offtherecord.com Open in urlscan Pro
99.86.4.19 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://offtherecord.com/
Effective URL:
https://offtherecord.com/
Submission: On March 12 via api (March 12th 2024, 6:14:21 am UTC) from US — Scanned from DE

Summary HTTP 216 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 43 IPs in 3 countries across 32 domains to perform 216 HTTP transactions. The main IP is 99.86.4.19, located in United States and belongs to AMAZON-02, US. The main domain is offtherecord.com.
TLS certificate: Issued by Amazon RSA 2048 M02 on November 16th 2023. Valid for: a year.

This is the only time offtherecord.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 50	99.86.4.19 99.86.4.19	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
16	2606:4700:440... 2606:4700:4400::ac40:93bc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a04:4e42:400... 2a04:4e42:400::729	54113 (FASTLY) (FASTLY)
8	151.101.64.176 151.101.64.176	54113 (FASTLY) (FASTLY)
1 8	44.219.181.71 44.219.181.71	14618 (AMAZON-AES) (AMAZON-AES)
4	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81d::200e	15169 (GOOGLE) (GOOGLE)
7	34.96.102.137 34.96.102.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80e::2008	15169 (GOOGLE) (GOOGLE)
2	2a04:4e42:600... 2a04:4e42:600::396	54113 (FASTLY) (FASTLY)
4	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:be59	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:11::215:14ca	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.193.140 151.101.193.140	54113 (FASTLY) (FASTLY)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c06::9d	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
2	18.173.205.24 18.173.205.24	16509 (AMAZON-02) (AMAZON-02)
3	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:4fba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:589a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:991b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f17... 2a03:2880:f176:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	18.66.112.5 18.66.112.5	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6812:a07d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	44.196.206.21 44.196.206.21	14618 (AMAZON-AES) (AMAZON-AES)
5	54.80.207.255 54.80.207.255	14618 (AMAZON-AES) (AMAZON-AES)
11	3.95.80.55 3.95.80.55	14618 (AMAZON-AES) (AMAZON-AES)
1	35.201.112.186 35.201.112.186	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.208.52.14 34.208.52.14	16509 (AMAZON-02) (AMAZON-02)
1	52.222.214.55 52.222.214.55	16509 (AMAZON-02) (AMAZON-02)
1	34.102.211.197 34.102.211.197	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
9	3.5.77.142 3.5.77.142	16509 (AMAZON-02) (AMAZON-02)
17	143.204.215.23 143.204.215.23	16509 (AMAZON-02) (AMAZON-02)
1	18.173.205.14 18.173.205.14	16509 (AMAZON-02) (AMAZON-02)
3	18.245.60.11 18.245.60.11	16509 (AMAZON-02) (AMAZON-02)
1	34.235.66.125 34.235.66.125	14618 (AMAZON-AES) (AMAZON-AES)
216	43

50 99.86.4.19 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-19.fra6.r.cloudfront.net

offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2606:4700:4400::ac40:93bc (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ka-p.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:400::729 (United States)

ASN54113 (FASTLY, US)

browser.sentry-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.64.176 (United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 44.219.181.71 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-219-181-71.compute-1.amazonaws.com

relay.offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.96.102.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:600::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:be59 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:11::215:14ca (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

websdk.appsflyer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c06::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.173.205.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-205-24.fra56.r.cloudfront.net

wa.onelink.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4fba (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:589a (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:991b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.5 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-5.fra56.r.cloudfront.net

wa.appsflyer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:a07d (United States)

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 44.196.206.21 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-196-206-21.compute-1.amazonaws.com

otr-backend-service-us-prod.offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.80.207.255 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-80-207-255.compute-1.amazonaws.com

relay.offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 3.95.80.55 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-95-80-55.compute-1.amazonaws.com

wchat.freshchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.112.186 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 186.112.201.35.bc.googleusercontent.com

edge.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.208.52.14 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-208-52-14.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.214.55 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-55.fra56.r.cloudfront.net

snippets.freshchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.211.197 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 197.211.102.34.bc.googleusercontent.com

anhkgav0.apicdn.sanity.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 3.5.77.142 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2-r-w.amazonaws.com

off-the-record-service.s3.us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 143.204.215.23 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-23.fra53.r.cloudfront.net

assetscdn-wchat.freshchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.205.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-205-14.fra56.r.cloudfront.net

rts-static-prod.freshworksapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.245.60.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-60-11.fra60.r.cloudfront.net

httpsofftherecordcom.webpush.freshchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.235.66.125 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-235-66-125.compute-1.amazonaws.com

relay.offtherecord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
74	offtherecord.com 2 redirects offtherecord.com relay.offtherecord.com otr-backend-service-us-prod.offtherecord.com	2 MB
32	freshchat.com wchat.freshchat.com — Cisco Umbrella Rank: 11625 snippets.freshchat.com — Cisco Umbrella Rank: 74501 assetscdn-wchat.freshchat.com — Cisco Umbrella Rank: 17537 httpsofftherecordcom.webpush.freshchat.com	744 KB
16	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1405 ka-p.fontawesome.com — Cisco Umbrella Rank: 3225	329 KB
11	gstatic.com www.gstatic.com fonts.gstatic.com	545 KB
10	google.com www.google.com — Cisco Umbrella Rank: 2 apis.google.com — Cisco Umbrella Rank: 102 region1.analytics.google.com — Cisco Umbrella Rank: 2656	152 KB
9	amazonaws.com off-the-record-service.s3.us-west-2.amazonaws.com	2 MB
7	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 2716	55 KB
7	stripe.com js.stripe.com — Cisco Umbrella Rank: 1155 m.stripe.com — Cisco Umbrella Rank: 1134	214 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 29	42 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	156 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	332 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	4 KB
3	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 4543 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 4466 track.hubspot.com — Cisco Umbrella Rank: 2406	27 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 375	14 KB
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 1243	16 KB
2	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 4886 forms.hsforms.com — Cisco Umbrella Rank: 4386	2 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4679 forms.hscollectedforms.net — Cisco Umbrella Rank: 4787	26 KB
2	onelink.me wa.onelink.me — Cisco Umbrella Rank: 10836	873 B
2	google.de www.google.de — Cisco Umbrella Rank: 6744	515 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 84	405 B
2	appsflyer.com websdk.appsflyer.com — Cisco Umbrella Rank: 4631 wa.appsflyer.com — Cisco Umbrella Rank: 7135	10 KB
2	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1245	10 KB
2	sentry-cdn.com browser.sentry-cdn.com — Cisco Umbrella Rank: 4640	22 KB
1	freshworksapi.com rts-static-prod.freshworksapi.com — Cisco Umbrella Rank: 10750	26 KB
1	sanity.io anhkgav0.apicdn.sanity.io	3 KB
1	fullstory.com edge.fullstory.com — Cisco Umbrella Rank: 1215	12 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	274 B
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2237	23 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2220	21 KB
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1415	637 B
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2484	1 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 124	18 KB
216	32

	Domain	Requested by
50	offtherecord.com	1 redirects offtherecord.com browser.sentry-cdn.com
17	assetscdn-wchat.freshchat.com	wchat.freshchat.com assetscdn-wchat.freshchat.com
14	ka-p.fontawesome.com	kit.fontawesome.com offtherecord.com
14	relay.offtherecord.com	1 redirects offtherecord.com browser.sentry-cdn.com relay.offtherecord.com
11	wchat.freshchat.com	offtherecord.com wchat.freshchat.com assetscdn-wchat.freshchat.com
10	otr-backend-service-us-prod.offtherecord.com	browser.sentry-cdn.com
9	off-the-record-service.s3.us-west-2.amazonaws.com
7	fonts.gstatic.com	www.google.com fonts.googleapis.com
7	dev.visualwebsiteoptimizer.com	relay.offtherecord.com offtherecord.com dev.visualwebsiteoptimizer.com
6	js.stripe.com	offtherecord.com js.stripe.com
6	www.google.com	offtherecord.com www.gstatic.com www.google.com
4	www.google-analytics.com	offtherecord.com www.google-analytics.com www.googletagmanager.com browser.sentry-cdn.com
4	connect.facebook.net	offtherecord.com connect.facebook.net
4	www.googletagmanager.com	offtherecord.com www.googletagmanager.com
4	fonts.googleapis.com	offtherecord.com
4	www.gstatic.com	www.google.com www.gstatic.com
3	httpsofftherecordcom.webpush.freshchat.com	wchat.freshchat.com httpsofftherecordcom.webpush.freshchat.com
3	bat.bing.com	offtherecord.com bat.bing.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	wa.onelink.me	browser.sentry-cdn.com
2	www.google.de	offtherecord.com
2	stats.g.doubleclick.net	www.googletagmanager.com browser.sentry-cdn.com
2	region1.analytics.google.com	www.googletagmanager.com
2	www.redditstatic.com	www.googletagmanager.com browser.sentry-cdn.com
2	apis.google.com	offtherecord.com apis.google.com
2	browser.sentry-cdn.com	offtherecord.com
2	kit.fontawesome.com	offtherecord.com kit.fontawesome.com
1	rts-static-prod.freshworksapi.com	assetscdn-wchat.freshchat.com
1	anhkgav0.apicdn.sanity.io	browser.sentry-cdn.com
1	track.hubspot.com
1	snippets.freshchat.com	offtherecord.com
1	m.stripe.com	m.stripe.network
1	edge.fullstory.com	offtherecord.com
1	forms.hsforms.com	offtherecord.com
1	perf-na1.hsforms.com	offtherecord.com
1	cta-service-cms2.hubspot.com	browser.sentry-cdn.com
1	forms.hscollectedforms.net	browser.sentry-cdn.com
1	wa.appsflyer.com	browser.sentry-cdn.com
1	www.facebook.com	offtherecord.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	alb.reddit.com	offtherecord.com
1	websdk.appsflyer.com	offtherecord.com
1	js.hs-scripts.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
216	47

This site contains links to these domains. Also see Links.

Domain
www.kiro7.com
kmph.com
www.king5.com
www.geekwire.com
www.facebook.com
www.reviews.io
www.google.com
fight.offtherecord.com
play.google.com
mylawfirm.offtherecord.com
facebook.com
twitter.com
www.instagram.com

Subject Issuer	Validity	Valid
*.offtherecord.com Amazon RSA 2048 M02	`2023-11-16` - `2024-12-14`	a year	crt.sh
www.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-04` - `2025-01-03`	a year	crt.sh
*.sentry-cdn.com GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-08-01` - `2024-09-01`	a year	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2024-02-07` - `2024-05-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.apis.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2023-07-06` - `2024-07-06`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-08` - `2024-07-06`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-12-20` - `2024-03-19`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-01-21` - `2024-06-27`	5 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-03` - `2024-05-02`	a year	crt.sh
*.appsflyer.com DigiCert TLS RSA SHA256 2020 CA1	`2023-07-27` - `2024-07-27`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-01-15` - `2024-07-13`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
www.google.de GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.onelink.me Amazon RSA 2048 M02	`2023-06-05` - `2024-07-03`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
*.freshchat.com Amazon RSA 2048 M02	`2024-01-22` - `2025-02-18`	a year	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2024-05-23`	3 months	crt.sh
freshchat.com Amazon RSA 2048 M02	`2023-06-26` - `2024-07-23`	a year	crt.sh
*.apicdn.sanity.io Sectigo RSA Domain Validation Secure Server CA	`2023-10-10` - `2024-09-30`	a year	crt.sh
*.s3-us-west-2.amazonaws.com Amazon RSA 2048 M01	`2024-01-23` - `2024-12-31`	a year	crt.sh
freshworksapi.com Amazon RSA 2048 M02	`2024-01-08` - `2025-02-04`	a year	crt.sh
*.wchat.webpush.myfreshworks.com Amazon RSA 2048 M01	`2023-06-21` - `2024-07-18`	a year	crt.sh

This page contains 8 frames:

Primary Page: https://offtherecord.com/
Frame ID: 40168BCA8801C1EA37E5585088EB0D19
Requests: 177 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3&co=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29tOjQ0Mw..&hl=de&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=g2yal4sx66ha
Frame ID: D7C8E8A5C7A68C659F8D599A337D63D1
Requests: 8 HTTP requests in this frame

Frame: https://js.stripe.com/v2/channel.html?stripe_xdm_e=https%3A%2F%2Fofftherecord.com&stripe_xdm_c=default102040&stripe_xdm_p=1
Frame ID: 1D47CD68024175BC901C2B62569DBB4A
Requests: 2 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
Frame ID: A14E19A00E27A04581B430394271651C
Requests: 2 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 71CB7FAFF00600C5A0D374EB4CA7E4AE
Requests: 3 HTTP requests in this frame

Frame: https://wchat.freshchat.com/widget/config_iframe.html?host=https://wchat.freshchat.com&token=c36ed4b1-ac05-4052-a91f-83203339cd7c&origin=https://offtherecord.com
Frame ID: DF59DE39948AC400BF2D236F9BFDCAD3
Requests: 2 HTTP requests in this frame

Frame: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
Frame ID: F7587F6AB57F79DBA2F9F427C2100637
Requests: 25 HTTP requests in this frame

Frame: https://httpsofftherecordcom.webpush.freshchat.com/index.html?ref=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t
Frame ID: 6503C6BD737C605B0AA9D3A76D931D2D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Fight Your Moving Violation | Traffic Ticket Lawyer Local & Online

Page URL History Show full URLs

http://offtherecord.com/ HTTP 301
https://offtherecord.com/ Page URL

Detected technologies

Sentry (Issue Trackers) Expand

Overall confidence: 100%
Detected patterns

browser\.sentry\-cdn\.com/([0-9.]+)/bundle(?:\.tracing)?(?:\.min)?\.js

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+(?:-?rc[.\d]*)*)/angular(?:\.min)?\.js
\bangular.{0,32}\.js

Freshchat (Live Chat) Expand

Overall confidence: 100%
Detected patterns

wchat\.freshchat\.com/js/widget\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

216
Requests

98 %
HTTPS

52 %
IPv6

32
Domains

47
Subdomains

43
IPs

3
Countries

7044 kB
Transfer

21979 kB
Size

37
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://www.kiro7.com/news/local/got-at-ticket-theres-an-app-for-that/273024500/

Search URL Search Domain Scan URL

URL: https://kmph.com/news/local/traffic-ticket-theres-an-app-for-that

Search URL Search Domain Scan URL

URL: https://www.king5.com/video/news/local/new-app-helps-drivers-fight-traffic-tickets/281-922497

Search URL Search Domain Scan URL

URL: https://www.geekwire.com/2016/off-record-speeding-ticket-app/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/OffTheRecordApp/
Title: 4.58 656 reviews

Search URL Search Domain Scan URL

URL: https://www.reviews.io/company-reviews/store/offtherecord-com
Title: 4.95 2491 reviews

Search URL Search Domain Scan URL

URL: https://www.google.com/search?q=off+the+record+fight+your+ticket
Title: 4.7 1603 reviews

Search URL Search Domain Scan URL

URL: https://fight.offtherecord.com/a/key_live_oik1hC6SvaFGaQl6L4f5chghyqkDbk9G?channel=website&feature=iOSBadge&stage=footer&$fallback_url=https%3A%2F%2Fapps.apple.com%2Fapp%2Fapple-store%2Fid1032930471%3Fpt%3D117925041%26ct%3Dcustomer_website%26mt%3D8

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.offtherecord.otr_mobile_app&referrer=utm_source%3Dwebsite%26utm_medium%3Dfooter

Search URL Search Domain Scan URL

URL: https://mylawfirm.offtherecord.com/
Title: Law Firm Portal

Search URL Search Domain Scan URL

URL: https://facebook.com/OffTheRecordApp

Search URL Search Domain Scan URL

URL: https://twitter.com/OffTheRecordApp

Search URL Search Domain Scan URL

URL: https://www.instagram.com/offtherecordapp/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://offtherecord.com/ HTTP 301
https://offtherecord.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 149

https://relay.offtherecord.com/datalayer/v4/latest.js HTTP 302
https://edge.fullstory.com/datalayer/v4/latest.js

216 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
offtherecord.com/
Redirect Chain

http://offtherecord.com/
https://offtherecord.com/

14 KB
4 KB

279ms
233ms

Document
text/html

99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 55caa0d379e34c4e8822bfb14dcf4f882d8b8bbf464449207909f388f2328e93

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 06:14:12 GMT
etag: W/"3911-18e256c7e38"
expires: 0
last-modified: Sat, 09 Mar 2024 22:54:11 GMT
server: nginx
vary: Accept-Encoding
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
x-amz-cf-id: PSWoN9PKeaxr6Z3t3FgdoxAIEVD_mDHVmTrDoW2bviQABrf-ECeTxg==
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
x-powered-by: Express

Redirect headers

Connection: keep-alive
Content-Length: 167
Content-Type: text/html
Date: Tue, 12 Mar 2024 06:14:12 GMT
Location: https://offtherecord.com/
Server: CloudFront
Via: 1.1 2f0580a0593ad9d3fb82aee9226d8178.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 1H-KVndJ8fHE9uNOhvTkFu3f4N8xYNnrKOWRiD_ABi7jsynY1lgT4Q==
X-Amz-Cf-Pop: FRA6-C1
X-Cache: Redirect from cloudfront

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
935 B 76ms
31ms Script
text/javascript 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2c2a72d20524531bbf7359f34c9625cf9bb21bed61b9c325f394cd02d1dacc22

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 74ms
28ms Script
text/javascript 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=explicit

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f6369864f88c35b1302ab28dbaa8944f4f275f11a3e43bd96187cc79bf82699d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 af20baf93e.js Show response
kit.fontawesome.com/ 12 KB
5 KB 494ms
448ms Script
text/javascript 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kit.fontawesome.com/af20baf93e.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c4c069374826c98ca14a13ddea5708a2425c0f55712357156a44c9ce14dca07

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
server: cloudflare
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
content-type: text/javascript
cache-control: max-age=60, public, stale-while-revalidate=30
cf-ray: 8631a48b7fc65d93-FRA
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F7uoxE9W3OEwaGjgrbRC

GET
H2 200 bundle.min.js Show response
browser.sentry-cdn.com/6.19.7/ 65 KB
21 KB 57ms
18ms Script
application/javascript 2a04:4e42:400::729
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:400::729 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

6ba797956f6d29b650d458897e48a190cddf0a6ba374350c0bb565fa04f80d65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Tue, 26 Apr 2022 13:11:05 GMT
server: Fastly
age: 5321506
etag: "4dc87c1e025f84ef0d14fe9187946dfd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 20887
expires: Wed, 26 Apr 2023 13:34:47 GMT

GET
H2 200 angular.min.js Show response
browser.sentry-cdn.com/6.19.7/ 2 KB
976 B 57ms
18ms Script
application/javascript 2a04:4e42:400::729
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://browser.sentry-cdn.com/6.19.7/angular.min.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:400::729 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

8971fe0a892f03a0f0ba568b545194578eaf62dcafabc254e2677c7af64200c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Tue, 26 Apr 2022 13:11:05 GMT
server: Fastly
age: 1613361
etag: "14f18525c8f97317f08d5cc6f80a1953"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 882
expires: Thu, 19 Sep 2024 13:29:39 GMT

GET
H2 200 / Show response
js.stripe.com/v2/ 62 KB
22 KB 133ms
68ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v2/

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

91ab93b25227f8a29a716fdc41831b0a8a8729d8cde9f8adb29f4c8392457b9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 12 Mar 2024 06:14:13 GMT
via: 1.1 varnish
age: 55
x-cache: HIT
content-length: 21836
x-request-id: 663017dd-ad8e-4f27-859e-60ceba3da677
x-served-by: cache-fra-etou8220039-FRA
last-modified: Thu, 03 Feb 2022 12:42:55 GMT
server: Fastly
etag: "4e0e5080f8f45588fcc33b82ee08fa3c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=300
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1

GET
H2 200 / Show response
js.stripe.com/v3/ 605 KB
168 KB 91ms
27ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

c91fcb89871b3af47fd3a4f5e17d40ac582ed9a6046963ab48caa4baa7c3dfe2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 12 Mar 2024 06:14:13 GMT
via: 1.1 varnish
age: 37
x-cache: HIT
content-length: 171172
x-request-id: c394891f-4ff6-4c7e-a1c1-930c99192ede
x-served-by: cache-fra-etou8220039-FRA
last-modified: Mon, 11 Mar 2024 20:42:57 GMT
server: Fastly
etag: "f3a39aae23abf21e515d4ae7b8044ae7"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 25

GET
H2 200 186.efe50517e7510d4bc3f6.js Show response
offtherecord.com/ 5 MB
1 MB 223ms
223ms Script
application/javascript 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/186.efe50517e7510d4bc3f6.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 426f004d8e6a5b308f6c2f66d16f736879a5c890d90ddf5571c78b86bb61039d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Sat, 09 Mar 2024 22:54:11 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
x-powered-by: Express
etag: W/"4df62b-18e256c7e38"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: EclNJmmxbj8HxokceWD_iIPO0K82_VXOsWaVLn6OvC4tmCbSYNAm-w==

GET
H2 200 main.bc291ec8b2b4aaf36033.js Show response
offtherecord.com/ 2 MB
363 KB 212ms
211ms Script
application/javascript 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/main.bc291ec8b2b4aaf36033.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 1a1f70c539853efed52501748b0db0ce50d2835999795b70189afbc802b8f84f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Sat, 09 Mar 2024 22:54:11 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
x-powered-by: Express
etag: W/"20b77a-18e256c7e38"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: yh_XBOlUWvE1vTVdXj1fFQDccNpVt6cvNB4bNByh7KiaznaHJ_INCQ==

GET
H2 200 j.php Show response
relay.offtherecord.com/ 13 KB
4 KB 494ms
224ms Script
application/javascript 44.219.181.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com:447/j.php?a=660553&u=https%3A%2F%2Fofftherecord.com%2F&vn=2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.219.181.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-219-181-71.compute-1.amazonaws.com
Software: gnv1 /
Resource Hash: c0bdde2f526d0f2e364516aa490ea8e6f076938db6176db8b3c9af3157a69b02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
via: 1.1 google
server: gnv1
etag: W/"1710196493"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=0, no-cache, must-revalidate
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/ 494 KB
197 KB 64ms
18ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5564f45c0991c7cceb19c0fb637ee44b119fb14c6cbf3691540a9cad11e1edf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 21:32:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31314
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 200579
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 05:02:47 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Mar 2025 21:32:19 GMT

GET
H2 200 inline-scripts.js Show response
offtherecord.com/app/common/preprocessor/ 320 B
700 B 28ms
27ms Script
application/javascript 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/app/common/preprocessor/inline-scripts.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 28503820ff423a3e61dcab001567d362860dfed3863e3143f5046316a2f262f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:18:59 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"140-18e14d68960"
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 320
x-amz-cf-id: XFp7z-xY964NM-sZrmx_2aBcjoWwxyetGVKU0udWelFNasTjbWsAYg==

GET
H2 200 client.js Show response
apis.google.com/js/ 15 KB
6 KB 72ms
26ms Script
text/javascript 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/client.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6c71bbedd62705164ce103d55e38f724ee3622b76dd30c8e43edf6eafe8e87f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 12 Mar 2024 06:14:13 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "fefec5f852e4c687"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 autotrack.js Show response
offtherecord.com/node_modules/autotrack/ 24 KB
8 KB 38ms
38ms Script
application/javascript 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/node_modules/autotrack/autotrack.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: bceb73993d094c4c821c7571921103bdc8c05e9082c4fc513d244358d53593db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:18:59 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 19:49:13 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"60d8-18e15501527"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: Y2UiamLSi1u0OnTEZRToDZ0GZHkZqFFcPI_WHaGgvko0fIkvaK8gig==

GET
H2 200 pro.min.css Show response
ka-p.fontawesome.com/releases/v6.5.1/css/ 669 KB
117 KB 46ms
36ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/css/pro.min.css?token=af20baf93e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/af20baf93e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c368e74321d2180806d6982ab26271a765594390c0d50a2e4fe452e901778d5e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:25:52 GMT
server: cloudflare
age: 8843301
etag: "6568c5a0-1d52d"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a48e6a565d93-FRA
content-length: 120109

GET
H2 200 pro-v4-shims.min.css Show response
ka-p.fontawesome.com/releases/v6.5.1/css/ 27 KB
4 KB 45ms
35ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/css/pro-v4-shims.min.css?token=af20baf93e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/af20baf93e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b3cf99ce39e5fc49169454f5639b5341dba747f16e3d01a5b9ebf50792e9a1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:25:51 GMT
server: cloudflare
age: 8843301
etag: "6568c59f-10e7"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a48e6a575d93-FRA
content-length: 4327

GET
H2 200 pro-v5-font-face.min.css Show response
ka-p.fontawesome.com/releases/v6.5.1/css/ 50 KB
7 KB 44ms
34ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/css/pro-v5-font-face.min.css?token=af20baf93e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/af20baf93e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4946b36e5208a0a01e69ac05696229353e101faece5c1572e2a6177742bf7b5c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:25:52 GMT
server: cloudflare
age: 8843301
etag: "6568c5a0-1c12"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a48e6a555d93-FRA
content-length: 7186

GET
H2 200 pro-v4-font-face.min.css Show response
ka-p.fontawesome.com/releases/v6.5.1/css/ 7 KB
2 KB 42ms
33ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/css/pro-v4-font-face.min.css?token=af20baf93e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/af20baf93e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58f2ed3e8753b14d9456de59f7a58f5089c81d1ce6691d80bbd4e58f145ffd2c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:25:51 GMT
server: cloudflare
age: 8843301
etag: "6568c59f-6c5"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a48e6a585d93-FRA
content-length: 1733

GET
H2 200 kit-upload.css Show response
kit.fontawesome.com/af20baf93e/103681994/ 423 B
400 B 41ms
41ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kit.fontawesome.com/af20baf93e/103681994/kit-upload.css
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/af20baf93e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30a1fac44395d192e65326af024746e1ed7f2f75ed38d183f6eb6265757fc773

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
age: 8994743
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
content-type: text/css
cache-control: max-age=31556926, public, must-revalidate
cf-ray: 8631a48e5a4f5d93-FRA
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F5v7C2l6549XpRkVN0Pi

GET
H2 200 fs.js Show response
relay.offtherecord.com/s/ 252 KB
70 KB 361ms
132ms Script
application/javascript 44.219.181.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/s/fs.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.219.181.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-219-181-71.compute-1.amazonaws.com
Software: UploadServer /
Resource Hash: c38b336f03108b44e85ed615a210c9832324f8d5f3efc8c418196fb0517750a9

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: br
age: 1171
x-guploader-uploadid: ABPtcPrNx0faSVNdXX2LjHTyXpjCSoi32WpERdLGht57odd4pjebZ1bwpBISQ8KG7SsIrdOe9R72IRGxow
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70374
last-modified: Thu, 07 Mar 2024 13:50:26 GMT
server: UploadServer
etag: "f14fadd940a61b9217c00dafdcacd622"
vary: Accept-Encoding
x-goog-generation: 1709819426398348
content-type: application/javascript
access-control-allow-origin: *
x-goog-hash: crc32c=RzMU9Q==, md5=8U+t2UCmG5IXwA2v3KzWIg==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=3600,no-transform
x-goog-stored-content-length: 70374
accept-ranges: bytes
expires: Tue, 12 Mar 2024 06:54:42 GMT

GET
H2 200 tag-96415ee2183995ea434159f64428cc13.js Show response
dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/ 184 KB
52 KB 69ms
20ms Script
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-96415ee2183995ea434159f64428cc13.js
Requested by: Host: relay.offtherecord.com
URL: https://relay.offtherecord.com:447/j.php?a=660553&u=https%3A%2F%2Fofftherecord.com%2F&vn=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: ba8f87d1df43af84216477d510342baafc071017d4a2ebc85576e431fad4d319

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: br
via: 1.1 google
last-modified: Mon, 11 Mar 2024 12:21:08 GMT
server: gfra1
etag: "65eef734-cd6b"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52587

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
143 B 160ms
111ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=660553&d=offtherecord.com&u=D9765C39322F3996C78EF71C5EAE33101&h=5eee0231205300e517190c672dede36d&t=false

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv3c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv3c
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=43200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
814 B 75ms
29ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700&display=swap

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

31d196afc7bf97b61be0a9881f623b3b8a7b56d4b0c08c6b78c37ce92d7827b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Mar 2024 05:16:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 css
fonts.googleapis.com/ 6 KB
2 KB 73ms
28ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c3061c3788ad5783ef8a5d10c454bafe7eb942c48200dccc852cc6d3c9f303d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Mar 2024 04:35:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 css
fonts.googleapis.com/ 12 KB
790 B 74ms
28ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Nunito:200,300,400,600,700,800,900&display=swap

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7b7ca9dee8acbf03925b43a2cb76e364ba514c30a18de9f1523d0b156093c7d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Mar 2024 06:14:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 css2
fonts.googleapis.com/ 6 KB
768 B 112ms
66ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Nunito+Sans:wght@400;600;700&display=swap

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7b5edcbf4a04dec3e1381046ccfe8e7135eaca4cc47973ccfd4ec6384b39b8bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Mar 2024 04:17:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 255 KB
88 KB 92ms
40ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/app/common/preprocessor/inline-scripts.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4c226ee7773e23400426cb39166ff91a970015586284e0cabe8a77d03a4ce05a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89732
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.DmKSjbfBf88.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8_s055Df1uT3LHoZow1yec9lVomg/ 315 KB
108 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.DmKSjbfBf88.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8_s055Df1uT3LHoZow1yec9lVomg/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f9a65ba114f6898003f69c309d43209c23a9093bcb50624b32001784e23bd9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 21:24:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31799
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109988
x-xss-protection: 0
last-modified: Fri, 01 Mar 2024 15:19:10 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Mar 2025 21:24:14 GMT

POST
H2 200 l.gif
dev.visualwebsiteoptimizer.com/ 35 B
167 B 109ms
109ms Ping
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/l.gif?experiment_id=50&account_id=660553&cu=https%3A%2F%2Fofftherecord.com%2F&combination=1&s=1&sId=1710224053&u=D9765C39322F3996C78EF71C5EAE33101&ed=%7B%22tz%22%3A%22Europe%2FBerlin%22%2C%22tO%22%3A%22-1%22%2C%22lt%22%3A%221710224053615%22%2C%22r%22%3A%22%22%2C%22ul%22%3A%22en-us%22%2C%22de%22%3A%22UTF-8%22%2C%22sc%22%3A%2224%22%2C%22sr%22%3A%221600x1200%22%7D&vn=7.0.337&vns=undefined&vno=undefined&eTime=1710224053620&random=0.48172718027829164

Requested by

Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-96415ee2183995ea434159f64428cc13.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv3c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:12 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv3c
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

POST
H2 200 l.gif
dev.visualwebsiteoptimizer.com/ 35 B
89 B 118ms
117ms Ping
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/l.gif?experiment_id=46&account_id=660553&cu=https%3A%2F%2Fofftherecord.com%2F&combination=2&s=1&u=D9765C39322F3996C78EF71C5EAE33101&vn=7.0.337&vns=undefined&vno=undefined&eTime=1710224053623&random=0.8584774464836138

Requested by

Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-96415ee2183995ea434159f64428cc13.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv3c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:12 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv3c
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

POST
H2 200 l.gif
dev.visualwebsiteoptimizer.com/ 35 B
89 B 132ms
131ms Ping
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/l.gif?experiment_id=28&account_id=660553&cu=https%3A%2F%2Fofftherecord.com%2F&combination=2&s=1&u=D9765C39322F3996C78EF71C5EAE33101&vn=7.0.337&vns=undefined&vno=undefined&eTime=1710224053628&random=0.04197104757709358

Requested by

Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-96415ee2183995ea434159f64428cc13.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv3c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:13 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv3c
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H2 200 settings.js Show response
dev.visualwebsiteoptimizer.com/ 9 KB
2 KB 23ms
23ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/settings.js?a=660553&settings_type=1&vn=7.0&exc=28|46|50
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-96415ee2183995ea434159f64428cc13.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: df74e2e61278796d56da196698abfd946a56610679d20ba298a7794f59f8058c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
via: 1.1 google
server: gfra1
etag: W/"1710196492"
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
89 B 128ms
128ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=660553&u=D9765C39322F3996C78EF71C5EAE33101&s=1710224053&p=1&tags={%22si%22:{%2250%22:%221%22,%2246%22:%222%22,%2228%22:%222%22}}&update=1&cq=0&vn=7.0.337&vns=undefined&vno=undefined&_cu=https%3A%2F%2Fofftherecord.com%2F&eTime=1710224053633&random=0.7803688281125627

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv3c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:13 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv3c
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame D7C8 45 KB
29 KB 47ms
46ms Document
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3&co=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29tOjQ0Mw..&hl=de&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=g2yal4sx66ha

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5daa6ab528b95654c0663a8936ef14a2b6d9dad9c0b2d58dbb8017066cf93202

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WLBJxViqqAMADOqMpxLhJA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-WLBJxViqqAMADOqMpxLhJA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 06:14:13 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 294 KB
97 KB 44ms
43ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-TMGSMNG8YY&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d0b61a80e81b2d02d93121474d80003948553484961b38946c38e3ecc0b495fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 98717
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 28 KB
9 KB 84ms
34ms Script
application/javascript 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 2939d067bced6e2e3e43c1b10d2b067cb980410c2cc42fd3e867798a4a36c697

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Feb 2024 20:38:48 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "9a680c8c475d8bba600d4d87b4fa7ee5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 8702

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 215 KB
58 KB 81ms
31ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

50b6e67cfcfe4ac8fe9cee705b681f696065306ee42bcd4e6b37a17dba333ac5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 12 Mar 2024 06:14:13 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57348
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=18, rtx=0, c=12, mss=1326, tbw=2807, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma: public
x-fb-debug: n2/pxAbVFykXi29+0eTS6yE8shCyDW8DFMviSCI2Je0uy60g/HHf8wDHPQk7YZivR21nNdhul7Olh07IUXPuMg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 124ms
56ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 12 Mar 2024 06:14:13 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 198BC7FFED794376B0453234C56A8A48 Ref B: FRAEDGE1419 Ref C: 2024-03-12T06:14:13Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 81ms
32ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 12 Mar 2024 05:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1565
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 12 Mar 2024 07:48:08 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 48 KB
18 KB 106ms
58ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

62ab2ab3a16c6d4f96e5ae538005ca6be5bb97d46affaac9ed79f8e2e163a808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17881
x-xss-protection: 0
server: cafe
etag: 12382634757272263151
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 190 KB
69 KB 44ms
44ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-69140841-1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

34077aedb6bf156c8eee33e844e9c5d8003f134afa867dc60e967e36f5a659ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 70774
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 24128821.js Show response
js.hs-scripts.com/ 2 KB
1 KB 203ms
154ms Script
application/javascript 2606:4700::6810:be59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/24128821.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:be59 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c4a8f43aee7ff10ed1cd4d5600632074498d3aeec720f65c11676e569b5cf8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 1f8c8a5f-41ec-4beb-a6a9-aa15c8bb59ef
x-envoy-upstream-service-time: 8
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 1f8c8a5f-41ec-4beb-a6a9-aa15c8bb59ef
last-modified: Mon, 11 Mar 2024 02:42:55 GMT
server: cloudflare
x-trace: 2BFF33301D57EA50F80625195329F473C7A9BB31EB000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://offtherecord.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-59d6fb747d-62gmh
access-control-allow-credentials: true
cache-control: public, max-age=90
cf-ray: 8631a4902b0c30ee-FRA
expires: Tue, 12 Mar 2024 06:15:43 GMT

GET
H/1.1 200
OK / Show response
websdk.appsflyer.com/ 34 KB
10 KB 133ms
38ms Script
application/javascript 2a02:26f0:3500:11::215:14ca
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://websdk.appsflyer.com/?st=pba&
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:11::215:14ca Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7ccf80229bbe586853232059978b67c1dbe6ccd7f6b4b8585b34bbcf2d9f195f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:13 GMT
Content-Encoding: gzip
x-amz-request-id: TNFWN7JAHP2EBEJM
x-amz-server-side-encryption: AES256
Connection: keep-alive
Content-Length: 9575
x-amz-id-2: rNwspp0GeeuGCVY8uOjVgWk/J3XTDq5+TTLu3jZaoCKMw4CAD3WOCSz6cVuBQQ9yvpK6HO0IqDY=
Last-Modified: Wed, 14 Jun 2023 06:58:46 GMT
Server: AmazonS3
ETag: "d4e7f1ffd74e53e33a46a668c2e9d67c"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2118
Accept-Ranges: bytes
X-DataStream-Cache-Status: 1
Expires: Tue, 12 Mar 2024 06:49:31 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/ Frame D7C8 55 KB
24 KB 76ms
28ms Stylesheet
text/css 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3&co=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29tOjQ0Mw..&hl=de&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=g2yal4sx66ha

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 19:35:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38326
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 05:02:47 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Mar 2025 19:35:27 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/ Frame D7C8 494 KB
196 KB 75ms
27ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5564f45c0991c7cceb19c0fb637ee44b119fb14c6cbf3691540a9cad11e1edf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 21:32:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31314
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 200579
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 05:02:47 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Mar 2025 21:32:19 GMT

GET
H2 200 t2_veaca_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
700 B 72ms
24ms XHR
application/json 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_veaca_telemetry
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
server: snooserv
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
content-length: 98

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 82ms
30ms Image
image/gif 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1710224053814&id=t2_veaca&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=dee74394-77b9-4353-9886-567bbd43b3d7&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_c9439d84&dpm=&dpcc=&dprc=
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 ecommerce.js Show response
www.google-analytics.com/plugins/ua/ 1 KB
962 B 25ms
22ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ecommerce.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 05:17:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3402
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 630
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 12 Mar 2024 06:17:31 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
254 B 78ms
27ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-TMGSMNG8YY&gtm=45je4360v9102325189z877772510za220&_p=1710224053536&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=874400336.1710224054&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1710224053&sct=1&seg=0&dl=https%3A%2F%2Fofftherecord.com%2F&dt=The%20fastest%20way%20to%20fight%20your%20traffic%20ticket&en=page_view&_fv=1&_ss=1&tfd=1237
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-TMGSMNG8YY&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:13 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://offtherecord.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
254 B 83ms
30ms Ping
text/plain 2a00:1450:400c:c06::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-TMGSMNG8YY&cid=874400336.1710224054&gtm=45je4360v9102325189z877772510za220&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-TMGSMNG8YY&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:13 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://offtherecord.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 83ms
32ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-TMGSMNG8YY&cid=874400336.1710224054&gtm=45je4360v9102325189z877772510za220&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&z=1808876212

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-69140841-1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 12 Mar 2024 05:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1565
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 12 Mar 2024 07:48:08 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 219 KB
78 KB 38ms
38ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-937085283&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVS6TPP

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7db9987845f7e973d4e2d6bae3ecce365acae016dfcdfaefa4fa400836301eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79896
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 12 Mar 2024 06:14:13 GMT

GET
H2 200 185612438538592 Show response
connect.facebook.net/signals/config/ 53 KB
11 KB 99ms
98ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/185612438538592?v=2.9.148&r=stable&domain=offtherecord.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d3511f959fb530a0d393bd6fa20fc6113245c87ad74acc6b6de16840ff709d6e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 12 Mar 2024 06:14:13 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=25, rtx=0, c=57, mss=1326, tbw=62513, tp=-1, tpl=-1, uplat=79, ullat=0
pragma: public
x-fb-debug: RWYCgI4RMfUvZjlw7J8yzxC4N295AQhqNnKhZDPzYKi7xLZin1i4u1ZzRWD31P0SJ1sgHnaYGS16lbII/PJHGg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 16001542.js Show response
bat.bing.com/p/action/ 0
116 B 49ms
45ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/16001542.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Tue, 12 Mar 2024 06:14:13 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1515697077794006BC9F5F77D9EB7F29 Ref B: FRAEDGE1419 Ref C: 2024-03-12T06:14:13Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
285 B 103ms
103ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16001542&Ver=2&mid=763ae433-4a06-4d9e-8134-ae831c254eeb&sid=bfb43340e03711ee872a2d1d2d537c0d&vid=bfb457c0e03711ee8935d1205936709b&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=The%20fastest%20way%20to%20fight%20your%20traffic%20ticket&kw=%7B%7BngMeta.keywords%7D%7D&p=https%3A%2F%2Fofftherecord.com%2F&r=&evt=pageLoad&sv=1&rn=190419

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 12 Mar 2024 06:14:13 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E7FED95F7EEF457892A8115CFC7421B8 Ref B: FRAEDGE1419 Ref C: 2024-03-12T06:14:13Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 29ms
28ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=767156789&t=pageview&_s=1&dl=https%3A%2F%2Fofftherecord.com%2F&ul=en-us&de=UTF-8&dt=The%20fastest%20way%20to%20fight%20your%20traffic%20ticket&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAUIRAAAAACAAI~&jid=1070636857&gjid=928290081&cid=874400336.1710224054&tid=UA-69140841-1&_gid=64841621.1710224054&_r=1&gtm=457e4360za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&jsscut=1&did=i5iSjo&npa=1&z=1133711821

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://offtherecord.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 oN6JOQxO2CZdhDuvURgc1WDqFpXrbMZ6mY5cTBya2tA.js Show response
www.google.com/js/bg/ Frame D7C8 17 KB
7 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/oN6JOQxO2CZdhDuvURgc1WDqFpXrbMZ6mY5cTBya2tA.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0de89390c4ed8265d843baf51181cd560ea1695eb6cc67a998e5c4c1c9adad0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3&co=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29tOjQ0Mw..&hl=de&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=g2yal4sx66ha
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:57:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 595009
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6931
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:30:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Mar 2025 08:57:24 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame D7C8 2 KB
2 KB 20ms
19ms Image
image/png 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 03:45:28 GMT
x-content-type-options: nosniff
age: 8925
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Tue, 19 Mar 2024 03:45:28 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame D7C8 15 KB
16 KB 65ms
19ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 21:26:23 GMT
x-content-type-options: nosniff
age: 31670
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Mar 2025 21:26:23 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame D7C8 15 KB
15 KB 69ms
23ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 09:11:37 GMT
x-content-type-options: nosniff
age: 594156
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Mar 2025 09:11:37 GMT

GET
H2 200 onelink Show response
wa.onelink.me/v1/ 13 B
364 B 106ms
42ms XHR
application/json 18.173.205.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://wa.onelink.me/v1/onelink
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.205.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-205-24.fra56.r.cloudfront.net
Software: /
Resource Hash: 38bc0f256821a9c0a02a1c0cedf8ff70c211e637ef77ac199de2fe0cf36ba9ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:14 GMT
via: 1.1 7f26f4279546775ace8410d89a15a960.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P12
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 13
x-amz-cf-id: V0UgI-6pjvnE04620skepq6X_m3lLw-sg6DMwye_BG1ZO_uLRQVJxg==

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame D7C8 102 B
134 B 33ms
31ms Other
text/javascript 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=QquE1_MNjnFHgZF4HPsEcf_2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a8bfdecce5d2156da95876601ab50733e863513e3689ce32498a8370e79a5687

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenzB4pAAAAAH6vbRHZg7yJ7zsNldSxJEZWsyr3&co=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29tOjQ0Mw..&hl=de&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=g2yal4sx66ha
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 12 Mar 2024 06:14:13 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 27ms
25ms XHR
text/plain 2a00:1450:400c:c06::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69140841-1&cid=874400336.1710224054&jid=1070636857&gjid=928290081&_gid=64841621.1710224054&npa=1&_u=aGDAAUIQAAAAACAAI~&z=1585981099

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 12 Mar 2024 06:14:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://offtherecord.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 84 KB
25 KB 188ms
143ms Script
application/javascript 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/24128821.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

989d0ff16db0110879e677d9ef14c48e83b028831830566393225fb0c39fe2fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.932/bundles/project.js&cfRay=8631a4919df118ef-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"35c4e3d2f89657082d5372c7bc6e79d3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.932/bundles/project.js
date: Tue, 12 Mar 2024 06:14:14 GMT
x-amz-version-id: cAhbXPz2og2F4B.zBTxw9oB4G3dvep2P
via: 1.1 c0b0d7167cc2eb52d8d154aa7fc03a0a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 10abc183-c731-4fb1-b5aa-2e1f60b46d7d
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
x-evy-trace-route-configuration: listener_https/all
x-request-id: 10abc183-c731-4fb1-b5aa-2e1f60b46d7d
last-modified: Wed, 28 Feb 2024 14:13:53 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=votX%2FTcxdXRaieJDB5B%2BsjYy71JMYREh5QTClPCXxteP%2B08Ta36BVV5l2ZjLOd6PqpQODKVlxy%2BcajmTx70xA3BE3H%2BmEg3ftsHOb4hSooI12NLUZyeMY0ERpU6FV16MXVaHB2YDONCDiNPF"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-576f9d768-jp2fd
cf-ray: 8631a4919df118ef-FRA
x-amz-cf-id: opZsLjF1_P-cuZ86-iBjTS5LRyIei4tZKyDoawWBUj-yx7VMIhOHlw==

GET
H2 200 24128821.js Show response
js.hs-analytics.net/analytics/1710223800000/ 66 KB
21 KB 201ms
157ms Script
text/javascript 2606:4700::6810:4fba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1710223800000/24128821.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/24128821.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4fba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7ef78f4ad97dfd507ddad9306670ff6f03401b119fcbf2f9227f12eb3279f11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:14 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: RZAMA3V9NSMKB8F1
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 2dd3a6fd-9e6f-4298-8804-d297322a9d6f
x-envoy-upstream-service-time: 34
x-amz-id-2: RiYsc0v44gIVaiKJlYZEvsAB8dkcKOzl1Sf0Bn7Dr061ckp18LREEXe44ZjISKKO/E+PymiNkLU=
x-evy-trace-listener: listener_https
x-request-id: 2dd3a6fd-9e6f-4298-8804-d297322a9d6f
x-evy-trace-route-configuration: listener_https/all
last-modified: Tue, 27 Feb 2024 16:13:49 GMT
server: cloudflare
etag: W/"1ced160aa62bbe543a74dffd44b10b17"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8555f56d-rk9w9
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8631a49199f09c01-FRA
expires: Tue, 12 Mar 2024 06:19:14 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 163ms
119ms Script
application/javascript 2606:4700::6811:589a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/24128821.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:589a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44dbbb0a1da3d1a2b3f637ba2eff82150de83164b3caf824fc0fc46633588de3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:14 GMT
x-amz-version-id: VTCx5Wpr_CjwKFe_1K6ShUsHQL37oHcJ
via: 1.1 a4f9ca051b97c1ac09e2af244690d376.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 5b62379a-0bd2-4cf2-b6e7-d708e5fc07e5
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.468/bundles/project.js&cfRay=8631a4919a71bbbf-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 5b62379a-0bd2-4cf2-b6e7-d708e5fc07e5
last-modified: Wed, 21 Feb 2024 09:36:07 UTC
server: cloudflare
etag: W/"0892458d49ed5681928e6be69131caa7"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-576f9d768-2qqmj
cf-ray: 8631a4919a71bbbf-FRA
x-amz-cf-id: BD8z3g_q8xxmZTexYTwfwiCo72BQTpVSbGyFm8AIJctpgVOpxdp1NA==
x-hs-target-asset: collected-forms-embed-js/static-1.468/bundles/project.js

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/24128821/ 70 KB
23 KB 547ms
503ms Script
text/javascript 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/24128821/banner.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/24128821.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e40863135f9a5c29d4667e873a6da4cebf8f158a58cc932aaa83bd61133730e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:14 GMT
x-amz-version-id: 7TIVHmDImdqkNk9C0lufYhopXx5ufIVk
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: RZATKWFHP7WC58N0
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 2e1b7b82-d90e-4589-ac58-ac89cda950e8
x-envoy-upstream-service-time: 97
x-amz-id-2: 3+HHD4I+n91yvRwEgdYiO7VIYfp2I0M2v+jR4x7VnDqhKZ0TEJg7j6TObaLxgBDdIPiQx00bgSSH6JLxGdJKAw==
x-evy-trace-listener: listener_https
x-request-id: 2e1b7b82-d90e-4589-ac58-ac89cda950e8
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 06 Mar 2024 18:37:20 GMT
server: cloudflare
etag: W/"00e5113df0c18da28bc78b27c4adc865"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://offtherecord.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8555f56d-rk9w9
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8631a4919cd41909-FRA
expires: Tue, 12 Mar 2024 06:19:14 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 32ms
31ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69140841-1&cid=874400336.1710224054&jid=1070636857&npa=1&_u=aGDAAUIQAAAAACAAI~&z=875161020

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 30ms
28ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69140841-1&cid=874400336.1710224054&jid=1070636857&npa=1&_u=aGDAAUIQAAAAACAAI~&z=875161020

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 59ms
19ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=185612438538592&ev=PageView&dl=https%3A%2F%2Fofftherecord.com%2F&rl=&if=false&ts=1710224054010&sw=1600&sh=1200&v=2.9.148&r=stable&ec=0&o=4126&fbp=fb.1.1710224054010.404108945&ler=empty&cdl=API_unavailable&it=1710224053901&coo=false&rqm=GET

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=17, rtx=0, c=10, mss=1326, tbw=2777, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 12 Mar 2024 06:14:14 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 200 events Show response
wa.appsflyer.com/ 80 B
534 B 109ms
45ms XHR
application/json 18.66.112.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://wa.appsflyer.com/events?site-id=26de086f-993b-4d92-9fb8-a2ee6128f041
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-5.fra56.r.cloudfront.net
Software: /
Resource Hash: 86490ae354f947bd2b55c26b8a48fd7369b534a0f6c06d61f5cae3766ab3cbf1

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-type: text/plain

Response headers

date: Tue, 12 Mar 2024 06:14:14 GMT
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 80
x-amz-cf-id: pySIpnLpgtaaHVMWJgdKDlTc__gSmkePXgeh6H66B2rQS7ooiQLe2A==

GET
H2 200 web Show response
relay.offtherecord.com/s/settings/6DGA5/v1/ 5 KB
6 KB 153ms
153ms XHR
application/json 44.219.181.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/s/settings/6DGA5/v1/web
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.219.181.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-219-181-71.compute-1.amazonaws.com
Software: /
Resource Hash: 71210ac42f5f0b1b7fb1d3bc5ac89d398caaa3011d8f566d4f2352b807c2f139

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin: https://offtherecord.com
date: Tue, 12 Mar 2024 06:14:14 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: application/json; charset=utf-8

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 116 B
434 B 127ms
127ms XHR
application/json 2606:4700::6811:589a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=24128821&utk=

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:589a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

591b2c578e439cac94475a576ae9649867abc142800981002bca6c5e46a9d0ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:14 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 5a8348dc-3ea3-4236-ac65-f938b22e2c51
x-envoy-upstream-service-time: 11
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 5a8348dc-3ea3-4236-ac65-f938b22e2c51
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://offtherecord.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-576f9d768-r7fvm
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8631a4927bebbbbf-FRA

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 433 B
1 KB 138ms
137ms Fetch
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=24128821&currentUrl=https%3A%2F%2Fofftherecord.com%2F

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4bf8910a202b24bd61be26e28eaa8c5f83a48d78999b2693a9cbdf4c9910cf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: e1ddcd66-81a4-4b1a-995d-a518f9da8c42
content-encoding: br
x-envoy-upstream-service-time: 14
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e1ddcd66-81a4-4b1a-995d-a518f9da8c42
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://offtherecord.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5uT5vCIuHZGp7Aaey4hM2HzqzMjAzCNfrAEslksR%2FSi4Ybx2Ies7e46MBOF4VcYsUj%2F94Nnb%2FZf0lkBUgs79YKnmvtYEZDwSJTQBj8m3YZKSYqwAzwRlaC3Icfh%2BOs0gV%2FVZ0EC86bytU2HdFHFqIbpBzE5WSiQC96E%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8631a4929ef418ef-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-bfd765d7d-bbxhh

GET
H2 200 onelink Show response
wa.onelink.me/v1/ 51 B
509 B 43ms
43ms XHR
application/json 18.173.205.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://wa.onelink.me/v1/onelink?af_id=8382efcc-183d-443f-9184-89cc47c9c7b6-p
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.205.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-205-24.fra56.r.cloudfront.net
Software: /
Resource Hash: b4f5a1e1c17e0b76e8a2883f5a5c2fcf1c9241e5f043fbac2aaa6d5f6b20d153

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:14 GMT
via: 1.1 7f26f4279546775ace8410d89a15a960.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P12
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 51
x-amz-cf-id: M4iBDnioubqR7jONXdtEQaKPhI9avJ43BdNTSGb5gsmbGBKd284Gxg==

POST
H2 200 page Show response
relay.offtherecord.com/rec/ 6 KB
2 KB 391ms
163ms XHR
application/json 44.219.181.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/rec/page
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.219.181.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-219-181-71.compute-1.amazonaws.com
Software: /
Resource Hash: 91f9507bd42de947a5f2219a6448cab85551f2b19f023a2bc6fadae5c7e258d5

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://offtherecord.com
date: Tue, 12 Mar 2024 06:14:14 GMT
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: application/json; charset=utf-8

GET
H/1.1 200
OK counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
1 KB 185ms
147ms Image
image/gif 2606:4700::6812:a07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:14 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: MISS
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 7dc10122-3db3-4e98-9084-3679aff5248a
x-envoy-upstream-service-time: 3
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 7dc10122-3db3-4e98-9084-3679aff5248a
Last-Modified: Tue, 12 Mar 2024 06:14:14 GMT
Server: cloudflare
X-Trace: 2BB3B5E2B7DD4A57E33203B6EF56013C7601277817000000000000000000
Vary: origin, Accept-Encoding
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-bfd765d7d-pd6kl
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
X-Robots-Tag: none
CF-RAY: 8631a493bddb6940-FRA

GET
H2 200 pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-s.woff2
fonts.gstatic.com/s/nunitosans/v15/ 30 KB
30 KB 21ms
21ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v15/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-s.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Nunito+Sans:wght@400;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1393acc632c160def86b45c2521c8ee742b7e6239d0d90fb95f51d55cf48b9c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:10:11 GMT
x-content-type-options: nosniff
age: 597843
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31052
x-xss-protection: 0
last-modified: Thu, 27 Apr 2023 00:27:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Mar 2025 08:10:11 GMT

GET
H2 200 channel.html Show response
js.stripe.com/v2/ Frame 1D47 1 KB
1009 B 19ms
19ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v2/channel.html?stripe_xdm_e=https%3A%2F%2Fofftherecord.com&stripe_xdm_c=default102040&stripe_xdm_p=1

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

a3e859b8149a06247853276aa0b4c79c4f3d0d63e91baf88bf96b76fbfc1b492

Security Headers

Name	Value
Content-Security-Policy	report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 38
cache-control: public, max-age=300
content-encoding: br
content-length: 563
content-security-policy: report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: default-src 'self'; connect-src https://api.stripe.com; base-uri 'none'; form-action 'none'; img-src 'self' https://q.stripe.com; script-src 'self' 'sha256-M1LJiJCn3XBCZ1erCVATqpCSJ5Yd9sUrS2npRlBZ6YE='; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 06:14:14 GMT
etag: "19af0c6cc7a0bca20a355b3362dc64a0"
last-modified: Tue, 05 Oct 2021 15:24:12 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 2
x-content-type-options: nosniff
x-request-id: 5da03ea5-d1e2-4e09-93f0-c9fc1024b541
x-served-by: cache-fra-etou8220039-FRA

GET
H/1.1 200
OK counters.gif
forms.hsforms.com/embed/v3/ 35 B
1015 B 244ms
130ms Image
image/gif 2606:4700::6812:a07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:14 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 4b517bdc-f59c-47e6-b7aa-a392fbb9ab8b
x-envoy-upstream-service-time: 5
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 4b517bdc-f59c-47e6-b7aa-a392fbb9ab8b
Server: cloudflare
X-Trace: 2B040242F8EC1EA34058B8FAFAE6A061DB08B8606E000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-bfd765d7d-8vflb
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 8631a496c9cc35f9-FRA

GET
H2 200 m-outer-3437aaddcdf6922d623e172c2d6f9278.html Show response
js.stripe.com/v3/ Frame A14E 200 B
923 B 20ms
20ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 3647775
cache-control: max-age=31536000
content-encoding: br
content-length: 154
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 06:14:14 GMT
etag: "3437aaddcdf6922d623e172c2d6f9278"
last-modified: Fri, 11 Nov 2022 20:25:37 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 524380
x-content-type-options: nosniff
x-request-id: ee5e6959-d81b-4da4-9b5b-b1aa7fbfbf47
x-served-by: cache-fra-etou8220039-FRA

GET
BLOB 200
OK 970bbb01-b4f6-4e1a-a0bb-2c52e6204a4c
https://offtherecord.com/ 1 MB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://offtherecord.com/970bbb01-b4f6-4e1a-a0bb-2c52e6204a4c
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5180628c01079691f3d21afc8086479b923f6127b860cad410a5c48c6bf4ad5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Length: 1322663
Content-Type: application/javascript

GET
BLOB 200
OK bac350d8-59ed-4086-a9f5-da04d67e0615
https://offtherecord.com/ 1 MB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://offtherecord.com/bac350d8-59ed-4086-a9f5-da04d67e0615
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5180628c01079691f3d21afc8086479b923f6127b860cad410a5c48c6bf4ad5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Length: 1322663
Content-Type: application/javascript

GET
H2 200 integrations Show response
relay.offtherecord.com/rec/ 4 KB
5 KB 150ms
149ms Script
text/javascript 44.219.181.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/rec/integrations?OrgId=6DGA5
Requested by: Host: relay.offtherecord.com
URL: https://relay.offtherecord.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.219.181.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-219-181-71.compute-1.amazonaws.com
Software: /
Resource Hash: fda8e2340dd0d31581f956b339da1e9533a2c6838d385e672f984d069dab2a62

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:14 GMT
via: 1.1 google
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: text/javascript; charset=utf-8

OPTIONS
H2 200 user
otr-backend-service-us-prod.offtherecord.com/api/v1/ Frame 0
0 374ms
123ms Preflight 44.196.206.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=7sw9fqq5lfg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.196.206.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-206-21.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: api-token
Access-Control-Request-Method: GET
Origin: https://offtherecord.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept, Api-Token, X-Api-Token, X-Feature, X-Captcha-Token, X-Captcha-Version, X-Resource-Id
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
access-control-max-age: 3600
date: Tue, 12 Mar 2024 06:14:15 GMT
server: nginx/1.22.1

GET
H2 200 _r Show response
relay.offtherecord.com/app-link/ 91 B
635 B 428ms
191ms Script
text/javascript 54.80.207.255
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:444/app-link/_r?sdk=web2.74.0&branch_key=key_live_oik1hC6SvaFGaQl6L4f5chghyqkDbk9G&callback=branch_callback__0

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/186.efe50517e7510d4bc3f6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.80.207.255 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-80-207-255.compute-1.amazonaws.com

Software

openresty /

Resource Hash

94f00b1691d982941263f3aacde8ee4a09a1356d89ebc2e15ce6a0d31ce9e674

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d5710f445906ae917df909d01c495c9e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
server: openresty
x-amz-cf-pop: IAD50-C2
etag: W/"5b-peIhh+OMnJ4HIhKmr2fkWFCJtC8"
x-cache: Miss from cloudfront
content-type: text/javascript; charset=utf-8
content-length: 91
x-amz-cf-id: CwSKagas6dbIAXrQyccaPMLxdJ95sTijSSwwMSMgv5XOztmlGzsWFA==

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 21ms
21ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/main.bc291ec8b2b4aaf36033.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8ca86cf48a8c2f4154e95cbea31e02571890a83dc4a4f97df58ba56aa7f3f164

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 12 Mar 2024 06:14:14 GMT
content-md5: kdeNNlYwNAcbvnIfIpH9jQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1687
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=22, rtx=0, c=23, mss=1232, tbw=4330, tp=9, tpl=0, uplat=0, ullat=-1
x-fb-debug: 4bUHf9WcU9uJG2l+ckIWsf6L6zmjtFAYyJ+8iCMzDy8ftjqfyIvGoq8C38YgU3ICktDnXv2b50ea01dsemnodQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 86aa7aefe009d7ff1a59d5737e87b6a0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "84cb187e5bff95f9e6bacd4b1981be02"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Tue, 12 Mar 2024 06:25:21 GMT

GET
H2 200 widget.js Show response
wchat.freshchat.com/js/ 67 KB
22 KB 491ms
241ms Script
application/javascript 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/js/widget.js

Requested by

Host: offtherecord.com
URL: https://offtherecord.com/main.bc291ec8b2b4aaf36033.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

b4db541e06042b252e36e46c88fd77da3bc560c9b3c92f6bb1425a4b13b8d0ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-trace-id: 00-f578837157fcd78f5b35ad2986ab41e9-485ded79ff364433-00
date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Mon, 11 Mar 2024 03:32:17 GMT
server: fwe
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/javascript
x-fw-ratelimiting-managed: false
cache-control: max-age=900, must-revalidate
x-server: pk9w4
x-envoy-upstream-service-time: 1
x-xss-protection: 1; mode=block
x-request-id: af7e813b-0b0b-4835-8051-e06b5952783a

GET
H2 200 user Show response
otr-backend-service-us-prod.offtherecord.com/api/v1/ 163 B
585 B 343ms
120ms XHR
application/json 44.196.206.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=7sw9fqq5lfg

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.206.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-206-21.compute-1.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

7e7558ddd527f6452c7c72f510f48964f6319f317b314829c2786e42346c372e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Api-Token: vKWrNZN8UMwxcqPxyRqbJo9x6OABtoqMA7scyCkpkSy82UcA
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
server: nginx/1.22.1
x-frame-options: DENY
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 / Show response
js.stripe.com/v2/ Frame 1D47 62 KB
22 KB 19ms
19ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v2/

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v2/channel.html?stripe_xdm_e=https%3A%2F%2Fofftherecord.com&stripe_xdm_c=default102040&stripe_xdm_p=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

91ab93b25227f8a29a716fdc41831b0a8a8729d8cde9f8adb29f4c8392457b9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v2/channel.html?stripe_xdm_e=https%3A%2F%2Fofftherecord.com&stripe_xdm_c=default102040&stripe_xdm_p=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 12 Mar 2024 06:14:14 GMT
via: 1.1 varnish
age: 57
x-cache: HIT
content-length: 21836
x-request-id: a6f4b826-5b95-4676-8d02-b9a0eca264b1
x-served-by: cache-fra-etou8220039-FRA
last-modified: Thu, 03 Feb 2022 12:42:55 GMT
server: Fastly
etag: "4e0e5080f8f45588fcc33b82ee08fa3c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=300
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 3

GET
H2 200 m-outer-15a2b40a058ddff1cffdb63779fe3de1.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame A14E 526 B
496 B 20ms
20ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 12 Mar 2024 06:14:14 GMT
via: 1.1 varnish
age: 3635684
x-cache: HIT
content-length: 315
x-request-id: 7d51cf65-4fbe-4821-b1d8-d359cbecd60a
x-served-by: cache-fra-etou8220039-FRA
last-modified: Fri, 11 Nov 2022 20:25:36 GMT
server: Fastly
etag: "d96c709017743c0759cf3853d1806ba5"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 501310

GET
H2 200 default-template.8ffdc728dbde00888df0.html Show response
offtherecord.com/templates/ 732 B
1 KB 43ms
43ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/default-template.8ffdc728dbde00888df0.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: bd90f865472fe70f7acafca83b79b17cea7a2687024d4842309ad97e7bc04f7c

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"2dc-18e14d68960"
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 732
x-amz-cf-id: gZWo43aRpwl1gnZQA6W7QzQHzcoN_vZSr2E8k6BrJD9HRNKBKe8QNg==

GET
H2 200 home.component.210dcaefd5226e739222.html Show response
offtherecord.com/templates/ 32 KB
7 KB 27ms
26ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/home.component.210dcaefd5226e739222.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 32a55c673dfbcccd608dfa96cd2aa9b34d0b503ba32de13ace9f5b81c05e0386

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"7eff-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: ahsQM4n3-rXmQenO926U10h6X-udqfI8n3hkuIC9ZrMgIxRRqQHGkA==

GET
H2 200 login.f6fbca98a517192141ec.html Show response
offtherecord.com/templates/ 23 KB
4 KB 39ms
39ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/login.f6fbca98a517192141ec.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 2f13b76b467a78df2cd37eb751e0af06073bcdd2513f28c88d18b2b729655b88

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:00 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"5d11-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: 6aHE1D24qy_PGIP6NhfXp3jWCfc2q05ZIkgjNv7F9UO5ihbmJFaGWQ==

GET
H2 200 state-selection.82c570e66814fe0590fd.html Show response
offtherecord.com/templates/ 1 KB
937 B 27ms
27ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/state-selection.82c570e66814fe0590fd.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: f01d3fe2a8106b2ac0fe9ed20c7c3548c198cb1402e5fba6ac150841ea4bd65f

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:00 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"572-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: 83PoD_QD25gOQ05gztQOZ8kWSn6zAhWncBvg1n1hxu_twlGJPkda7A==

GET
H2 200 main-header.partial.b3df9044de97598fd08b.html Show response
offtherecord.com/templates/ 12 KB
2 KB 38ms
36ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/main-header.partial.b3df9044de97598fd08b.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 489d06131e031d27a033f924daba197f6b483b9bc8602b0dddaea8ebe90f60d8

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:00 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"3005-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: ierVvBGmYeo90s5pYbppYPb6tYbG2sIyjQFOo0-6UkNwCQu9wOXfsw==

GET
H2 200 footer.partial.81e920274a90200db452.html Show response
offtherecord.com/templates/ 10 KB
3 KB 38ms
37ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/footer.partial.81e920274a90200db452.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: f0aca14253930503a97bf0b479bd91941bc9e58f6c81ca5967033a2abfb71506

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:00 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"29b3-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: -uyFQbUK9o3rM3D6RavFVJrMuXQZiBhQ6KCwoP297ps0mWa5euRDkQ==

GET
H2 200 featured-on.partial.e808beb00cc7948f5691.html Show response
offtherecord.com/templates/ 1 KB
790 B 39ms
35ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/featured-on.partial.e808beb00cc7948f5691.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 5d904be0b7b81df09b9197c0b09baac3340e08a583a17f64b75e1c0b467dd07f

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:00 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"593-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: vO_-wSjAqsM1EIX6ffqAQYOoOMCX3jYUzWoS9uMOA8kuKA1vCBpwLQ==

GET
H2 200 inner.html Show response
m.stripe.network/ Frame 71CB 930 B
1 KB 48ms
19ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 209
cache-control: max-age=300, public
content-encoding: br
content-length: 540
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 06:14:14 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: Accept-Encoding, Origin
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 75
x-content-type-options: nosniff
x-request-id: d1853ea8-3080-44a9-bd92-cbad27d0a9b1
x-served-by: cache-fra-etou8220039-FRA
x-timer: S1710224055.962024,VS0,VE0

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 298 KB
85 KB 49ms
22ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=865dcb2e9490fb2ac9011033adb017a9

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2ef16bb29f01e7d86c77b1e4486887baca5f00283c04c9dbc460661801899a2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 12 Mar 2024 06:14:14 GMT
content-md5: RV6YQpZZu3gb/4qRXtWs5w==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87206
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=20, rtx=0, c=23, mss=1232, tbw=4330, tp=9, tpl=0, uplat=1, ullat=-1
x-fb-debug: xQ2Cm0Gd3OZUZBuuaOPyv1W4x6fd3ARFT3E31xPyUrgdTSSaLEVf+ebZMFniseFbcfuGx1VEJF/ytFOcfrDlGg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 77a0548c6ddde0abeae3b96e3b120c97
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "cbb3ab957660ff0dfc3279860b25f74b"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Wed, 12 Mar 2025 05:26:40 GMT

OPTIONS
H2 200 reviews
otr-backend-service-us-prod.offtherecord.com/api/v1/ Frame 0
0 280ms
127ms Preflight 44.196.206.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://otr-backend-service-us-prod.offtherecord.com/api/v1/reviews?includeAnonymous=false&limit=24
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.196.206.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-206-21.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: api-token
Access-Control-Request-Method: GET
Origin: https://offtherecord.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept, Api-Token, X-Api-Token, X-Feature, X-Captcha-Token, X-Captcha-Version, X-Resource-Id
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
access-control-max-age: 3600
date: Tue, 12 Mar 2024 06:14:15 GMT
server: nginx/1.22.1

GET
H2 200 banner-alert.component.d2f56183364bd8e20a47.html Show response
offtherecord.com/templates/ 2 KB
980 B 37ms
34ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/banner-alert.component.d2f56183364bd8e20a47.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a570be658968d1a85d2f9093d62ea04bf3c0b1ef5755b0af1b863cfbb17b4bb4

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"6bf-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: mdX6lq8VqZJV0agP7k4WWF4T7kJBjzqzo8R9smMEz-SsBIpshhBDUA==

GET
H2 200 side-nav.partial.6838a80488aaaa725f31.html Show response
offtherecord.com/templates/ 4 KB
1 KB 27ms
26ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/side-nav.partial.6838a80488aaaa725f31.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 031f287592b33afc19eee9195f23b5146d5922bc004dc439df3e3d8b0bf54008

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"1153-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: 0Lv2kOWNkAwuCAKPJgmiER2urElCB8Am0lo-8R5w9GlFPMK10vKawg==

GET
H2 200 app-text-reveal.component.ec73460453e9a8290e8b.html Show response
offtherecord.com/templates/ 304 B
676 B 25ms
24ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/app-text-reveal.component.ec73460453e9a8290e8b.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: d100a79e9ca4f220f81fd0729136ce2839c361f0850a3ddabb987bb04c99b925

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"130-18e14d68960"
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 304
x-amz-cf-id: ejP8hP-PQWAuyI0Us3qFt577hFDOqq-3nDtaDEZtpZdZTcfOlWpHog==

GET
H2 200 stats-banner.component.1cdbc52a8051d62bdd92.html Show response
offtherecord.com/templates/ 3 KB
1 KB 25ms
25ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/stats-banner.component.1cdbc52a8051d62bdd92.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 9d64ce89336a149d954573c477ff7d9b320f92db397e754626c809b1d1313503

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136513
x-powered-by: Express
etag: W/"ba1-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: ftt2LC7VZy13Dopm6Xz2Ar-pnKToOtxcSrE-Pfo6dT5davrA6RLr_g==

GET
H2 200 reviews Show response
otr-backend-service-us-prod.offtherecord.com/api/v1/ 26 KB
4 KB 342ms
123ms XHR
application/json 44.196.206.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://otr-backend-service-us-prod.offtherecord.com/api/v1/reviews?includeAnonymous=false&limit=24

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.206.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-206-21.compute-1.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

ef86cd162f0d8a08cc65b8c8e07efdf5e3e2d3dd1dea0136e0ded75f40ba38f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Api-Token: vKWrNZN8UMwxcqPxyRqbJo9x6OABtoqMA7scyCkpkSy82UcA
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
server: nginx/1.22.1
x-frame-options: DENY
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 faq-dropdown.1f8e8ecca146a162f7ea.html Show response
offtherecord.com/templates/ 1 KB
787 B 27ms
27ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/faq-dropdown.1f8e8ecca146a162f7ea.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 99141deb1e06c17d62b664d1b8bacde6c827cd0559a8cd2c2a81b45e0ac3304c

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"42a-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: buA5lG_rcEEbkKNGPkUxA0Lw2k9thrX3Xf_dHIGVdGMwKmkfwN4fWQ==

GET
H2 200 9b29c8910f036259af20.webp
offtherecord.com/ 5 KB
5 KB 28ms
27ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/9b29c8910f036259af20.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 3f0730cd0abfa61ab736fc7797e8d6ed2ad78d1b1a903a0664bcfb2f67b04adb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"1344-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 4932
x-amz-cf-id: 59unocuZQZAUSoDM2Kbodcz2aQ1Tdsyif0X_mYhM6ppuppKKBuH2wQ==

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 22ms
22ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 00:37:10 GMT
x-content-type-options: nosniff
age: 365825
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Mar 2025 00:37:10 GMT

GET
H2 200 pro-fa-solid-900-0.woff2
ka-p.fontawesome.com/releases/v6.5.1/webfonts/ 12 KB
12 KB 46ms
41ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/webfonts/pro-fa-solid-900-0.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aca4dbd73acdbca407bee1704d3a11d396de341d74dbc08bb028b36b7626ea4d

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:53:38 GMT
server: cloudflare
age: 8843302
etag: "6568cc22-2ee0"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a497da325d93-FRA
content-length: 12000

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 23ms
21ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 01:17:56 GMT
x-content-type-options: nosniff
age: 17779
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Mar 2025 01:17:56 GMT

GET
H3 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v40/ 18 KB
18 KB 30ms
27ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 02:10:54 GMT
x-content-type-options: nosniff
age: 533001
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18668
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:00:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 06 Mar 2025 02:10:54 GMT

GET
H2 200 pro-fa-brands-400-1.woff2
ka-p.fontawesome.com/releases/v6.5.1/webfonts/ 39 KB
39 KB 45ms
40ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/webfonts/pro-fa-brands-400-1.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 116b5b718ba3beeea9dd77ad669ca8aff001cf40c1c6e549dd38c3d08668d4cd

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:53:28 GMT
server: cloudflare
age: 8843302
etag: "6568cc18-9cfc"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a497da335d93-FRA
content-length: 40188

GET
H2 200 pro-fa-brands-400-0.woff2
ka-p.fontawesome.com/releases/v6.5.1/webfonts/ 38 KB
38 KB 57ms
52ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/webfonts/pro-fa-brands-400-0.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70356aaad8b043112594064fea69694e5af4f17b6af4d4836b184735afe24c56

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:53:28 GMT
server: cloudflare
age: 8843302
etag: "6568cc18-9620"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a497da345d93-FRA
content-length: 38432

GET
H2 200 otr-main-header-logo.svg
offtherecord.com/assets/img/ 9 KB
4 KB 36ms
32ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/otr-main-header-logo.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 648c698dd41bf291833204226476e7d092b281fd06255a70a4925f45ca8c96c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"2495-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: uZC4zc0Cm7_088dU__al3ZmpXj7SV5SfQ2-79EfP-7RPUmTKLVovrQ==

GET
H2 200 badge_ios.webp
offtherecord.com/assets/img/ 2 KB
2 KB 31ms
27ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/badge_ios.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: f1e6a0811f0df7be7482db95552fd57017ca33d5a35f07c330859debd46d135c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"6f4-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 1780
x-amz-cf-id: xjfaLq4WMAmhpMy9n8ci3gh_EaLCZe3yeHDqV7bOhfnCU4w6Awqc1Q==

GET
H2 200 badge_google_play.webp
offtherecord.com/assets/img/ 3 KB
4 KB 30ms
26ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/badge_google_play.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 6b771d8c7719a4d6187fb47de02b830ba0ccf68e66be12526786ded85cb960b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"cd2-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 3282
x-amz-cf-id: faRFe_z1FceTYk0yaaBLoOQIsNEc6VXudamJ6vdCbAbSe-FmiYTBJg==

GET
H2 200 hero-img.webp
offtherecord.com/assets/img/ 36 KB
37 KB 33ms
29ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/hero-img.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: c625a259d52303bc63e165e0326e1d78de9bb5b5074423f368df77fca407b7bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"90b4-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 37044
x-amz-cf-id: VtDI6k8zbX1JNSvqaJJ8iuaCtSMxS9BFIMeJg4WglvWx7f6H2w0ZNQ==

GET
H2 200 facebook--gray.webp
offtherecord.com/assets/img/logos/ 2 KB
2 KB 37ms
33ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/facebook--gray.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 7e3f2e5c9c0f642f19eb5d1488c3257ad89341700795e0e6253400c876c4e06d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"7fe-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 2046
x-amz-cf-id: lbm4uSe4ZtOUl6tE258yrXS3GjzeARCeXoyLaZ8QouZfwCOArl22NA==

GET
H2 200 reviews-io--gray.webp
offtherecord.com/assets/img/logos/ 3 KB
3 KB 34ms
30ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/reviews-io--gray.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: e2eb49ebf978dd7140eacd08fca34dfe6da0db3bebdee08606996d00766d60af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:29 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"c0a-18e14d68d48"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 3082
x-amz-cf-id: 9zfWsrPrrj0gDOkZBG9mlASHkOUxx-R5zAMIrxfzz276T38imdLZfw==

GET
H2 200 google--gray.webp
offtherecord.com/assets/img/logos/ 5 KB
5 KB 46ms
43ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/google--gray.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: d52af8243ca6afe270829cfe2853cb79a486b81650f8b575374a220c311d5411

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:29 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"145c-18e14d68d48"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 5212
x-amz-cf-id: dyZ7_sma8GqBG4iftVDr28BN-WsUiP-inz5BqQBSYem_PZ1g6_I3lA==

GET
H2 200 icon-handfull-stars.svg
offtherecord.com/assets/img/ 4 KB
2 KB 37ms
34ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-handfull-stars.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: c46812c7c91d67dcc84ac30ff32138415af25b3416ea5b6588628cb3e2d1f686

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"11aa-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: 5AmQe3dLVrQGuY_Xq-pV-FAk9_7JpGz9n16nP1RWfEUHnEL12IQWFw==

GET
H2 200 icon-wallet.svg
offtherecord.com/assets/img/ 2 KB
1 KB 38ms
35ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-wallet.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 8e742fbd7146cea9dee3a9c4b4474e1da43f62e8864d519c1debe7f10ec6043b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"7cf-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: b0LVS74xbHfDPtFWxJP4oIy08xlFi4KnichHZTfbcr-y0feV7TOXIA==

GET
H2 200 icon-briefcase.svg
offtherecord.com/assets/img/ 2 KB
1 KB 40ms
37ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-briefcase.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a8510ffd3e9d2934e0ad67e81a2fc12f36e2b04ac3f3f150bd7e44ad12af3d76

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"79f-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: gL5dQL5hy_fzHYAY5mo3jfX9Gd3YXH9qTvQMQSh3eS_LhtVGWm8boQ==

GET
H2 200 icon-refresh.svg
offtherecord.com/assets/img/ 2 KB
1011 B 39ms
36ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-refresh.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a3d2952330aefe690302e90460777d9b5c6fc354861336a919c83e44fe352800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"6e0-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: sYwpR9ELIzj9aPr37vFVxx2XYfDsyw29Xf78m-DX9XkjBgpAtJcdfA==

GET
H2 200 how-step-1.webp
offtherecord.com/assets/img/ 26 KB
26 KB 42ms
39ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/how-step-1.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: fac08aba895b0525de1904bc4fb04928ba03ec2cd715d084831f0dd265774bce

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"6680-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 26240
x-amz-cf-id: fpUEH_JlthYJm-Z2DM3d6IPWO6LKUG986MJBgfkOIk2RkeNBA9jIUg==

GET
H2 200 how-step-2.webp
offtherecord.com/assets/img/ 36 KB
37 KB 53ms
50ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/how-step-2.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 38ba6370b8d16de4ee7f82099425ead835ff7317d56bf86fe0f5bd34a1a266ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"9112-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 37138
x-amz-cf-id: 5TWrKTTdBTeijcvJj0ObTDJIiSwPYRHGR4YA3WAnVWNOiP3IqYqrhw==

GET
H2 200 how-step-3.webp
offtherecord.com/assets/img/ 27 KB
28 KB 65ms
62ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/how-step-3.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 099f5764acf448fdd12bdb9f709606093ea481ecf2b55f03f89ed8cbad7849fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"6d12-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 27922
x-amz-cf-id: hmdAa6keZfbj6pgIxjNIGMyHG77WlEMZxrb2Qw05ZezrsGfKi0BaEw==

GET
H2 200 icon-tickets.svg
offtherecord.com/assets/img/ 3 KB
1 KB 71ms
69ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-tickets.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 2d367b9054bc5b92d423f2f9484c18d8b41468a7f4fd9e63829d3dba290a206e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"d60-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: aZAvI1TXmnPMecaFeZhCtoN2l_EkxgH2HMSNRMWpYnT8d_-TWeq_SA==

GET
H2 200 icon-window-check.svg
offtherecord.com/assets/img/ 2 KB
1 KB 44ms
42ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-window-check.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 0e52361cb2f6af4bb1f5fa4f27c87ddb8c6d4918ccd75655bd1d1bb34d4eeabe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"6b8-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: PfurIaBpfMzWk83xY_7xV1n6Vug_fE3OnFU27s5CHPpPjtwBwC1Tug==

GET
H2 200 icon-directions.svg
offtherecord.com/assets/img/ 2 KB
1 KB 48ms
46ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-directions.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a5d227b5d9c8b9b461d0a35df1c39685463fe0bd375c2aa2aa197dfd2776a7c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"787-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: ZhyvrSBP1auAg3SVtmJ6bMLyf4L4WHJ8NuBS06MeIJcNyxTuxnT6Jg==

GET
H2 200 icon-verified.svg
offtherecord.com/assets/img/ 3 KB
2 KB 52ms
50ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-verified.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 909c4adf1c2435d373b6e0d83ee64cc9888881ac24905238ea010b4da3d06b93

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"b51-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: M16kOtQ_nKPJtp2tvRhWksfWkd2P2RhOQQmdVYFhkv0fvsZIzJE4gw==

GET
H2 200 icon-money-back.svg
offtherecord.com/assets/img/ 2 KB
1 KB 47ms
45ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-money-back.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 17d2ee6ef525d4a35125c1ce7417ef5b7e1b611c2dc110a3add824bb078adcbf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"897-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: gAtBayJZ7U2To4l7pDlZ6LwQP1FygXuNCQCsqtAb571SrY4XWp6keQ==

GET
H2 200 icon-courthouse.svg
offtherecord.com/assets/img/ 3 KB
1 KB 46ms
44ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-courthouse.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 6a432ec996da0b400368eb6cf47f8e056f2b25e32a50b03d9a709fa6c1fecc1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"c41-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: 0gkc8oI0b7E8L2qxyqzvicSUWbLY_yI6FR1u3row3J5YUJTg7DewNw==

GET
H2 200 icon-notification-bell.svg
offtherecord.com/assets/img/ 3 KB
1 KB 49ms
47ms Image
image/svg+xml 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/icon-notification-bell.svg
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: b07fffef0ae1504dfba7fb4096afb6e097815298973f51a1b211771e05c075b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"a5c-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-amz-cf-id: QAn3uNzWu6n64EWoUbmfkhoZR-FFDfE6_HrUF3TR2lPDjGqhOmj2xw==

GET
H2 200 cbs-logo-bw-min.webp
offtherecord.com/assets/img/logos/ 2 KB
2 KB 54ms
52ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/cbs-logo-bw-min.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 98af017c05d0d89d07187e5fea5df961cfe0da03321de1daf05e545b663718a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"866-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 2150
x-amz-cf-id: gDPjQUrBUWvbayuxGHMT8vDOkA-SgyDZojbjUrqDyU6g2hLmz_6kSA==

GET
H2 200 fox-news-logo-bw-min.webp
offtherecord.com/assets/img/logos/ 650 B
1012 B 49ms
48ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/fox-news-logo-bw-min.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: fdcc34060c0c6a0ec771d0a4f1e14f00092e96577e166be28d33b83ba72faa69

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:29 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"28a-18e14d68d48"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 650
x-amz-cf-id: H51RursX3BVg4QawM6ljmFc17LZMLKHjI4Hu0tphcO2XXJ_5Rnb_-Q==

GET
H2 200 nbc-logo-bw-min.webp
offtherecord.com/assets/img/logos/ 2 KB
2 KB 50ms
48ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/nbc-logo-bw-min.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a6b9e77f842f68bf64b450048c752a189401955f45d149c5430fbc208469ffe0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:29 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"76a-18e14d68d48"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 1898
x-amz-cf-id: EaYYCT2Y1yV8V0zJGcTKnTo9vuGytFt_ukAa-2sTqVeVkgs9og5cVw==

GET
H2 200 geekwire-logo-bw-min.webp
offtherecord.com/assets/img/logos/ 3 KB
3 KB 50ms
49ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/logos/geekwire-logo-bw-min.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: b1ec55a9e66fe05243e1977a0db2af48f4af4c07bfd0b9cdef32c01ab0f42b9d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:29 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"a46-18e14d68d48"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 2630
x-amz-cf-id: z6X3cgN2HcCsZuKw5pkNAIGM2Yj2geyheunmtZ1y4vjJC7WctR00FQ==

GET
H2 200 b251b2efc9d8ee4fbafb.gif
offtherecord.com/ 2 KB
3 KB 50ms
49ms Image
image/gif 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/b251b2efc9d8ee4fbafb.gif
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: a05de9f3792048eff0cedc9370691b2a604cc1628f6aa9f70ad07444d2f02bdb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"9f2-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/gif
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 2546
x-amz-cf-id: Pf1JocBGV-h-wj0zqc37gGREj6kZGTEVTwqE_ROaGoIb0x8pfRWh7g==

OPTIONS
H2 200 user
otr-backend-service-us-prod.offtherecord.com/api/v1/ Frame 0
0 192ms
124ms Preflight 44.196.206.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=4ueg16o8icd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.196.206.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-206-21.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: api-token
Access-Control-Request-Method: GET
Origin: https://offtherecord.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept, Api-Token, X-Api-Token, X-Feature, X-Captcha-Token, X-Captcha-Version, X-Resource-Id
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
access-control-max-age: 3600
date: Tue, 12 Mar 2024 06:14:15 GMT
server: nginx/1.22.1

GET
H2 200 user Show response
otr-backend-service-us-prod.offtherecord.com/api/v1/ 163 B
584 B 344ms
121ms XHR
application/json 44.196.206.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=4ueg16o8icd

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.206.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-206-21.compute-1.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

7e7558ddd527f6452c7c72f510f48964f6319f317b314829c2786e42346c372e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Api-Token: vKWrNZN8UMwxcqPxyRqbJo9x6OABtoqMA7scyCkpkSy82UcA
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
server: nginx/1.22.1
x-frame-options: DENY
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 out-4.5.43.js Show response
m.stripe.network/ Frame 71CB 87 KB
15 KB 20ms
20ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.43.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
date: Tue, 12 Mar 2024 06:14:15 GMT
x-content-type-options: nosniff
content-encoding: br
via: 1.1 varnish
age: 74
x-cache: HIT
content-length: 15509
x-request-id: 788237d7-e0d2-470e-9370-a0014111d12d
x-served-by: cache-fra-etou8220039-FRA
server: Fastly
x-timer: S1710224055.086749,VS0,VE0
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=300, public
accept-ranges: bytes
x-cache-hits: 30

GET
H2 200 stats-banner-design.webp
offtherecord.com/assets/img/ 13 KB
14 KB 29ms
28ms Image
image/webp 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/assets/img/stats-banner-design.webp
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 4c64d183304fcb9316adeceed80e112ae71c6e33484b097896dbb6998d4b9659

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"353a-18e14d68960"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 13626
x-amz-cf-id: avGEZjSOACLFJyLhLfJ6tZNiLeFdi7y0KJsd6MjVp0eHR9bfee39Jw==

GET
H2 200 pro-fa-solid-900-12.woff2
ka-p.fontawesome.com/releases/v6.5.1/webfonts/ 13 KB
14 KB 34ms
34ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/webfonts/pro-fa-solid-900-12.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4aae83ca0e34e5fef9bebf88ca4edfdf495e4927bbd583d1f05ff101c9421d4c

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:53:38 GMT
server: cloudflare
age: 8843302
etag: "6568cc22-35f8"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a4987aac5d93-FRA
content-length: 13816

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 26ms
26ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 04:10:19 GMT
x-content-type-options: nosniff
age: 7436
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Mar 2025 04:10:19 GMT

GET
H2 200 pro-fa-solid-900-14.woff2
ka-p.fontawesome.com/releases/v6.5.1/webfonts/ 13 KB
13 KB 32ms
32ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/webfonts/pro-fa-solid-900-14.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3bb91ef2b6189fe3bb3bcbfd35f127e49b588e629ec86a9e9265462c3bd9e55

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:53:38 GMT
server: cloudflare
age: 8843302
etag: "6568cc22-3408"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a4987ab55d93-FRA
content-length: 13320

GET
H2 200 pro-fa-solid-900-1.woff2
ka-p.fontawesome.com/releases/v6.5.1/webfonts/ 14 KB
14 KB 43ms
43ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/webfonts/pro-fa-solid-900-1.woff2
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 56c15eda02cf6ba7e0d5395be0711db12448713af34cff495ce568289afdb730

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:53:38 GMT
server: cloudflare
age: 8843302
etag: "6568cc22-36d0"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a4987ab65d93-FRA
content-length: 14032

GET
H2

200

latest.js Show response
edge.fullstory.com/datalayer/v4/
Redirect Chain

https://relay.offtherecord.com/datalayer/v4/latest.js
https://edge.fullstory.com/datalayer/v4/latest.js

43 KB
12 KB

103ms
22ms

Script
application/javascript

35.201.112.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/datalayer/v4/latest.js
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/
Protocol: H2
Server: 35.201.112.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e9cb2dafa252ae54afb3b91b1c30d12761a37459d7e03741268408d9bd106bb6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 05:35:17 GMT
content-encoding: gzip
age: 2338
x-guploader-uploadid: ABPtcPo91o4o_9_jWA3h3xofh_Rc9eUJhdEszrg7opE7PCY24nCXS3_lXRDdqoLIAgs0Nx_JOe4miTqQgQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11988
last-modified: Wed, 07 Feb 2024 17:30:35 GMT
server: UploadServer
etag: "f508d59395bb8a9f0ad225a4e0ee1b59"
x-goog-generation: 1707327035834140
x-goog-hash: crc32c=hIvD1g==, md5=9QjVk5W7ip8K0iWk4O4bWQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=3600,no-transform
x-goog-stored-content-length: 11988
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 12 Mar 2024 06:35:17 GMT

Redirect headers

location: https://edge.fullstory.com/datalayer/v4/latest.js
date: Tue, 12 Mar 2024 06:14:15 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72
content-type: text/html; charset=utf-8

POST
H2 200 6 Show response
m.stripe.com/ Frame 71CB 156 B
669 B 586ms
190ms XHR
application/json 34.208.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.208.52.14 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-208-52-14.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

52ad033ab67a5c5a03293a9f3cd15bcb0556019fb479c60f7d5fc2984b86626f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1710224055668481
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 2
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1710224055667836
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

POST
H2 200 open Show response
relay.offtherecord.com/v1/ 323 B
694 B 439ms
199ms XHR
application/json 54.80.207.255
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:444/v1/open

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.80.207.255 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-80-207-255.compute-1.amazonaws.com

Software

Resource Hash

ead100902fcce73a9e8a3f597b51bf6f2d6749d76f90b3a9c4130465283153d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
via: 1.1 f1dd5bd4f4b31b158b9e826b6e013cda.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: IAD55-P4
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-branch-request-id: 698ff9ed-ab21-4373-9f2f-2fa7a882dc50-2024031206
content-length: 323
x-amz-cf-id: St5ygYMyiUO_M53_m8jGiNrWqP3in8HllvYJciUKUabgzMaTiFzrng==

GET
H2 200 config_iframe.html Show response
wchat.freshchat.com/widget/ Frame DF59 701 B
1 KB 124ms
124ms Document
text/html 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/widget/config_iframe.html?host=https://wchat.freshchat.com&token=c36ed4b1-ac05-4052-a91f-83203339cd7c&origin=https://offtherecord.com

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

bae1f759fd4cd9055a14e9384f474c8e53358ea04bffda92bde1e11b0599c61c

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-encoding: gzip
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
content-type: text/html
date: Tue, 12 Mar 2024 06:14:15 GMT
last-modified: Mon, 11 Mar 2024 03:32:17 GMT
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
server: fwe
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1
x-fw-ratelimiting-managed: false
x-request-id: 6427cbab-d997-4534-9c5a-7e9ec3b591c5
x-server: fnxjq
x-trace-id: 00-8d89f7ba89c8b5b5eadeca9ea2a4eb71-b88990d5dd00a581-00
x-xss-protection: 1; mode=block

GET
H2 200 fc-pre-chat-form.css
snippets.freshchat.com/css/ 2 KB
1 KB 468ms
409ms Stylesheet
text/css 52.222.214.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://snippets.freshchat.com/css/fc-pre-chat-form.css
Requested by: Host: offtherecord.com
URL: https://offtherecord.com/main.bc291ec8b2b4aaf36033.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-55.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9027bc2ee5d559beeb81d822fd8e1b8962f6be256aaed95aca74a0a519406c3a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-amz-version-id: 7OnEBywXzVAA7dOf2qysIqyO2hTJpPUZ
content-encoding: br
via: 1.1 e45d812d65a0d0336b945e28b9381462.cloudfront.net (CloudFront)
date: Tue, 12 Mar 2024 06:14:16 GMT
last-modified: Wed, 30 Oct 2019 14:02:09 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P3
x-amz-server-side-encryption: AES256
etag: W/"4e65817d49212c3bd08daf7ba74670a9"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: text/css
cache-control: max-age=3600
x-amz-cf-id: 9WT-amzoAPqEH2Yo2PfgTp3wallPVzVfjRPWKgG8tYwVnggP-MBBjA==

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 178ms
140ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=166860084&v=1.1&a=24128821&rcu=https%3A%2F%2Fofftherecord.com%2F&pu=https%3A%2F%2Fofftherecord.com%2F&t=Fight+Your+Moving+Violation+%7C+Traffic+Ticket+Lawyer+Local+%26+Online&cts=1710224055385&vi=f307fde14550058fd5a73070e81e8b66&nc=true&u=77102922.f307fde14550058fd5a73070e81e8b66.1710224055383.1710224055383.1710224055383.1&b=77102922.1.1710224055383&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: fa389863-51b1-4df6-8566-7ba32b62a099
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 8
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: fa389863-51b1-4df6-8566-7ba32b62a099
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rOUO0YnyZCqfpcKvpsuMaacIVq16t1MPS07tAZpcedsL0VzDfxWk0Z4gBKR5M48g7S1rZYx8fIJCnvkys6jatMFH1AWkECsMSYUAFGYVNEazisD6Dx0%2Fm0T7JKgMYsUKi4FlIuOHJ2AO14iE7lGF"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-68f68ffdf9-scd75
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8631a49a7b399040-FRA
x-robots-tag: none

GET
H2 200 config Show response
wchat.freshchat.com/app/services/app/webchat/c36ed4b1-ac05-4052-a91f-83203339cd7c/ Frame DF59 3 KB
2 KB 138ms
138ms Fetch
application/json 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/app/services/app/webchat/c36ed4b1-ac05-4052-a91f-83203339cd7c/config?domain=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/config_iframe.html?host=https://wchat.freshchat.com&token=c36ed4b1-ac05-4052-a91f-83203339cd7c&origin=https://offtherecord.com

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

8b742fc4a5cda07cc6fb4b147cc71a75b1245d392b21b10d0eda3010d7112c56

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/widget/config_iframe.html?host=https://wchat.freshchat.com&token=c36ed4b1-ac05-4052-a91f-83203339cd7c&origin=https://offtherecord.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-ratelimit-total: 3000
x-ratelimit-used-currentrequest: 1
x-envoy-upstream-service-time: 12
x-xss-protection: 1; mode=block
x-request-id: efe3e7c6-b034-92da-a60d-c12d3f58c6cf
x-trace-id: 00-aa59a44e65865e156043f992116680a8-0b531c2be6c24a89-01
server: fwe
vary: accept-encoding
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/json;charset=UTF-8
x-fw-ratelimiting-managed: true
cache-control: no-store
access-control-allow-credentials: true
x-server: 9886
x-ratelimit-remaining: 2999
x-ratelimit-limit: 3000

OPTIONS
H2 200 logout
otr-backend-service-us-prod.offtherecord.com/api/v1/authentication/ Frame 0
0 116ms
116ms Preflight 44.196.206.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://otr-backend-service-us-prod.offtherecord.com/api/v1/authentication/logout
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.196.206.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-206-21.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: api-token,content-type
Access-Control-Request-Method: POST
Origin: https://offtherecord.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept, Api-Token, X-Api-Token, X-Feature, X-Captcha-Token, X-Captcha-Version, X-Resource-Id
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
access-control-max-age: 3600
date: Tue, 12 Mar 2024 06:14:15 GMT
server: nginx/1.22.1

POST
H2 200 logout Show response
otr-backend-service-us-prod.offtherecord.com/api/v1/authentication/ 0
442 B 115ms
114ms XHR
text/plain 44.196.206.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://otr-backend-service-us-prod.offtherecord.com/api/v1/authentication/logout

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.206.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-206-21.compute-1.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Api-Token: vKWrNZN8UMwxcqPxyRqbJo9x6OABtoqMA7scyCkpkSy82UcA
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
server: nginx/1.22.1
x-frame-options: DENY
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 / Show response
wchat.freshchat.com/widget/ Frame F758 5 KB
3 KB 124ms
124ms Document
text/html 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

4c8c6c8d826a559e77b05c609b67debcc8130d72fa176a5f53ae0685e33629c3

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-encoding: gzip
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
content-type: text/html
date: Tue, 12 Mar 2024 06:14:15 GMT
last-modified: Mon, 11 Mar 2024 03:32:17 GMT
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
server: fwe
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1
x-fw-ratelimiting-managed: false
x-request-id: 41a20d6f-38a6-4d49-8747-c4966abf5e4a
x-server: pk9w4
x-trace-id: 00-a961cb08dd6fe15b809fef4d68996c04-1f60b7ecbe9df3b2-00
x-xss-protection: 1; mode=block

GET
H2 200 widget.css
wchat.freshchat.com/widget/css/ 9 KB
2 KB 125ms
125ms Stylesheet
text/css 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/widget/css/widget.css?t=1710224055656

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

1746b268addac39a01bc462c8e85434841637a136be1c0234b2eae14988e3d3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-envoy-upstream-service-time: 1
x-xss-protection: 1; mode=block
x-request-id: bcfa4c8c-b451-9099-89cf-371102a34193
x-trace-id: 00-0bfd0266a8969f0bff65bf7ece0439cb-ba8fe1cd55eec4e9-01
last-modified: Mon, 11 Mar 2024 03:32:17 GMT
server: fwe
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: text/css
x-fw-ratelimiting-managed: false
cache-control: max-age=31536000,no-cache, no-store, must-revalidate, pre-check=0, post-check=0,public
x-server: pk9w4
expires: Wed, 12 Mar 2025 06:14:15 GMT

GET
H2 200 review-rating.component.170c675fa134251aaf4c.html Show response
offtherecord.com/templates/ 948 B
1 KB 28ms
27ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/review-rating.component.170c675fa134251aaf4c.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 2d95f71505cec68b09ebcbad4208d2ede280629de1b62c329cca5aab65fad29a

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"3b4-18e14d68960"
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 948
x-amz-cf-id: 8SxilpQh8KscO3TLjbRDA8tP_Cht0iQqph8sFBPOt-DlwPyueMVYBQ==

GET
H2 200 avatar-image-fallback.component.6d85a17c6b223631488b.html Show response
offtherecord.com/templates/ 88 B
459 B 26ms
26ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/avatar-image-fallback.component.6d85a17c6b223631488b.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 091c27084bee9182fda190c70ab01d92f1f32c72be2f4dd37946f62c315ec574

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"58-18e14d68960"
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 88
x-amz-cf-id: 8kzdsg5Mc5UOOEY8cjjeCTHa0qDWa1RQ05oT-B-8FpLm_z3pwYuZ_Q==

GET
DATA 200
OK truncated
/ 331 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45295a811f899c7eea5e4d0312049da477390afc2a94ffa491dc6979cc34c9ec

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 331 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ff00234ed13b5e571fe0ef5b0f9e465c86d895c156193cd0a7c2f75eac059bf1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 330 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 603e10027c39bb736cc7dee132026554899c8df72c18a59e85d3f748228b0bd9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 330 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1feff37397f802603ed85e9061608051d5b2a77cea125d78519057d06232b07b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 329 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b15b6c9545897b7e1ec41dae5284c1e102e53c435f12c56ede872c54eae03a92

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 329 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed1f896874cf1d2e5ffcf369ed1277be55c36ab18bcbeb822e7a587008e397bf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 329 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 78555e77f61d09d04c161af14988377120b44cbfa38a4f8886083949e34f3e46

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 331 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8a73d9886283369e97c809bb8b7af15cab6263559318fb730256f6da6a720426

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 331 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b2355de8c35632901a81e09dd89f0df8f7f27f9203bf4824da8b9c483801401

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 330 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4333f5dde7ebbe95817db62d45966b8b0ea878734e0ebdceb3cbf93b0b2620d0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 production Show response
anhkgav0.apicdn.sanity.io/v2023-07-12/data/query/ 7 KB
3 KB 151ms
67ms XHR
application/json 34.102.211.197
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://anhkgav0.apicdn.sanity.io/v2023-07-12/data/query/production?query=*%5B_type+%3D%3D+%22faq%22+%26%26+%22home-page-faq%22+in+category+%26%26+state-%3EstateName+%21%3D+%22Florida%22%5D+%7C+order%28orderRank%29&perspective=published

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.102.211.197 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

197.211.102.34.bc.googleusercontent.com

Software

Resource Hash

0e07b0fb649afcc0f980ce84b181a4d5ac825761b516931e25e766cf03d1511e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-sanity-shard: gcp-eu-w1-01-prod-1034
date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
apicdn-cache-control: public, max-age=60, s-maxage=3600, stale-while-revalidate=60, stale-if-error=7200
via: 1.1 google
server-timing: api;dur=20
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2365
access-control-max-age: 600
x-sanity-age: 0
content-type: application/json; charset=utf-8
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Content-Type, Content-Length, ETag, X-Sanity-Deprecated, X-Sanity-Warning
cache-control: public, max-age=60, s-maxage=60, stale-while-revalidate=15, stale-if-error=7200
access-control-allow-credentials: true
vary: accept-encoding, origin
accept-ranges: bytes

POST
H2 200 pageview Show response
relay.offtherecord.com/v1/ 29 B
330 B 255ms
255ms XHR
application/json 54.80.207.255
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:444/v1/pageview

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.80.207.255 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-80-207-255.compute-1.amazonaws.com

Software

Resource Hash

c3dd5a6fff633c6393dca21ce74cd6dc95265943575b43d2d9616f020eea68fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f1dd5bd4f4b31b158b9e826b6e013cda.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P4
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 29
x-amz-cf-id: 6JbwlZJDnGQZOs-otGvAWY_t9-M3IAH4_3r3xtjVcaBDmWJ-TDFnIA==

GET
H2 200 user-rating.component.e3e94106426db1e8d981.html Show response
offtherecord.com/templates/ 2 KB
875 B 25ms
25ms XHR
text/html 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://offtherecord.com/templates/user-rating.component.e3e94106426db1e8d981.html
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: cafed8afce97ffc3d420081a23c193ac0dc3d2c70454332284233b3d151da5ad

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 16:19:01 GMT
content-encoding: gzip
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 17:36:28 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 136514
x-powered-by: Express
etag: W/"913-18e14d68960"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31557600
x-amz-cf-id: yVl2R5JiZ2ByJkGycwGwa7LE3K6tro26V-KPARBrDDpxC83exXs9LA==

GET
H/1.1 200
OK 571041.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 581 KB
581 KB 629ms
221ms Image
image/jpeg 3.5.77.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/571041.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240312T060311Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240312%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=131b1867d7ddc599caf1dde304050813106eab5e44c188d5373af96479aea1d3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.77.142 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 84d2173fa3c469a8e317792681d4bcfa0602be112966a3b6e09d54d233e19b2f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:17 GMT
Last-Modified: Sun, 07 Jan 2024 00:47:53 GMT
Server: AmazonS3
x-amz-request-id: E11N6JQ6A4ETMBTV
ETag: "4431a52d6755c788907ec7365bd5ba7a"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 594764
x-amz-id-2: 6oPEagRH7kN96ee6k9yipj+/jPnFPPEON8sOlp4KA8IljjWDH19DBNd9kOZ8ee18lsd4HLyvSOAJx/jZY5DbbA==

GET
H/1.1 200
OK 555520.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 79 KB
80 KB 644ms
234ms Image
image/jpeg 3.5.77.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/555520.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240312T060311Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240312%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=4f963e75ee59cac0b0e555474b70679911f14804f7149b85c3e2aaabb028a7bf
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.77.142 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 2b92220ef099ffa4a27603556d9b462172c699f8f0198a231b3b83d853c23190

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:17 GMT
Last-Modified: Sun, 30 Jul 2023 16:48:27 GMT
Server: AmazonS3
x-amz-request-id: E11P03Q1BDJ4D167
ETag: "3fb23e48435354752560745372465b2a"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 81190
x-amz-id-2: tw+qj9uL+1E8sty78/ErNgi6S66qqadGuX7Hr5bEh5Zf9lpIwv9je1O94POp0cHdM2+hOHCCeBbaAvjHSrJuRw==

GET
H/1.1 200
OK 620961.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 131 KB
132 KB 664ms
254ms Image
image/jpeg 3.5.77.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/620961.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240312T060311Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240312%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=9a10edef2f96ad370e8d06d901d63967a6cd7fd66d79ea170e19615861e9e181
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.77.142 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 77ca3f103f53fbd67626ae94f18a945d98dc1a82613b493ec9733b01f11c5e97

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:17 GMT
Last-Modified: Wed, 15 Nov 2023 04:56:40 GMT
Server: AmazonS3
x-amz-request-id: E11WQ9E9EZSPCZ5P
ETag: "650a01db0aaf317a11f3fb7333076fec"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 134372
x-amz-id-2: iGwxvmRgzBO6ra35AwEoXYFEYDHelUHWqWXUX5m0dfeMQZFJgRTdwywuGpLVGMV4VPvAB2Ae54KSgxQFoqEAhg==

GET
H/1.1 200
OK 459144.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 106 KB
106 KB 632ms
225ms Image
image/jpeg 3.5.77.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/459144.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240312T060311Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240312%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=c92e7e428a2bfe6e16ed4752c8ec4d3e524384f19f4289b952726da7095163d8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.77.142 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: c19a14f70d866bb5329d5d83f2adc33f4b08321dafbbddd0bcf3a0331f808851

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:17 GMT
Last-Modified: Fri, 13 Jan 2023 04:25:08 GMT
Server: AmazonS3
x-amz-request-id: E11NFK30Y489REZB
ETag: "a37c1ae1d8c653e76599d0724984618d"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 108593
x-amz-id-2: 3evDtiuGzYp/juSxbv/fx5PPXD8o4UarF8JK86SmsCBKmtdcusU+Jbol5+t7EPG0fnwceIXV5kFO0cnQmP/xRg==

GET
H/1.1 200
OK BsfYZQn.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 4 KB
4 KB 631ms
220ms Image
image/jpeg 3.5.77.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/BsfYZQn.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240312T060311Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240312%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=c8116f54819d6e898ff999fbde21c19166f7d2dcd5172bd45a12851d92473231
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.77.142 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: ef1e94b344600fa590f252456ce727e01a2300ccfbf2b41440a836459c3978cc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:17 GMT
Last-Modified: Fri, 22 Dec 2023 05:40:20 GMT
Server: AmazonS3
x-amz-request-id: E11PS9BQCRRTY1R5
ETag: "fa009ce88d6e3eaad30dfb43a19789c2"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 4148
x-amz-id-2: XLbSGDcH9jgIEdTDvpOXL1q5urY1qKQESu2yIPY7O33SsTHNkvkAV4iec2/gj97ZG+RZHBkPcC4SQkEOkC+XpQ==

GET
H/1.1 200
OK sN4G7M0.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 16 KB
16 KB 628ms
218ms Image
image/jpeg 3.5.77.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/sN4G7M0.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240312T060311Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240312%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=633de192571242d166e3158a8bd0251b9249436021b06cff8470d4f5fbb41048
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.77.142 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 127305d53af6493590687101ccb0c9a0780c5e08116bbdd536e6dc12467b88a7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:17 GMT
Last-Modified: Mon, 18 Dec 2023 21:46:12 GMT
Server: AmazonS3
x-amz-request-id: E11Q9VKSP5WEYE8A
ETag: "ca39a8a28d0c1f979be3948bd7940f1b"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 16459
x-amz-id-2: cqhlRny9pK3hWkMd80VV0nvId7RjV0Gz4/12SKihqmyo8cbCimvJpvaQsItrxSD8xDf8hLQ0MEsb+CyQilkMNg==

GET
H/1.1 200
OK 657694.png
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 1 MB
1 MB 220ms
220ms Image
image/png 3.5.77.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/657694.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240312T060311Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240312%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=ea2c87ce08a689203745555fc6174ebd51477558a91a020718593d9f600184e6
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.77.142 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0f85767e82a49dfe91de95bf2bdf0dffe47214b866029529419ecb55806c22d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:17 GMT
Last-Modified: Fri, 12 Jan 2024 03:17:24 GMT
Server: AmazonS3
x-amz-request-id: E11XPVBWJSYE666P
ETag: "cb3750773b9441b4354e4b968aacd628"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1394039
x-amz-id-2: R5gapyV6F5JB8rwTyRCDEdM3Gkm21S3R46z/uETByTG+PNX6MsFKpmiLW0T5n6v8EUz5WQN8Ak8kDWy55A4JZQ==

GET
H/1.1 200
OK 6lTB3MR.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 7 KB
8 KB 198ms
198ms Image
image/jpeg 3.5.77.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/6lTB3MR.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240312T060311Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240312%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=f4235cf25fd2f1799b50539913dbd0d34ad492370bc567f056e67a1aef509b50
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.77.142 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: f29ae1e8114aa0f4413cdc878fa5d10b1aa8fc4cb0caf9bc13fdcab7f26337e2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:17 GMT
Last-Modified: Sun, 22 Oct 2023 21:53:04 GMT
Server: AmazonS3
x-amz-request-id: E11MJWXY95548CT9
ETag: "62551d497a75151cd828d25b8a597ed9"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 7385
x-amz-id-2: 7OO+YtdL9q/kkgbRhk1yvhoUcKbx/5ZozmG41FiIOVhmvQoqKa0hfEVewtKKAcd4Ujmd85r1Ou0WCCISXlGKTA==

GET
H/1.1 200
OK 572951.jpeg
off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/ 170 KB
170 KB 223ms
223ms Image
image/jpeg 3.5.77.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://off-the-record-service.s3.us-west-2.amazonaws.com/private/clients/profile-pictures/572951.jpeg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240312T060311Z&X-Amz-SignedHeaders=host&X-Amz-Expires=900&X-Amz-Credential=AKIAIYSJJP6QCX3XDV7A%2F20240312%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=669d529bb143cb9e3647728e2b88dc9ef5bb34d60a921bf8c9db425e6fca1c0d
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.77.142 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7b3b6bef2a7b5649aa4b189428b070359fcf2858255454445a78d2518b356d5d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 06:14:17 GMT
Last-Modified: Fri, 26 Jan 2024 04:19:05 GMT
Server: AmazonS3
x-amz-request-id: E11VVGBK4D0VG7AV
ETag: "804a2afd38d5dd91254241a8a1e90076"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 173698
x-amz-id-2: efq27GYx7gNatoItgxy3giAaHtBTfdViRc17CYPfy9C0gIXMFjMwHChDYlrMXn6c7u5FFXe66eBnKJOf6L7emQ==

GET
H2 200 pro-fa-light-300-1.woff2
ka-p.fontawesome.com/releases/v6.5.1/webfonts/ 18 KB
18 KB 42ms
42ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/webfonts/pro-fa-light-300-1.woff2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8d8603e5e751094f2a2bf74cf55e58f8d8499d2580a1c93d21990360f4d8aef

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:53:30 GMT
server: cloudflare
age: 8842636
etag: "6568cc1a-4674"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a49cce5a5d93-FRA
content-length: 18036

GET
H2 200 vendor.d64d219ca4493f67a3970efc52d51c86.css
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 23 KB
5 KB 139ms
21ms Stylesheet
text/css 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/vendor.d64d219ca4493f67a3970efc52d51c86.css
Requested by: Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f2154f49d7d4ed6c74a1ad1dc0e39ef3136fd859059986ed5bcd3050d59867b3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:12:47 GMT
content-encoding: gzip
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 03:06:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 132
x-amz-server-side-encryption: AES256
etag: W/"d64d219ca4493f67a3970efc52d51c86"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: hOjSNjHKRRZgHqwEqHKTN_aNrENyh7jLUeZ8k5WzJbgqwiUB7Mfnaw==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 hotline-web.d41d8cd98f00b204e9800998ecf8427e.css
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 0
421 B 138ms
21ms Stylesheet
text/css 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/hotline-web.d41d8cd98f00b204e9800998ecf8427e.css
Requested by: Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:12:00 GMT
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
age: 136
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 0
last-modified: Mon, 11 Mar 2024 03:32:11 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, no-transform, public
accept-ranges: bytes
x-amz-cf-id: LRBS8pBD4gYdUkM31fJ4tdZNZnnpulDfdP1ZCIsiIV5yqRwxfeTVvQ==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 vendor.862630a2b93632e0d7bbae6d63246102.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 684 KB
182 KB 141ms
24ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/vendor.862630a2b93632e0d7bbae6d63246102.js
Requested by: Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a7fecbfe24b0884ff617e8bb7bd0871397a39e6de70a6d2ff276743988f532bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:12:19 GMT
content-encoding: br
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 03:06:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 117
x-amz-server-side-encryption: AES256
etag: W/"862630a2b93632e0d7bbae6d63246102"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: mgWQTgpG4uYfdTblm6z26OIipyUd8MA-wdNiscBopAr1Msvo27o_Zg==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 pro-fa-light-300-13.woff2
ka-p.fontawesome.com/releases/v6.5.1/webfonts/ 16 KB
16 KB 39ms
39ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/webfonts/pro-fa-light-300-13.woff2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a31024e3bdb136aac7eacc594d12f0f94f44eb7972f9adc45f68c1a9fd8abaa

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:53:30 GMT
server: cloudflare
age: 374150
etag: "6568cc1a-4130"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a49cde705d93-FRA
content-length: 16688

POST
H2 200 logout Show response
relay.offtherecord.com/v1/ 190 B
617 B 205ms
205ms XHR
application/json 54.80.207.255
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:444/v1/logout

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.80.207.255 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-80-207-255.compute-1.amazonaws.com

Software

/ Express

Resource Hash

9d487e4cf152f8ec874d188c4e86ac0045133501b4574eb1dcfae871f7e20de9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 6d5b0fa46ef77b2ff227bdbcee6603ee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: IAD55-P4
etag: W/"be-nP0iVjsLpL9dQWNt9qos1dDzTx8"
x-powered-by: Express
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-branch-request-id: f31a083b45c84fd0b92df39c8a3963fc-2024031206
content-length: 190
x-amz-cf-id: HqsgkKv-ClfLg9jVovFGc1rhpMiw-QiAfUlPsd_k4NQKNLZXXNY9Mw==

GET
H2 200 pro-fa-solid-900-13.woff2
ka-p.fontawesome.com/releases/v6.5.1/webfonts/ 14 KB
14 KB 30ms
30ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/webfonts/pro-fa-solid-900-13.woff2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec1941ce9e7878f195767288346eb2821e3af0e25652c0233411ff6acf2810ad

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:15 GMT
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:53:38 GMT
server: cloudflare
age: 8842127
etag: "6568cc22-3688"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a49d5eda5d93-FRA
content-length: 13960

POST
H2 200 v2 Show response
relay.offtherecord.com/rec/bundle/ 29 B
233 B 1787ms
664ms XHR
application/json 44.219.181.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/rec/bundle/v2?OrgId=6DGA5&UserId=beaf9d60-f6c2-4c2b-b25b-5f30633b222f&SessionId=0592ccf6-b265-4be3-955a-792869886e69&PageId=5c09ffc2-0500-4a8f-8b79-56c2be039ff2&Seq=1&ClientTime=1710224055993&PageStart=1710224054830&PrevBundleTime=0&LastActivity=836&IsNewSession=true
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.219.181.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-219-181-71.compute-1.amazonaws.com
Software: /
Resource Hash: ce586fc08d8c751578c9489d658b1739d2de2c259f7c5aa34134549929cd0109

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://offtherecord.com
date: Tue, 12 Mar 2024 06:14:17 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
content-type: application/json; charset=utf-8

POST
H2 200 logout Show response
relay.offtherecord.com/v1/ 190 B
618 B 195ms
195ms XHR
application/json 54.80.207.255
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:444/v1/logout

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.80.207.255 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-80-207-255.compute-1.amazonaws.com

Software

/ Express

Resource Hash

0f9415b7dd2ffaf4295a51e61f9bfff2db8d042abfd7d5d76347c42771f44650

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 12 Mar 2024 06:14:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 6d5b0fa46ef77b2ff227bdbcee6603ee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: IAD55-P4
etag: W/"be-5H+4q+rkFVJ3JppG5ANgL1h53PI"
x-powered-by: Express
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-branch-request-id: 6f053344c1a44fa481a172dbbc01ea0f-2024031206
content-length: 190
x-amz-cf-id: 2tucyvIHj6NX8x7TbKkfRyp3alnGNwFpMITu5znTu9k9qPmAQqSx-g==

GET
H2 200 211.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 772 KB
178 KB 20ms
20ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/211.js
Requested by: Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6433a43310293748cf1fddd99a260723f22d8202abe6c37e736716eb1f0a7c05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:12:31 GMT
content-encoding: br
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Mon, 11 Mar 2024 03:32:09 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 106
x-amz-server-side-encryption: AES256
etag: W/"47c822f8cee790a907c6e7dd37148e0b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: or9WpNs7VxohFoZLKPBabTDCrLLGNyD0QrkfSAhq4xBOs1j72QORrg==
expires: Tue, 11 Mar 2025 03:32:08 GMT

OPTIONS
H2 200 user
otr-backend-service-us-prod.offtherecord.com/api/v1/ Frame 0
0 116ms
116ms Preflight 44.196.206.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=jg37m4vxfh
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.196.206.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-206-21.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: api-token
Access-Control-Request-Method: GET
Origin: https://offtherecord.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept, Api-Token, X-Api-Token, X-Feature, X-Captcha-Token, X-Captcha-Version, X-Resource-Id
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
access-control-max-age: 3600
date: Tue, 12 Mar 2024 06:14:16 GMT
server: nginx/1.22.1

GET
H2 200 user Show response
otr-backend-service-us-prod.offtherecord.com/api/v1/ 163 B
584 B 120ms
115ms XHR
application/json 44.196.206.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://otr-backend-service-us-prod.offtherecord.com/api/v1/user?version=jg37m4vxfh

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.206.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-206-21.compute-1.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

7e7558ddd527f6452c7c72f510f48964f6319f317b314829c2786e42346c372e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://offtherecord.com/
Api-Token: vKWrNZN8UMwxcqPxyRqbJo9x6OABtoqMA7scyCkpkSy82UcA
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:16 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
server: nginx/1.22.1
x-frame-options: DENY
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: Location, Otr-url-location, Otr-signed-url-location
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 chunk.b5645190bb6494a8b04e.css
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 243 KB
27 KB 20ms
20ms Stylesheet
text/css 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.b5645190bb6494a8b04e.css
Requested by: Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dfca08bf68a7574152f992bb6b1c3d76e318a4059b944e6879e1a720690ffd7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:10:49 GMT
content-encoding: br
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 03:06:04 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 208
x-amz-server-side-encryption: AES256
etag: W/"0c3847992b2924e739906f6d9095b16d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: K_nS3Pym21Rp6iHExU6S_pSkAAET20sMVqg8hJ9v-wLkqjTfAoVuAA==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 fd-messaging.b06d3173a46f1f0dfdd0.css
assetscdn-wchat.freshchat.com/static/ Frame F758 243 KB
27 KB 21ms
21ms Stylesheet
text/css 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/fd-messaging.b06d3173a46f1f0dfdd0.css
Requested by: Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dfca08bf68a7574152f992bb6b1c3d76e318a4059b944e6879e1a720690ffd7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:12:33 GMT
content-encoding: br
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Mon, 11 Mar 2024 03:32:12 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 104
x-amz-server-side-encryption: AES256
etag: W/"0c3847992b2924e739906f6d9095b16d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: KNTAsMdDnJbbEB3Ov__ospS8qneJqlfNhNykuh_lmAt5ECEDXmbuJg==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 fd-messaging.2319169d2a82e54c07fc.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 744 KB
133 KB 20ms
20ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.2319169d2a82e54c07fc.js
Requested by: Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4371631688e829ddc9b65afa067a810ee797987a2eb12b4e31616f15b915b6db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:12:38 GMT
content-encoding: br
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Mon, 11 Mar 2024 03:32:11 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 100
x-amz-server-side-encryption: AES256
etag: W/"98d44f272eff65336064482f7f235400"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: Pu6pus7kZwxI2NpMWcRlHc2yWFWk1syKWO52uWhPb0y0XCO5Cjjvew==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 rts-min.js Show response
rts-static-prod.freshworksapi.com/us/ Frame F758 86 KB
26 KB 72ms
20ms Script
text/javascript 18.173.205.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rts-static-prod.freshworksapi.com/us/rts-min.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.2319169d2a82e54c07fc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.205.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-205-14.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 79e9194c169e7b3ddbc1f655295ae7c3396c1aaad6a8ca0acff9927f706eaa48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-amz-version-id: vRHJ6RxtNJ2AL6Re3oCf7s8O1iu.sEcu
content-encoding: gzip
via: 1.1 e787a68a5271d06ea7b7e56fa6886dc8.cloudfront.net (CloudFront)
date: Tue, 12 Mar 2024 06:14:14 GMT
last-modified: Tue, 27 Feb 2024 06:23:04 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P12
age: 4
x-amz-server-side-encryption: AES256
etag: W/"7b09742cdc3b38c25ef6472f5b52986b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: no-cache
x-amz-cf-id: EX6jXDRu96UN4cKseUSe-RQJ68-TEG3nsE12pRMBoSj89YtWr4BC4A==

GET
H2 200 chunk.53225951580d96ba885c.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 5 KB
2 KB 20ms
20ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.53225951580d96ba885c.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.2319169d2a82e54c07fc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9037e86768130186d676f65444b051b348944719247563d521046bca6af241b4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:12:41 GMT
content-encoding: br
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 03:06:03 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 96
x-amz-server-side-encryption: AES256
etag: W/"16f166059cdfefcc4cccee6866835222"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: 2lojr7r7U-jFY535WLqW9uvFS6aGNEI78TnBWTSRbUzJfqUaN3HmCQ==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 chunk.7be603f8fb2482fb972b.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 11 KB
4 KB 20ms
20ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.7be603f8fb2482fb972b.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.2319169d2a82e54c07fc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 52a64558e7d0d7e73cd2fea7064fc02b849852b98e3c344f25fc6a5f1d449b8b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:10:35 GMT
content-encoding: br
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 03:06:03 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 222
x-amz-server-side-encryption: AES256
etag: W/"516f14e4be6e5d509f7f85c85054d45f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: ElrIS1kZMaWZK969-oWE8YI8zCzGR-WeYYY8C3FnjbCar3ilARWzxA==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 co-browsing.js Show response
wchat.freshchat.com/widget/js/ 26 KB
8 KB 125ms
125ms Script
application/javascript 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/widget/js/co-browsing.js

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

1e10e9493470eb296ba1ba705a39455e226be2906bd24a41e1f2b8287ff8f62b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-envoy-upstream-service-time: 1
x-xss-protection: 1; mode=block
x-request-id: 41f9aae8-1734-42a4-9c37-024aa7220656
x-trace-id: 00-81da1f4ae48b55e9198d1086fb63d2aa-1ed440988060bc72-00
last-modified: Mon, 11 Mar 2024 03:32:17 GMT
server: fwe
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/javascript
x-fw-ratelimiting-managed: false
cache-control: max-age=31536000,no-cache, no-store, must-revalidate, pre-check=0, post-check=0,public
x-server: zhcx7
expires: Wed, 12 Mar 2025 06:14:16 GMT

GET
H2 206 notif.da662fefc5060dabf2859ea199198b14.mp3
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 4 KB
5 KB 20ms
20ms Media
audio/mpeg 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/notif.da662fefc5060dabf2859ea199198b14.mp3
Requested by: Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: eb2e3f703cf8ee0156a1d625e053c0968b0dfcff62ea4254ddd8ba9fece3ad32

Request headers

Referer: https://wchat.freshchat.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 12 Mar 2024 06:12:48 GMT
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
age: 112
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
Content-Range: bytes 0-4301/4302
Content-Length: 4302
last-modified: Wed, 06 Mar 2024 03:06:05 GMT
server: AmazonS3
etag: "a529450a7cfb4a60dea41ef294fa90dd"
vary: Accept-Encoding
content-type: audio/mpeg
cache-control: max-age=31536000, no-transform, public
accept-ranges: bytes
x-amz-cf-id: BEDOS4Cp_-IsvOVsaQ77SDhqk_8xom6H-w4bJIC08tDz0KoBAF-9hw==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 user Show response
wchat.freshchat.com/app/services/app/webchat/c36ed4b1-ac05-4052-a91f-83203339cd7c/ Frame F758 63 B
1000 B 130ms
130ms XHR
application/json 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/app/services/app/webchat/c36ed4b1-ac05-4052-a91f-83203339cd7c/user

Requested by

Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/vendor.862630a2b93632e0d7bbae6d63246102.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

02a00e3ef645e0351f654665d42b03388e6a73e0ab4f853c8904faecf322b229

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:16 GMT
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
strict-transport-security: max-age=31536000; includeSubDomains
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-ratelimit-total: 3000
x-ratelimit-used-currentrequest: 1
x-envoy-upstream-service-time: 4
content-length: 63
x-xss-protection: 1; mode=block
x-request-id: 3ab7bed5-55e5-950c-a2d1-0cbd7832b982
x-trace-id: 00-03362b82cf2f4a06eab3e9147b0903c3-306ca44219990035-01
server: fwe
x-ratelimit-remaining: 2998
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/json;charset=UTF-8
x-fw-ratelimiting-managed: true
cache-control: no-store
access-control-allow-credentials: true
x-server: 3063
x-ratelimit-limit: 3000

GET
H2 200 eb79c0b24a5a9494cd36.png
offtherecord.com/ 5 KB
6 KB 213ms
212ms Image
image/png 99.86.4.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://offtherecord.com/eb79c0b24a5a9494cd36.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-19.fra6.r.cloudfront.net
Software: nginx / Express
Resource Hash: 072583eaca4f4cf965ff3913f7bffe2108cb46c91f28a51cff411e91459ca836

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:16 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront)
last-modified: Sat, 09 Mar 2024 22:54:11 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
x-powered-by: Express
etag: W/"1534-18e256c7e38"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: public, max-age=31557600
accept-ranges: bytes
content-length: 5428
x-amz-cf-id: ubLKB-rDMa2wx3l2EoNQ-G00cJHNg7p8WplAkaI4cKRHSPOMhMdhRA==

GET
H2 200 pro-fa-regular-400-12.woff2
ka-p.fontawesome.com/releases/v6.5.1/webfonts/ 16 KB
16 KB 39ms
39ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.1/webfonts/pro-fa-regular-400-12.woff2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8f5fbf30176a7f19df33745854710609eb9a8290a8f273a6590f020cf83f352

Request headers

Referer: https://offtherecord.com/
Origin: https://offtherecord.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:16 GMT
cf-cache-status: HIT
last-modified: Thu, 30 Nov 2023 17:53:32 GMT
server: cloudflare
age: 8840107
etag: "6568cc1c-3f50"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8631a4a0b9995d93-FRA
content-length: 16208

GET
H2 200 cb.css
wchat.freshchat.com/widget/css/ 1 KB
1 KB 124ms
124ms Stylesheet
text/css 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/widget/css/cb.css?t=1710224056496

Requested by

Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/widget/js/co-browsing.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

8029982e606b01f8d1651a46683c7a90ef2496e73823047c0e73b72e285d593e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-envoy-upstream-service-time: 1
x-xss-protection: 1; mode=block
x-request-id: af484419-efc4-4e21-8811-365017034d9d
x-trace-id: 00-cd019fa027153522e7930b052a9a33c6-01f19e49e9440a82-00
last-modified: Mon, 11 Mar 2024 03:32:17 GMT
server: fwe
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: text/css
x-fw-ratelimiting-managed: false
cache-control: max-age=31536000,no-cache, no-store, must-revalidate, pre-check=0, post-check=0,public
x-server: zhcx7
expires: Wed, 12 Mar 2025 06:14:16 GMT

GET
H2 200 widget_info_v2 Show response
wchat.freshchat.com/app/services/app/webchat/c36ed4b1-ac05-4052-a91f-83203339cd7c/ Frame F758 10 KB
3 KB 155ms
155ms XHR
application/json 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/app/services/app/webchat/c36ed4b1-ac05-4052-a91f-83203339cd7c/widget_info_v2?locales=en-US,en-US&platform=web

Requested by

Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/vendor.862630a2b93632e0d7bbae6d63246102.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

3b6563d040b1d5e869a891c311eb61db2ec1a3f849bee334c2150d71491b31ae

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:16 GMT
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-ratelimit-total: 3000
x-ratelimit-used-currentrequest: 1
x-envoy-upstream-service-time: 30
x-status: MISS
x-xss-protection: 1; mode=block
x-request-id: 2d521b22-3e60-40e1-a96c-19943e645616
x-trace-id: 00-d318a663346a2156c5e1a1863171df34-c8e74caa84fd2675-00
server: fwe
vary: accept-encoding
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/json;charset=UTF-8
x-fw-ratelimiting-managed: true
cache-control: no-store
access-control-allow-credentials: true
x-server: 4082
x-ratelimit-remaining: 2997
x-ratelimit-limit: 3000

GET
H2 200 chunk.b236f79826d7b18644c3.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 90 KB
18 KB 24ms
23ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.b236f79826d7b18644c3.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.2319169d2a82e54c07fc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c113d2d891192c213a9ef749ca10766f1b7ad0e6bdaf342fbe7c6488c68ae2c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:12:56 GMT
content-encoding: br
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Mon, 11 Mar 2024 03:32:11 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 81
x-amz-server-side-encryption: AES256
etag: W/"085ad1fe056eb843ec23fc3b37afe543"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: YCb2GGcM4wWHp6IeZt0tQQnoWHNaMSDRPRvRupHqxJwZW-X9uvGMPA==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 chunk.fe14cbb085cfb0396ab8.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 282 KB
55 KB 25ms
25ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.fe14cbb085cfb0396ab8.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.2319169d2a82e54c07fc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0bfb45c1f15da40643c44e892089b2cb28d4b30a1d5918495386956ea7a4599d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:13:07 GMT
content-encoding: gzip
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 03:06:04 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 70
x-amz-server-side-encryption: AES256
etag: W/"8bef775d5509d472cbe7f9fb1f08114b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: iUVaUGXdvbkUnn6FRlQMNSs3Lw35ZKupXxSAMTNhQ7DQOfJJe91OpA==
expires: Tue, 11 Mar 2025 03:32:08 GMT

PUT
H2 200 activity Show response
wchat.freshchat.com/app/services/app/webchat/c36ed4b1-ac05-4052-a91f-83203339cd7c/user/132c62e0-3ed2-4666-be6b-e79f8756f1d9/ Frame F758 17 B
953 B 129ms
129ms XHR
application/json 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/app/services/app/webchat/c36ed4b1-ac05-4052-a91f-83203339cd7c/user/132c62e0-3ed2-4666-be6b-e79f8756f1d9/activity?widgetInfoTraceId=84c64e8c-05d3-432b-9fd1-976015eaaa31

Requested by

Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/211.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:16 GMT
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
strict-transport-security: max-age=31536000; includeSubDomains
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-ratelimit-total: 3000
x-ratelimit-used-currentrequest: 1
x-envoy-upstream-service-time: 4
content-length: 17
x-xss-protection: 1; mode=block
x-request-id: c00a4eca-0d77-4f55-b08d-5cd918cd3e8c
x-trace-id: 00-6af4c3471234575e8d99024ee8de76cb-306ca5e41e22e0a2-00
server: fwe
x-ratelimit-remaining: 2996
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/json;charset=UTF-8
x-fw-ratelimiting-managed: true
cache-control: no-store
access-control-allow-credentials: true
x-server: 3063
x-ratelimit-limit: 3000

GET
H2 200 index.html Show response
httpsofftherecordcom.webpush.freshchat.com/ Frame 6503 30 KB
7 KB 492ms
406ms Document
text/html 18.245.60.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://httpsofftherecordcom.webpush.freshchat.com/index.html?ref=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t
Requested by: Host: wchat.freshchat.com
URL: https://wchat.freshchat.com/js/widget.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.60.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-60-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 05a530dd5d40bf5dbef4e3d5ed6976e9aec1baf49a20be30e07b1608918e3bc3

Request headers

Referer: https://offtherecord.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Tue, 12 Mar 2024 06:14:18 GMT
etag: W/"4d98f93ebe4eb8cedbbfdb3004920aeb"
last-modified: Fri, 25 Oct 2019 06:53:38 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 5b17764336ffdab7d2a3e7707394867a.cloudfront.net (CloudFront)
x-amz-cf-id: YQu_NTRNYqY-nqlmxnJFq_2899H6z4KYy5BFHsrzEBNEAFba8nvOfA==
x-amz-cf-pop: FRA60-P5
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront

GET
H2 200 category Show response
wchat.freshchat.com/app/services/app/webchat/c36ed4b1-ac05-4052-a91f-83203339cd7c/faq/ Frame F758 209 B
1 KB 132ms
132ms XHR
application/json 3.95.80.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wchat.freshchat.com/app/services/app/webchat/c36ed4b1-ac05-4052-a91f-83203339cd7c/faq/category?platform=web&locales=en-US%2Cen-US&since=&lastLocaleId=

Requested by

Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/vendor.862630a2b93632e0d7bbae6d63246102.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.95.80.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-80-55.compute-1.amazonaws.com

Software

fwe /

Resource Hash

5d1b3f98e41c0c318f5ebcf69b206583c2fc462665218fc3584e916e57b249c8

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://wchat.freshchat.com/widget/?token=c36ed4b1-ac05-4052-a91f-83203339cd7c&referrer=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t&eagerLoad=true
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:14:16 GMT
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
strict-transport-security: max-age=31536000; includeSubDomains
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-ratelimit-total: 3000
x-ratelimit-used-currentrequest: 1
x-envoy-upstream-service-time: 8
content-length: 209
x-xss-protection: 1; mode=block
x-request-id: bd2d7e4e-5180-4ee5-9c5b-f5ddf57374c4
x-trace-id: 00-d7ea833c6ce58d68b26b07be4d9c8f5b-8f8080cb4210c6c0-00
server: fwe
x-ratelimit-remaining: 2995
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/json;charset=UTF-8
x-fw-ratelimiting-managed: true
cache-control: no-store
access-control-allow-credentials: true
x-server: 9886
x-ratelimit-limit: 3000

GET
H2 200 9849.css
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 16 KB
3 KB 23ms
23ms Stylesheet
text/css 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/9849.css
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.2319169d2a82e54c07fc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 93ac8e22ef8a241ddd954362cc979528693e4b7732dc5de26154d9bbf60011fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:10:33 GMT
content-encoding: br
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 03:06:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 224
x-amz-server-side-encryption: AES256
etag: W/"20f054b8b45ccd177447feada77d0895"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: cH7o860jsx9Ma5VCbIUBVZOBGyvH32TlUfhx7qAvGWLlXWFjO2YjTw==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 chunk.fd314e4ac1e6a45b6b94.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 137 B
576 B 24ms
24ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.fd314e4ac1e6a45b6b94.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.2319169d2a82e54c07fc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 44c7b3c33a1d28e0360f7b972e222118b5c746c1c774c67f3fd6ab9e53e9974f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:13:51 GMT
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
age: 26
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 137
last-modified: Wed, 06 Mar 2024 03:06:04 GMT
server: AmazonS3
etag: "a89e4a96c2e88cb6a5a23d73c000bcae"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
accept-ranges: bytes
x-amz-cf-id: qrKxVFiIeuYyzcjukhTh7-DkuDM7pHfb7ot8Gva1FTwbrhQFkvTXDg==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 chunk.cf2220b6d090e27b9496.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 48 KB
14 KB 25ms
25ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.cf2220b6d090e27b9496.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.2319169d2a82e54c07fc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5936b3730015c46ef27548aff7b2162d0878761a5fda6f9d026fbeaef34c0ed3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:12:57 GMT
content-encoding: br
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 03:06:04 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 80
x-amz-server-side-encryption: AES256
etag: W/"c6a94cb46d8753f365405e99cf7185f8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: QZhUA4ibuFlwLaXeVOCK8o5KyG02GD7U_E0eMkEuj72Lv1w8x3juXQ==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
BLOB 200
OK 4c5283ae-8b39-4417-9a93-dcf86feadcd2
https://wchat.freshchat.com/ Frame F758 152 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://wchat.freshchat.com/4c5283ae-8b39-4417-9a93-dcf86feadcd2
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3d08747462129e4b1e6756b57c9f24cc8dd7a6ad095cc416f5dbd52aaa5f7b2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Length: 152
Content-Type

GET
H2 200 freshchat-line.7327fc2a43ff6a857c38e96ffa7e00f2.svg
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 663 B
1 KB 21ms
20ms Image
image/svg+xml 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/freshchat-line.7327fc2a43ff6a857c38e96ffa7e00f2.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2b82601133216ec29983087a0532e9b0af553f7f4a8b3b00ff9d7ffcc1142542

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:11:44 GMT
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
age: 152
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 663
last-modified: Wed, 06 Mar 2024 03:06:04 GMT
server: AmazonS3
etag: "cd452acf4efb05843ef7575e5a9de756"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000, no-transform, public
accept-ranges: bytes
x-amz-cf-id: _IgEjj-5CbIveVRFNDKk_xmCM8JwTAhJG-g1q6DAojFeSoEQXC-BGg==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 ic_offline.e15c54b5fa2b3da7577b7869b850722d.svg
assetscdn-wchat.freshchat.com/static/assets/ Frame F758 3 KB
2 KB 22ms
22ms Image
image/svg+xml 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/ic_offline.e15c54b5fa2b3da7577b7869b850722d.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7352780751ec91c6bc82b985ffc63fe2505da7a810748fc963010eec199abc73

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:09:52 GMT
content-encoding: gzip
via: 1.1 f960fa0538fdb326fc338e984fa7ece8.cloudfront.net (CloudFront)
last-modified: Wed, 06 Mar 2024 03:06:04 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 267
x-amz-server-side-encryption: AES256
etag: W/"2ba96002b738a49d340002ab84587a3a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: xM4ICLKAwJkZNvCZkqxnaHGisEXG_xtnsLoSCq9OXM0ow8FnYdWBFw==
expires: Tue, 11 Mar 2025 03:32:08 GMT

GET
H2 200 img_1525886662574.png
httpsofftherecordcom.webpush.freshchat.com/0403b2ccea0c0c5cc50c75b8637339f1f576312a7a63730edc62a2eb40b11742/f_hlimage/u_a64204bfa240cb896c36e2b48c543dd110fc838dc1e3e7bcb378b720c4c2ad6a/ Frame F758 31 KB
31 KB 24ms
24ms Image
image/png 18.245.60.11
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://httpsofftherecordcom.webpush.freshchat.com/0403b2ccea0c0c5cc50c75b8637339f1f576312a7a63730edc62a2eb40b11742/f_hlimage/u_a64204bfa240cb896c36e2b48c543dd110fc838dc1e3e7bcb378b720c4c2ad6a/img_1525886662574.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.60.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-60-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96056e7f261b02dc4cddc8bc5b87307b95eccd8ed9f41973a51250cd83cc09bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wchat.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 12 Mar 2024 03:35:21 GMT
via: 1.1 5b17764336ffdab7d2a3e7707394867a.cloudfront.net (CloudFront)
last-modified: Wed, 09 May 2018 17:24:23 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P5
age: 47103
x-amz-server-side-encryption: AES256
etag: "641d035b6bb597ef736cb45850194a86"
x-cache: Hit from cloudfront
content-type: image/png
x-amz-storage-class: REDUCED_REDUNDANCY
accept-ranges: bytes
content-length: 31610
x-amz-cf-id: QmeO5gBNmgWnUXmEoTLKDOxkmxgLoTWTAKnus6flvm-I00mDrixq6w==

GET
H2 200 fc_logo.png
httpsofftherecordcom.webpush.freshchat.com/ Frame 6503 4 KB
4 KB 21ms
21ms Image
image/png 18.245.60.11
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://httpsofftherecordcom.webpush.freshchat.com/fc_logo.png
Requested by: Host: httpsofftherecordcom.webpush.freshchat.com
URL: https://httpsofftherecordcom.webpush.freshchat.com/index.html?ref=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.60.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-60-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a963621b4341552ca61590aa02e93b70f189e8050a105c32c0197c3c34b2d114

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://httpsofftherecordcom.webpush.freshchat.com/index.html?ref=aHR0cHM6Ly9vZmZ0aGVyZWNvcmQuY29t
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 03:33:40 GMT
via: 1.1 5b17764336ffdab7d2a3e7707394867a.cloudfront.net (CloudFront)
last-modified: Thu, 08 Feb 2018 07:54:41 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P5
age: 9638
etag: "e87df9f10dcf497ae292dc234200465c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 3777
x-amz-cf-id: -Et5BCHiPq6xiTLzOGfcul2pqlwIHmP_IdKa1MNPZfgdvcVjA_M1DQ==

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 26ms
25ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-TMGSMNG8YY&gtm=45je4360v9102325189za220&_p=1710224053536&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=874400336.1710224054&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AEA&_s=2&sid=1710224053&sct=1&seg=0&dl=https%3A%2F%2Fofftherecord.com%2F&dt=The%20fastest%20way%20to%20fight%20your%20traffic%20ticket&en=scroll&epn.percent_scrolled=90&_et=4&tfd=6246
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-TMGSMNG8YY&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offtherecord.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 06:14:18 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://offtherecord.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
relay.offtherecord.com/track/ 25 B
439 B 427ms
202ms XHR
application/json 34.235.66.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://relay.offtherecord.com:446/track/?verbose=1&ip=1&_=1710224059863

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.235.66.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-235-66-125.compute-1.amazonaws.com

Software

envoy /

Resource Hash

e39a8118ec6cdf6ac33e6961518e9fe6ba3f6caf099aeeaec1389c2108ba90ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800; includeSubDomains

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 12 Mar 2024 06:14:20 GMT
strict-transport-security: max-age=604800; includeSubDomains
via: 1.1 google
server: envoy
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://offtherecord.com
access-control-expose-headers: X-MP-CE-Backoff
cache-control: no-cache, no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 51
access-control-allow-headers: X-Requested-With, X-Amzn-Trace-Id
content-length: 25
alt-svc: clear

POST
H2 200 v2 Show response
relay.offtherecord.com/rec/bundle/ 29 B
233 B 387ms
387ms XHR
application/json 44.219.181.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://relay.offtherecord.com/rec/bundle/v2?OrgId=6DGA5&UserId=beaf9d60-f6c2-4c2b-b25b-5f30633b222f&SessionId=0592ccf6-b265-4be3-955a-792869886e69&PageId=5c09ffc2-0500-4a8f-8b79-56c2be039ff2&Seq=2&ClientTime=1710224059919&PageStart=1710224054830&PrevBundleTime=1710224056118&LastActivity=4803&IsNewSession=true
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.219.181.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-219-181-71.compute-1.amazonaws.com
Software: /
Resource Hash: e2d8d3ddad554350fdc7bb72fc25a64742726e01bfbbdebeddba3d8a64e7f567

Request headers

Referer: https://offtherecord.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://offtherecord.com
date: Tue, 12 Mar 2024 06:14:20 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
content-type: application/json; charset=utf-8

Verdicts & Comments Add Verdict or Comment

177 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

37 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.offtherecord.com/	1970-01-21 03:50:46	Name: _vwo_uuid_v2 Value: D9765C39322F3996C78EF71C5EAE33101\|5eee0231205300e517190c672dede36d
.offtherecord.com/	1970-01-20 21:27:44	Name: _vis_opt_s Value: 1%7C
.offtherecord.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.offtherecord.com/	1970-01-21 04:39:44	Name: _vwo_uuid Value: D9765C39322F3996C78EF71C5EAE33101
.offtherecord.com/	1970-01-20 21:13:20	Name: _vwo_ds Value: 3%241710224053%3A26.34951624%3A%3A
.offtherecord.com/	1970-01-20 19:03:45	Name: _vwo_sn Value: 0%3A1%3A%3A%3A1
.offtherecord.com/	1970-01-20 21:27:44	Name: _vis_opt_exp_28_combi Value: 2
.offtherecord.com/	1970-01-20 21:27:44	Name: _vis_opt_exp_46_combi Value: 2
.offtherecord.com/	1970-01-20 21:27:44	Name: _vis_opt_exp_50_combi Value: 1
.offtherecord.com/	1970-01-20 21:13:20	Name: _gcl_au Value: 1.1.811876705.1710224054
.offtherecord.com/	1970-01-20 21:13:20	Name: _rdt_uuid Value: 1710224053810.dee74394-77b9-4353-9886-567bbd43b3d7
.offtherecord.com/	1970-01-20 19:05:10	Name: _gid Value: GA1.2.64841621.1710224054
.offtherecord.com/	1970-01-21 04:39:44	Name: _ga_TMGSMNG8YY Value: GS1.1.1710224053.1.0.1710224053.60.0.0
.offtherecord.com/	1970-01-20 19:05:10	Name: _uetsid Value: bfb43340e03711ee872a2d1d2d537c0d
.offtherecord.com/	1970-01-21 04:25:20	Name: _uetvid Value: bfb457c0e03711ee8935d1205936709b
.offtherecord.com/	1970-01-21 04:39:44	Name: _ga Value: GA1.2.874400336.1710224054
.offtherecord.com/	1970-01-20 19:03:44	Name: _gat_gtag_UA_69140841_1 Value: 1
.offtherecord.com/	1970-01-20 21:13:20	Name: _fbp Value: fb.1.1710224054010.404108945
.bing.com/	1970-01-21 04:25:20	Name: MUID Value: 180016BDE1FF60CA21B302FDE0946168
.appsflyer.com/	1970-01-21 04:32:32	Name: af_id Value: 8382efcc-183d-443f-9184-89cc47c9c7b6-p
.offtherecord.com/	1970-01-21 04:39:44	Name: afUserId Value: 8382efcc-183d-443f-9184-89cc47c9c7b6-p
.onelink.me/	1970-01-21 04:39:44	Name: af_id Value: 8382efcc-183d-443f-9184-89cc47c9c7b6-p
.offtherecord.com/	1970-01-20 19:13:48	Name: AF_SYNC Value: 1710224054212
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: z_nZTtNHwA_AKmmzUyWbdeMOhcgSqVhCEztD5sQ_IgM-1710224054477-0.0.1.1-604800000
.offtherecord.com/	1970-01-20 19:03:45	Name: fs_lua Value: 1.1710224054830
.offtherecord.com/	1970-01-21 03:49:20	Name: fs_uid Value: #6DGA5#beaf9d60-f6c2-4c2b-b25b-5f30633b222f:0592ccf6-b265-4be3-955a-792869886e69:1710224054830::1#/1741760054
.offtherecord.com/	1970-01-21 03:49:20	Name: mp_971aeee0e6b3795a30de20c2cc8585b4_mixpanel Value: %7B%22distinct_id%22%3A%20%22%24device%3A18e314c1a558bc-07a787b0f450b3-673d5551-1d4c00-18e314c1a558bc%22%2C%22%24device_id%22%3A%20%2218e314c1a558bc-07a787b0f450b3-673d5551-1d4c00-18e314c1a558bc%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%2C%22__mps%22%3A%20%7B%22%24os%22%3A%20%22Windows%22%2C%22%24browser%22%3A%20%22Chrome%22%2C%22%24browser_version%22%3A%20122%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%2C%22%24vwo_user_id%22%3A%20%22D9765C39322F3996C78EF71C5EAE33101%22%7D%2C%22__mpso%22%3A%20%7B%7D%2C%22__mpus%22%3A%20%7B%7D%2C%22__mpa%22%3A%20%7B%7D%2C%22__mpu%22%3A%20%7B%7D%2C%22__mpr%22%3A%20%5B%5D%2C%22__mpap%22%3A%20%5B%5D%7D
.offtherecord.com/	1970-01-20 23:22:56	Name: __hstc Value: 77102922.f307fde14550058fd5a73070e81e8b66.1710224055383.1710224055383.1710224055383.1
.offtherecord.com/	1970-01-20 23:22:56	Name: hubspotutk Value: f307fde14550058fd5a73070e81e8b66
.offtherecord.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.offtherecord.com/	1970-01-20 19:03:45	Name: __hssc Value: 77102922.1.1710224055383
.hubspot.com/	1970-01-20 19:03:45	Name: __cf_bm Value: 76QgQbzv77B7GD9eLO9VAzLDECqsk_3KkPRMZGpp.Vc-1710224055-1.0.1.1-zqk5xqPlZbuN0ppU6zlvD0NPdNbPyYYYGn0pHITHjE2.9BQkhYrPZgYS3GMVGmi3hGiNYst4nb1swBO_HxC.hw
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: UKaq5VDpSviR6EYnjsgs7Zp4pFCZhg0Yt.9NrXo3VbU-1710224055554-0.0.1.1-604800000
.offtherecord.com/	1970-01-20 19:46:52	Name: otr-referrer Value: %22https%3A%2F%2Fofftherecord.com%2F%22
m.stripe.com/	1970-01-21 04:39:44	Name: m Value: ee2e9c92-00ad-4f24-a93c-61d88d4b650491efed
.offtherecord.com/	1970-01-21 03:49:20	Name: __stripe_mid Value: 4a4fc123-232a-4c0e-9a80-511fc3cbb001a9db23
.offtherecord.com/	1970-01-20 19:03:45	Name: __stripe_sid Value: 4ee31fa5-5388-4298-bdd6-e5f859edb8c3a562a6

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://connect.facebook.net/signals/config/185612438538592?v=2.9.148&r=stable&domain=offtherecord.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100(Line 95) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://offtherecord.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alb.reddit.com
anhkgav0.apicdn.sanity.io
apis.google.com
assetscdn-wchat.freshchat.com
bat.bing.com
browser.sentry-cdn.com
connect.facebook.net
cta-service-cms2.hubspot.com
dev.visualwebsiteoptimizer.com
edge.fullstory.com
fonts.googleapis.com
fonts.gstatic.com
forms.hscollectedforms.net
forms.hsforms.com
httpsofftherecordcom.webpush.freshchat.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hscollectedforms.net
js.hubspot.com
js.stripe.com
ka-p.fontawesome.com
kit.fontawesome.com
m.stripe.com
m.stripe.network
off-the-record-service.s3.us-west-2.amazonaws.com
offtherecord.com
otr-backend-service-us-prod.offtherecord.com
perf-na1.hsforms.com
region1.analytics.google.com
relay.offtherecord.com
rts-static-prod.freshworksapi.com
snippets.freshchat.com
stats.g.doubleclick.net
track.hubspot.com
wa.appsflyer.com
wa.onelink.me
wchat.freshchat.com
websdk.appsflyer.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.redditstatic.com
142.250.181.226
143.204.215.23
151.101.193.140
151.101.64.176
18.173.205.14
18.173.205.24
18.245.60.11
18.66.112.5
2001:4860:4802:34::36
2606:4700:4400::ac40:93bc
2606:4700:4400::ac40:991b
2606:4700::6810:4fba
2606:4700::6810:be59
2606:4700::6811:589a
2606:4700::6812:a07d
2606:4700::6813:9b53
2620:1ec:c11::200
2a00:1450:4001:80e::2008
2a00:1450:4001:80f::2004
2a00:1450:4001:81c::2003
2a00:1450:4001:81d::200e
2a00:1450:4001:827::200a
2a00:1450:4001:828::2003
2a00:1450:4001:831::200e
2a00:1450:400c:c06::9d
2a02:26f0:3500:11::215:14ca
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
2a04:4e42:400::729
2a04:4e42:600::396
3.5.77.142
3.95.80.55
34.102.211.197
34.208.52.14
34.235.66.125
34.96.102.137
35.201.112.186
44.196.206.21
44.219.181.71
52.222.214.55
54.80.207.255
99.86.4.19
02a00e3ef645e0351f654665d42b03388e6a73e0ab4f853c8904faecf322b229
031f287592b33afc19eee9195f23b5146d5922bc004dc439df3e3d8b0bf54008
05a530dd5d40bf5dbef4e3d5ed6976e9aec1baf49a20be30e07b1608918e3bc3
072583eaca4f4cf965ff3913f7bffe2108cb46c91f28a51cff411e91459ca836
091c27084bee9182fda190c70ab01d92f1f32c72be2f4dd37946f62c315ec574
099f5764acf448fdd12bdb9f709606093ea481ecf2b55f03f89ed8cbad7849fb
0bfb45c1f15da40643c44e892089b2cb28d4b30a1d5918495386956ea7a4599d
0c4c069374826c98ca14a13ddea5708a2425c0f55712357156a44c9ce14dca07
0e07b0fb649afcc0f980ce84b181a4d5ac825761b516931e25e766cf03d1511e
0e52361cb2f6af4bb1f5fa4f27c87ddb8c6d4918ccd75655bd1d1bb34d4eeabe
0f85767e82a49dfe91de95bf2bdf0dffe47214b866029529419ecb55806c22d8
0f9415b7dd2ffaf4295a51e61f9bfff2db8d042abfd7d5d76347c42771f44650
116b5b718ba3beeea9dd77ad669ca8aff001cf40c1c6e549dd38c3d08668d4cd
127305d53af6493590687101ccb0c9a0780c5e08116bbdd536e6dc12467b88a7
1393acc632c160def86b45c2521c8ee742b7e6239d0d90fb95f51d55cf48b9c3
1746b268addac39a01bc462c8e85434841637a136be1c0234b2eae14988e3d3c
17d2ee6ef525d4a35125c1ce7417ef5b7e1b611c2dc110a3add824bb078adcbf
1a1f70c539853efed52501748b0db0ce50d2835999795b70189afbc802b8f84f
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1e10e9493470eb296ba1ba705a39455e226be2906bd24a41e1f2b8287ff8f62b
1feff37397f802603ed85e9061608051d5b2a77cea125d78519057d06232b07b
28503820ff423a3e61dcab001567d362860dfed3863e3143f5046316a2f262f2
2939d067bced6e2e3e43c1b10d2b067cb980410c2cc42fd3e867798a4a36c697
2b3cf99ce39e5fc49169454f5639b5341dba747f16e3d01a5b9ebf50792e9a1c
2b82601133216ec29983087a0532e9b0af553f7f4a8b3b00ff9d7ffcc1142542
2b92220ef099ffa4a27603556d9b462172c699f8f0198a231b3b83d853c23190
2c2a72d20524531bbf7359f34c9625cf9bb21bed61b9c325f394cd02d1dacc22
2d367b9054bc5b92d423f2f9484c18d8b41468a7f4fd9e63829d3dba290a206e
2d95f71505cec68b09ebcbad4208d2ede280629de1b62c329cca5aab65fad29a
2ef16bb29f01e7d86c77b1e4486887baca5f00283c04c9dbc460661801899a2d
2f13b76b467a78df2cd37eb751e0af06073bcdd2513f28c88d18b2b729655b88
30a1fac44395d192e65326af024746e1ed7f2f75ed38d183f6eb6265757fc773
31d196afc7bf97b61be0a9881f623b3b8a7b56d4b0c08c6b78c37ce92d7827b2
32a55c673dfbcccd608dfa96cd2aa9b34d0b503ba32de13ace9f5b81c05e0386
34077aedb6bf156c8eee33e844e9c5d8003f134afa867dc60e967e36f5a659ae
35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb
38ba6370b8d16de4ee7f82099425ead835ff7317d56bf86fe0f5bd34a1a266ef
38bc0f256821a9c0a02a1c0cedf8ff70c211e637ef77ac199de2fe0cf36ba9ec
3b6563d040b1d5e869a891c311eb61db2ec1a3f849bee334c2150d71491b31ae
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3f0730cd0abfa61ab736fc7797e8d6ed2ad78d1b1a903a0664bcfb2f67b04adb
426f004d8e6a5b308f6c2f66d16f736879a5c890d90ddf5571c78b86bb61039d
4333f5dde7ebbe95817db62d45966b8b0ea878734e0ebdceb3cbf93b0b2620d0
4371631688e829ddc9b65afa067a810ee797987a2eb12b4e31616f15b915b6db
44c7b3c33a1d28e0360f7b972e222118b5c746c1c774c67f3fd6ab9e53e9974f
44dbbb0a1da3d1a2b3f637ba2eff82150de83164b3caf824fc0fc46633588de3
45295a811f899c7eea5e4d0312049da477390afc2a94ffa491dc6979cc34c9ec
489d06131e031d27a033f924daba197f6b483b9bc8602b0dddaea8ebe90f60d8
4946b36e5208a0a01e69ac05696229353e101faece5c1572e2a6177742bf7b5c
4aae83ca0e34e5fef9bebf88ca4edfdf495e4927bbd583d1f05ff101c9421d4c
4c226ee7773e23400426cb39166ff91a970015586284e0cabe8a77d03a4ce05a
4c64d183304fcb9316adeceed80e112ae71c6e33484b097896dbb6998d4b9659
4c8c6c8d826a559e77b05c609b67debcc8130d72fa176a5f53ae0685e33629c3
50b6e67cfcfe4ac8fe9cee705b681f696065306ee42bcd4e6b37a17dba333ac5
52a64558e7d0d7e73cd2fea7064fc02b849852b98e3c344f25fc6a5f1d449b8b
52ad033ab67a5c5a03293a9f3cd15bcb0556019fb479c60f7d5fc2984b86626f
5564f45c0991c7cceb19c0fb637ee44b119fb14c6cbf3691540a9cad11e1edf3
55caa0d379e34c4e8822bfb14dcf4f882d8b8bbf464449207909f388f2328e93
56c15eda02cf6ba7e0d5395be0711db12448713af34cff495ce568289afdb730
58f2ed3e8753b14d9456de59f7a58f5089c81d1ce6691d80bbd4e58f145ffd2c
591b2c578e439cac94475a576ae9649867abc142800981002bca6c5e46a9d0ed
5936b3730015c46ef27548aff7b2162d0878761a5fda6f9d026fbeaef34c0ed3
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5b2355de8c35632901a81e09dd89f0df8f7f27f9203bf4824da8b9c483801401
5d1b3f98e41c0c318f5ebcf69b206583c2fc462665218fc3584e916e57b249c8
5d904be0b7b81df09b9197c0b09baac3340e08a583a17f64b75e1c0b467dd07f
5daa6ab528b95654c0663a8936ef14a2b6d9dad9c0b2d58dbb8017066cf93202
603e10027c39bb736cc7dee132026554899c8df72c18a59e85d3f748228b0bd9
62ab2ab3a16c6d4f96e5ae538005ca6be5bb97d46affaac9ed79f8e2e163a808
6433a43310293748cf1fddd99a260723f22d8202abe6c37e736716eb1f0a7c05
648c698dd41bf291833204226476e7d092b281fd06255a70a4925f45ca8c96c2
6a432ec996da0b400368eb6cf47f8e056f2b25e32a50b03d9a709fa6c1fecc1a
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b771d8c7719a4d6187fb47de02b830ba0ccf68e66be12526786ded85cb960b2
6ba797956f6d29b650d458897e48a190cddf0a6ba374350c0bb565fa04f80d65
6f9a65ba114f6898003f69c309d43209c23a9093bcb50624b32001784e23bd9c
70356aaad8b043112594064fea69694e5af4f17b6af4d4836b184735afe24c56
71210ac42f5f0b1b7fb1d3bc5ac89d398caaa3011d8f566d4f2352b807c2f139
7352780751ec91c6bc82b985ffc63fe2505da7a810748fc963010eec199abc73
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5
77ca3f103f53fbd67626ae94f18a945d98dc1a82613b493ec9733b01f11c5e97
78555e77f61d09d04c161af14988377120b44cbfa38a4f8886083949e34f3e46
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
79e9194c169e7b3ddbc1f655295ae7c3396c1aaad6a8ca0acff9927f706eaa48
7b3b6bef2a7b5649aa4b189428b070359fcf2858255454445a78d2518b356d5d
7b5edcbf4a04dec3e1381046ccfe8e7135eaca4cc47973ccfd4ec6384b39b8bb
7b7ca9dee8acbf03925b43a2cb76e364ba514c30a18de9f1523d0b156093c7d6
7ccf80229bbe586853232059978b67c1dbe6ccd7f6b4b8585b34bbcf2d9f195f
7db9987845f7e973d4e2d6bae3ecce365acae016dfcdfaefa4fa400836301eff
7e3f2e5c9c0f642f19eb5d1488c3257ad89341700795e0e6253400c876c4e06d
7e7558ddd527f6452c7c72f510f48964f6319f317b314829c2786e42346c372e
8029982e606b01f8d1651a46683c7a90ef2496e73823047c0e73b72e285d593e
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84d2173fa3c469a8e317792681d4bcfa0602be112966a3b6e09d54d233e19b2f
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86490ae354f947bd2b55c26b8a48fd7369b534a0f6c06d61f5cae3766ab3cbf1
8971fe0a892f03a0f0ba568b545194578eaf62dcafabc254e2677c7af64200c3
8a73d9886283369e97c809bb8b7af15cab6263559318fb730256f6da6a720426
8b742fc4a5cda07cc6fb4b147cc71a75b1245d392b21b10d0eda3010d7112c56
8c4a8f43aee7ff10ed1cd4d5600632074498d3aeec720f65c11676e569b5cf8f
8ca86cf48a8c2f4154e95cbea31e02571890a83dc4a4f97df58ba56aa7f3f164
8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7
8e742fbd7146cea9dee3a9c4b4474e1da43f62e8864d519c1debe7f10ec6043b
9027bc2ee5d559beeb81d822fd8e1b8962f6be256aaed95aca74a0a519406c3a
9037e86768130186d676f65444b051b348944719247563d521046bca6af241b4
909c4adf1c2435d373b6e0d83ee64cc9888881ac24905238ea010b4da3d06b93
91ab93b25227f8a29a716fdc41831b0a8a8729d8cde9f8adb29f4c8392457b9e
91f9507bd42de947a5f2219a6448cab85551f2b19f023a2bc6fadae5c7e258d5
93ac8e22ef8a241ddd954362cc979528693e4b7732dc5de26154d9bbf60011fb
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
94f00b1691d982941263f3aacde8ee4a09a1356d89ebc2e15ce6a0d31ce9e674
96056e7f261b02dc4cddc8bc5b87307b95eccd8ed9f41973a51250cd83cc09bf
989d0ff16db0110879e677d9ef14c48e83b028831830566393225fb0c39fe2fd
98af017c05d0d89d07187e5fea5df961cfe0da03321de1daf05e545b663718a4
99141deb1e06c17d62b664d1b8bacde6c827cd0559a8cd2c2a81b45e0ac3304c
9a31024e3bdb136aac7eacc594d12f0f94f44eb7972f9adc45f68c1a9fd8abaa
9d487e4cf152f8ec874d188c4e86ac0045133501b4574eb1dcfae871f7e20de9
9d64ce89336a149d954573c477ff7d9b320f92db397e754626c809b1d1313503
a05de9f3792048eff0cedc9370691b2a604cc1628f6aa9f70ad07444d2f02bdb
a0de89390c4ed8265d843baf51181cd560ea1695eb6cc67a998e5c4c1c9adad0
a3d08747462129e4b1e6756b57c9f24cc8dd7a6ad095cc416f5dbd52aaa5f7b2
a3d2952330aefe690302e90460777d9b5c6fc354861336a919c83e44fe352800
a3e859b8149a06247853276aa0b4c79c4f3d0d63e91baf88bf96b76fbfc1b492
a5180628c01079691f3d21afc8086479b923f6127b860cad410a5c48c6bf4ad5
a570be658968d1a85d2f9093d62ea04bf3c0b1ef5755b0af1b863cfbb17b4bb4
a5d227b5d9c8b9b461d0a35df1c39685463fe0bd375c2aa2aa197dfd2776a7c8
a6b9e77f842f68bf64b450048c752a189401955f45d149c5430fbc208469ffe0
a6c71bbedd62705164ce103d55e38f724ee3622b76dd30c8e43edf6eafe8e87f
a7ef78f4ad97dfd507ddad9306670ff6f03401b119fcbf2f9227f12eb3279f11
a7fecbfe24b0884ff617e8bb7bd0871397a39e6de70a6d2ff276743988f532bd
a8510ffd3e9d2934e0ad67e81a2fc12f36e2b04ac3f3f150bd7e44ad12af3d76
a8bfdecce5d2156da95876601ab50733e863513e3689ce32498a8370e79a5687
a963621b4341552ca61590aa02e93b70f189e8050a105c32c0197c3c34b2d114
aca4dbd73acdbca407bee1704d3a11d396de341d74dbc08bb028b36b7626ea4d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b07fffef0ae1504dfba7fb4096afb6e097815298973f51a1b211771e05c075b0
b15b6c9545897b7e1ec41dae5284c1e102e53c435f12c56ede872c54eae03a92
b1ec55a9e66fe05243e1977a0db2af48f4af4c07bfd0b9cdef32c01ab0f42b9d
b4bf8910a202b24bd61be26e28eaa8c5f83a48d78999b2693a9cbdf4c9910cf1
b4db541e06042b252e36e46c88fd77da3bc560c9b3c92f6bb1425a4b13b8d0ea
b4f5a1e1c17e0b76e8a2883f5a5c2fcf1c9241e5f043fbac2aaa6d5f6b20d153
b8f5fbf30176a7f19df33745854710609eb9a8290a8f273a6590f020cf83f352
ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652
ba8f87d1df43af84216477d510342baafc071017d4a2ebc85576e431fad4d319
bae1f759fd4cd9055a14e9384f474c8e53358ea04bffda92bde1e11b0599c61c
bceb73993d094c4c821c7571921103bdc8c05e9082c4fc513d244358d53593db
bd90f865472fe70f7acafca83b79b17cea7a2687024d4842309ad97e7bc04f7c
c0bdde2f526d0f2e364516aa490ea8e6f076938db6176db8b3c9af3157a69b02
c113d2d891192c213a9ef749ca10766f1b7ad0e6bdaf342fbe7c6488c68ae2c7
c19a14f70d866bb5329d5d83f2adc33f4b08321dafbbddd0bcf3a0331f808851
c3061c3788ad5783ef8a5d10c454bafe7eb942c48200dccc852cc6d3c9f303d4
c368e74321d2180806d6982ab26271a765594390c0d50a2e4fe452e901778d5e
c38b336f03108b44e85ed615a210c9832324f8d5f3efc8c418196fb0517750a9
c3dd5a6fff633c6393dca21ce74cd6dc95265943575b43d2d9616f020eea68fa
c46812c7c91d67dcc84ac30ff32138415af25b3416ea5b6588628cb3e2d1f686
c625a259d52303bc63e165e0326e1d78de9bb5b5074423f368df77fca407b7bf
c91fcb89871b3af47fd3a4f5e17d40ac582ed9a6046963ab48caa4baa7c3dfe2
cafed8afce97ffc3d420081a23c193ac0dc3d2c70454332284233b3d151da5ad
ce586fc08d8c751578c9489d658b1739d2de2c259f7c5aa34134549929cd0109
d0b61a80e81b2d02d93121474d80003948553484961b38946c38e3ecc0b495fa
d100a79e9ca4f220f81fd0729136ce2839c361f0850a3ddabb987bb04c99b925
d3511f959fb530a0d393bd6fa20fc6113245c87ad74acc6b6de16840ff709d6e
d52af8243ca6afe270829cfe2853cb79a486b81650f8b575374a220c311d5411
d8d8603e5e751094f2a2bf74cf55e58f8d8499d2580a1c93d21990360f4d8aef
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df74e2e61278796d56da196698abfd946a56610679d20ba298a7794f59f8058c
dfca08bf68a7574152f992bb6b1c3d76e318a4059b944e6879e1a720690ffd7c
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
e2d8d3ddad554350fdc7bb72fc25a64742726e01bfbbdebeddba3d8a64e7f567
e2eb49ebf978dd7140eacd08fca34dfe6da0db3bebdee08606996d00766d60af
e39a8118ec6cdf6ac33e6961518e9fe6ba3f6caf099aeeaec1389c2108ba90ba
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3bb91ef2b6189fe3bb3bcbfd35f127e49b588e629ec86a9e9265462c3bd9e55
e40863135f9a5c29d4667e873a6da4cebf8f158a58cc932aaa83bd61133730e7
e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6
e9cb2dafa252ae54afb3b91b1c30d12761a37459d7e03741268408d9bd106bb6
ead100902fcce73a9e8a3f597b51bf6f2d6749d76f90b3a9c4130465283153d3
eb2e3f703cf8ee0156a1d625e053c0968b0dfcff62ea4254ddd8ba9fece3ad32
ec1941ce9e7878f195767288346eb2821e3af0e25652c0233411ff6acf2810ad
ed1f896874cf1d2e5ffcf369ed1277be55c36ab18bcbeb822e7a587008e397bf
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef1e94b344600fa590f252456ce727e01a2300ccfbf2b41440a836459c3978cc
ef86cd162f0d8a08cc65b8c8e07efdf5e3e2d3dd1dea0136e0ded75f40ba38f6
f01d3fe2a8106b2ac0fe9ed20c7c3548c198cb1402e5fba6ac150841ea4bd65f
f0aca14253930503a97bf0b479bd91941bc9e58f6c81ca5967033a2abfb71506
f1e6a0811f0df7be7482db95552fd57017ca33d5a35f07c330859debd46d135c
f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4
f2154f49d7d4ed6c74a1ad1dc0e39ef3136fd859059986ed5bcd3050d59867b3
f29ae1e8114aa0f4413cdc878fa5d10b1aa8fc4cb0caf9bc13fdcab7f26337e2
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6369864f88c35b1302ab28dbaa8944f4f275f11a3e43bd96187cc79bf82699d
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fac08aba895b0525de1904bc4fb04928ba03ec2cd715d084831f0dd265774bce
fda8e2340dd0d31581f956b339da1e9533a2c6838d385e672f984d069dab2a62
fdcc34060c0c6a0ec771d0a4f1e14f00092e96577e166be28d33b83ba72faa69
ff00234ed13b5e571fe0ef5b0f9e465c86d895c156193cd0a7c2f75eac059bf1

offtherecord.com Open in urlscan Pro 99.86.4.19 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

216 Requests

98 %HTTPS

52 %IPv6

32 Domains

47 Subdomains

43 IPs

3 Countries

7044 kBTransfer

21979 kBSize

37 Cookies

13 Outgoing links

Page URL History

Redirected requests

216 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

offtherecord.com Open in urlscan Pro
99.86.4.19 Public Scan

Screenshot
Live screenshot

Full Image

216
Requests

98 %
HTTPS

52 %
IPv6

32
Domains

47
Subdomains

43
IPs

3
Countries

7044 kB
Transfer

21979 kB
Size

37
Cookies

216 HTTP transactions
10 data transactions