urlscan.io logo urlscan.io
SecurityTrails logo

www.getyourrefund.org Open in urlscan Pro
52.21.182.156  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.getyourrefund.org/
Effective URL: https://www.getyourrefund.org/en
Submission: On January 28 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 3 countries across 11 domains to perform 35 HTTP transactions. The main IP is 52.21.182.156, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.getyourrefund.org.
TLS certificate: Issued by TrustID Server CA E1 on August 3rd 2021. Valid for: a year.
This is the only time www.getyourrefund.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 18 52.21.182.156 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
2 2a03:2880:f02... 32934 (FACEBOOK)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f12... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 99.86.3.46 16509 (AMAZON-02)
3 18.66.248.99 16509 (AMAZON-02)
2 75.2.88.188 16509 (AMAZON-02)
35 11
18    52.21.182.156 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-182-156.compute-1.amazonaws.com
www.getyourrefund.org
1    2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
3    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
2    2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
2    2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2a00:1450:400c:c0d::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:800::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    99.86.3.46 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-3-46.fra6.r.cloudfront.net
widget.intercom.io
3    18.66.248.99 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-99.dus51.r.cloudfront.net
js.intercomcdn.com
2    75.2.88.188 (United States)

ASN16509 (AMAZON-02, US)
PTR: ad8b87a22ce463223.awsglobalaccelerator.com
api-iam.intercom.io
Apex Domain
Subdomains		 Transfer
18 getyourrefund.org
www.getyourrefund.org
531 KB
3 intercomcdn.com
js.intercomcdn.com — Cisco Umbrella Rank: 2553
124 KB
3 intercom.io
widget.intercom.io — Cisco Umbrella Rank: 2532
api-iam.intercom.io — Cisco Umbrella Rank: 2952
5 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 385
11 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 98
386 B
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 42
20 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 146
114 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 5557
501 B
1 google.com
www.google.com — Cisco Umbrella Rank: 13
501 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 96
447 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 78
36 KB
35 11
Domain Requested by
18 www.getyourrefund.org 1 redirects www.getyourrefund.org
3 js.intercomcdn.com widget.intercom.io
3 bat.bing.com www.getyourrefund.org
bat.bing.com
2 api-iam.intercom.io js.intercomcdn.com
2 www.facebook.com www.getyourrefund.org
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 connect.facebook.net www.getyourrefund.org
connect.facebook.net
1 widget.intercom.io 1 redirects
1 www.google.de www.getyourrefund.org
1 www.google.com www.getyourrefund.org
1 stats.g.doubleclick.net www.google-analytics.com
1 www.googletagmanager.com www.getyourrefund.org
35 12
Subject Issuer Validity Valid
getyourrefund.org
TrustID Server CA E1		 2021-08-03 -
2022-07-28		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-12-27 -
2022-03-21		 3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 01		 2021-12-22 -
2022-06-22		 6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-11-07 -
2022-02-05		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-12-27 -
2022-03-21		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-12-27 -
2022-03-21		 3 months crt.sh
www.google.de
GTS CA 1C3		 2021-12-27 -
2022-03-21		 3 months crt.sh
*.intercomcdn.com
Amazon		 2021-03-01 -
2022-03-30		 a year crt.sh
*.intercom.com
Amazon		 2021-04-15 -
2022-05-14		 a year crt.sh

This page contains 2 frames:

Primary Page: https://www.getyourrefund.org/en
Frame ID: 5532F13BCDE6287F4FB6ADC2D82DD9B2
Requests: 31 HTTP requests in this frame

Frame: https://js.intercomcdn.com/frame-modern.7481ad61.js
Frame ID: 83F1F65C94DAE817EE78886E2C282089
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Free tax help from IRS-certified volunteers. | GetYourRefund

Page URL History Show full URLs

  1. https://www.getyourrefund.org/ HTTP 302
    https://www.getyourrefund.org/en Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

35
Requests

97 %
HTTPS

67 %
IPv6

11
Domains

12
Subdomains

11
IPs

3
Countries

842 kB
Transfer

2212 kB
Size

11
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.getyourrefund.org/ HTTP 302
    https://www.getyourrefund.org/en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 28
  • https://widget.intercom.io/widget/p1hu33n8 HTTP 302
  • https://js.intercomcdn.com/shim.latest.js

35 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request en
www.getyourrefund.org/
Redirect Chain
  • https://www.getyourrefund.org/
  • https://www.getyourrefund.org/en
17 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
0d8f0dab13d35a5e89cd7fc592e14092bc8b1f040ad511a7f36b239bdf133c7f
Security Headers
Name Value
Content-Security-Policy
Strict-Transport-Security max-age=63072000; includeSubDomains max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Fri, 28 Jan 2022 23:36:04 GMT
content-type
text/html; charset=utf-8
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-download-options
noopen
x-permitted-cross-domain-policies
none
referrer-policy
strict-origin-when-cross-origin
etag
W/"0d8f0dab13d35a5e89cd7fc592e14092"
cache-control
max-age=0, private, must-revalidate
content-security-policy
x-request-id
d1b6456c-d2e6-4096-bac1-d2a1517892b9
x-runtime
0.062859
strict-transport-security
max-age=63072000; includeSubDomains max-age=31536000
content-encoding
gzip

Redirect headers

date
Fri, 28 Jan 2022 23:36:04 GMT
content-type
text/html; charset=utf-8
location
https://www.getyourrefund.org/en
server
nginx
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-download-options
noopen
x-permitted-cross-domain-policies
none
referrer-policy
strict-origin-when-cross-origin
cache-control
no-cache
content-security-policy
x-request-id
d686ab82-94cb-4ed9-bce7-d4459f5bbeb1
x-runtime
0.076292
strict-transport-security
max-age=63072000; includeSubDomains max-age=31536000
js
www.googletagmanager.com/gtag/ 		90 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-156157414-1
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
62a49d74f9ad5c1ea05992ec53cc91906c8ed56a98b987717cb4fdde0ac23e28
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36115
x-xss-protection
0
last-modified
Fri, 28 Jan 2022 22:38:19 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 28 Jan 2022 23:36:05 GMT
application-13c6e1cf84edb5d1a6907ff3602adc01b0982ad165215e8d509d76f24ddd5f0f.css
www.getyourrefund.org/assets/ 		188 KB
37 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.getyourrefund.org/assets/application-13c6e1cf84edb5d1a6907ff3602adc01b0982ad165215e8d509d76f24ddd5f0f.css
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1fb1b628bc56c8369ba6864e3f8d2c0777178f1131e8d27b9f3c5f097e9f5e56
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
content-encoding
gzip
last-modified
Fri, 28 Jan 2022 21:58:28 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-length
37499
application-ba16c635.css
www.getyourrefund.org/packs/css/ 		10 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.getyourrefund.org/packs/css/application-ba16c635.css
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
241487c3cd3a923a353564d582834c6ac342bc4dd17ed33bf409a011ca88ab56
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
content-encoding
br
last-modified
Fri, 28 Jan 2022 22:41:10 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-length
2208
application-abefa18585e2e74963a9.js
www.getyourrefund.org/packs/js/ 		611 KB
143 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.getyourrefund.org/packs/js/application-abefa18585e2e74963a9.js
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ac015e070f9b3e66c2dbed596e9b39a1d7fe6e0ac48b2b94465bbcce5429a8bc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
content-encoding
br
last-modified
Fri, 28 Jan 2022 22:41:10 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-length
145511
homepage-hero-mobile-4950352800361d7a4d5caab45c0bd250306c53403a83f3b5013d7296afdeaa44.svg
www.getyourrefund.org/assets/ 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/homepage-hero-mobile-4950352800361d7a4d5caab45c0bd250306c53403a83f3b5013d7296afdeaa44.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4950352800361d7a4d5caab45c0bd250306c53403a83f3b5013d7296afdeaa44
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
35639
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
homepage-hero-c0d4a74737f53e9900db9dc5cc8c1f4847fb4d1be32b74798367c86bf27fd9c2.svg
www.getyourrefund.org/assets/ 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/homepage-hero-c0d4a74737f53e9900db9dc5cc8c1f4847fb4d1be32b74798367c86bf27fd9c2.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
c0d4a74737f53e9900db9dc5cc8c1f4847fb4d1be32b74798367c86bf27fd9c2
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
35687
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
irs-certified-44c74075deaaa49c355e721496612f029c822caf230469976ff542ebbf558fcd.svg
www.getyourrefund.org/assets/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/irs-certified-44c74075deaaa49c355e721496612f029c822caf230469976ff542ebbf558fcd.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
44c74075deaaa49c355e721496612f029c822caf230469976ff542ebbf558fcd
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
6565
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
money-fan-1f977256e081805ccbb0b2e22302fb0a6ac94e240b9ce5db22a26d4e788ff5e0.svg
www.getyourrefund.org/assets/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/money-fan-1f977256e081805ccbb0b2e22302fb0a6ac94e240b9ce5db22a26d4e788ff5e0.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1f977256e081805ccbb0b2e22302fb0a6ac94e240b9ce5db22a26d4e788ff5e0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
14612
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
uwba-79029d40d42d6471132325300df4c8662c7ee38698eec483637354775b7f8c41.svg
www.getyourrefund.org/assets/partner-logos/grayscale/ 		110 KB
110 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/partner-logos/grayscale/uwba-79029d40d42d6471132325300df4c8662c7ee38698eec483637354775b7f8c41.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
79029d40d42d6471132325300df4c8662c7ee38698eec483637354775b7f8c41
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
112148
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
thc-53cb408ec4b5474a3998dd5a46a89f055e933aeec67d6cf0e09771287d5bf923.svg
www.getyourrefund.org/assets/partner-logos/grayscale/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/partner-logos/grayscale/thc-53cb408ec4b5474a3998dd5a46a89f055e933aeec67d6cf0e09771287d5bf923.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
53cb408ec4b5474a3998dd5a46a89f055e933aeec67d6cf0e09771287d5bf923
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
16444
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
prosperity-now-8b916d63899fc4ad9aaca1a7c93b6b4f3a99f4058b4964ba12141bebe8463243.svg
www.getyourrefund.org/assets/partner-logos/grayscale/ 		62 KB
62 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/partner-logos/grayscale/prosperity-now-8b916d63899fc4ad9aaca1a7c93b6b4f3a99f4058b4964ba12141bebe8463243.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8b916d63899fc4ad9aaca1a7c93b6b4f3a99f4058b4964ba12141bebe8463243
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
63617
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
gwisr-4846f4179c5df0495cc9eaa1f87e2fdce2abedf415a72a6bd64ffdb32f4800b5.svg
www.getyourrefund.org/assets/partner-logos/grayscale/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/partner-logos/grayscale/gwisr-4846f4179c5df0495cc9eaa1f87e2fdce2abedf415a72a6bd64ffdb32f4800b5.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4846f4179c5df0495cc9eaa1f87e2fdce2abedf415a72a6bd64ffdb32f4800b5
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
17426
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
uwtsa-c95bd9fde48b4ad603c53e4a958018e98e112e6dd242a29169d7543cfeaaaa7f.svg
www.getyourrefund.org/assets/partner-logos/grayscale/ 		36 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/partner-logos/grayscale/uwtsa-c95bd9fde48b4ad603c53e4a958018e98e112e6dd242a29169d7543cfeaaaa7f.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
c95bd9fde48b4ad603c53e4a958018e98e112e6dd242a29169d7543cfeaaaa7f
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
37133
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
star_rating-c80da63dda13779706bfc48be453b38e27e9cc07b9dc90731dbff61ccfbefafb.svg
www.getyourrefund.org/assets/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/star_rating-c80da63dda13779706bfc48be453b38e27e9cc07b9dc90731dbff61ccfbefafb.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
c80da63dda13779706bfc48be453b38e27e9cc07b9dc90731dbff61ccfbefafb
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
4488
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
lock-gear-cef557bc93aa1490a8b0cca8ec0ee152fcd7f55d736e4435d962ae9a4c7fe1d2.svg
www.getyourrefund.org/assets/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/lock-gear-cef557bc93aa1490a8b0cca8ec0ee152fcd7f55d736e4435d962ae9a4c7fe1d2.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cef557bc93aa1490a8b0cca8ec0ee152fcd7f55d736e4435d962ae9a4c7fe1d2
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
1657
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
checkbox-logo--white-252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e.png
www.getyourrefund.org/assets/ 		363 B
581 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/checkbox-logo--white-252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e.png
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
363
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/png
intercom-chat-303f5019f96110dce78eb26a69e3c412587c9377bd92caf2d5dcfb8d6d629d65.svg
www.getyourrefund.org/assets/ 		330 B
552 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.getyourrefund.org/assets/intercom-chat-303f5019f96110dce78eb26a69e3c412587c9377bd92caf2d5dcfb8d6d629d65.svg
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.182.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-182-156.compute-1.amazonaws.com
Software
nginx /
Resource Hash
303f5019f96110dce78eb26a69e3c412587c9377bd92caf2d5dcfb8d6d629d65
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains, max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
public, max-age=31536000
last-modified
Sat, 01 Jan 2000 00:00:00 GMT
server
nginx
content-length
330
strict-transport-security
max-age=63072000; includeSubDomains, max-age=31536000
content-type
image/svg+xml
bat.js
bat.bing.com/ 		36 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:04 GMT
content-encoding
gzip
last-modified
Fri, 03 Dec 2021 01:53:50 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B3E442BEBB6B4027A811BEAD1C59C8D3 Ref B: FRAEDGE1515 Ref C: 2022-01-28T23:36:05Z
etag
"0cb09ee8e7d71:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
10468
fbevents.js
connect.facebook.net/en_US/ 		99 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c55508ea7ce1ad08364772fbfadb835d2b1d1b9238d345c45eee1943ada4ff6f
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
26237
x-xss-protection
0
pragma
public
x-fb-debug
j8nzSrYT/xbTtAaf7uz66JYYLJ9+Zka6pQObdM75yZBAIu06dZ2WsosN2zndxYFZnHUWcgzNbur+J5MQnfdu7w==
x-fb-trip-id
917726464
x-frame-options
DENY
date
Fri, 28 Jan 2022 23:36:05 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-156157414-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
71
date
Fri, 28 Jan 2022 23:34:54 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sat, 29 Jan 2022 01:34:54 GMT
27009625.js
bat.bing.com/p/action/ 		0
115 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/27009625.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 28 Jan 2022 23:36:05 GMT
cache-control
private,max-age=1800
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: EB4037C80A324A10905703F0E9F9A4E7 Ref B: FRAEDGE1515 Ref C: 2022-01-28T23:36:05Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/ 		0
151 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=27009625&Ver=2&mid=683e4a91-fd7f-4fa7-bb76-91c341a08c68&sid=0fa46270809311ec88f61f3d10f4066b&vid=0fa45cd0809311eca9545f85e5002e12&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Free%20tax%20help%20from%20IRS-certified%20volunteers.%20%7C%20GetYourRefund&p=https%3A%2F%2Fwww.getyourrefund.org%2Fen&r=&evt=pageLoad&msclkid=N&sv=1&rn=236617
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Jan 2022 23:36:04 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 8C81E1D9C3FF4AD18CE34E4999BEF3DF Ref B: FRAEDGE1515 Ref C: 2022-01-28T23:36:05Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
709757979791571
connect.facebook.net/signals/config/ 		305 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/709757979791571?v=2.9.51&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
78b2ad101e68defc52ccb30195720707dd78e97e2752d8bc0974180bc9b39e53
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
4M9NtHibO0R93dU10eIsqz9NGxYIKHUV6u/fdaxGz4eZ/AATllcjpnNQH3ysydfvRLcEpW9xCymwXAifBKOYiQ==
x-fb-trip-id
917726464
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Fri, 28 Jan 2022 23:36:05 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=774361775&t=pageview&_s=1&dl=https%3A%2F%2Fwww.getyourrefund.org%2Fen&ul=en-us&de=UTF-8&dt=Free%20tax%20help%20from%20IRS-certified%20volunteers.%20%7C%20GetYourRefund&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=730813046&gjid=1507768760&cid=1303372390.1643412965&tid=UA-156157414-1&_gid=879535265.1643412965&_r=1&gtm=2ou1q0&z=2094925315
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.getyourrefund.org/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 28 Jan 2022 23:36:05 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.getyourrefund.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=709757979791571&ev=PageView&dl=https%3A%2F%2Fwww.getyourrefund.org%2Fen&rl=&if=false&ts=1643412965459&sw=1600&sh=1200&v=2.9.51&r=stable&ec=0&o=30&fbp=fb.1.1643412965458.786538108&it=1643412965270&coo=false&rqm=GET
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length
44
expires
Fri, 28 Jan 2022 23:36:05 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
447 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-156157414-1&cid=1303372390.1643412965&jid=730813046&gjid=1507768760&_gid=879535265.1643412965&_u=YEBAAUAAAAAAAC~&z=381041354
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0d::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.getyourrefund.org/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Fri, 28 Jan 2022 23:36:05 GMT
content-type
text/plain
access-control-allow-origin
https://www.getyourrefund.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-156157414-1&cid=1303372390.1643412965&jid=730813046&_u=YEBAAUAAAAAAAC~&z=1527644200
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Jan 2022 23:36:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-156157414-1&cid=1303372390.1643412965&jid=730813046&_u=YEBAAUAAAAAAAC~&z=1527644200
Requested by
Host: www.getyourrefund.org
URL: https://www.getyourrefund.org/en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 28 Jan 2022 23:36:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
shim.latest.js
js.intercomcdn.com/
Redirect Chain
  • https://widget.intercom.io/widget/p1hu33n8
  • https://js.intercomcdn.com/shim.latest.js
18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.intercomcdn.com/shim.latest.js
Protocol
H2
Server
18.66.248.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-248-99.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b6c0560046df1ecabbcbeb82522ca9887fb3467e334a52536d460a3b08dc2ec2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 28 Jan 2022 23:31:20 GMT
content-encoding
gzip
last-modified
Fri, 28 Jan 2022 10:36:16 GMT
server
AmazonS3
age
286
etag
"798afe8bf33434189d517d72c8db81dd"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
via
1.1 cca0e030e1fac6fb27702d182fb6a74a.cloudfront.net (CloudFront)
cache-control
max-age=300, s-maxage=300, public
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
content-length
6064
x-amz-cf-id
Lcqajq8LFSXGR2gmP7iV2BZMRCJ1WSlf2DCSMTsc-J_YNKGRZ4YRsw==

Redirect headers

date
Fri, 24 Dec 2021 00:05:15 GMT
via
1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
server
AmazonS3
age
3108651
x-cache
Hit from cloudfront
location
https://js.intercomcdn.com/shim.latest.js
x-amz-cf-pop
FRA6-C1
content-length
0
x-amz-cf-id
MzeVwVn-D9pPIWaw7sKUBLP-kHBA6_Qg9zlWwETwRhTMivJAXJj6Mw==
frame-modern.7481ad61.js
js.intercomcdn.com/ Frame 83F1 		295 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.intercomcdn.com/frame-modern.7481ad61.js
Requested by
Host: widget.intercom.io
URL: https://widget.intercom.io/widget/p1hu33n8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.248.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-248-99.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
fb8badce346e70c769a2a7d28514c5793db08e4f6a18255b1d3754f6bfe2363f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 28 Jan 2022 22:36:20 GMT
content-encoding
gzip
last-modified
Fri, 28 Jan 2022 10:35:10 GMT
server
AmazonS3
age
3586
etag
"7bfa70cb9d093cc78e6653a93dbee22f"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
via
1.1 cca0e030e1fac6fb27702d182fb6a74a.cloudfront.net (CloudFront)
cache-control
max-age=31536000, s-maxage=7200, public
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
content-length
80664
x-amz-cf-id
VCnmvegmGfjyeHZQb2oNhuC6RmA0-_AOwM8nHl7Sh-jJPqu3gdURpg==
vendor-modern.aee7a985.js
js.intercomcdn.com/ Frame 83F1 		125 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.intercomcdn.com/vendor-modern.aee7a985.js
Requested by
Host: widget.intercom.io
URL: https://widget.intercom.io/widget/p1hu33n8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.248.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-248-99.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b75c433e51e4711bd83ba4a7e97d4ca5d7a0aec267a19f208777133dd1225988

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 28 Jan 2022 23:20:29 GMT
content-encoding
gzip
last-modified
Thu, 27 Jan 2022 12:46:34 GMT
server
AmazonS3
age
937
etag
"2592073d2e195b1ae899f2a67f496096"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
via
1.1 cca0e030e1fac6fb27702d182fb6a74a.cloudfront.net (CloudFront)
cache-control
max-age=31536000, s-maxage=7200, public
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
content-length
39084
x-amz-cf-id
FmXU4CLd61P5AexEveZ0j045D5wR1mFV2_TemoFKFQlutdHEZsL7ig==
ping
api-iam.intercom.io/messenger/web/ Frame 83F1 		30 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-iam.intercom.io/messenger/web/ping
Requested by
Host: js.intercomcdn.com
URL: https://js.intercomcdn.com/frame-modern.7481ad61.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.2.88.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ad8b87a22ce463223.awsglobalaccelerator.com
Software
nginx /
Resource Hash
d27d7295e29ba6c9823d802e408a6826d99271db779dd967025c5659ad72332c
Security Headers
Name Value
Strict-Transport-Security max-age=31556952; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Fri, 28 Jan 2022 23:36:06 GMT
content-encoding
gzip
x-ami-version
ami-039729ea2c975defa
status
200 OK
strict-transport-security
max-age=31556952; includeSubDomains; preload
vary
Accept,Accept-Encoding
x-xss-protection
1; mode=block
x-request-id
00081s7sphtrfgobnjug
x-runtime
0.431523
server
nginx
x-frame-options
SAMEORIGIN
etag
W/"d27d7295e29ba6c9823d802e408a6826"
x-ratelimit-remaining
13323
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.getyourrefund.org
x-intercom-version
02a738ce96fd88adca1134119382b4126702e38e
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
x-ratelimit-reset
1643412970
x-ratelimit-limit
13333
access-control-allow-headers
Content-Type
x-content-type-options
nosniff
/
www.facebook.com/tr/ 		44 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=709757979791571&ev=Microdata&dl=https%3A%2F%2Fwww.getyourrefund.org%2Fen&rl=&if=false&ts=1643412965962&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%20%20Free%20tax%20help%20from%20IRS-certified%20volunteers.%5Cn%20%7C%20GetYourRefund%22%2C%22meta%3Adescription%22%3A%22Maximize%20your%20refund%20by%20filing%20with%20our%20trusted%20volunteers.%20Available%20to%20you%20online%20or%20in%20person!%22%7D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22%20%20Free%20tax%20help%20from%20IRS-certified%20volunteers.%5Cn%20%7C%20GetYourRefund%22%2C%22og%3Adescription%22%3A%22Maximize%20your%20refund%20by%20filing%20with%20our%20trusted%20volunteers.%20Available%20to%20you%20online%20or%20in%20person!%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.getyourrefund.org%2Fassets%2Fsocial_share_banner-2627e4187e4cd35a80746b84de2dbd44241efb34f9a4ae31e98c7a754da7ba39.png%22%2C%22twitter%3Atitle%22%3A%22%20%20Free%20tax%20help%20from%20IRS-certified%20volunteers.%5Cn%20%7C%20GetYourRefund%22%2C%22twitter%3Adescription%22%3A%22Maximize%20your%20refund%20by%20filing%20with%20our%20trusted%20volunteers.%20Available%20to%20you%20online%20or%20in%20person!%22%2C%22twitter%3Aimage%22%3A%22https%3A%2F%2Fwww.getyourrefund.org%2Fassets%2Fsocial_share_banner-2627e4187e4cd35a80746b84de2dbd44241efb34f9a4ae31e98c7a754da7ba39.png%22%2C%22og%3Atype%22%3A%22website%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.getyourrefund.org%2Fen%22%2C%22twitter%3Acard%22%3A%22summary_large_image%22%2C%22twitter%3Aurl%22%3A%22https%3A%2F%2Fwww.getyourrefund.org%2Fen%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.51&r=stable&ec=1&o=30&fbp=fb.1.1643412965458.786538108&it=1643412965270&coo=false&es=automatic&tm=3&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.getyourrefund.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 23:36:05 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority
u=3,i
expires
Fri, 28 Jan 2022 23:36:05 GMT
match
api-iam.intercom.io/messenger/web/rulesets/16405629/ Frame 83F1 		253 B
848 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-iam.intercom.io/messenger/web/rulesets/16405629/match
Requested by
Host: js.intercomcdn.com
URL: https://js.intercomcdn.com/frame-modern.7481ad61.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.2.88.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ad8b87a22ce463223.awsglobalaccelerator.com
Software
nginx /
Resource Hash
b1ac0f14f70b2ff0172f3835186198050cf75d98eb3d1275ccf9533141ea4697
Security Headers
Name Value
Strict-Transport-Security max-age=31556952; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Fri, 28 Jan 2022 23:36:06 GMT
content-encoding
gzip
x-ami-version
ami-039729ea2c975defa
status
200 OK
strict-transport-security
max-age=31556952; includeSubDomains; preload
vary
Accept,Accept-Encoding
x-xss-protection
1; mode=block
x-request-id
0008r4m6tkpnbc2ag3b0
x-runtime
0.220320
server
nginx
x-frame-options
SAMEORIGIN
etag
W/"b1ac0f14f70b2ff0172f383518619805"
x-ratelimit-remaining
13321
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.getyourrefund.org
x-intercom-version
02a738ce96fd88adca1134119382b4126702e38e
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
x-ratelimit-reset
1643412970
x-ratelimit-limit
13333
access-control-allow-headers
Content-Type
x-content-type-options
nosniff

Verdicts & Comments Add Verdict or Comment

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| gtag object| dataLayer object| uetq object| appData object| mixpanelData function| fbq function| _fbq object| intercomSettings function| Intercom object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| UET function| UET_init function| UET_push object| ueto_0e5b5b8499 object| gaplugins object| gaGlobal object| gaData function| setImmediate function| clearImmediate object| regeneratorRuntime function| jQuery function| $ boolean| _rails_loaded function| __intercomAssignLocation

11 Cookies

Domain/Path Name / Value
www.getyourrefund.org/ Name: visitor_id
Value: 700eabd359d849058a638cc4a1f90fe8352bf3d8a6e2e91d95ef
www.getyourrefund.org/ Name: _vita_min_session
Value: py4N6GVXtNgPiP4GiP%2B7sTumieguUoaFLFVVDdsrIQhoMNwzAp3AgwnSQRpAXCQfywN3sxqtREp0n3MokrIqrzXaYjVWaTirH4qa6BggVp0NkyWEwC0ZCXpqvXk1Cqgwu9YeY%2B%2Fg1OPi6%2Bp60V9OlivqoIc7wGR5n5JLKCeAgNnzCKNUNgze9Zkp9DnG4IItAiQTACwR8KN2SiZG8n8F8%2BgAQAWqAA0qinitgLPNMAUTbdYn8LM4Tx2yiD8gOXEsJLRPrHF%2FHTz5jmnJ9HD%2FZXbx2GexoSwuzXAyw9S72wjok8huK61XNHMM3grN2Sz9TQ%3D%3D--SgWxjjA9PN20b40j--NHkLbIErm5q8MlWHuUqsbw%3D%3D
.bing.com/ Name: MUID
Value: 0D2D9B071E696F9527EC8A3D1F026E9F
.getyourrefund.org/ Name: _uetsid
Value: 0fa46270809311ec88f61f3d10f4066b
.getyourrefund.org/ Name: _uetvid
Value: 0fa45cd0809311eca9545f85e5002e12
.getyourrefund.org/ Name: _ga
Value: GA1.2.1303372390.1643412965
.getyourrefund.org/ Name: _gid
Value: GA1.2.879535265.1643412965
.getyourrefund.org/ Name: _gat_gtag_UA_156157414_1
Value: 1
.getyourrefund.org/ Name: _fbp
Value: fb.1.1643412965458.786538108
.getyourrefund.org/ Name: intercom-id-p1hu33n8
Value: cc9d4ccb-591c-4ddf-a1d0-6b670bc6533c
.getyourrefund.org/ Name: intercom-session-p1hu33n8
Value:

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy
Strict-Transport-Security max-age=63072000; includeSubDomains max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api-iam.intercom.io
bat.bing.com
connect.facebook.net
js.intercomcdn.com
stats.g.doubleclick.net
widget.intercom.io
www.facebook.com
www.getyourrefund.org
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
18.66.248.99
2620:1ec:c11::200
2a00:1450:4001:800::2004
2a00:1450:4001:80f::2003
2a00:1450:4001:810::200e
2a00:1450:4001:82f::2008
2a00:1450:400c:c0d::9d
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
52.21.182.156
75.2.88.188
99.86.3.46
0d8f0dab13d35a5e89cd7fc592e14092bc8b1f040ad511a7f36b239bdf133c7f
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1f977256e081805ccbb0b2e22302fb0a6ac94e240b9ce5db22a26d4e788ff5e0
1fb1b628bc56c8369ba6864e3f8d2c0777178f1131e8d27b9f3c5f097e9f5e56
241487c3cd3a923a353564d582834c6ac342bc4dd17ed33bf409a011ca88ab56
252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e
303f5019f96110dce78eb26a69e3c412587c9377bd92caf2d5dcfb8d6d629d65
44c74075deaaa49c355e721496612f029c822caf230469976ff542ebbf558fcd
4846f4179c5df0495cc9eaa1f87e2fdce2abedf415a72a6bd64ffdb32f4800b5
4950352800361d7a4d5caab45c0bd250306c53403a83f3b5013d7296afdeaa44
53cb408ec4b5474a3998dd5a46a89f055e933aeec67d6cf0e09771287d5bf923
62a49d74f9ad5c1ea05992ec53cc91906c8ed56a98b987717cb4fdde0ac23e28
78b2ad101e68defc52ccb30195720707dd78e97e2752d8bc0974180bc9b39e53
79029d40d42d6471132325300df4c8662c7ee38698eec483637354775b7f8c41
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8b916d63899fc4ad9aaca1a7c93b6b4f3a99f4058b4964ba12141bebe8463243
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
ac015e070f9b3e66c2dbed596e9b39a1d7fe6e0ac48b2b94465bbcce5429a8bc
b1ac0f14f70b2ff0172f3835186198050cf75d98eb3d1275ccf9533141ea4697
b6c0560046df1ecabbcbeb82522ca9887fb3467e334a52536d460a3b08dc2ec2
b75c433e51e4711bd83ba4a7e97d4ca5d7a0aec267a19f208777133dd1225988
c0d4a74737f53e9900db9dc5cc8c1f4847fb4d1be32b74798367c86bf27fd9c2
c55508ea7ce1ad08364772fbfadb835d2b1d1b9238d345c45eee1943ada4ff6f
c80da63dda13779706bfc48be453b38e27e9cc07b9dc90731dbff61ccfbefafb
c95bd9fde48b4ad603c53e4a958018e98e112e6dd242a29169d7543cfeaaaa7f
cef557bc93aa1490a8b0cca8ec0ee152fcd7f55d736e4435d962ae9a4c7fe1d2
d27d7295e29ba6c9823d802e408a6826d99271db779dd967025c5659ad72332c
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fb8badce346e70c769a2a7d28514c5793db08e4f6a18255b1d3754f6bfe2363f