ord=undefined&rev=undefined
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.38.21 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
any-in-2615.1e100.net
Software
Google Frontend /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:07 GMT
server
Google Frontend
content-type
image/gif
x-cloud-trace-context
bf4c0d256ca7e605f21ecf4d1ebb36c9
cache-control
no-store,no-cache,must-revalidate,max-age=0,post-check=0,pre-check=0
content-length
43
expires
-1
D22CCB709CDC50.js
cdn.datasteam.io/js/
70 KB
23 KB
Script
General
Full URL
https://cdn.datasteam.io/js/D22CCB709CDC50.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-31.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
97f5ecdc5516a2af7d1d027d72a74f42e41755e0039f330331cd66bd330e7b39

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 23 Aug 2021 22:52:43 GMT
content-encoding
gzip
last-modified
Mon, 05 Apr 2021 20:11:28 GMT
server
AmazonS3
age
60985
etag
W/"013875b925c46b5f1a7965baf37eee42"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
via
1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
cache-control
max-age=600,s-maxage=86400
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
HZA6IeOlzACie7RzMxz22w1-HGnbrF1uPR31s5aSfkypnlnTWY3AGA==
sp-at-v2-14-0.js
images.firstleaf.club/js/
97 KB
30 KB
Script
General
Full URL
https://images.firstleaf.club/js/sp-at-v2-14-0.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ffb92ab9eefa3b6e3f6313d9a4194715887b0b8442d7be6cd1a472db7e810e5a

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
6416
cf-polished
origSize=100349
x-cache
Hit from cloudfront
content-encoding
br
last-modified
Mon, 27 Jul 2020 04:28:00 GMT
server
cloudflare
etag
W/"8dba669b94e3865c9205ef8fd15ee4d1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=5356800
x-amz-cf-pop
FRA2-C1
cf-ray
683dba929fc85b44-FRA
x-amz-cf-id
nhHLRYaiQjJk16lz7XN16Hco-9sNmxX3JLlQ9alz1uq_3x1KPPCVPg==
cf-bgj
minify
c8fdefca-b38f-49ff-a307-bcb109f7aefb-latest.js
d2hrivdxn8ekm8.cloudfront.net/tag-manager/
275 B
652 B
Script
General
Full URL
https://d2hrivdxn8ekm8.cloudfront.net/tag-manager/c8fdefca-b38f-49ff-a307-bcb109f7aefb-latest.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:b400:17:3f5c:f800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3b5ec8ee05daecb254a5b42fd0742c2d9b0dfa20223156fa43a29f96de97d2d0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id
mHjDJSVK2u.BPMgdGzMgKwBZFArdO6eR
via
1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
last-modified
Fri, 13 Nov 2020 20:22:38 GMT
server
AmazonS3
age
49387
etag
"b988df2daf770c7753535798447d3067"
x-cache
Hit from cloudfront
content-type
application/javascript
date
Tue, 24 Aug 2021 02:06:01 GMT
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
275
x-amz-cf-id
vYsDyZ3xAQLF7UXJRt1S10mRZ5vlztnaKdyoRRgs1RHUITc0hIsNlQ==
events.js
tags.srv.stackadapt.com/
13 KB
5 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-165-186-74.compute-1.amazonaws.com
Software
/
Resource Hash
54f3f8a69600b4c817ec5f7332b615eca054945e355238f798893bf6d1c1489f

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 24 Aug 2021 15:49:07 GMT
Content-Encoding
gzip
Cache-Control
max-age=30
Content-Length
4436
Connection
keep-alive
Content-Type
text/javascript
a-069s.min.js
b-code.liadm.com/
25 KB
10 KB
Script
General
Full URL
https://b-code.liadm.com/a-069s.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKCVNW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7a00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ZIO-Http /
Resource Hash
724bbf6dc23c60a8ebfc0a3c99c7499c17c90182f148efb0057c9a5f2fc2a1ae

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 13:57:09 GMT
via
1.1 5317564e96c9dceb46123f6c5f149a03.cloudfront.net (CloudFront)
server
ZIO-Http
age
6718
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=86400
x-amz-cf-pop
FRA50-C1
content-encoding
gzip
x-amz-cf-id
T3xgZV0S-EMVo_-IQWocFvi78RWtPZf6hj7yAVz1fImLf-a-XdbfKA==
fs.js
edge.fullstory.com/s/
209 KB
63 KB
Script
General
Full URL
https://edge.fullstory.com/s/fs.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.112.186 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
186.112.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
082a814158a4221fc2e1da585435b8d31fa704f221169ebe12b9b4d3573016a2

Request headers

Origin
https://page.firstleaf.club
Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:19:06 GMT
content-encoding
gzip
age
1801
x-guploader-uploadid
ADPycdvpatabkazmiFJ2xp0RVaeChmrlHhvbnjI-1Ht_hBQJNSdBeit4U4E4gkxGoZ7SdO-Hs4U-9DLTbK9qVwz-lyx67uE-OQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
64115
last-modified
Thu, 05 Aug 2021 19:32:56 GMT
server
UploadServer
etag
"22b58691e95646727daf16321cfe2ed1"
x-goog-hash
crc32c=z4hkXw==, md5=IrWGkelWRnJ9rxYyHP4u0Q==
x-goog-generation
1628191976428607
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600,no-transform
x-goog-stored-content-length
64115
accept-ranges
bytes
content-type
application/javascript
expires
Tue, 24 Aug 2021 16:19:06 GMT
cs.js
aa.trkn.us/1/e/
0
192 B
Script
General
Full URL
https://aa.trkn.us/1/e/cs.js?cid=c013&evid=5713e69f-ed70-4bb9-9079-619171b397f7&suu=1&dmn=page.firstleaf.club
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.239.203 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-239-203.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:07 GMT
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Expires
Tue, 24 Aug 2021 15:49:07 GMT
result
page.firstleaf.club/cdn-cgi/bm/cv/
0
280 B
XHR
General
Full URL
https://page.firstleaf.club/cdn-cgi/bm/cv/result?req_id=683dba887dcb5b44
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/cdn-cgi/bm/cv/669835187/api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-fetch-mode
cors
origin
https://page.firstleaf.club
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
empty
cookie
_gcl_au=1.1.1614649646.1629820146; query=?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f; _uetsid=d0d539e004f211ecb7fd63f68c885fdc; _uetvid=d0d55f4004f211ec975e07ffc4eff880; _ga=GA1.2.210538565.1629820147; _gid=GA1.2.1163922906.1629820147; _rdt_uuid=1629820147427.d43da7b5-b0d3-4546-b9ea-08e6cecad634; FL_Referrer=2; CJEVENT=cfef647f04f211ec8075032c0a18050f
content-length
744
:path
/cdn-cgi/bm/cv/result?req_id=683dba887dcb5b44
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type
application/json
accept
*/*
cache-control
no-cache
:authority
page.firstleaf.club
referer
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
:scheme
https
sec-fetch-site
same-origin
:method
POST
Referer
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
server
cloudflare
set-cookie
__cf_bm=66d958b891cd51d5c2313a142a0ee740d407e05c-1629820147-1800-ASfe75FzTUQkCPoRQ5/3u/ETyPXyDuaEKSshCr8exlPhN8XfneHqK5I5smgHixFMCGpUn+4YR6PFMs+EuO0Cu4vF9YJPxIfqca7ylPAY9V2LWxMI/3DOHMtnD3CYMaWxdV30P1La15lpPl59GVUtWP0=; path=/; expires=Tue, 24-Aug-21 16:19:07 GMT; domain=.firstleaf.club; HttpOnly; Secure; SameSite=None
cf-ray
683dba91de225b44-FRA
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
trackable.js
ext.chtbl.com/
4 KB
4 KB
Script
General
Full URL
https://ext.chtbl.com/trackable.js
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:8400:a:b27c:d040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
27dc4f62298834987d3d8e5608c1af94c82ee3d18ee31858d39e0202697b5308

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:12:36 GMT
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
last-modified
Fri, 12 Feb 2021 20:28:32 GMT
server
AmazonS3
age
2191
etag
"4a494dbb82444463b6fd8bff0e5593d6"
x-cache
Hit from cloudfront
content-type
application/javascript;charset=UTF-8
cache-control
max-age=3600
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
4092
x-amz-cf-id
4AzYV7IP7S_LL5ns6ZZLaGoGRxiGqQCe2XpZBUN8G00M_qaXdr6VBA==
j
s-vop.sundaysky.com/t/v1/
Redirect Chain
  • https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_1...
  • https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_1...
644 B
644 B
Image
General
Full URL
https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&cb=1790363202&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&udt.segment=visitor&_cvt=t&timestamp=1629820148098&nonce=ms17hkusp0t2baeq9ooe6lulh&signature=a2e34435cf6a9bf3cdf264ea7097524552abe864
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.237.157.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-237-157-181.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:07 GMT
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI PUR COM NAV INT DEM STA PRE"
Cache-control
private, no-cache, no-cache=Set-Cookie, must-revalidate, proxy-revalidate, max-age=0
Connection
keep-alive
Content-Type
application/javascript;charset=UTF-8
Content-Length
644
X-XSS-Protection
1; mode=block
Expires
Sat, 1 Apr 2000 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:07 GMT
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI PUR COM NAV INT DEM STA PRE"
Location
https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&cb=1790363202&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&udt.segment=visitor&_cvt=t&timestamp=1629820148098&nonce=ms17hkusp0t2baeq9ooe6lulh&signature=a2e34435cf6a9bf3cdf264ea7097524552abe864
Cache-control
private, no-cache, no-cache=Set-Cookie, must-revalidate, proxy-revalidate, max-age=0
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Expires
Sat, 1 Apr 2000 00:00:00 GMT
collect
www.google-analytics.com/j/
2 B
31 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j92&a=1310578191&t=pageview&_s=1&dl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&dr=https%3A%2F%2Fjacobs.perkspot.com%2F&ul=en-us&de=UTF-8&dt=Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAEALQAAAAC~&jid=1813848593&gjid=570399367&cid=210538565.1629820147&tid=UA-68049103-4&_gid=1163922906.1629820147&_r=1&gtm=2wg8n0TKCVNW&z=2048760215
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:07 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://page.firstleaf.club
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
64 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j92&a=1310578191&t=event&ni=1&_s=1&dl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&dr=https%3A%2F%2Fjacobs.perkspot.com%2F&ul=en-us&de=UTF-8&dt=Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page&ea=atf-creative-control&el=%2Fquiz&_u=aGDACEALRAAAAC~&jid=&gjid=&cid=210538565.1629820147&tid=UA-68049103-4&_gid=1163922906.1629820147&gtm=2wg8n0TKCVNW&z=1537254273
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 12:14:13 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
12894
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
ekr.zdassets.com/compose/
635 B
589 B
XHR
General
Full URL
https://ekr.zdassets.com/compose/b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4731e62066a0dd232bda3ae64cb3293df6488f92969b61457622cab819cf8f
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
vary
Origin, Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
0
status
200 OK
access-control-allow-methods
GET, POST, OPTIONS
strict-transport-security
max-age=0
x-request-id
90325290-dd82-4782-bf54-d884f470cf49
x-runtime
0.016814
server
cloudflare
etag
W/"cf4731e62066a0dd232bda3ae64cb329"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
7200
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NOZLChba0e3FD8EbQNRd7e4Gvyct4nubcinyTbtxiZKbvpxJS6viiaxHKcgtpvfS%2FYyx0XfIjGGtWR%2BxCLU%2BiIrcMm4qDEZdyrMt4KKRHoDGOXh73PrxovN8zMzHJ6%2FuSLU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
max-age=600, public, s-maxage=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray
683dba921e674242-AMS
i
tr.snapchat.com/cm/ Frame 9E3F
0
262 B
Document
General
Full URL
https://tr.snapchat.com/cm/i?pid=c20b9c7f-d0c3-4f4d-94a3-2a2c5fad8834
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.17.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

:method
GET
:authority
tr.snapchat.com
:scheme
https
:path
/cm/i?pid=c20b9c7f-d0c3-4f4d-94a3-2a2c5fad8834
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://page.firstleaf.club/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
https://page.firstleaf.club/

Response headers

server
nginx/1.17.3
date
Tue, 24 Aug 2021 15:49:07 GMT
content-type
text/html
content-length
0
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
ekr.zdassets.com/compose/
635 B
679 B
XHR
General
Full URL
https://ekr.zdassets.com/compose/b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4731e62066a0dd232bda3ae64cb3293df6488f92969b61457622cab819cf8f
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
vary
Origin, Accept-Encoding
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
status
200 OK
access-control-allow-methods
GET, POST, OPTIONS
strict-transport-security
max-age=0
x-request-id
90325290-dd82-4782-bf54-d884f470cf49
x-runtime
0.016814
server
cloudflare
etag
W/"cf4731e62066a0dd232bda3ae64cb329"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
7200
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ukr9FABlWPfXQ29apxyB5ZpCWNK%2FtldW2VDeQU3pvCMCwklZcw0ebYFjOTq8u5FknnvI4jJD0qW7c3H%2Bk7N87xFq5LdTTfC5LtUP6ZzkHWn6RtwV%2FSymXnOF0Dt3ydn8DxE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
max-age=600, public, s-maxage=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray
683dba921e694242-AMS
p
tr.snapchat.com/
68 B
86 B
Image
General
Full URL
https://tr.snapchat.com/p?pid=c20b9c7f-d0c3-4f4d-94a3-2a2c5fad8834&ev=PAGE_VIEW&pl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&ts=1629820147529&rf=https%3A%2F%2Fjacobs.perkspot.com%2F&v=1.5&if=false&bt=__LIVE__&intg=gtm&u_c1=d8d57eb2-a82e-4412-a2a2-273cdf4e4e39&m_sl=2209&m_rd=2243&m_pi=2068&m_ic=0
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.17.3 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
via
1.1 google
server
nginx/1.17.3
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache, no-transform
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
68
p
tr.snapchat.com/
68 B
86 B
Image
General
Full URL
https://tr.snapchat.com/p?pid=c20b9c7f-d0c3-4f4d-94a3-2a2c5fad8834&ev=PAGE_VIEW&pl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&ts=1629820147529&rf=https%3A%2F%2Fjacobs.perkspot.com%2F&v=1.5&if=false&bt=__LIVE__&intg=gtm&u_c1=d8d57eb2-a82e-4412-a2a2-273cdf4e4e39&m_sl=2209&m_rd=2244&m_pi=2068&m_ic=0
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.17.3 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
via
1.1 google
server
nginx/1.17.3
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache, no-transform
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
68
collect
stats.g.doubleclick.net/j/
1 B
22 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-68049103-4&cid=210538565.1629820147&jid=1813848593&gjid=570399367&_gid=1163922906.1629820147&_u=aGDAAEAKQAAAAC~&z=1651673438
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 24 Aug 2021 15:49:07 GMT
content-type
text/plain
access-control-allow-origin
https://page.firstleaf.club
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
ijs_all_modules_cjs_min_bc5e3af4a13fb7099bc155a3b357edf2.js
assets.bounceexchange.com/assets/smart-tag/versioned/
574 KB
143 KB
Script
General
Full URL
https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bc5e3af4a13fb7099bc155a3b357edf2.js
Requested by
Host: tag.wknd.ai
URL: https://tag.wknd.ai/4263/i.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
95.72.98.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
266af8d8c2c6a1818709dbd25f9e4d8a82705e3254ddd8b2ca97c41183aaeb0d

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 23 Aug 2021 19:07:26 GMT
content-encoding
gzip
age
74501
x-guploader-uploadid
ADPycdsSW_aj445wYr6GjdxIdTAOpkaQAruBdbm_VqgLCsUFko_8aX1B2xp_H9cLqB1ssCjf65owXcKxtPxBCHQYzBKcyg6J3A
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
145573
last-modified
Mon, 23 Aug 2021 19:07:16 GMT
server
UploadServer
etag
"84942b3afd245dd412b542d2f417a7e9"
vary
Accept-Encoding
x-goog-hash
crc32c=HjpP8w==, md5=hJQrOv0kXdQStULS9Ben6Q==
x-goog-generation
1629745636174412
access-control-allow-origin
*
access-control-expose-headers
etag, Content-Type
cache-control
public,max-age=31536000
x-goog-stored-content-length
145573
accept-ranges
bytes
content-type
text/javascript
expires
Tue, 23 Aug 2022 19:07:26 GMT
modules.e763089bec9f2503d752.js
script.hotjar.com/
221 KB
59 KB
Script
General
Full URL
https://script.hotjar.com/modules.e763089bec9f2503d752.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-465352.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.102.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-123.zrh50.r.cloudfront.net
Software
/
Resource Hash
b8e39dad2211fe2aafd3c487471c94934a5230aeb00608f59b80c880ce777440
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 18 Aug 2021 10:32:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
537422
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
59555
access-control-allow-origin
*
last-modified
Wed, 18 Aug 2021 10:31:58 GMT
etag
"59b0bd2bf71a6ea4a84151c51b91fba8"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 e92dffa8673a73c15c61e7c3abefc47d.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
ZRH50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
qnJyHhJb58j7BdCikhPnizxqSmbpFULkHYhnjvt0cpuDWvIX91YABw==
box-25a418976ea02a6f393fbbe77cec94bb.html
vars.hotjar.com/ Frame B19C
2 KB
1 KB
Document
General
Full URL
https://vars.hotjar.com/box-25a418976ea02a6f393fbbe77cec94bb.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-465352.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.102.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-79.zrh50.r.cloudfront.net
Software
/
Resource Hash
7a44e0685d8929b5d4d50476273c9957c8c76f03afc424c665a4066e5bc1beb9

Request headers

:method
GET
:authority
vars.hotjar.com
:scheme
https
:path
/box-25a418976ea02a6f393fbbe77cec94bb.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://page.firstleaf.club/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
https://page.firstleaf.club/

Response headers

content-type
text/html
content-length
1044
date
Sun, 18 Jul 2021 00:16:30 GMT
accept-ranges
bytes
cache-control
max-age=31536000
content-encoding
br
etag
"76922233be8bdb14c053af468d29404a"
last-modified
Thu, 15 Jul 2021 14:16:09 GMT
x-amz-server-side-encryption
AES256
x-robots-tag
none
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 6b0e09b8a7d995016df1513b4b11c17e.cloudfront.net (CloudFront)
x-amz-cf-pop
ZRH50-C1
x-amz-cf-id
z0hheMNc0nnn65sxgdECrwff2e-2ivLXQEsniD3wWNrGA6U9_zMwUw==
age
3252757
pipeline
ct.firstleaf.club/prh/ Frame
0
0
Preflight
General
Full URL
https://ct.firstleaf.club/prh/pipeline
Protocol
H2
Server
2606:4700:10::6816:2be0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://page.firstleaf.club
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-length
0
access-control-allow-origin
https://page.firstleaf.club
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, SP-Anonymous
access-control-max-age
5
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
683dba930ca4dfcb-FRA
pipeline
ct.firstleaf.club/prh/
2 B
312 B
XHR
General
Full URL
https://ct.firstleaf.club/prh/pipeline
Requested by
Host: images.firstleaf.club
URL: https://images.firstleaf.club/js/sp-at-v2-14-0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
683dba95ed7e5b44-FRA
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
access-control-allow-origin
https://page.firstleaf.club
access-control-allow-credentials
true
content-type
text/plain; charset=UTF-8
content-length
2
j
s-vop.sundaysky.com/t/v1/
Redirect Chain
  • https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_1...
  • https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_1...
645 B
645 B
Image
General
Full URL
https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&cb=1605776153&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&udt.segment=visitor&_cvt=t&timestamp=1629820148098&nonce=3iqr30k19taoqre7maafg5j688&signature=690e42326fecd521b29e032c8be1099ff0b8d92f
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.237.157.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-237-157-181.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:07 GMT
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI PUR COM NAV INT DEM STA PRE"
Cache-control
private, no-cache, no-cache=Set-Cookie, must-revalidate, proxy-revalidate, max-age=0
Connection
keep-alive
Content-Type
application/javascript;charset=UTF-8
Content-Length
645
X-XSS-Protection
1; mode=block
Expires
Sat, 1 Apr 2000 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:07 GMT
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI PUR COM NAV INT DEM STA PRE"
Location
https://s-vop.sundaysky.com/t/v1/j?a=firstleaf&ap=1&m=uui&pb=f&sp=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&cb=1605776153&udt.ptype=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&udt.segment=visitor&_cvt=t&timestamp=1629820148098&nonce=3iqr30k19taoqre7maafg5j688&signature=690e42326fecd521b29e032c8be1099ff0b8d92f
Cache-control
private, no-cache, no-cache=Set-Cookie, must-revalidate, proxy-revalidate, max-age=0
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Expires
Sat, 1 Apr 2000 00:00:00 GMT
integrations
rbv9j7km.firstleaf.club/
42 B
246 B
Script
General
Full URL
https://rbv9j7km.firstleaf.club/integrations?source=firstleaf
Requested by
Host: rbv9j7km.firstleaf.club
URL: https://rbv9j7km.firstleaf.club/assets/wxyz.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.203.152.45 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
openresty /
Resource Hash
a6e9e1722cffa254dc5061e3d89fc40a4faec0cd7d44819923657d498e8df822

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:07 GMT
Content-Encoding
gzip
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/javascript
jpuid
rbv9j7km.firstleaf.club/
67 B
409 B
Script
General
Full URL
https://rbv9j7km.firstleaf.club/jpuid?jsonp=RB.jsonPUID
Requested by
Host: rbv9j7km.firstleaf.club
URL: https://rbv9j7km.firstleaf.club/assets/wxyz.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.203.152.45 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
openresty /
Resource Hash
c30d80930b9f7ebf235ad92c96036d57ba6e877aa09987e97594e5fbeec36502

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:07 GMT
Content-Encoding
gzip
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/javascript
tracker-latest.min.js
d2hrivdxn8ekm8.cloudfront.net/
10 KB
10 KB
Script
General
Full URL
https://d2hrivdxn8ekm8.cloudfront.net/tracker-latest.min.js
Requested by
Host: d2hrivdxn8ekm8.cloudfront.net
URL: https://d2hrivdxn8ekm8.cloudfront.net/tag-manager/c8fdefca-b38f-49ff-a307-bcb109f7aefb-latest.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:b400:17:3f5c:f800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8dd95d85ec6c727b643ee77877b0f0f871e5e0c23c4a4f8b2717c8e2992113ea

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id
TMoLD_DiUBmYAiSnr6YprAKLygQ3P9GG
via
1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
last-modified
Thu, 25 Mar 2021 23:09:46 GMT
server
AmazonS3
age
20482
etag
"0e1055fa94f517c775220f50e87ea05b"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
date
Tue, 24 Aug 2021 10:07:46 GMT
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
9967
x-amz-cf-id
qIZArjYbOXLWoh97jCAviPJgh6SDjHIVBUVaO7VNv5QVQjoN-CQBcw==
5a28e627
dvqigh9b7wa32.cloudfront.net/
43 B
492 B
XHR
General
Full URL
https://dvqigh9b7wa32.cloudfront.net/5a28e627?data=dmVyc2lvbj0xLjIuMTImdG9rZW49YzhmZGVmY2EtYjM4Zi00OWZmLWEzMDctYmNiMTA5ZjdhZWZiJnNlc3Npb25JZD05MzkyNmYzYi1lYjY2LTlmNzEtYzI3NC1hZDRmZjBiNjQ1YzA%3D&date=1629820147702
Requested by
Host: d2hrivdxn8ekm8.cloudfront.net
URL: https://d2hrivdxn8ekm8.cloudfront.net/tracker-latest.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.89.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-89-17.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 09:17:40 GMT
via
1.1 25d46f0dbca17b9a78cca036e17d8ad3.cloudfront.net (CloudFront)
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age
23487
x-cache
Hit from cloudfront
content-length
43
last-modified
Wed, 08 Mar 2017 06:19:28 GMT
server
AmazonS3
etag
"fb02f374b8f73825415db1bccd4bd76d"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
image/gif
access-control-allow-origin
*
x-amz-cf-pop
ZRH50-C1
accept-ranges
bytes
x-amz-cf-id
yyKUrOszAUrUHtfA1ih2hGDdvNtACtgc-FcTZRjYV86tuNuuAYsAHQ==
5a28e627
d330aiyvva2oww.cloudfront.net/
43 B
494 B
XHR
General
Full URL
https://d330aiyvva2oww.cloudfront.net/5a28e627?data=aXB2Nj10cnVlJnZlcnNpb249MS4yLjEyJnRva2VuPWM4ZmRlZmNhLWIzOGYtNDlmZi1hMzA3LWJjYjEwOWY3YWVmYiZzZXNzaW9uSWQ9OTM5MjZmM2ItZWI2Ni05ZjcxLWMyNzQtYWQ0ZmYwYjY0NWMw&date=1629820147702
Requested by
Host: d2hrivdxn8ekm8.cloudfront.net
URL: https://d2hrivdxn8ekm8.cloudfront.net/tracker-latest.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:4000:3:760:2800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 23 Aug 2021 22:53:55 GMT
via
1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age
60913
x-cache
Hit from cloudfront
content-length
43
last-modified
Wed, 08 Mar 2017 06:19:28 GMT
server
AmazonS3
etag
"fb02f374b8f73825415db1bccd4bd76d"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
image/gif
access-control-allow-origin
*
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
_6Q__RTDvM7__vPOPHXoGF__vGNeq494iKHghhi4wNoTDoIVHfGSKQ==
5a28e627
d1lu3pmaz2ilpx.cloudfront.net/
43 B
449 B
XHR
General
Full URL
https://d1lu3pmaz2ilpx.cloudfront.net/5a28e627?data=dmVyc2lvbj0xLjIuMTImdG9rZW49YzhmZGVmY2EtYjM4Zi00OWZmLWEzMDctYmNiMTA5ZjdhZWZiJnNlc3Npb25JZD05MzkyNmYzYi1lYjY2LTlmNzEtYzI3NC1hZDRmZjBiNjQ1YzAmY29va2llU3VwcG9ydD1QRVJTSVNUJmV2ZW50PXBhZ2V2aWV3JiUyNG9zPVdpbmRvd3MmJTI0cmVmZXJyZXI9aHR0cHMlM0ElMkYlMkZqYWNvYnMucGVya3Nwb3QuY29tJTJGJiUyNGN1cnJlbnRVcmw9aHR0cHMlM0ElMkYlMkZwYWdlLmZpcnN0bGVhZi5jbHViJTJGcXVpeiUzRnV0bV9zb3VyY2UlM0Rjal9hZmZpbGlhdGUlMjZmcmllbmRzJTNEdHJ1ZSUyNnV0bV9tZWRpdW0lM0RjcGElMjZ1dG1fY2FtcGFpZ24lM0QxODUwNzcxXzEyJTJCSW50ZXJhY3RpdmUlMkJMTENfMjA5NzA2MiUyNnV0bV90ZXJtJTNEJTI2dXRtX2NvbnRlbnQlM0QxMzU1Mjg0NV82JTJCQm90dGxlcyUyQmZvciUyQiUyNTI0NDAlMkJQbHVzJTJCRnJlZSUyQlNoaXBwaW5nJTJCZm9yJTJCYSUyQlllYXIlMjZ1dG1fc3ViY2FtcGFpZ24lM0QyMDk3MDYyJTI2Y2pldmVudCUzRGNmZWY2NDdmMDRmMjExZWM4MDc1MDMyYzBhMTgwNTBm&date=1629820147708
Requested by
Host: d2hrivdxn8ekm8.cloudfront.net
URL: https://d2hrivdxn8ekm8.cloudfront.net/tracker-latest.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2190:6800:17:f683:1d40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 13:52:27 GMT
via
1.1 c76347c8ef1f3a2b6fb69cd7d1c6f749.cloudfront.net (CloudFront)
vary
Origin
age
7001
x-cache
Hit from cloudfront
content-length
43
last-modified
Wed, 08 Mar 2017 06:19:28 GMT
server
AmazonS3
etag
"fb02f374b8f73825415db1bccd4bd76d"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
image/gif
access-control-allow-origin
*
x-amz-cf-pop
ZRH50-C1
accept-ranges
bytes
x-amz-cf-id
B9iEEiU5JVEyNULFSL3pT6EnxqtsL3Ub3ncaSSybDsqjGf_sgFDA0Q==
web-widget-preload-d9d81488360f65d03f84.js
static.zdassets.com/web_widget/latest/ Frame B67E
88 KB
32 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbb99457e56765ea4bea432267ab799598687f0a3cedf17ca67efb913ee9d9ec
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
397785
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
4Q3JEDADYY0YPQ6M
x-amz-id-2
4GcTnFjmyHh3ukA5HgP+mpHvxmHRUMbz5oX9lww43RO2u0TOj9KzlUuDAKyWmqJUz14i4TmrZ4s=
last-modified
Thu, 19 Aug 2021 06:56:54 GMT
server
cloudflare
etag
W/"344f0fe59e0f077ebeeeef03607601ac"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8L2tRfx0zClaZEgB4hgZ7jKH1EEJpDGHDD5FXqTi6ZehiC3ljhZ3lMkIYmOJ9ta2JlfUD5EJVHRUrTWOfRdZGuVq700WqPEzwdlx8LzLZPx12QqEiJbEC5NrU3kzgbLsfM%2BJzKU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
57Ip39pR3YbL9FqP79r8Y7su0sTb6uxl
cf-ray
683dba93797e4c86-AMS
expires
Fri, 19 Aug 2022 06:56:53 GMT
web-widget-framework-97edc71e1362291b402d.js
static.zdassets.com/web_widget/latest/ Frame B67E
184 KB
60 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eeaf2e313228f5fa957d5cf730e42df5cf45b7e2132a594d470576a88736a481
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
397785
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
4Q3VZ42PDHS8X1TT
x-amz-id-2
S2uEwZHGl+E6BzLxDC5n2Ea33S0aubhUaQxKIPVDmw2r+5eGV2GKZhSQ5p5RWMX17kKg+U4xJSU=
last-modified
Thu, 19 Aug 2021 06:56:54 GMT
server
cloudflare
etag
W/"e374a6019f706d78fc0110673a8149b4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZPs6A6lHJoPhPgItVHB12CjUCXZAGCXtUUPkpBzmx2Prlwntoy%2BphQfJ1DmFxULP9vSM0vRmQ0tmbbe%2F52Wr%2Bk1W2nFTJX7HPfdYIrOtCP3qnyaRR7XCHujC5%2FKSzlIiKgUojyM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
Wk53zNM1BfAU488Z5dqm0HEqnFW4uGAe
cf-ray
683dba9379804c86-AMS
expires
Fri, 19 Aug 2022 06:56:53 GMT
web-widget-chat-sdk-ad0bca0cd862985f164f.js
static.zdassets.com/web_widget/latest/ Frame B67E
203 KB
52 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-chat-sdk-ad0bca0cd862985f164f.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a77ebced88a45b7146f3e8b0359f37d658f0f6e0eb481583ee9319cb601d893
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3078297
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
31A3BAY1ZH9GD1BV
x-amz-id-2
tfFkqroZKroq+pqLI+M3idv/nOENLrOjrlitzrzbLnFwRXLmuGoNzapA4k4INMPdjWyRcioA/K8=
last-modified
Mon, 19 Jul 2021 02:04:04 GMT
server
cloudflare
etag
W/"093f405bc41723c43486a657a0e1a173"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hnUFFTTafbjndOkzq7w%2B8qxRkoaG4TPl31T7Kdl3Pz1OrZEwzgrioOlATtECqOsD3IUmfWZIi5bq7wOnCpeHHlUm8sY6EMcvB%2FZktFKkStZmFvWEv7C7S1wo7wQKpVWyqp3qDfc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
6nLy1oZDiI0GDEsA2cGfRKjp8Mm1fRS8
cf-ray
683dba9379814c86-AMS
expires
Tue, 19 Jul 2022 02:04:03 GMT
web-widget-preload-d9d81488360f65d03f84.js
static.zdassets.com/web_widget/latest/ Frame C813
88 KB
32 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbb99457e56765ea4bea432267ab799598687f0a3cedf17ca67efb913ee9d9ec
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
397785
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
4Q3JEDADYY0YPQ6M
x-amz-id-2
4GcTnFjmyHh3ukA5HgP+mpHvxmHRUMbz5oX9lww43RO2u0TOj9KzlUuDAKyWmqJUz14i4TmrZ4s=
last-modified
Thu, 19 Aug 2021 06:56:54 GMT
server
cloudflare
etag
W/"344f0fe59e0f077ebeeeef03607601ac"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t6v%2BAS%2FqJIXv1vXJvmPx2Pumi4HB2ETh634epFkOmuRHXXP8YQA5C9X9N4VUWGECCR8eabz2G3m%2BIMsPr8pPH52e7Czgor4bK%2FXFj43OUm4ZbR0vDsEA5dG0lcon689O6TzEsQc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
57Ip39pR3YbL9FqP79r8Y7su0sTb6uxl
cf-ray
683dba9379824c86-AMS
expires
Fri, 19 Aug 2022 06:56:53 GMT
web-widget-framework-97edc71e1362291b402d.js
static.zdassets.com/web_widget/latest/ Frame C813
184 KB
59 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eeaf2e313228f5fa957d5cf730e42df5cf45b7e2132a594d470576a88736a481
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
397785
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
4Q3VZ42PDHS8X1TT
x-amz-id-2
S2uEwZHGl+E6BzLxDC5n2Ea33S0aubhUaQxKIPVDmw2r+5eGV2GKZhSQ5p5RWMX17kKg+U4xJSU=
last-modified
Thu, 19 Aug 2021 06:56:54 GMT
server
cloudflare
etag
W/"e374a6019f706d78fc0110673a8149b4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N7c8%2B3mWpSnq%2FvsWSPs6FiKTwnanGFvCR1fKGj%2B5%2BA8Qm%2FzTT1ewEV16qUCsajzU7H%2Fka%2F8IzMmCV29dgog3NBhBjpz2QxkXpE7SPE0maYqa1%2FR0Uo9w68s5WD1vU29A7UhXY%2Bs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
Wk53zNM1BfAU488Z5dqm0HEqnFW4uGAe
cf-ray
683dba9379854c86-AMS
expires
Fri, 19 Aug 2022 06:56:53 GMT
web-widget-chat-sdk-ad0bca0cd862985f164f.js
static.zdassets.com/web_widget/latest/ Frame C813
203 KB
52 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-chat-sdk-ad0bca0cd862985f164f.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a77ebced88a45b7146f3e8b0359f37d658f0f6e0eb481583ee9319cb601d893
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3078297
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
31A3BAY1ZH9GD1BV
x-amz-id-2
tfFkqroZKroq+pqLI+M3idv/nOENLrOjrlitzrzbLnFwRXLmuGoNzapA4k4INMPdjWyRcioA/K8=
last-modified
Mon, 19 Jul 2021 02:04:04 GMT
server
cloudflare
etag
W/"093f405bc41723c43486a657a0e1a173"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TqQ1ovA2K5hMIyF2oFLlRm%2Be%2Fj7Cztpmp4dV4UHoXfrqAHnjp1j1Roi5pYklwfazkU32Dr9B5QetcpjW5hFNZMssfs19RGx2Utra8l1A1B8iqpfxtinuvd7awFplbY3gBIJU76o%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
6nLy1oZDiI0GDEsA2cGfRKjp8Mm1fRS8
cf-ray
683dba9379874c86-AMS
expires
Tue, 19 Jul 2022 02:04:03 GMT
config
fbapi.firstleaf.club/.open-bridge/
0
0

/
www.facebook.com/tr/
44 B
147 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1669030446688031&ev=PageView&dl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&rl=https%3A%2F%2Fjacobs.perkspot.com%2F&if=false&ts=1629820147767&sw=1600&sh=1200&v=2.9.44&r=stable&ec=0&o=30&fbp=fb.1.1629820147765.1299446688&eid=ob2_plugin-set_3c1feb2198306f310880bf709eee317be8218119a54fcd28812ecadf1c8a789e&it=1629820147467&coo=false&rqm=GET
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Tue, 24 Aug 2021 15:49:07 GMT
track
web.chtbl.com/
49 B
380 B
XHR
General
Full URL
https://web.chtbl.com/track
Requested by
Host: ext.chtbl.com
URL: https://ext.chtbl.com/trackable.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:ae00:0:cc59:3900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
uvicorn /
Resource Hash
bb30148d9df7671c14f2cd5be91e6b7a1488932efb740a80b66f39052744c168

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type
application/json;charset=UTF-8

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
via
1.1 9128c49d19c76fd86ec4c647434ccb0a.cloudfront.net (CloudFront)
server
uvicorn
x-amz-cf-pop
FRA50-C1
vary
Origin
access-control-allow-methods
OPTIONS,POST
content-type
application/json
access-control-allow-origin
*
x-cache
Miss from cloudfront
access-control-allow-headers
*
content-length
49
x-amz-cf-id
jvoc1pWZfPF_shZypO0eGnprbGFWjrbzw1Fn19qV8VLtMVb_klEiGQ==
track
web.chtbl.com/ Frame
0
0
Preflight
General
Full URL
https://web.chtbl.com/track
Protocol
H2
Server
2600:9000:2156:ae00:0:cc59:3900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
uvicorn /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://page.firstleaf.club
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-type
application/json
content-length
49
date
Tue, 24 Aug 2021 15:49:07 GMT
server
uvicorn
access-control-allow-methods
OPTIONS,POST
access-control-allow-headers
*
access-control-allow-origin
*
vary
Origin
x-cache
Miss from cloudfront
via
1.1 9128c49d19c76fd86ec4c647434ccb0a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
SyT1ZxvqN8gVWFG6sHVIqLNt3TVFugJ9QJBDejKvTImVED-_HdWnsw==
config
penrosehill.zendesk.com/embeddable/
1 KB
1 KB
XHR
General
Full URL
https://penrosehill.zendesk.com/embeddable/config
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1847eaa967fa68572b15907b46b8c40d76095549e9af076ac613e21d8de52eb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:07 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-zendesk-zorg
yes
x-zendesk-origin-server
embeddable-app-server-757d8758c7-v2vx7
access-control-allow-methods
GET
vary
Origin, Accept-Encoding
x-cached
MISS
x-request-id
683dba942fd140ef-IAD, 683dba942fd140ef-IAD
x-runtime
0.001753
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
1728000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WTaoVbACbHs8llNo0V%2FcmVG8jsXOIoXL8KSNj%2BA4p%2B%2BdNHll0JR1pitUpZ%2FMBJIRxViYwUCY3LCxctwfBJ6qN8uCxy%2B26s%2FIsi2%2FOqkS2ewI2usxgrAaWFk7h7fYiPd3c5xIMz%2FL88s6"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
public, max-age=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray
683dba942fd140ef-LHR
config
penrosehill.zendesk.com/embeddable/
1 KB
861 B
XHR
General
Full URL
https://penrosehill.zendesk.com/embeddable/config
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/ekr/snippet.js?key=b253b5fa-0522-4fcb-b2f3-9056b25ec9b1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1847eaa967fa68572b15907b46b8c40d76095549e9af076ac613e21d8de52eb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-zendesk-zorg
yes
x-zendesk-origin-server
embeddable-app-server-757d8758c7-s4dlv
access-control-allow-methods
GET
vary
Origin, Accept-Encoding
x-cached
MISS
x-request-id
683dba942fd440ef-LHR, 683dba942fd440ef-LHR
x-runtime
0.001172
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
1728000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xKgyE2629LOQaBke44MLfqYHo7dWExH2FLAxwHqnuGzmysj04aVATNpqR1gy8XmIpqRZfEoVo9sUlIkQS61rVsQXHiTNDgN%2Bgo8%2BB7dAGTvG1JN1dmZxW5BHdqmyNiJF%2Fj6Oxkuncrwm"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
public, max-age=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray
683dba942fd440ef-LHR
/
data.cdnbasket.net/
100 B
449 B
XHR
General
Full URL
https://data.cdnbasket.net/
Requested by
Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bc5e3af4a13fb7099bc155a3b357edf2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.186.228.232 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
232.228.186.35.bc.googleusercontent.com
Software
/
Resource Hash
dddbefca801fe592189033bf1dd2495f0d9b9cc11415d33c6e542049e5e1efe1

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:08 GMT
Transfer-Encoding
chunked
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Headers
Origin, Content-Type, Accept
Expires
0
/
page.cdnbasket.net/
57 B
406 B
XHR
General
Full URL
https://page.cdnbasket.net/
Requested by
Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bc5e3af4a13fb7099bc155a3b357edf2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.245.27 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.245.178.107.bc.googleusercontent.com
Software
/
Resource Hash
0acc6818b6a6578b044f85f1bad10d66c20edb3347fd1e0cf7403d2d2260cc92

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:08 GMT
Transfer-Encoding
chunked
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Headers
Origin, Content-Type, Accept
Expires
0
/
view.cdnbasket.net/
57 B
406 B
XHR
General
Full URL
https://view.cdnbasket.net/
Requested by
Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bc5e3af4a13fb7099bc155a3b357edf2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.83.84 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
84.83.190.35.bc.googleusercontent.com
Software
/
Resource Hash
eccd2e8f9e883f74421b6f7310316ac70ecfbb30f966639b2ca31a9be8dc10ff

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 24 Aug 2021 15:49:08 GMT
Transfer-Encoding
chunked
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Headers
Origin, Content-Type, Accept
Expires
0
j
rp4.liadm.com/
Redirect Chain
  • https://rp.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2B...
  • https://rp4.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2...
13 B
569 B
XHR
General
Full URL
https://rp4.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&refr=https%3A%2F%2Fjacobs.perkspot.com%2F&duid=a0b8fe163af0--01fdwdkp0ewf817j4tc940cszd&se=e30&dtstmp=1629820147856&i6=MmEwMTo0Zjg6MTIxOjEzMWE6OjI%3D&n3pc=true
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.206.124.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-124-188.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
x-pixel-event-id
8ccbf771-25f0-44dd-a13f-2194980084d6
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
request-time
1
vary
Origin
content-length
13
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
nginx/1.18.0
x-frame-options
DENY
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/json
access-control-allow-origin
null
access-control-allow-credentials
true
trace-id
4d2f013dfa73f823

Redirect headers

date
Tue, 24 Aug 2021 15:49:08 GMT
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
nginx/1.18.0
vary
Origin
location
https://rp4.liadm.com/j?tna=v2.0.1&aid=a-069s&wpn=lc-bundle&pu=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&refr=https%3A%2F%2Fjacobs.perkspot.com%2F&duid=a0b8fe163af0--01fdwdkp0ewf817j4tc940cszd&se=e30&dtstmp=1629820147856&i6=MmEwMTo0Zjg6MTIxOjEzMWE6OjI%3D&n3pc=true
x-frame-options
DENY
access-control-allow-origin
https://page.firstleaf.club
x-xss-protection
1; mode=block
x-permitted-cross-domain-policies
master-only
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
trace-id
49218556efb5d7f2
request-time
0
content-length
0
x-content-type-options
nosniff
local_storage_frame16.min.html
assets.bounceexchange.com/assets/bounce/ Frame 840A
2 KB
1 KB
Document
General
Full URL
https://assets.bounceexchange.com/assets/bounce/local_storage_frame16.min.html
Requested by
Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bc5e3af4a13fb7099bc155a3b357edf2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
95.72.98.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
f2f11e4d45030f1f21ec7d3ae67a65b83c4c67016fe861fbebdff04ca0c8cd60

Request headers

:method
GET
:authority
assets.bounceexchange.com
:scheme
https
:path
/assets/bounce/local_storage_frame16.min.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://page.firstleaf.club/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
https://page.firstleaf.club/

Response headers

x-guploader-uploadid
ADPycdsy_64rJYjaAXYK-Jfj4swrzgPqSLmS1SrbEMbZrA3rpLHOkuOK7NcQiGz17ZYHoM8QPX9bvGAibuYDL_gE4c-j9W_CrA
date
Tue, 27 Jul 2021 07:49:07 GMT
expires
Wed, 27 Jul 2022 07:49:07 GMT
last-modified
Wed, 21 Jul 2021 13:51:07 GMT
etag
"14069ce2fb6b93493204f90c2ddf1067"
x-goog-generation
1626875467658110
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
x-goog-stored-content-length
1055
content-type
text/html; charset=UTF-8
content-encoding
gzip
x-goog-hash
crc32c=G6KB+g== md5=FAac4vtrk0kyBPkMLd8QZw==
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
vary
Accept-Encoding
content-length
1055
access-control-allow-origin
*
access-control-expose-headers
etag Content-Type
server
UploadServer
cache-control
public,max-age=31536000
age
2448000
alt-svc
clear
page
rs.fullstory.com/rec/
2 KB
1 KB
XHR
General
Full URL
https://rs.fullstory.com/rec/page
Requested by
Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.194.186.35.bc.googleusercontent.com
Software
/
Resource Hash
06b7173ef05c46ce8a3b160805d624bdc61f1223d78317aa622f0815f169c2fb

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
gzip
content-type
application/json; charset=utf-8
access-control-allow-origin
https://page.firstleaf.club
access-control-allow-credentials
true
alt-svc
clear
content-length
1026
via
1.1 google
en-us-json-c92f040571c86c5604a4.js
static.zdassets.com/web_widget/latest/web-widget-locales/ Frame C813
33 KB
7 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-locales/en-us-json-c92f040571c86c5604a4.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6eb4e5bf06118c495126b1cf6f5f370f94bc7651c6525d6c606877170afbf53a
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
738505
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
0TBV60A79Z96NHFA
x-amz-id-2
nmsb3c7vCzxhDfkxWWx0UqPrGt9Ibcee3mnut3akBqyyz7Vljdn5Esz75cUqy1/6V2OaALxHsZg=
last-modified
Fri, 13 Aug 2021 00:23:14 GMT
server
cloudflare
etag
W/"38e7cc9c495c12720eec3517509bd5e3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P0fM0R2K6cYKUVLGsjYPlO%2BklwnY8VtPDAWr12rvoHt8dePE2ry48WUrxbn%2F45GlsecA%2FvMLtnL3MECtCY6VLTNy0Wb4TS5LW6KRW1drGQO16Xm%2BHgXrOMEmGcaUrkvw4xstqGI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
nxyhPh39LbwqesfRpjKXUZuzYoFcnoU5
cf-ray
683dba950b544c86-AMS
expires
Sat, 13 Aug 2022 00:23:13 GMT
web-widget-218-a0e6bddf78f556c0ba98.js
static.zdassets.com/web_widget/latest/ Frame C813
330 KB
100 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-218-a0e6bddf78f556c0ba98.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9dcaeb939318effbb2db3a742e54dba4b1d31e84858207fb43b75a4b6a576dd7
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1291451
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
NMMVGY97EERBT9S0
x-amz-id-2
yEYoF4CZYjClgh5qy89ifZQokaoi3D/qINbwHHlxPlRqrHZsOv+e9iMxDa720RZb7GemgmHLX3Y=
last-modified
Mon, 09 Aug 2021 15:03:50 GMT
server
cloudflare
etag
W/"d270a189c9839f5d9d7f3e49bbeae2d8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m8zDDQRORPxY78Xq97VIZQ45Wx6SUuMotLwr2LGqTGWq9K6MYMPY1D10XDyUGd3C8dsPPyrp8f42hkbVZWA7uw5sV9AqhD0aXa78qNCax0RJWFRwHDzNziFGaNX5WuNZi%2BQZ6rE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
3sjv5e8lvY6f4Mm3flRDrq1MhhcZeVSU
cf-ray
683dba950b574c86-AMS
expires
Tue, 09 Aug 2022 15:03:49 GMT
web-widget-9829-5f3c12ec148288f64210.js
static.zdassets.com/web_widget/latest/ Frame C813
91 KB
25 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-9829-5f3c12ec148288f64210.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0987ab417187ff28db7f13e2ba5a66623e2b2cc83ba11308c8735df9a9db2792
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
738505
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
0TBS30EW49BDBRCH
x-amz-id-2
iDatlsCNBJN8nIaPicGQQ6pq0JwTtFoqW3HGYnfv7bIPfxwXqnL8iRXm7mr01+gjJVm43b5waSs=
last-modified
Fri, 13 Aug 2021 00:23:50 GMT
server
cloudflare
etag
W/"c416333951b19b5a604bb7f65785650e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ktw4BOd1UY0VDDLtZoKcvdKJp8PkSsqQsEog7InwSkrUjvzwwgxOPhX3No%2FTE7pKNuRiXdb5G10wf9uKufD0M7DoXCtxPhU9zL1jZ7oglgXAD5Fgfxelf%2BWnd0fTK3ZxuQao7YU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
49ot3h21npFAkxmz5L51VOsC2.m1cZtL
cf-ray
683dba950b594c86-AMS
expires
Sat, 13 Aug 2022 00:23:49 GMT
web_widget-0eb90e308aa2a8387460.js
static.zdassets.com/web_widget/latest/web-widget-lazy/ Frame C813
417 KB
89 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-lazy/web_widget-0eb90e308aa2a8387460.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eccbf3fae72a87817cd2d39cca489de2c2d9f73b130d223882a1c36b88919da0
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
397786
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
4Q3PJANJ74DCJSP8
x-amz-id-2
rJAlNUnAKoWbvjG2rA8uHKnOF1igvPVlukSSDMgbr82cfxCprmheqMA5RqzaThCFfNLMpAmLHa4=
last-modified
Thu, 19 Aug 2021 06:55:13 GMT
server
cloudflare
etag
W/"9fb8b7e9cc7e6cea49362f07cb92834c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J5t3GtOUdlbGqlvoDlLi%2BHqZ8HF%2FkX%2Bj0ZHnESCn36hTqxBTSLLiPi8qZwvZ64U%2FKs5ozj1JTodHvfAxbcioWsENhtkncyGnAwPi6jUZnk%2FU%2BSDiOoE0V18dvTWT0dlDrSnpIO0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
ZZZrJnthwO1ZQ_GxukaRr7aoxAPsnxhT
cf-ray
683dba950b5a4c86-AMS
expires
Fri, 19 Aug 2022 06:55:12 GMT
rb
rbv9j7km.firstleaf.club/v2/
44 B
338 B
Image
General
Full URL
https://rbv9j7km.firstleaf.club/v2/rb?pageReferrer=https%3A%2F%2Fjacobs.perkspot.com%2F&url=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&action=view&source=firstleaf&rb_source=firstleaf&script_version=wxyz.js&sessionId=7a109442-dd1e-459f-b0cc-de1796519960&uid=rbos-2502348d-a449-445b-8ff8-19018705364e
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.203.152.45 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
openresty /
Resource Hash
039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:08 GMT
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
image/gif
embeddable_blip
penrosehill.zendesk.com/ Frame C813
0
454 B
XHR
General
Full URL
https://penrosehill.zendesk.com/embeddable_blip?type=pageView&data=eyJjaGFubmVsIjoid2ViX3dpZGdldCIsInBhZ2VWaWV3Ijp7InJlZmVycmVyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tLyIsInRpbWUiOjAsImxvYWRUaW1lIjo0MS4yMDAwMDA3NjI5Mzk0NSwibmF2aWdhdG9yTGFuZ3VhZ2UiOiJlbi1VUyIsInBhZ2VUaXRsZSI6IkJ1eWluZyBBd2FyZC1XaW5uaW5nIFdpbmUgSXMgU2ltcGxlIFdpdGggRmlyc3RsZWFmIiwidXNlckFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzkyLjAuNDUxNS4xNTkgU2FmYXJpLzUzNy4zNiIsImlzTW9iaWxlIjpmYWxzZSwiaXNSZXNwb25zaXZlIjp0cnVlLCJ2aWV3cG9ydE1ldGEiOiJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIiwiaGVscENlbnRlckRlZHVwIjpmYWxzZX0sImJ1aWQiOiI0ODQ0OTY0YzNiMTAwMjAzODg0YjkzYWQzYTQwOTkwZiIsInN1aWQiOiIwNzQ2MWE4ZGQxYzM5MTljNzMwMzFlZjQxYzNjZWZiNyIsInZlcnNpb24iOiIwYmQ2MGFiNmQiLCJ0aW1lc3RhbXAiOiIyMDIxLTA4LTI0VDE1OjQ5OjA4LjA4N1oiLCJ1cmwiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpej91dG1fc291cmNlPWNqX2FmZmlsaWF0ZSZmcmllbmRzPXRydWUmdXRtX21lZGl1bT1jcGEmdXRtX2NhbXBhaWduPTE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjImdXRtX3Rlcm09JnV0bV9jb250ZW50PTEzNTUyODQ1XzYrQm90dGxlcytmb3IrJTI0NDArUGx1cytGcmVlK1NoaXBwaW5nK2ZvcithK1llYXImdXRtX3N1YmNhbXBhaWduPTIwOTcwNjImY2pldmVudD1jZmVmNjQ3ZjA0ZjIxMWVjODA3NTAzMmMwYTE4MDUwZiJ9
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-zendesk-zorg
yes
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cr6wTnF5%2BRqPRQOosM2tmRwr3ktnoP%2B2TGRj6e0IdQMpf0jYvDG%2Fr0wTmNCUJhDW9NNAdSxgenc%2BH%2B7N3oo1OUfCdrwDHy3CZQbhPV%2BUjp2p69uDdSbc6HIPxvFmgh8L%2B4mD9gDSqgja"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://page.firstleaf.club
accept-ranges
bytes
cf-ray
683dba959a8540ef-LHR
vary
Accept-Encoding
content-length
0
x-request-id
52abef918ba86e701d813288cb9b7742
sa.css
tags.srv.stackadapt.com/
80 B
307 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-165-186-74.compute-1.amazonaws.com
Software
/
Resource Hash
36e5ff0bed43f4b93707ba74eef50c8cf9169b84892a80294ecfb0f36db1f703

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 24 Aug 2021 15:49:08 GMT
Cache-Control
only-if-cached, no-transform, private, max-age=7776000
Connection
keep-alive
Content-Length
80
Content-Type
text/css
sa.jpeg
tags.srv.stackadapt.com/
0
881 B
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: jacobs.perkspot.com
URL: https://jacobs.perkspot.com/offer/1420262/none?utm_medium=email&utm_id=weeklyblast
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-165-186-74.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 24 Aug 2021 15:49:08 GMT
Cache-Control
only-if-cached, no-transform, private, max-age=7776000
Connection
keep-alive
Content-Length
651
Content-Type
image/jpeg
tv2track.php
collector-7547.tvsquared.com/
42 B
276 B
Image
General
Full URL
https://collector-7547.tvsquared.com/tv2track.php?action_name=Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf&idsite=TV-27455427-1&rec=1&r=855205&h=17&m=49&s=8&url=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&urlref=https%3A%2F%2Fjacobs.perkspot.com%2F&_id=8b53636b1d03b6ea&_idts=1629820148&_idvc=0&_idn=1&_viewts=&cookie=1&res=1600x1200&gt_ms=73
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.219.93.205 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-219-93-205.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:08 GMT
Server
nginx
Connection
keep-alive
Request-Id
b2984566-c36f-4351-b28b-cadb3bff7a97
P3p
CP='OTI DSP COR NID STP UNI OTPa OUR'
Content-Length
42
Content-Type
image/gif
2CCB709CDC50
api.datasteam.io/v1/C/RawData/
208 B
795 B
Script
General
Full URL
https://api.datasteam.io/v1/C/RawData/2CCB709CDC50?v=0152a23c-ae3c-4017-800d-99e93ec5a637&se=2ebf3bd4-7964-48ac-972e-d11c8a016ed7&d=eyJ2IjoiMDE1MmEyM2MtYWUzYy00MDE3LTgwMGQtOTllOTNlYzVhNjM3IiwibSI6IjA3OTY2YmMwLTZhM2QtNDlhNi04NTRlLTM1ZjdkNDI1MDMzMiIsImNzaSI6IiIsInNlIjoiMmViZjNiZDQtNzk2NC00OGFjLTk3MmUtZDExYzhhMDE2ZWQ3IiwibiI6MSwicCI6IjMzNjA5YWViLTNlZmItNGZkNi1hZTE4LTM2OGZhYmM4NDRkNyIsInUiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpej91dG1fc291cmNlPWNqX2FmZmlsaWF0ZSZmcmllbmRzPXRydWUmdXRtX21lZGl1bT1jcGEmdXRtX2NhbXBhaWduPTE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjImdXRtX3Rlcm09JnV0bV9jb250ZW50PTEzNTUyODQ1XzYrQm90dGxlcytmb3IrJTI0NDArUGx1cytGcmVlK1NoaXBwaW5nK2ZvcithK1llYXImdXRtX3N1YmNhbXBhaWduPTIwOTcwNjImY2pldmVudD1jZmVmNjQ3ZjA0ZjIxMWVjODA3NTAzMmMwYTE4MDUwZiIsInBuIjoiL3F1aXoiLCJyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tLyIsInQiOiJCdXlpbmcgQXdhcmQtV2lubmluZyBXaW5lIElzIFNpbXBsZSBXaXRoIEZpcnN0bGVhZiIsImMiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpeiIsInByIjoiOUNEQzUwIiwidXRtX3MiOiJjal9hZmZpbGlhdGUiLCJ1dG1fbSI6ImNwYSIsInV0bV9jIjoiMTg1MDc3MV8xMitJbnRlcmFjdGl2ZStMTENfMjA5NzA2MiIsInMiOjEsInZzIjoxLCJsIjoiUGFnZUxvYWQifQ%3D%3D&callback=cbf2e2e3c07c9de
Requested by
Host: cdn.datasteam.io
URL: https://cdn.datasteam.io/js/D22CCB709CDC50.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.22.146.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-22-146-11.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
3a93df543083c11f919d60466fb4a325b129b26b9eca6cd4d4e32069792c64cc

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:07 GMT
Server
Kestrel
Connection
keep-alive
Content-Length
208
c
ids.cdnwidget.com/
31 B
170 B
XHR
General
Full URL
https://ids.cdnwidget.com/c?cookieID=&deviceID=&iv=&v=&GCH1=729d75981c40ef36dbb3922b610cbb99&SCH1=1d6dfbbbb7b96c912aaa879429e9cbed&GCS1=026122067&GCS2=YWVkMDY4ZmUtZjdiYS00MGI3LTgxMGEtYjNhNDU2ZmNhNzI2LmxvY2FsLGZkNmJkMGEzLWQyNTEtNDUxZS04MDhiLTliOGY3MTQ4MTA1Yi5sb2NhbA==&pe=false&wsid=4263&log=%7B%22config%22%3A%7B%22gmEN%22%3Atrue%2C%22pixEN%22%3Afalse%7D%2C%22apikey%22%3A%222%5EHIykD%22%2C%22cjsversion%22%3A%221.5.9%22%2C%22wsid%22%3A4263%2C%22loadID%22%3A%22XzAScA9TG84SGRm%22%2C%22timing%22%3A%7B%22sessionStorageLoad%22%3A6%2C%22IDStageStart%22%3A6%2C%22netComplete%22%3A147%2C%22obsReqdata%22%3A356%2C%22obsReqpage%22%3A362%2C%22obsReqview%22%3A392%2C%22IDStagePrefire%22%3A392%7D%2C%22matches%22%3A%7B%22cookie%22%3Afalse%2C%22LS%22%3Afalse%7D%2C%22info%22%3A%7B%22isSpoofed%22%3Atrue%2C%22PM%22%3Afalse%2C%22DNT%22%3Afalse%2C%22deviceTimezone%22%3A2%2C%22extensionID%22%3Anull%2C%22externalID%22%3Anull%2C%22agent%22%3A%7B%22device%22%3Anull%7D%2C%22firstLoad%22%3Atrue%7D%7D
Requested by
Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bc5e3af4a13fb7099bc155a3b357edf2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.47.17 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
17.47.211.130.bc.googleusercontent.com
Software
/
Resource Hash
6627c5ab36fa407f18fc9b6987e359eccef005ae6d35b370d2142b7daa770324

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin
https://page.firstleaf.club
date
Tue, 24 Aug 2021 15:49:08 GMT
via
1.1 google
access-control-allow-credentials
true
alt-svc
clear
content-type
application/json
en-us-json-c92f040571c86c5604a4.js
static.zdassets.com/web_widget/latest/web-widget-locales/ Frame B67E
33 KB
7 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-locales/en-us-json-c92f040571c86c5604a4.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6eb4e5bf06118c495126b1cf6f5f370f94bc7651c6525d6c606877170afbf53a
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
738505
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
0TBV60A79Z96NHFA
x-amz-id-2
nmsb3c7vCzxhDfkxWWx0UqPrGt9Ibcee3mnut3akBqyyz7Vljdn5Esz75cUqy1/6V2OaALxHsZg=
last-modified
Fri, 13 Aug 2021 00:23:14 GMT
server
cloudflare
etag
W/"38e7cc9c495c12720eec3517509bd5e3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iyqd5TtvabORfGTZwam%2Fw%2FriOnwUUVguMVxl0BqR6OoPuDeZQ0L3oasz8z%2FGrzViENFLq3vn1sI1xdEi5VH3Lycwk2iG0ON297nfqHSN2PUDUMEzKtPOyuOnGW%2F23JSnlI9eS9g%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
nxyhPh39LbwqesfRpjKXUZuzYoFcnoU5
cf-ray
683dba969d5b4c86-AMS
expires
Sat, 13 Aug 2022 00:23:13 GMT
web-widget-218-a0e6bddf78f556c0ba98.js
static.zdassets.com/web_widget/latest/ Frame B67E
330 KB
100 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-218-a0e6bddf78f556c0ba98.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9dcaeb939318effbb2db3a742e54dba4b1d31e84858207fb43b75a4b6a576dd7
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1291451
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
NMMVGY97EERBT9S0
x-amz-id-2
yEYoF4CZYjClgh5qy89ifZQokaoi3D/qINbwHHlxPlRqrHZsOv+e9iMxDa720RZb7GemgmHLX3Y=
last-modified
Mon, 09 Aug 2021 15:03:50 GMT
server
cloudflare
etag
W/"d270a189c9839f5d9d7f3e49bbeae2d8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yuhwtJGQs%2FXOqY4bwNmGpWRaF%2FkIJ5%2FWSLR48dGKCNrDMb%2Fa0JJeYidc7JXEB4m2c6ifw5tg8SZjuyTg5gPGtIVInJhSxD2Kef%2BIMI6xDQm7MqrzmtomhEAhPwUwKEmv3ApDlbQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
3sjv5e8lvY6f4Mm3flRDrq1MhhcZeVSU
cf-ray
683dba969d5f4c86-AMS
expires
Tue, 09 Aug 2022 15:03:49 GMT
web-widget-9829-5f3c12ec148288f64210.js
static.zdassets.com/web_widget/latest/ Frame B67E
91 KB
25 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-9829-5f3c12ec148288f64210.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0987ab417187ff28db7f13e2ba5a66623e2b2cc83ba11308c8735df9a9db2792
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
738505
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
0TBS30EW49BDBRCH
x-amz-id-2
iDatlsCNBJN8nIaPicGQQ6pq0JwTtFoqW3HGYnfv7bIPfxwXqnL8iRXm7mr01+gjJVm43b5waSs=
last-modified
Fri, 13 Aug 2021 00:23:50 GMT
server
cloudflare
etag
W/"c416333951b19b5a604bb7f65785650e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dtLNYTNOVUsNOWXqHcwKOFm1N69h6tsAwuWf2%2FCENDLwPfHSAuDgTKoazKwOAgcFmst3w7DFHNfa3EkVEJS2%2BxQ2E4wagaQHdhcMyHZHp%2BTt7Od1A1nRAS4h51WpKZKdJMBhmI8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
49ot3h21npFAkxmz5L51VOsC2.m1cZtL
cf-ray
683dba969d624c86-AMS
expires
Sat, 13 Aug 2022 00:23:49 GMT
web_widget-0eb90e308aa2a8387460.js
static.zdassets.com/web_widget/latest/web-widget-lazy/ Frame B67E
417 KB
89 KB
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-lazy/web_widget-0eb90e308aa2a8387460.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eccbf3fae72a87817cd2d39cca489de2c2d9f73b130d223882a1c36b88919da0
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
397786
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
4Q3PJANJ74DCJSP8
x-amz-id-2
rJAlNUnAKoWbvjG2rA8uHKnOF1igvPVlukSSDMgbr82cfxCprmheqMA5RqzaThCFfNLMpAmLHa4=
last-modified
Thu, 19 Aug 2021 06:55:13 GMT
server
cloudflare
etag
W/"9fb8b7e9cc7e6cea49362f07cb92834c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lIzsfvn0eTu0nB7lUmm8JJEPsFUfl%2BkfD3YLeeEdNe%2FOohhU0lHHp4oHuZ3H5G00tgOF66SEecC70kCqYKZoRYs6bS5GGCTN8eLL9tuY1Xe0r1fhLI%2FbkXzDF9pbh1UjDRgklW0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
ZZZrJnthwO1ZQ_GxukaRr7aoxAPsnxhT
cf-ray
683dba969d644c86-AMS
expires
Fri, 19 Aug 2022 06:55:12 GMT
/
www.facebook.com/tr/
44 B
88 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1669030446688031&ev=Microdata&dl=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&rl=https%3A%2F%2Fjacobs.perkspot.com%2F&if=false&ts=1629820148269&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf%22%2C%22meta%3Adescription%22%3A%22Firstleaf%20brings%20you%20the%20best%20wines%20that%20fit%20your%20individual%20taste%20when%20you%20become%20a%20member%20of%20our%20award-winning%20wine%20club%22%2C%22meta%3Akeywords%22%3A%22wine%2C%20wine%20club%22%7D&cd[OpenGraph]=%7B%22og%3Alocale%22%3A%22en_US%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22Discover%20Award-Winning%20Wines%20From%20Around%20The%20World%20That%20Are%20Personalized%20To%20Your%20Individual%20Taste%22%2C%22og%3Adescription%22%3A%22Our%20world-class%20winemakers%20will%20send%20you%20the%20best%20wines%2C%20specific%20to%20your%20individual%20palate%2C%20at%20a%20value%20that%20can%27t%20be%20beat.%22%2C%22og%3Asite_name%22%3A%22Discover%20Award-Winning%20Wines%20From%20Around%20The%20World%20That%20Are%20Personalized%20To%20Your%20Individual%20Taste%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fpage.firstleaf.club%2Fquiz%22%2C%22og%3Aimage%22%3A%22%2F%2Fv.fastcdn.co%2Fu%2F814df80e%2F34504091-0-Unboxing03-132-1.jpg%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fv.fastcdn.co%2Fu%2F814df80e%2F34504091-0-Unboxing03-132-1.jpg%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.44&r=stable&ec=1&o=30&fbp=fb.1.1629820147765.1299446688&eid=ob2_plugin-set_ac4d147e09cf00f686ad2e5ba6fae3b44516ee51ad747fbd6f50ddb04c6012c8&it=1629820147467&coo=false&es=automatic&tm=3&rqm=GET
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
expires
Tue, 24 Aug 2021 15:49:08 GMT
embeddable_blip
penrosehill.zendesk.com/ Frame B67E
0
280 B
XHR
General
Full URL
https://penrosehill.zendesk.com/embeddable_blip?type=pageView&data=eyJjaGFubmVsIjoid2ViX3dpZGdldCIsInBhZ2VWaWV3Ijp7InJlZmVycmVyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tLyIsInRpbWUiOjAsImxvYWRUaW1lIjo1NC43MDAwMDA3NjI5Mzk0NSwibmF2aWdhdG9yTGFuZ3VhZ2UiOiJlbi1VUyIsInBhZ2VUaXRsZSI6IkJ1eWluZyBBd2FyZC1XaW5uaW5nIFdpbmUgSXMgU2ltcGxlIFdpdGggRmlyc3RsZWFmIiwidXNlckFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzkyLjAuNDUxNS4xNTkgU2FmYXJpLzUzNy4zNiIsImlzTW9iaWxlIjpmYWxzZSwiaXNSZXNwb25zaXZlIjp0cnVlLCJ2aWV3cG9ydE1ldGEiOiJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIiwiaGVscENlbnRlckRlZHVwIjpmYWxzZX0sImJ1aWQiOiI3YWNlNDFiMTNiOTVkM2UzOTAwNDg3OWNmOGNhYmY2YyIsInN1aWQiOiI2ZWYyOGQyN2ZlYzVkOWQyMjI4YzllODFjYTU2ZjkyNSIsInZlcnNpb24iOiIwYmQ2MGFiNmQiLCJ0aW1lc3RhbXAiOiIyMDIxLTA4LTI0VDE1OjQ5OjA4LjQxNloiLCJ1cmwiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpej91dG1fc291cmNlPWNqX2FmZmlsaWF0ZSZmcmllbmRzPXRydWUmdXRtX21lZGl1bT1jcGEmdXRtX2NhbXBhaWduPTE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjImdXRtX3Rlcm09JnV0bV9jb250ZW50PTEzNTUyODQ1XzYrQm90dGxlcytmb3IrJTI0NDArUGx1cytGcmVlK1NoaXBwaW5nK2ZvcithK1llYXImdXRtX3N1YmNhbXBhaWduPTIwOTcwNjImY2pldmVudD1jZmVmNjQ3ZjA0ZjIxMWVjODA3NTAzMmMwYTE4MDUwZiJ9
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-zendesk-zorg
yes
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ayf5jhJ7GHKoEP6ylFvzUeWK7Po9l1wzh%2Ff2R0e4yT1wBerAlISTCrLKBDSbPeclUAqd522snyH7MrU4irMy54qAq4u6uQHxo%2B4cvcp8M4GNRv%2FF98qQc1UxdV9r3YL2sRf2g0gsOzFk"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://page.firstleaf.club
accept-ranges
bytes
cf-ray
683dba97ae0b40ef-LHR
vary
Accept-Encoding
content-length
0
x-request-id
33a3662b4f11a2f71b1e1c9726671a27
embeddable_blip
penrosehill.zendesk.com/ Frame B67E
0
283 B
XHR
General
Full URL
https://penrosehill.zendesk.com/embeddable_blip?type=performance&data=eyJwZXJmb3JtYW5jZSI6eyJpbml0SW50ZXJ2YWwiOjkxMSwiY29uZmlnTG9hZFRpbWUiOjQyNn0sImJ1aWQiOiJiZDA5ZDQwZDM1OGE2NmY1NzFlMjE5YzYxMWNhYTc1MCIsInN1aWQiOiIzNGYwOTk2MGRmM2E3MGEwZDIwYmQ1YmUzMjZjNWY2OSIsInZlcnNpb24iOiIwYmQ2MGFiNmQiLCJ0aW1lc3RhbXAiOiIyMDIxLTA4LTI0VDE1OjQ5OjA4LjQxN1oiLCJ1cmwiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpej91dG1fc291cmNlPWNqX2FmZmlsaWF0ZSZmcmllbmRzPXRydWUmdXRtX21lZGl1bT1jcGEmdXRtX2NhbXBhaWduPTE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjImdXRtX3Rlcm09JnV0bV9jb250ZW50PTEzNTUyODQ1XzYrQm90dGxlcytmb3IrJTI0NDArUGx1cytGcmVlK1NoaXBwaW5nK2ZvcithK1llYXImdXRtX3N1YmNhbXBhaWduPTIwOTcwNjImY2pldmVudD1jZmVmNjQ3ZjA0ZjIxMWVjODA3NTAzMmMwYTE4MDUwZiJ9
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-framework-97edc71e1362291b402d.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.51.111 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-zendesk-zorg
yes
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IdjF52GFh6qt7iVS45ED1Pw0nD8KdQ00URKwf1TlQ%2F6eCcGcsUM%2BAB%2B02K6rzxtO6D50I1Me%2BV4unnthI7jEJPAyYdQj3lmtW7%2FefgVgZQWhqveRZpV75y6dOa21l7SFfeWckpVYWwmL"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://page.firstleaf.club
accept-ranges
bytes
cf-ray
683dba97ae2e40ef-LHR
vary
Accept-Encoding
content-length
0
x-request-id
4dce673abc925f96cd5ae2d7d6322d2c
fs.js
edge.fullstory.com/s/ Frame 96EF
209 KB
63 KB
Script
General
Full URL
https://edge.fullstory.com/s/fs.js
Requested by
Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.112.186 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
186.112.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
082a814158a4221fc2e1da585435b8d31fa704f221169ebe12b9b4d3573016a2

Request headers

Origin
https://page.firstleaf.club
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:19:06 GMT
content-encoding
gzip
age
1802
x-guploader-uploadid
ADPycdvpatabkazmiFJ2xp0RVaeChmrlHhvbnjI-1Ht_hBQJNSdBeit4U4E4gkxGoZ7SdO-Hs4U-9DLTbK9qVwz-lyx67uE-OQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
64115
last-modified
Thu, 05 Aug 2021 19:32:56 GMT
server
UploadServer
etag
"22b58691e95646727daf16321cfe2ed1"
x-goog-hash
crc32c=z4hkXw==, md5=IrWGkelWRnJ9rxYyHP4u0Q==
x-goog-generation
1628191976428607
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600,no-transform
x-goog-stored-content-length
64115
accept-ranges
bytes
content-type
application/javascript
expires
Tue, 24 Aug 2021 16:19:06 GMT
fs.js
edge.fullstory.com/s/ Frame BA89
209 KB
63 KB
Script
General
Full URL
https://edge.fullstory.com/s/fs.js
Requested by
Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.112.186 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
186.112.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
082a814158a4221fc2e1da585435b8d31fa704f221169ebe12b9b4d3573016a2

Request headers

Origin
https://page.firstleaf.club
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:19:06 GMT
content-encoding
gzip
age
1802
x-guploader-uploadid
ADPycdvpatabkazmiFJ2xp0RVaeChmrlHhvbnjI-1Ht_hBQJNSdBeit4U4E4gkxGoZ7SdO-Hs4U-9DLTbK9qVwz-lyx67uE-OQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
64115
last-modified
Thu, 05 Aug 2021 19:32:56 GMT
server
UploadServer
etag
"22b58691e95646727daf16321cfe2ed1"
x-goog-hash
crc32c=z4hkXw==, md5=IrWGkelWRnJ9rxYyHP4u0Q==
x-goog-generation
1628191976428607
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600,no-transform
x-goog-stored-content-length
64115
accept-ranges
bytes
content-type
application/javascript
expires
Tue, 24 Aug 2021 16:19:06 GMT
bundle
rs.fullstory.com/rec/
29 B
91 B
XHR
General
Full URL
https://rs.fullstory.com/rec/bundle?OrgId=134SPF&UserId=4872181789270016&SessionId=6329740983312384&PageId=5009430757548032&Seq=1&PageStart=1629820148166&PrevBundleTime=0&LastActivity=510&IsNewSession=true
Requested by
Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.194.186.35.bc.googleusercontent.com
Software
/
Resource Hash
d4e6f499ae83c676daba1fdfbbc57de7cdb350343f6fe42b4108ad7c66f2515d

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://page.firstleaf.club
date
Tue, 24 Aug 2021 15:49:08 GMT
via
1.1 google
access-control-allow-credentials
true
alt-svc
clear
content-length
29
content-type
application/json; charset=utf-8
init1.js
api.bounceexchange.com/bounce/
36 B
320 B
Script
General
Full URL
https://api.bounceexchange.com/bounce/init1.js?wklz=C4ewVgigvAZgrgOwMbAJYgQMhQZygRgDYAmATgA5iAGfAFnIFYqHNgAvEKAWn2swHcApgCMcqYIID6qACZRaxQgGZMAJ0E4QAGzhoMBQlSoAPXkbWCYg1etVQwAQyQhRAOgAO1gNY53IYK7OALbYDlpaqAgA5pJwqlpQABbAwO44AKRKAILpxABiuXnuDlGCrjCoqjjAWoIOMIE6woUAjnCobJl5ukGSmnFIgpkAIkhgkvUVEQ4SuYQwqqiCCDIZSsPAqnBDij2SQYIyqHBBI0jFc3tIDkHFqFEII-iMVADsr-iSvLkAQgCSCAkqicaAAbjsfgAZSEAYUk1FIryoJEuwF6QNO61RvWcgOWwCeSgYDGI5FoDEkhF+P38NQ0vxgIFUv1yJNotCovwACjoMsQfnl1BCAMqJVDudyRKIMpm-By-ACadWZuzRfTgwmutwc90e6wRSJRijGgnBgLOVhghForxgVFoMGI+HwgiQ5DeTCUxCQVAcz2YVBgmFBqDEwEkzhAXiWUHSrx+uWIWncicyOWIxGSqT5DGyrPy+aKJTKFSqdPqjQ1hbaHVZSm6av6qkGddG40mqGms2IJPmi2Wq1bm22+cIewORxOrfO8p7qpxNzuD1bzyY70+3zn-zxwJQqHB+ahsPhVERyOIo72GNbl7VuIk5p763wRJJZIpVK3NJStRz-MZKokgmc5shyh48nAf4CkKh6iuKkrRIeAGHrOQFKg4gHzuqmqLjqy5PsMBrnqOJpmgSBFIJa1q2vajrOq67qvJ63q+v6TAwKmxAwomKoXnmGaOM4bieKoPh+AEwSpq8wzYCAUYxnGwHEKCqZ5vGiamtYkhaCAUSlDI0iPBmaYwGEOA7NxGbXKo4YtMAACeqlZJyXGJtZ4agmEI7GdkLmWcQOAakE4gSAZGBhjsfFZKZWjmbk-nuX0gjkVFMVxa5GY6XphyGdIMj4qgFSHE5aVDNJ8WJjIUR5JU1SQiADgyE5w5lTJnlVAA2ll+mGQAurAZmCMGGE4B1mmqNpuk9ZE-WlcNnWJXZ9n9VQ82jYlnk6IIK1rR17iqCABn7aggyzYNu37YdkgIDc20DbFQ3taNkR9KASBeGdD27YFwjBSkOXheId1zU9HWJeZwCfeZu3dTlL2yAVRUyFDj0jR1pZSLDBkzVALXBvlMBgxhtkOTtoIE0TNmSJt2xkxT4PJSj+OWF1U1wwgeWI0syP3dDkbRlIoAgNpGGlLzQ3CO4UCrclUsdQARO58sADSKzMghREy9kq-Ll0yHAKA6zWbDy71mDuMAeCybc0zIFIMBaCUUDBokDhQEAA
Requested by
Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_bc5e3af4a13fb7099bc155a3b357edf2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.4.53 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
53.4.117.34.bc.googleusercontent.com
Software
istio-envoy /
Resource Hash
fe3fcb884394be745dbd11141b6d780028a4d86106b6292d7502db096f582218

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
via
1.1 google
server
istio-envoy
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-encoding
gzip
x-envoy-upstream-service-time
17
content-type
text/html; charset=UTF-8
alt-svc
clear
cjs-logger
e.cdnwidget.com/
0
68 B
Image
General
Full URL
https://e.cdnwidget.com/cjs-logger?source=ID%20generation%20error&severity=Warning&error=Country%2520not%2520allowed&cookieID=&deviceID=&BXWID=4263&warpspeed=2%5EHIykD&loadID=XzAScA9TG84SGRm&version=1.5.9
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.221.36 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
36.221.107.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
via
1.1 google
alt-svc
clear
content-type
image/png
web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js
static.zdassets.com/web_widget/latest/ Frame C813
337 B
704 B
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3a3ab89bc8d4feb680748ba773ff13a07c2db610c1308ec9c12040aa9b65d46b
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3078303
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
R0EMPM7SV24WKMWR
x-amz-id-2
aWz5ad5XM0iHyU++SxDxGYjYuW1Z0JSzwBoxQMyjMvXiyFhtmx5owXFlv1YsrrZfAiWHdGssAI4=
last-modified
Mon, 19 Jul 2021 02:04:04 GMT
server
cloudflare
etag
W/"200371227ff3b0fb85badb2d2faef3b5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HiQGlafjSLHU3hw9rVAifDCGXCANei6VO4QY%2Byd7QCIl9HlKUo88yknBDkDaab75OnKKERK7fTj%2B8pFUroDBcqCdqlssjKIQFzyM4HpTmzh1O2FwvhViGoEHOEPYZfScyjRod0Q%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
___O_wFiyDX4A56Xq4fDhtClHpW0qk0i
cf-ray
683dba98d84e4c86-AMS
expires
Tue, 19 Jul 2022 02:04:03 GMT
saq_pxl
tags.srv.stackadapt.com/
116 B
424 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=IOSBs3FjUaqbjgRgvgMP0A&is_js=true&landing_url=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&t=Buying%20Award-Winning%20Wine%20Is%20Simple%20With%20Firstleaf&host=https://page.firstleaf.club
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-165-186-74.compute-1.amazonaws.com
Software
/
Resource Hash
bce81f2aefa4042dd1af80d01b7f9c874e95aadb151fa05cfaae23e64e8f3e86

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:08 GMT
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://page.firstleaf.club
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
116
g.jsonp
aa.agkn.com/adscores/
82 B
391 B
Script
General
Full URL
https://aa.agkn.com/adscores/g.jsonp?sid=9202274878&userid=9CDC50-0152A23C-AE3C-4017-800D-99E93EC5A637
Requested by
Host: cdn.datasteam.io
URL: https://cdn.datasteam.io/js/D22CCB709CDC50.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.8.243.222 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-8-243-222.eu-west-2.compute.amazonaws.com
Software
AAWebServer /
Resource Hash
9e446e75dc20b6dc693b247aaf7704112e55ef434588368aa0761fc76b3a29a5

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Aug 2021 15:49:08 GMT
server
AAWebServer
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
cache-control
no-cache, no-store, must-revalidate
content-type
application/json
content-length
82
expires
0
63537
i6.liadm.com/s/
Redirect Chain
  • https://i.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-0152A23C-AE3C-4017-800D-99E93EC5A637
  • https://i6.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-0152A23C-AE3C-4017-800D-99E93EC5A637
43 B
447 B
Image
General
Full URL
https://i6.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-0152A23C-AE3C-4017-800D-99E93EC5A637
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:444a:4602:b51a:2bef:14:5241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:09 GMT
Cache-Control
no-store
Connection
keep-alive
trace-id
59fdbfd6f709506a
Content-Length
43
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/63537?bidder_id=242861&bidder_uuid=9CDC50-0152A23C-AE3C-4017-800D-99E93EC5A637
Date
Tue, 24 Aug 2021 15:49:08 GMT
Connection
keep-alive
trace-id
6e7f133a402de60f
Content-Length
0
Strict-Transport-Security
max-age=31536000; includeSubDomains
fda6cd35495c75f83508d9d2e77ee33d.mp3
static.zdassets.com/web_widget/latest/ Frame C813
19 KB
20 KB
Media
General
Full URL
https://static.zdassets.com/web_widget/latest/fda6cd35495c75f83508d9d2e77ee33d.mp3
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
97e5b0b6cfc2ba9815028429c069631ba12b294aa7419d1ea130accd0adc2d46
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range
bytes=0-

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
YEC3DGB0GRDD6DAB
x-amz-server-side-encryption
AES256
cf-ray
683dba9908944c86-AMS
Content-Range
bytes 0-19697/19698
x-amz-replication-status
COMPLETED
Content-Length
19698
x-amz-id-2
ha5EGdSvJc2foSgOfpU8pSbkMyX4jzU4saxXnVBCxFL4gWdAB+nzeao/Bie2CCHKU2fZlMwt8eY=
last-modified
Mon, 23 Aug 2021 23:28:35 GMT
server
cloudflare
etag
"f11ce9e8f40a392830217253fe75d6de"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BkS2r5SQCbMAisM6Yh3PS5bYlWTgjQDEygJaJOUH5Hx2Mf3BcdDLEyDnlEeOqmtrHmsuzEebGBRBIe2RWl4Hb165b%2B2o9yv2KO4lNGlJLACfxutBPJmY1pU95AZUyTM5up3nZaE%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
O7Ps8bp437FYfPdbGZPcf1VBhcf9ZiJE
cache-control
public, max-age=31536000
accept-ranges
bytes
content-type
audio/mpeg; charset=utf-8
expires
Tue, 23 Aug 2022 23:28:34 GMT
2CCB709CDC50
api.datasteam.io/v1/C/RawData/
208 B
795 B
Script
General
Full URL
https://api.datasteam.io/v1/C/RawData/2CCB709CDC50?v=0152a23c-ae3c-4017-800d-99e93ec5a637&se=2ebf3bd4-7964-48ac-972e-d11c8a016ed7&d=eyJ2IjoiMDE1MmEyM2MtYWUzYy00MDE3LTgwMGQtOTllOTNlYzVhNjM3IiwibSI6ImU1MDMyMmMyLTViZTEtNDNjNi1iZTEwLTFkY2Q5NTE3YzNiOSIsImNzaSI6IiIsInNlIjoiMmViZjNiZDQtNzk2NC00OGFjLTk3MmUtZDExYzhhMDE2ZWQ3IiwicCI6IjMzNjA5YWViLTNlZmItNGZkNi1hZTE4LTM2OGZhYmM4NDRkNyIsInUiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpej91dG1fc291cmNlPWNqX2FmZmlsaWF0ZSZmcmllbmRzPXRydWUmdXRtX21lZGl1bT1jcGEmdXRtX2NhbXBhaWduPTE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjImdXRtX3Rlcm09JnV0bV9jb250ZW50PTEzNTUyODQ1XzYrQm90dGxlcytmb3IrJTI0NDArUGx1cytGcmVlK1NoaXBwaW5nK2ZvcithK1llYXImdXRtX3N1YmNhbXBhaWduPTIwOTcwNjImY2pldmVudD1jZmVmNjQ3ZjA0ZjIxMWVjODA3NTAzMmMwYTE4MDUwZiIsInBuIjoiL3F1aXoiLCJyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tLyIsInQiOiJCdXlpbmcgQXdhcmQtV2lubmluZyBXaW5lIElzIFNpbXBsZSBXaXRoIEZpcnN0bGVhZiIsImMiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpeiIsInByIjoiOUNEQzUwIiwiZWlkIjoibnNfc2VnXzAwMCIsInV0bV9zIjoiY2pfYWZmaWxpYXRlIiwidXRtX20iOiJjcGEiLCJ1dG1fYyI6IjE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjIiLCJzIjoyLCJ2cyI6MSwibCI6IkFjdGlvbiIsInYwMSI6IkVpZCIsInYwMiI6Im5zX3NlZ18wMDAifQ%3D%3D&callback=cb4d7a20da4174f
Requested by
Host: cdn.datasteam.io
URL: https://cdn.datasteam.io/js/D22CCB709CDC50.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.22.146.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-22-146-11.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
8df6cd407aab29a78027a024a87a8ed1cef0a8b02dbbe9b5eb064a83c9dc5ed7

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:08 GMT
Server
Kestrel
Connection
keep-alive
Content-Length
208
web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js
static.zdassets.com/web_widget/latest/ Frame B67E
337 B
729 B
Script
General
Full URL
https://static.zdassets.com/web_widget/latest/web-widget-chat-incoming-message-notification-bdfd1edd38ba2ec92175.js
Requested by
Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/web-widget-preload-d9d81488360f65d03f84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3a3ab89bc8d4feb680748ba773ff13a07c2db610c1308ec9c12040aa9b65d46b
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3078303
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-request-id
R0EMPM7SV24WKMWR
x-amz-id-2
aWz5ad5XM0iHyU++SxDxGYjYuW1Z0JSzwBoxQMyjMvXiyFhtmx5owXFlv1YsrrZfAiWHdGssAI4=
last-modified
Mon, 19 Jul 2021 02:04:04 GMT
server
cloudflare
etag
W/"200371227ff3b0fb85badb2d2faef3b5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BA6ZqeYrZAJizjzBb1TsWKvqNTpZhHwum8muN6kaiYhyy11N78hwPu75LPr1TnInpdYR%2ByvdnMg74V5KeDi0Sm56HxqthxjLAWL4Fkt97Y1B2hJk5wlA4tmIdJkwMyt4IJ5Os40%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
x-amz-version-id
___O_wFiyDX4A56Xq4fDhtClHpW0qk0i
cf-ray
683dba99c95d4c86-AMS
expires
Tue, 19 Jul 2022 02:04:03 GMT
fda6cd35495c75f83508d9d2e77ee33d.mp3
static.zdassets.com/web_widget/latest/ Frame B67E
19 KB
20 KB
Media
General
Full URL
https://static.zdassets.com/web_widget/latest/fda6cd35495c75f83508d9d2e77ee33d.mp3
Requested by
Host: page.firstleaf.club
URL: https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
97e5b0b6cfc2ba9815028429c069631ba12b294aa7419d1ea130accd0adc2d46
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range
bytes=0-

Response headers

date
Tue, 24 Aug 2021 15:49:08 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
YEC2A2T541YB35ZV
x-amz-server-side-encryption
AES256
cf-ray
683dba99f9914c86-AMS
Content-Range
bytes 0-19697/19698
x-amz-replication-status
COMPLETED
Content-Length
19698
x-amz-id-2
Drg51cIVZJhccJuM46ZuPCNEeuOGb02azc1Hs0H9gzHE9+HJNX33YPVA71o0I1VdTIz1e0rFx7c=
last-modified
Mon, 23 Aug 2021 23:28:35 GMT
server
cloudflare
etag
"f11ce9e8f40a392830217253fe75d6de"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fpuAw6f%2BVQKTS7EfBQBledqvDJlrxA9lC4pb0GvUWiYl5ZQCiuovu%2FtWGLnFwaWQveSPuQIp9UbXZCrXW%2FIz8N2p1SnCem0VW9YdrtslM5CedNaHCHpUDHHZitfV%2FjKemrx7QRw%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
O7Ps8bp437FYfPdbGZPcf1VBhcf9ZiJE
cache-control
public, max-age=31536000
accept-ranges
bytes
content-type
audio/mpeg; charset=utf-8
expires
Tue, 23 Aug 2022 23:28:34 GMT
2CCB709CDC50
api.datasteam.io/v1/C/RawData/
208 B
795 B
Script
General
Full URL
https://api.datasteam.io/v1/C/RawData/2CCB709CDC50?v=0152a23c-ae3c-4017-800d-99e93ec5a637&se=2ebf3bd4-7964-48ac-972e-d11c8a016ed7&d=eyJ2IjoiMDE1MmEyM2MtYWUzYy00MDE3LTgwMGQtOTllOTNlYzVhNjM3IiwibSI6IjdjYzY3ODgzLWRkNzItNDY0Ni1hMzE5LWY0YmUzODg5MWE2OCIsImNzaSI6IiIsInNlIjoiMmViZjNiZDQtNzk2NC00OGFjLTk3MmUtZDExYzhhMDE2ZWQ3IiwicCI6IjMzNjA5YWViLTNlZmItNGZkNi1hZTE4LTM2OGZhYmM4NDRkNyIsInUiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpej91dG1fc291cmNlPWNqX2FmZmlsaWF0ZSZmcmllbmRzPXRydWUmdXRtX21lZGl1bT1jcGEmdXRtX2NhbXBhaWduPTE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjImdXRtX3Rlcm09JnV0bV9jb250ZW50PTEzNTUyODQ1XzYrQm90dGxlcytmb3IrJTI0NDArUGx1cytGcmVlK1NoaXBwaW5nK2ZvcithK1llYXImdXRtX3N1YmNhbXBhaWduPTIwOTcwNjImY2pldmVudD1jZmVmNjQ3ZjA0ZjIxMWVjODA3NTAzMmMwYTE4MDUwZiIsInBuIjoiL3F1aXoiLCJyIjoiaHR0cHM6Ly9qYWNvYnMucGVya3Nwb3QuY29tLyIsInQiOiJCdXlpbmcgQXdhcmQtV2lubmluZyBXaW5lIElzIFNpbXBsZSBXaXRoIEZpcnN0bGVhZiIsImMiOiJodHRwczovL3BhZ2UuZmlyc3RsZWFmLmNsdWIvcXVpeiIsInByIjoiOUNEQzUwIiwiZWlkIjoibnNfc2VnXzAwMCIsInV0bV9zIjoiY2pfYWZmaWxpYXRlIiwidXRtX20iOiJjcGEiLCJ1dG1fYyI6IjE4NTA3NzFfMTIrSW50ZXJhY3RpdmUrTExDXzIwOTcwNjIiLCJzIjozLCJ2cyI6MSwibCI6IkFjdGlvbiIsInYwMSI6IkVzMSJ9&callback=cb27dd679561fc7
Requested by
Host: cdn.datasteam.io
URL: https://cdn.datasteam.io/js/D22CCB709CDC50.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.22.146.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-22-146-11.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
7a81a8e80f8a5f5edcea05eda32348a8278fcc5c894cb7cd6d1748969aa15784

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:08 GMT
Server
Kestrel
Connection
keep-alive
Content-Length
208
adsct
analytics.twitter.com/i/
31 B
658 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=nzfyd&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 15:49:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
pragma
no-cache
last-modified
Tue, 24 Aug 2021 15:49:09 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
78a9c4be863edee7b6554c774f12fccb4a1ef372ed40bd1322e109fcfb01f103
x-transaction
1f8d09eaa20c876e
expires
Tue, 31 Mar 1981 05:00:00 GMT
rum
page.firstleaf.club/cdn-cgi/
0
185 B
XHR
General
Full URL
https://page.firstleaf.club/cdn-cgi/rum?req_id=683dba887dcb5b44
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1a84 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-fetch-mode
cors
origin
https://page.firstleaf.club
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
empty
cookie
_gcl_au=1.1.1614649646.1629820146; query=?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f; _uetsid=d0d539e004f211ecb7fd63f68c885fdc; _uetvid=d0d55f4004f211ec975e07ffc4eff880; _ga=GA1.2.210538565.1629820147; _gid=GA1.2.1163922906.1629820147; _rdt_uuid=1629820147427.d43da7b5-b0d3-4546-b9ea-08e6cecad634; FL_Referrer=2; CJEVENT=cfef647f04f211ec8075032c0a18050f; __cf_bm=66d958b891cd51d5c2313a142a0ee740d407e05c-1629820147-1800-ASfe75FzTUQkCPoRQ5/3u/ETyPXyDuaEKSshCr8exlPhN8XfneHqK5I5smgHixFMCGpUn+4YR6PFMs+EuO0Cu4vF9YJPxIfqca7ylPAY9V2LWxMI/3DOHMtnD3CYMaWxdV30P1La15lpPl59GVUtWP0=; _gat_UA-68049103-4=1; _scid=d8d57eb2-a82e-4412-a2a2-273cdf4e4e39; _sp_ses.efdf=*; _sp_id.efdf=3e456700-faf9-4192-af4a-4ad4b8a02788.1629820148.1.1629820148.1629820148.00871b7f-566b-4cd1-9bf6-36e7e091530f; tatari-cookie-test=59567808; t-ip=1; tatari-session-cookie=93926f3b-eb66-9f71-c274-ad4ff0b645c0; _li_dcdm_c=.firstleaf.club; _lc2_fpi=a0b8fe163af0--01fdwdkp0ewf817j4tc940cszd; _fbp=fb.1.1629820147765.1299446688; _wchtbl_uid=2c1f406c-f3f1-46de-97ea-a68438e102c8; _wchtbl_sid=40d05c00-1b56-4e2a-901c-cfb58f96a958; _hjid=60144ebc-08a9-4c86-bf57-5dd263a1fd5e; _hjFirstSeen=1; rbuid=rbos-2502348d-a449-445b-8ff8-19018705364e; _wchtbl_do_not_process=1; _wchtbl_pixel_sync=0; _tq_id.TV-27455427-1.ed11=8b53636b1d03b6ea.1629820148.0.1629820148..; fs_uid=rs.fullstory.com#134SPF#4872181789270016:6329740983312384/1661356147; sp=2a8eefd6-75ec-42b6-9c15-840be72c1a87; MGX_UC=JTdCJTIyTUdYX1AlMjIlM0ElN0IlMjJ2JTIyJTNBJTIyMDE1MmEyM2MtYWUzYy00MDE3LTgwMGQtOTllOTNlYzVhNjM3JTIyJTJDJTIyZSUyMiUzQTE2MzAzNDU3NDc2NjYlN0QlMkMlMjJNR1hfUFglMjIlM0ElN0IlMjJ2JTIyJTNBJTIyMmViZjNiZDQtNzk2NC00OGFjLTk3MmUtZDExYzhhMDE2ZWQ3JTIyJTJDJTIycyUyMiUzQXRydWUlMkMlMjJlJTIyJTNBMTYyOTgyMTk0ODY2MyU3RCUyQyUyMk1HWF9DSUQlMjIlM0ElN0IlMjJ2JTIyJTNBJTIyMDk5NjQ2NjgtNGNiYS00ZTI3LTkxYzgtOTdlMjU1OTBjZTFmJTIyJTJDJTIyZSUyMiUzQTE2MzAzNDU3NDc2NjklN0QlMkMlMjJNR1hfVlMlMjIlM0ElN0IlMjJ2JTIyJTNBMSUyQyUyMnMlMjIlM0F0cnVlJTJDJTIyZSUyMiUzQTE2Mjk4MjE5NDg2NjMlN0QlMkMlMjJNR1hfRUlEJTIyJTNBJTdCJTIydiUyMiUzQSUyMm5zX3NlZ18wMDAlMjIlMkMlMjJzJTIyJTNBdHJ1ZSUyQyUyMmUlMjIlM0ExNjI5ODIxOTQ4NjYzJTdEJTdE; __zlcmid=15jkHOAGr8yFLR4
content-length
45730
:path
/cdn-cgi/rum?req_id=683dba887dcb5b44
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type
application/json
accept
*/*
cache-control
no-cache
:authority
page.firstleaf.club
referer
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
:scheme
https
sec-fetch-site
same-origin
:method
POST
Referer
https://page.firstleaf.club/quiz?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type
application/json

Response headers

date
Tue, 24 Aug 2021 15:49:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
access-control-allow-methods
POST,OPTIONS
content-type
text/plain
access-control-allow-origin
https://page.firstleaf.club
access-control-max-age
86400
access-control-allow-credentials
true
cf-ray
683dba9d6a825b44-FRA
vary
Origin
two
ec.instapagemetrics.com/t/ Frame
0
0
Preflight
General
Full URL
https://ec.instapagemetrics.com/t/two
Protocol
H2
Server
35.222.120.150 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
150.120.222.35.bc.googleusercontent.com
Software
akka-http/10.1.12 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://page.firstleaf.club
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type, SP-Anonymous
access-control-allow-origin
https://page.firstleaf.club
access-control-max-age
5
date
Tue, 24 Aug 2021 15:49:09 GMT
referrer-policy
same-origin
server
akka-http/10.1.12
strict-transport-security
max-age=315360000; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
content-length
0
two
ec.instapagemetrics.com/t/
2 B
439 B
XHR
General
Full URL
https://ec.instapagemetrics.com/t/two
Requested by
Host: cdn.instapagemetrics.com
URL: https://cdn.instapagemetrics.com/t/js/3/it.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.222.120.150 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
150.120.222.35.bc.googleusercontent.com
Software
akka-http/10.1.12 /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

date
Tue, 24 Aug 2021 15:49:10 GMT
referrer-policy
same-origin
server
akka-http/10.1.12
x-frame-options
SAMEORIGIN
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
access-control-allow-origin
https://page.firstleaf.club
access-control-allow-credentials
true
x-content-type-options
nosniff
strict-transport-security
max-age=315360000; includeSubDomains
content-type
text/plain; charset=UTF-8
vary
Accept-Encoding
content-length
2
x-xss-protection
1; mode=block
rb
rbv9j7km.firstleaf.club/v2/
44 B
338 B
Image
General
Full URL
https://rbv9j7km.firstleaf.club/v2/rb?pageReferrer=https%3A%2F%2Fjacobs.perkspot.com%2F&url=https%3A%2F%2Fpage.firstleaf.club%2Fquiz%3Futm_source%3Dcj_affiliate%26friends%3Dtrue%26utm_medium%3Dcpa%26utm_campaign%3D1850771_12%2BInteractive%2BLLC_2097062%26utm_term%3D%26utm_content%3D13552845_6%2BBottles%2Bfor%2B%252440%2BPlus%2BFree%2BShipping%2Bfor%2Ba%2BYear%26utm_subcampaign%3D2097062%26cjevent%3Dcfef647f04f211ec8075032c0a18050f&action=identify&source=firstleaf&rb_source=firstleaf&tatari_session_id=93926f3b-eb66-9f71-c274-ad4ff0b645c0&chartable_user_id=2c1f406c-f3f1-46de-97ea-a68438e102c8&script_version=wxyz.js&sessionId=7a109442-dd1e-459f-b0cc-de1796519960&uid=rbos-2502348d-a449-445b-8ff8-19018705364e
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.203.152.45 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
openresty /
Resource Hash
039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Tue, 24 Aug 2021 15:49:09 GMT
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
image/gif
bundle
rs.fullstory.com/rec/
29 B
183 B
XHR
General
Full URL
https://rs.fullstory.com/rec/bundle?OrgId=134SPF&UserId=4872181789270016&SessionId=6329740983312384&PageId=5009430757548032&Seq=2&PageStart=1629820148166&PrevBundleTime=1629820148682&LastActivity=4819&IsNewSession=true
Requested by
Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.194.186.35.bc.googleusercontent.com
Software
/
Resource Hash
716b6ea4770a3b04651d3b7b2b8c405cda5e59b0db8a9ae7b59969185c2bacb3

Request headers

Referer
https://page.firstleaf.club/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://page.firstleaf.club
date
Tue, 24 Aug 2021 15:49:13 GMT
via
1.1 google
access-control-allow-credentials
true
alt-svc
clear
content-length
29
content-type
application/json; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.google-analytics.com
URL
https://www.google-analytics.com/g/collect?v=2&tid=G-8J161FED5Z&gtm=2oe8n0&_p=486039241&sr=1600x1200&ul=en-us&cid=660937558.1629820143&dl=https%3A%2F%2Fjacobs.perkspot.com%2Foffer%2F1420262%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&dt=You%27re%20on%20your%20way%20to%20saving%20at%20Firstleaf%20Wine%20Club%20%7C%20Jacobs%20Employee%20Discount%20Program&sid=1629820142&sct=1&seg=0&_s=2
Domain
fbapi.firstleaf.club
URL
https://fbapi.firstleaf.club/.open-bridge/config?pixel_id=1669030446688031

Verdicts & Comments Add Verdict or Comment

169 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| setupGTM object| dataLayer object| __variantsData number| __page_id number| __customer_id number| __default_experience_id number| __version string| __variant number| __variant_id string| __variant_custom_name boolean| __preview number| __page_type string| __variant_hash string| __page_domain boolean| __page_generator object| __experiment_id object| _Translate object| trackingData object| GlobalSnowplowNamespace function| instapageSp function| _instapageSnowplow function| $ function| ijQuery function| jQuery object| google_tag_manager object| google_tag_data function| twq string| GoogleAnalyticsObject function| ga function| rdt function| snaptr function| UET function| UET_init function| UET_push object| uetq function| setGTMPage function| updateQueryStringParameter function| getQueryWithLink function| setLinks object| a0_0x433e function| a0_0x3d7e object| div object| innerdiv object| css object| webpackJsonp object| __eventBus object| __CF$cv$params object| __cfBeacon string| test_page function| instapageAnchorClick object| __config number| __workspaceWidth function| fbq function| _fbq object| RB object| f object| _pxDataLayer function| __pxDataTag object| pxcelData object| s object| img object| __session boolean| __cradleReady object| __featuresReady object| unknown object| gaplugins object| gaGlobal object| gaData object| twttr object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels string| cookieName string| cookieValue number| expirationTime string| date number| dateTimeNow function| hj object| _hjSettings object| _tfa object| _tvq function| snowplow object| tatari function| trackable function| saq function| _saq boolean| _fs_debug string| _fs_host string| _fs_script string| _fs_org string| _fs_namespace function| FS boolean| triedToSendCookieToNative object| WebJSBridge object| zEWebpackACJsonp function| zE function| zEmbed object| SSKY object| google_optimize object| bouncex object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules function| ownKeys function| _objectSpread function| _defineProperty function| _typeof object| Snowplow function| _MGX_LU function| _MGX_LG object| MGX object| __MGX__ object| MGX_API object| MGX_DATA object| TFASC object| TRC object| _taboola number| taboola_view_id object| TRCImpl function| __trcError function| ju_init object| LI object| __li__evt_bus object| liQ boolean| zEACLoaded object| regeneratorRuntime object| bxgraph function| reload_campaigns function| setBounceCookie function| getBounceCookie function| setBounceVisitCookie function| getBounceVisitCookie function| clearBounceCookie string| _fs_loaded function| _fs_shutdown function| $zopim object| JSON2 object| TV2Track boolean| __MGX_E__ undefined| cbf2e2e3c07c9de object| res string| current_window_url_param function| neustarResponse undefined| cb4d7a20da4174f undefined| cb27dd679561fc7 object| _htmp object| _snowplowTrackerWrapper

33 Cookies

Domain/Path Name / Value
.firstleaf.club/ Name: fs_uid
Value: rs.fullstory.com#134SPF#4872181789270016:6329740983312384/1661356147
page.firstleaf.club/ Name: _tq_id.TV-27455427-1.ed11
Value: 8b53636b1d03b6ea.1629820148.0.1629820148..
page.firstleaf.club/ Name: _wchtbl_do_not_process
Value: 1
.firstleaf.club/ Name: rbuid
Value: rbos-2502348d-a449-445b-8ff8-19018705364e
.firstleaf.club/ Name: FL_Referrer
Value: 2
.firstleaf.club/ Name: _lc2_fpi
Value: a0b8fe163af0--01fdwdkp0ewf817j4tc940cszd
.firstleaf.club/ Name: __cf_bm
Value: 66d958b891cd51d5c2313a142a0ee740d407e05c-1629820147-1800-ASfe75FzTUQkCPoRQ5/3u/ETyPXyDuaEKSshCr8exlPhN8XfneHqK5I5smgHixFMCGpUn+4YR6PFMs+EuO0Cu4vF9YJPxIfqca7ylPAY9V2LWxMI/3DOHMtnD3CYMaWxdV30P1La15lpPl59GVUtWP0=
.firstleaf.club/ Name: tatari-session-cookie
Value: 93926f3b-eb66-9f71-c274-ad4ff0b645c0
page.firstleaf.club/ Name: _wchtbl_pixel_sync
Value: 0
page.firstleaf.club/ Name: tatari-cookie-test
Value: 59567808
.firstleaf.club/ Name: _sp_ses.efdf
Value: *
.firstleaf.club/ Name: _li_dcdm_c
Value: .firstleaf.club
.firstleaf.club/ Name: __zlcmid
Value: 15jkHOAGr8yFLR4
.firstleaf.club/ Name: _uetsid
Value: d0d539e004f211ecb7fd63f68c885fdc
.firstleaf.club/ Name: _scid
Value: d8d57eb2-a82e-4412-a2a2-273cdf4e4e39
.firstleaf.club/ Name: _gat_UA-68049103-4
Value: 1
.firstleaf.club/ Name: query
Value: ?utm_source=cj_affiliate&friends=true&utm_medium=cpa&utm_campaign=1850771_12+Interactive+LLC_2097062&utm_term=&utm_content=13552845_6+Bottles+for+%2440+Plus+Free+Shipping+for+a+Year&utm_subcampaign=2097062&cjevent=cfef647f04f211ec8075032c0a18050f
.firstleaf.club/ Name: MGX_UC
Value: JTdCJTIyTUdYX1AlMjIlM0ElN0IlMjJ2JTIyJTNBJTIyMDE1MmEyM2MtYWUzYy00MDE3LTgwMGQtOTllOTNlYzVhNjM3JTIyJTJDJTIyZSUyMiUzQTE2MzAzNDU3NDc2NjYlN0QlMkMlMjJNR1hfUFglMjIlM0ElN0IlMjJ2JTIyJTNBJTIyMmViZjNiZDQtNzk2NC00OGFjLTk3MmUtZDExYzhhMDE2ZWQ3JTIyJTJDJTIycyUyMiUzQXRydWUlMkMlMjJlJTIyJTNBMTYyOTgyMTk0ODY2MyU3RCUyQyUyMk1HWF9DSUQlMjIlM0ElN0IlMjJ2JTIyJTNBJTIyMDk5NjQ2NjgtNGNiYS00ZTI3LTkxYzgtOTdlMjU1OTBjZTFmJTIyJTJDJTIyZSUyMiUzQTE2MzAzNDU3NDc2NjklN0QlMkMlMjJNR1hfVlMlMjIlM0ElN0IlMjJ2JTIyJTNBMSUyQyUyMnMlMjIlM0F0cnVlJTJDJTIyZSUyMiUzQTE2Mjk4MjE5NDg2NjMlN0QlMkMlMjJNR1hfRUlEJTIyJTNBJTdCJTIydiUyMiUzQSUyMm5zX3NlZ18wMDAlMjIlMkMlMjJzJTIyJTNBdHJ1ZSUyQyUyMmUlMjIlM0ExNjI5ODIxOTQ4NjYzJTdEJTdE
.firstleaf.club/ Name: _gid
Value: GA1.2.1163922906.1629820147
.firstleaf.club/ Name: _rdt_uuid
Value: 1629820147427.d43da7b5-b0d3-4546-b9ea-08e6cecad634
.firstleaf.club/ Name: _hjid
Value: 60144ebc-08a9-4c86-bf57-5dd263a1fd5e
.firstleaf.club/ Name: _hjFirstSeen
Value: 1
.firstleaf.club/ Name: CJEVENT
Value: cfef647f04f211ec8075032c0a18050f
page.firstleaf.club/ Name: _wchtbl_uid
Value: 2c1f406c-f3f1-46de-97ea-a68438e102c8
page.firstleaf.club/ Name: _wchtbl_sid
Value: 40d05c00-1b56-4e2a-901c-cfb58f96a958
.firstleaf.club/ Name: _sp_id.efdf
Value: 3e456700-faf9-4192-af4a-4ad4b8a02788.1629820148.1.1629820148.1629820148.00871b7f-566b-4cd1-9bf6-36e7e091530f
.firstleaf.club/ Name: _gcl_au
Value: 1.1.1614649646.1629820146
.snapchat.com/ Name: sc_at
Value: v2|H4sIAAAAAAAAAA3KwQ0AIAgEsIlIBE/QdTzCFAyvfRdaGTZUYoKCmy5XseTMJGtn0ditbmf/hejxAGLNoCUyAAAA
.firstleaf.club/ Name: _uetvid
Value: d0d55f4004f211ec975e07ffc4eff880
.firstleaf.club/ Name: t-ip
Value: 1
.firstleaf.club/ Name: sp
Value: 2a8eefd6-75ec-42b6-9c15-840be72c1a87
.firstleaf.club/ Name: _fbp
Value: fb.1.1629820147765.1299446688
.firstleaf.club/ Name: _ga
Value: GA1.2.210538565.1629820147

2 Console Messages

Source Level URL
Text
console-api warning URL: https://connect.facebook.net/en_US/fbevents.js(Line 24)
Message:
[Facebook Pixel] - Duplicate Pixel ID: 1669030446688031.
console-api warning URL: https://connect.facebook.net/en_US/fbevents.js(Line 24)
Message:
Error was Error sending XHR: 0 -

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors *.perkspot.com
X-Content-Security-Policy frame-ancestors *.perkspot.com
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
aa.trkn.us
ak.sail-horizon.com
alb.reddit.com
analytics.twitter.com
anthill.instapage.com
api.bounceexchange.com
api.datasteam.io
assets.bounceexchange.com
assets.zendesk.com
az416426.vo.msecnd.net
b-code.liadm.com
bat.bing.com
cdn.datasteam.io
cdn.heapanalytics.com
cdn.instapagemetrics.com
cdn.rollbar.com
cdn.taboola.com
cdn1-res.sundaysky.com
cj.dotomi.com
cloud.typography.com
collector-7547.tvsquared.com
connect.facebook.net
ct.firstleaf.club
d1hdjv7b05hja2.cloudfront.net
d1lu3pmaz2ilpx.cloudfront.net
d2hrivdxn8ekm8.cloudfront.net
d330aiyvva2oww.cloudfront.net
data.cdnbasket.net
dc.services.visualstudio.com
dvqigh9b7wa32.cloudfront.net
e.cdnwidget.com
ec.instapagemetrics.com
edge.fullstory.com
ekr.zdassets.com
email.perkspot.com
ext.chtbl.com
fbapi.firstleaf.club
fonts.googleapis.com
fonts.gstatic.com
g.fastcdn.co
googleads.g.doubleclick.net
heapanalytics.com
heatmap-events-collector.instapage.com
hello.myfonts.net
i.liadm.com
i6.liadm.com
ids.cdnwidget.com
images.firstleaf.club
init.blackcrow.ai
jacobs.perkspot.com
jelly.mdhv.io
page.cdnbasket.net
page.firstleaf.club
penrosehill.zendesk.com
perkspot.zendesk.com
psprods3ep.azureedge.net
rbv9j7km.firstleaf.club
rp.liadm.com
rp4.liadm.com
rs.fullstory.com
s-vop.sundaysky.com
sailthru.perkspot.com
sc-static.net
script.hotjar.com
static.ads-twitter.com
static.cloudflareinsights.com
static.hotjar.com
static.zdassets.com
stats.g.doubleclick.net
stdomi.com
t.co
tag.wknd.ai
tags.srv.stackadapt.com
tr.snapchat.com
trkn.us
v.fastcdn.co
vars.hotjar.com
view.cdnbasket.net
web.chtbl.com
www.anrdoezrs.net
www.emjcd.com
www.facebook.com
www.firstleaf.club
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.redditstatic.com
fbapi.firstleaf.club
www.google-analytics.com
104.111.232.231
104.111.239.203
104.16.51.111
104.18.70.113
104.18.72.113
104.244.42.131
104.244.42.69
107.178.245.27
13.224.102.123
13.224.102.2
13.224.102.59
13.224.102.6
13.224.102.68
13.224.102.72
13.224.102.79
13.224.89.17
13.224.89.80
13.69.106.216
130.211.47.17
142.250.184.194
143.204.98.31
143.204.98.89
151.101.12.157
151.101.13.140
151.101.13.44
159.203.152.45
167.172.228.26
18.219.93.205
192.229.133.208
216.239.38.21
23.96.203.178
2600:1f18:444a:4602:b51a:2bef:14:5241
2600:1f18:730:b120:5b38:df27:617f:9396
2600:9000:2156:4000:3:760:2800:21
2600:9000:2156:7a00:8:8845:1500:93a1
2600:9000:2156:8400:a:b27c:d040:93a1
2600:9000:2156:ae00:0:cc59:3900:93a1
2600:9000:2156:b400:17:3f5c:f800:21
2600:9000:2156:e600:b:dc44:3680:21
2600:9000:2190:6800:17:f683:1d40:21
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:4700:10::6816:2be0
2606:4700:10::ac43:1a84
2606:4700::6810:5e41
2606:4700::6811:f349
2620:1ec:bdf::45
2620:1ec:c11::200
2a00:1450:4001:800::2004
2a00:1450:4001:80e::2003
2a00:1450:4001:810::2003
2a00:1450:4001:810::2008
2a00:1450:4001:812::2003
2a00:1450:4001:813::2002
2a00:1450:4001:813::2004
2a00:1450:4001:829::200e
2a00:1450:4001:82b::2008
2a00:1450:4001:830::200a
2a00:1450:400c:c08::9a
2a00:1450:400c:c08::9c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a03:2880:f12d:83:face:b00c:0:25de
3.226.166.212
3.8.243.222
34.107.221.36
34.117.4.53
34.120.253.250
34.120.27.38
34.206.124.188
34.98.72.95
35.186.194.58
35.186.226.184
35.186.228.232
35.190.83.84
35.201.112.186
35.222.120.150
35.244.137.202
52.1.91.246
52.206.179.19
52.22.146.11
54.165.186.74
54.225.68.204
54.237.157.181
89.207.16.72
01af466f48d14857d97a67cd7025ce67c8a0b9ca83ddb6d3f313c7369c432868
0255458c627efd907d6313000cabccc2af24fbebd5c14cc112d3eaf6d1649f11
039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
06b7173ef05c46ce8a3b160805d624bdc61f1223d78317aa622f0815f169c2fb
082a814158a4221fc2e1da585435b8d31fa704f221169ebe12b9b4d3573016a2
0987ab417187ff28db7f13e2ba5a66623e2b2cc83ba11308c8735df9a9db2792
0a77ebced88a45b7146f3e8b0359f37d658f0f6e0eb481583ee9319cb601d893
0acc6818b6a6578b044f85f1bad10d66c20edb3347fd1e0cf7403d2d2260cc92
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
0e567066985125e7974f68b42914dcb134e3c38373a4a3d668bdb38a3e55f299
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
162a3eebb385684e99a8b624b77189f9b5c38cb51d1b814c1c3a84fc17c324a7
16cc547456ffa0052c3679e6c5ece2e14ad57c92b93562deb7bcb5829b7afcb7
1a764c2e4e6cc6808b49bff5d27d1db28790d291c525f3849e12fc492fb62076
1c3bd00be556bf95f92a2ab1119b8b26544a1997ab0c09f86490bc32339ad32e
200d01f0cd516bfaff8f477ceb07b4eb083cf7e56ac403153175071990d53380
2066a5c2ea3def6ac7eb16471ef8c07c031e70970d70275185fbe53d0ae85bac
255733aa26ecbe1a2608fc086d6b510fafce3647ad1ddf22392c390a1306e640
266af8d8c2c6a1818709dbd25f9e4d8a82705e3254ddd8b2ca97c41183aaeb0d
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27dc4f62298834987d3d8e5608c1af94c82ee3d18ee31858d39e0202697b5308
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
364571a2f5be79b1b7cd8ed5e011ac1d62d3c05326b879582018d4bed97cac49
36e5ff0bed43f4b93707ba74eef50c8cf9169b84892a80294ecfb0f36db1f703
3a3ab89bc8d4feb680748ba773ff13a07c2db610c1308ec9c12040aa9b65d46b
3a93df543083c11f919d60466fb4a325b129b26b9eca6cd4d4e32069792c64cc
3b5ec8ee05daecb254a5b42fd0742c2d9b0dfa20223156fa43a29f96de97d2d0
3d5345db796d43e4a5c561a4c5d99d9c06a73709b0b47e1f580b6d315f1c9212
40f2d552c0db3ead874ec52bf624d9ec88007d8b659cd7189fecc3ff19d3d248
42ae1eb8cc55b4e2382e02323c96a40e80432d3e810bce85f10c75ddacbd2e2b
437a1672bb11b8d01e8867a7cbe9f16fb1b6217b3849f15f4247ab19cb5d6a34
449319f85e3e51826d1452e7dfe201765992eeb42366d5b862c497af03721d4b
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5143cdd9667ebdd0a8d068d11aade5a818924eb03c8c9381deea5c46a1603c38
51b06909334339bd5f4027e70f4d2fd30a2a3977ee44cce7385b908ec8f51903
525f091870c1282bb4823f9e64192983f1652a3bbc84c97ca5e6c4f063ca6e82
54f3f8a69600b4c817ec5f7332b615eca054945e355238f798893bf6d1c1489f
55a72ceec0d570523aea5267ed47bbefe802949f7c3b7426554f277f96b1344f
5bf2b2b83890a96d19a0e1380220b43f046d88a4f3710b74cf6d69b72198fad1
5c1282fb121104f5a505ecbfd7194e64c98db6b830684450dcfc478021d05257
5efd1cdc9fe57d8ee4c5ee8839c2deb5a4c0a6f0eae362825bf0c94785c01632
5f9fdb61e50cacfa4aeb8191d50c647ce1507ab13801d8848d4d00be1ad6bf1d
60035f8d3292fc0b3155089baabc76fce2178f8d104ef606e4e31cbe0a2803b2
6038138cc175775b42f31d117e20be6d12d56bc495b4ccac86f2db8ca6b1240b
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
63d4ae54784e36c3b76b2bc6384fd489c10f4ff55572af5c83657686a6ae2a46
65e4d18477e0e194ae2b3848fe053621a40508eeb817ab8c832b8005edd2c6af
6627c5ab36fa407f18fc9b6987e359eccef005ae6d35b370d2142b7daa770324
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6eb4e5bf06118c495126b1cf6f5f370f94bc7651c6525d6c606877170afbf53a
7084ebbefbe4e68b8d66c66b4f05795676a2c51bd8e7fffc47a7c2e015aa0544
7125a66456daa35dd3e3e8cca4b9523e05caf0b4fa5bd5874676e7c6db40f3aa
7160bf300aedb0d16945e3ee5e15851ac0f21c571e2d4632e121eb6f1ab1d9aa
716b6ea4770a3b04651d3b7b2b8c405cda5e59b0db8a9ae7b59969185c2bacb3
724bbf6dc23c60a8ebfc0a3c99c7499c17c90182f148efb0057c9a5f2fc2a1ae
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d
779ea318ca1aa1b8d459103115b7ed6ce64ccc1e411a816ca7806b09e3f03bc5
7a44e0685d8929b5d4d50476273c9957c8c76f03afc424c665a4066e5bc1beb9
7a58cec4842503db6949177b80ece47d5f5aba937676400675bfea596bc7492b
7a81a8e80f8a5f5edcea05eda32348a8278fcc5c894cb7cd6d1748969aa15784
7e7c84efcf8e336f390d7a51a24cba3873782769b33470b31d2cef95b2f01cee
7f16b41c0ac3d3c2b732a3c136d94a34ccaef99f0d8cce5f3ef244b78c03e036
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8459ec0213bcf434156ac2e810c8ad3f800e2fadef7b41950c4399d0ed0c1e1e
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
871a395274807a496ca51c603b7320eca9fc11a7949c0df992be96f29dcb7211
89c69b70386c8e4a1be1f0dfe4b485807c2ac88bfe195de3a254a855f36d8c0c
89d2b04a6542b3cfa82cce050c54aa0039de047b27072f7c1dc1b9b82ab2e5a8
8dd95d85ec6c727b643ee77877b0f0f871e5e0c23c4a4f8b2717c8e2992113ea
8df6cd407aab29a78027a024a87a8ed1cef0a8b02dbbe9b5eb064a83c9dc5ed7
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
8fd170635383b0c3166c17896a4b975f48d4d76d8f1a1d603d0481442f052d84
9052548b73711c81589b805f3ef741747fca42bb7c6760bd1ded1bddd5c7823c
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
94c6483dadce933e499cc7f0a7cbd22d2565bbaf160f19086d55bd2e2df69f7b
95bdb8a3cd90e91621c9e68d4b157dd7fedab021ee89e9e173d17f93f0f03305
97e5b0b6cfc2ba9815028429c069631ba12b294aa7419d1ea130accd0adc2d46
97f5ecdc5516a2af7d1d027d72a74f42e41755e0039f330331cd66bd330e7b39
9dcaeb939318effbb2db3a742e54dba4b1d31e84858207fb43b75a4b6a576dd7
9e446e75dc20b6dc693b247aaf7704112e55ef434588368aa0761fc76b3a29a5
9f0fab72c8a1fea1df1d6c5d128115031a8c44ccbc7f37e314acee6acb98779b
9f4331078abd467835bcf0b2367872f497045d37ebfb32fe7d9f82cf6843d282
9fd678871d5c502175e5233f33bb7c2cb09eda96eebfa139f527b72683f8b92b
a01e4ff4f213411c091723504a716e822ca36538464759af29ba56ffe0f0c310
a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4
a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839
a6238c15d9a3deae4e52b398e99b7e9b1dc9ac26ffd6604baa8a9640c3a459c0
a6e9e1722cffa254dc5061e3d89fc40a4faec0cd7d44819923657d498e8df822
a825805da94e038e12f102f89e46f27ad9646d7ab7057753fb82786431ecc64e
a899a0398bbfbb8343c67e83098446254c1609aae412962cff6929087135a51c
a92b99b413aa8afe65e9a4943c148fdedab142e7b913dafc52a040d850a5b197
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c
b8e39dad2211fe2aafd3c487471c94934a5230aeb00608f59b80c880ce777440
b96b4f9b3146047939f342700eb43b54b7ab687d070048efa199320fc250844e
bafaf035161ee03b515d06003c1c5559b047e4ab9f72302843850618740482a8
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb30148d9df7671c14f2cd5be91e6b7a1488932efb740a80b66f39052744c168
bbf7c43612543660ff95df57151eeca1a83e4dc59ff40df67fde5c3e20d7b71f
bce81f2aefa4042dd1af80d01b7f9c874e95aadb151fa05cfaae23e64e8f3e86
bdeda331b720b33bf5b8bc88d52d16a1c40da840b41f4692e3ed70253fed9486
c151d0f1c12c1ca6dc262f901b62a2e595d7da89411a6a43101d869f015d666e
c3060cd252f0a0a5f81a15fbef41b596d2db68cefe3de3e0a8c16fdc7177da0f
c30d80930b9f7ebf235ad92c96036d57ba6e877aa09987e97594e5fbeec36502
c4a07a396ffa057bcc0ca3da5adb8ffc76619e7246b4d8d13b327427fa00709c
c77d5979a9eb0e45bd243053b0724ea63b2d3381a0b43a3ec80ad58df66cf781
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cf4731e62066a0dd232bda3ae64cb3293df6488f92969b61457622cab819cf8f
d06ae5e97e495832fc4526c3e93d7e9440f1faf5f77669b41678c9d564a25faf
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393
d0f6bf2305f367f3f41e105e5a2ae6bba3a1a7b342da063e236d2522680ad523
d3852f0df9e3b203b5b90779457995a07c7b2e15028aada14edfcd34030f7da3
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
d45a6e3aadb9377c77af81e0a242fc627c1826bd877235d8a75614e5547f0eae
d4e6f499ae83c676daba1fdfbbc57de7cdb350343f6fe42b4108ad7c66f2515d
d88d643839a4133a341acdbb486111679804cbce0b2d9af9cf7423a3bc62450d
d96709da01a87621fce7114b4f51beabccde158af5ddb2e4de80ef900f10bd59
d9aeeae782fdde78411155839930b81c16fa4154002c1573462fa61806910409
db398ae2a6bcdac2506e0b532026b62c4058013a757d28b613a1188de22a066b
dddbefca801fe592189033bf1dd2495f0d9b9cc11415d33c6e542049e5e1efe1
dddf04d190be2e7006f807221d5f5852bf45a97c2aad4c66b1f0a1661efa7dda
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e14b6036972fd446c62212fe39351614667c28fa0de47e41e836b45d35ee6366
e1847eaa967fa68572b15907b46b8c40d76095549e9af076ac613e21d8de52eb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4ebb4fc0904aae6b08aaa40be3f5d6d1bc00794ef5f3bb0d608b3e2428f4ec4
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
e62bc837007999cb7c58bb6aab499ba2d02bd49c40149db8bc60936e982564e4
eccbf3fae72a87817cd2d39cca489de2c2d9f73b130d223882a1c36b88919da0
eccd2e8f9e883f74421b6f7310316ac70ecfbb30f966639b2ca31a9be8dc10ff
ee59049a77ecefd16b8b808229676b9f061ca97da27d3daf1271ef59dd5268e2
eeaf2e313228f5fa957d5cf730e42df5cf45b7e2132a594d470576a88736a481
eee2bc6e4edf311a6a0337c339dbd85d0d8d4040b25e390ab18237e2fa84f1c9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f03d501be0c66306ee87d7b0a268787aafa368221c9a50f5feabc9e73cc1a0ba
f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660
f201df44d5c747fcb0e34380d77409cd02be1f6e8810138d75394674b057a929
f2f11e4d45030f1f21ec7d3ae67a65b83c4c67016fe861fbebdff04ca0c8cd60
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70
f7c20d02ef54341b1562afe8db32d1bc701bb7974db2ffc0a560097e3875c1be
fbb99457e56765ea4bea432267ab799598687f0a3cedf17ca67efb913ee9d9ec
fdf5dfab742b9d6c8c626174cd7e8899d2350d3ada34202ad6f3e87dadabb36c
fe3fcb884394be745dbd11141b6d780028a4d86106b6292d7502db096f582218
ffb92ab9eefa3b6e3f6313d9a4194715887b0b8442d7be6cd1a472db7e810e5a