auth.onepeloton.com Open in urlscan Pro
2606:4700::6811:4ff9 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://account.test-vercel.onepeloton.de/
Effective URL:
https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTla...
Submission: On January 08 via automatic, source certstream-suspicious (January 8th 2025, 9:13:12 pm UTC) — Scanned from DE

Summary HTTP 206 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 41 IPs in 5 countries across 25 domains to perform 206 HTTP transactions. The main IP is 2606:4700::6811:4ff9, located in United States and belongs to CLOUDFLARENET, US. The main domain is auth.onepeloton.com. The Cisco Umbrella rank of the primary domain is 125533.
TLS certificate: Issued by WE1 on January 8th 2025. Valid for: 3 months.

This is the only time auth.onepeloton.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
12	76.76.21.61 76.76.21.61	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
2	2a04:4e42:200... 2a04:4e42:200::347	54113 (FASTLY) (FASTLY)
2	13.33.187.45 13.33.187.45	16509 (AMAZON-02) (AMAZON-02)
8	18.66.147.95 18.66.147.95	16509 (AMAZON-02) (AMAZON-02)
8	157.240.0.6 157.240.0.6	32934 (FACEBOOK) (FACEBOOK)
3	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	13.33.187.68 13.33.187.68	16509 (AMAZON-02) (AMAZON-02)
4	18.66.147.53 18.66.147.53	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700::68... 2606:4700::6810:8f9b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2a02:26f0:278... 2a02:26f0:2780:5e::210:a86d	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
34	99.86.8.175 99.86.8.175	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6812:4139	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	142.250.184.227 142.250.184.227	15169 (GOOGLE) (GOOGLE)
6	2600:1f18:24e... 2600:1f18:24e6:b902:3219:69a3:9bec:162d	14618 (AMAZON-AES) (AMAZON-AES)
2	2600:1f18:24e... 2600:1f18:24e6:b900:1b9f:2fe7:7ce5:577a	14618 (AMAZON-AES) (AMAZON-AES)
1	52.12.47.65 52.12.47.65	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
2	18.245.86.101 18.245.86.101	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:803::200e	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:278... 2a02:26f0:2780:5e::210:a87d	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2a00:1450:400... 2a00:1450:400c:c02::9d	15169 (GOOGLE) (GOOGLE)
1	2600:9000:214... 2600:9000:214f:9000:f:8ce2:fb80:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:440... 2606:4700:4400::6812:2a5c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	157.240.0.35 157.240.0.35	32934 (FACEBOOK) (FACEBOOK)
1	2600:9000:264... 2600:9000:2646:f400:1b:1628:8a00:21	16509 (AMAZON-02) (AMAZON-02)
6	2a05:d014:58f... 2a05:d014:58f:6202::1f4	16509 (AMAZON-02) (AMAZON-02)
13	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2606:4700::68... 2606:4700::6811:4ff9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.74.206 142.250.74.206	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
20	2a05:d014:58f... 2a05:d014:58f:6201::1f4	16509 (AMAZON-02) (AMAZON-02)
2	2a02:26f0:278... 2a02:26f0:2780:66::217:e3d5	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
4	2600:1f18:24e... 2600:1f18:24e6:b901:5b01:a51e:fe46:50f5	14618 (AMAZON-AES) (AMAZON-AES)
1	35.163.144.222 35.163.144.222	16509 (AMAZON-02) (AMAZON-02)
1	18.245.86.69 18.245.86.69	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:7809	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.107.199.61 34.107.199.61	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	35.190.10.96 35.190.10.96	15169 (GOOGLE) (GOOGLE)
4	104.18.39.68 104.18.39.68	13335 (CLOUDFLAR...) (CLOUDFLARENET)
206	41

12 76.76.21.61 (Walnut, United States)

ASN16509 (AMAZON-02, US)

account.test-vercel.onepeloton.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:200::347 (United States)

ASN54113 (FASTLY, US)

polyfill-fastly.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.33.187.45 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-45.fra60.r.cloudfront.net

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 18.66.147.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-95.fra60.r.cloudfront.net

static.ada.support	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 157.240.0.6 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.33.187.68 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-68.fra60.r.cloudfront.net

rollout.ada.support	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.66.147.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-53.fra60.r.cloudfront.net

peloton-support.ada.support	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:8f9b (United States)

ASN13335 (CLOUDFLARENET, US)

api.onepeloton.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a02:26f0:2780:5e::210:a86d (Netherlands)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 99.86.8.175 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-8-175.fra6.r.cloudfront.net

cdn.segment.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:4139 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 142.250.184.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:1f18:24e6:b902:3219:69a3:9bec:162d (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

rum.browser-intake-datadoghq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1f18:24e6:b900:1b9f:2fe7:7ce5:577a (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

session-replay.browser-intake-datadoghq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.12.47.65 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-12-47-65.us-west-2.compute.amazonaws.com

api.segment.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.245.86.101 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-101.fra60.r.cloudfront.net

cdn.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:803::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:2780:5e::210:a87d (Netherlands)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c02::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:9000:f:8ce2:fb80:93a1 (United States)

ASN16509 (AMAZON-02, US)

www.dwin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::6812:2a5c (United States)

ASN13335 (CLOUDFLARENET, US)

graph.prod.k8s.onepeloton.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.240.0.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2646:f400:1b:1628:8a00:21 (United States)

ASN16509 (AMAZON-02, US)

d1no8tpthtviug.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a05:d014:58f:6202::1f4 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

account.onepeloton.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:4ff9 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

auth.onepeloton.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.206 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

privacyportal.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a05:d014:58f:6201::1f4 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

auth-deviceflow.onepeloton.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:2780:66::217:e3d5 (Netherlands)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

client.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:1f18:24e6:b901:5b01:a51e:fe46:50f5 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

rum.browser-intake-datadoghq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.163.144.222 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-163-144-222.us-west-2.compute.amazonaws.com

api.segment.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.86.69 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-69.fra60.r.cloudfront.net

cdn.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7809 (United States)

ASN13335 (CLOUDFLARENET, US)

js.appboycdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.199.61 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 61.199.107.34.bc.googleusercontent.com

stk.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.190.10.96 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 96.10.190.35.bc.googleusercontent.com

collector-pxirnc16b3.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.18.39.68 (None, )

ASN13335 (CLOUDFLARENET, US)

sdk.iad-01.braze.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
34	segment.com cdn.segment.com — Cisco Umbrella Rank: 1935	158 KB
26	onepeloton.de account.test-vercel.onepeloton.de api.onepeloton.de graph.prod.k8s.onepeloton.de account.onepeloton.de	2 MB
22	onepeloton.com 1 redirects auth.onepeloton.com — Cisco Umbrella Rank: 125533 auth-deviceflow.onepeloton.com — Cisco Umbrella Rank: 572128	665 KB
15	ada.support static.ada.support — Cisco Umbrella Rank: 8896 rollout.ada.support — Cisco Umbrella Rank: 8288 peloton-support.ada.support — Cisco Umbrella Rank: 371538	68 KB
13	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 329	160 KB
13	gstatic.com fonts.gstatic.com	186 KB
12	browser-intake-datadoghq.com rum.browser-intake-datadoghq.com — Cisco Umbrella Rank: 3036 session-replay.browser-intake-datadoghq.com — Cisco Umbrella Rank: 10448	2 KB
12	typekit.net use.typekit.net — Cisco Umbrella Rank: 460 p.typekit.net — Cisco Umbrella Rank: 571	118 KB
8	facebook.net connect.facebook.net — Cisco Umbrella Rank: 192	324 KB
6	px-cloud.net client.px-cloud.net — Cisco Umbrella Rank: 4595 stk.px-cloud.net — Cisco Umbrella Rank: 2121 collector-pxirnc16b3.px-cloud.net — Cisco Umbrella Rank: 711207	72 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	22 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	3 KB
4	braze.com sdk.iad-01.braze.com — Cisco Umbrella Rank: 1754	4 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	252 KB
4	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 514 privacyportal.onetrust.com — Cisco Umbrella Rank: 2479	888 B
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	318 B
3	amplitude.com cdn.amplitude.com — Cisco Umbrella Rank: 3096	36 KB
2	segment.io api.segment.io — Cisco Umbrella Rank: 1510	362 B
2	optimizely.com cdn.optimizely.com — Cisco Umbrella Rank: 1024	11 KB
2	stripe.com js.stripe.com — Cisco Umbrella Rank: 1073	167 KB
2	polyfill-fastly.io polyfill-fastly.io — Cisco Umbrella Rank: 10421	351 B
1	appboycdn.com js.appboycdn.com — Cisco Umbrella Rank: 3707	47 KB
1	cloudfront.net d1no8tpthtviug.cloudfront.net	492 B
1	dwin1.com www.dwin1.com — Cisco Umbrella Rank: 5114	13 KB
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135	658 B
206	25

	Domain	Requested by
34	cdn.segment.com	account.test-vercel.onepeloton.de cdn.segment.com account.onepeloton.de auth.onepeloton.com auth-deviceflow.onepeloton.com
20	auth-deviceflow.onepeloton.com	auth.onepeloton.com
13	cdn.cookielaw.org	account.onepeloton.de
13	fonts.gstatic.com	fonts.googleapis.com auth-deviceflow.onepeloton.com
12	account.test-vercel.onepeloton.de	account.test-vercel.onepeloton.de
10	rum.browser-intake-datadoghq.com	account.test-vercel.onepeloton.de account.onepeloton.de auth-deviceflow.onepeloton.com
10	use.typekit.net	account.test-vercel.onepeloton.de account.onepeloton.de
8	connect.facebook.net	account.test-vercel.onepeloton.de connect.facebook.net cdn.segment.com account.onepeloton.de
8	static.ada.support	account.test-vercel.onepeloton.de static.ada.support account.onepeloton.de
6	account.onepeloton.de	account.test-vercel.onepeloton.de account.onepeloton.de
6	api.onepeloton.de	account.test-vercel.onepeloton.de account.onepeloton.de
5	www.google-analytics.com	cdn.segment.com account.test-vercel.onepeloton.de account.onepeloton.de
5	fonts.googleapis.com	account.test-vercel.onepeloton.de account.onepeloton.de auth-deviceflow.onepeloton.com
4	sdk.iad-01.braze.com	auth-deviceflow.onepeloton.com
4	www.googletagmanager.com	cdn.segment.com www.googletagmanager.com account.onepeloton.de
4	peloton-support.ada.support	static.ada.support account.onepeloton.de
3	collector-pxirnc16b3.px-cloud.net	auth-deviceflow.onepeloton.com
3	www.facebook.com	account.test-vercel.onepeloton.de
3	cdn.amplitude.com	cdn.segment.com account.onepeloton.de
3	rollout.ada.support	static.ada.support account.test-vercel.onepeloton.de account.onepeloton.de
3	geolocation.onetrust.com	account.test-vercel.onepeloton.de account.onepeloton.de
2	client.px-cloud.net	auth.onepeloton.com auth-deviceflow.onepeloton.com
2	auth.onepeloton.com	1 redirects account.onepeloton.de
2	graph.prod.k8s.onepeloton.de	account.test-vercel.onepeloton.de
2	p.typekit.net	account.test-vercel.onepeloton.de account.onepeloton.de
2	api.segment.io	account.test-vercel.onepeloton.de auth-deviceflow.onepeloton.com
2	session-replay.browser-intake-datadoghq.com	account.test-vercel.onepeloton.de account.onepeloton.de
2	cdn.optimizely.com	account.test-vercel.onepeloton.de account.onepeloton.de
2	js.stripe.com	account.test-vercel.onepeloton.de account.onepeloton.de
2	polyfill-fastly.io	account.test-vercel.onepeloton.de account.onepeloton.de
1	stk.px-cloud.net	auth-deviceflow.onepeloton.com
1	js.appboycdn.com	cdn.segment.com
1	privacyportal.onetrust.com	cdn.cookielaw.org
1	d1no8tpthtviug.cloudfront.net	account.test-vercel.onepeloton.de
1	www.dwin1.com	www.googletagmanager.com
1	stats.g.doubleclick.net	account.test-vercel.onepeloton.de
206	36

This site contains links to these domains. Also see Links.

Domain
members.onepeloton.com
www.onepeloton.com
www.facebook.com
www.instagram.com
twitter.com
www.youtube.com
boutique.onepeloton.com
studio.onepeloton.com
blog.onepeloton.com
support.onepeloton.com

Subject Issuer	Validity	Valid
account.test-vercel.onepeloton.de R10	`2025-01-08` - `2025-04-08`	3 months	crt.sh
upload.video.google.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
polyfill-fastly.net Certainly Intermediate R1	`2025-01-08` - `2025-02-07`	a month	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2024-12-16` - `2025-04-03`	4 months	crt.sh
*.ada.support Amazon RSA 2048 M02	`2024-06-18` - `2025-07-18`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-10-18` - `2025-01-16`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-12-09` - `2025-03-09`	3 months	crt.sh
onepeloton.de WE1	`2024-11-27` - `2025-02-25`	3 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-12-10` - `2026-01-10`	a year	crt.sh
*.segment.com Amazon RSA 2048 M02	`2024-10-15` - `2025-11-14`	a year	crt.sh
cdn.optimizely.com WE1	`2024-12-19` - `2025-03-19`	3 months	crt.sh
*.gstatic.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
*.browser-intake-datadoghq.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-05-14` - `2025-05-17`	a year	crt.sh
*.segment.io Amazon RSA 2048 M03	`2024-11-13` - `2025-12-13`	a year	crt.sh
*.google-analytics.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
cdn.amplitude.com Amazon RSA 2048 M03	`2024-11-14` - `2025-12-13`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.dwin1.com Amazon RSA 2048 M03	`2024-10-02` - `2025-10-30`	a year	crt.sh
prod.k8s.onepeloton.de WE1	`2024-11-24` - `2025-02-22`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
account.onepeloton.com Sectigo RSA Organization Validation Secure Server CA	`2024-10-02` - `2025-11-01`	a year	crt.sh
cookielaw.org WE1	`2024-12-09` - `2025-03-09`	3 months	crt.sh
auth.onepeloton.com WE1	`2025-01-08` - `2025-04-08`	3 months	crt.sh
onetrust.com WE1	`2024-12-11` - `2025-03-11`	3 months	crt.sh
auth-deviceflow.onepeloton.com E5	`2025-01-04` - `2025-04-04`	3 months	crt.sh
client.botchk.net R10	`2025-01-07` - `2025-04-07`	3 months	crt.sh
appboycdn.com WE1	`2024-12-04` - `2025-03-04`	3 months	crt.sh
*.px-cloud.net Sectigo RSA Domain Validation Secure Server CA	`2024-08-16` - `2025-09-15`	a year	crt.sh
sdk.iad-01.braze.com WE1	`2024-12-12` - `2025-03-12`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTlaUkFER0paZmFhOUp0ajdreHl0T0-jY2lk2SB6ekxyNzhjcWJhN0RkdEJnUkFYRlFybFI3eFAwRkFiNA&client=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&protocol=oauth2&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Faccount.onepeloton.de%2Fcallback&response_type=code&response_mode=query&nonce=ZzkzLnB5TTdiR0l5V2tMM2pFZUFGfjVmdGJKUmRZSUVjS0xLZWtHZXZDSA%3D%3D&code_challenge=gikV0o6Y07Da9MWTCYbNhbqZvZNWRIARbJGbsCtXbtA&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjIuMS4zIn0%3D&scope=email%20offline_access%20openid%20peloton-api.members%3Adefault%20profile
Frame ID: 41F34477B95007B913585793E26F5C85
Requests: 193 HTTP requests in this frame

Frame: https://peloton-support.ada.support/embed/x-storage/7423118/index.html
Frame ID: A0DD419979C5A39C993D4ED38CD1F1AD
Requests: 1 HTTP requests in this frame

Frame: https://peloton-support.ada.support/embed/button/7423118/index.html
Frame ID: 8D763B1CF19F78776D7337DA45BA3579
Requests: 1 HTTP requests in this frame

Frame: https://peloton-support.ada.support/embed/x-storage/7423118/index.html
Frame ID: E07BCCCE446BCF81AC087CCD07994025
Requests: 1 HTTP requests in this frame

Frame: https://peloton-support.ada.support/embed/button/7423118/index.html
Frame ID: DA2285EE506268AC2344545508AA6793
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in | Peloton

Page URL History Show full URLs

https://account.test-vercel.onepeloton.de/ Page URL
https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5 Page URL
https://auth.onepeloton.com/authorize?client_id=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&scope=openid+profile+em... HTTP 302
https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3Rp... Page URL

Detected technologies

Prototype (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

AWIN (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

dwin1\.com

Amplitude (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.amplitude\.com

Braze (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

js\.appboycdn\.com/web-sdk/([\d.]+)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Optimizely (Analytics) Expand

Overall confidence: 100%
Detected patterns

optimizely\.com.*\.js

PerimeterX (Security) Expand

Overall confidence: 100%
Detected patterns

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

Segment (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.segment\.com/analytics\.js

Page Statistics

206
Requests

97 %
HTTPS

57 %
IPv6

25
Domains

36
Subdomains

41
IPs

5
Countries

4080 kB
Transfer

17945 kB
Size

29
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://members.onepeloton.com/forgot-password
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://www.onepeloton.com/app-membership
Title: Sign up now.

Search URL Search Domain Scan URL

URL: https://www.facebook.com/onepeloton

Search URL Search Domain Scan URL

URL: https://www.instagram.com/onepeloton

Search URL Search Domain Scan URL

URL: https://twitter.com/onepeloton

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/onepeloton

Search URL Search Domain Scan URL

URL: https://www.onepeloton.com/
Title: Peloton

Search URL Search Domain Scan URL

URL: https://boutique.onepeloton.com/
Title: Apparel

Search URL Search Domain Scan URL

URL: https://studio.onepeloton.com/
Title: Studio

Search URL Search Domain Scan URL

URL: https://blog.onepeloton.com/
Title: Blog

Search URL Search Domain Scan URL

URL: https://support.onepeloton.com/
Title: Support

Search URL Search Domain Scan URL

URL: https://www.onepeloton.com/terms-of-service
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://www.onepeloton.com/membership-terms
Title: Membership Terms

Search URL Search Domain Scan URL

URL: https://www.onepeloton.com/privacy-policy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.onepeloton.com/ip-policy
Title: IP Policy

Search URL Search Domain Scan URL

URL: https://www.onepeloton.com/accessibility
Title: Accessibility

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://account.test-vercel.onepeloton.de/ Page URL
https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5 Page URL
https://auth.onepeloton.com/authorize?client_id=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&scope=openid+profile+email+offline_access&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Faccount.onepeloton.de%2Fcallback&response_type=code&response_mode=query&state=eHE3WjlKdDNwUWRhVUVlXzdlYlVPSkpOdTVhNW9%2BQzVjQ2lWT2hyRVVrZQ%3D%3D&nonce=ZzkzLnB5TTdiR0l5V2tMM2pFZUFGfjVmdGJKUmRZSUVjS0xLZWtHZXZDSA%3D%3D&code_challenge=gikV0o6Y07Da9MWTCYbNhbqZvZNWRIARbJGbsCtXbtA&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjIuMS4zIn0%3D HTTP 302
https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTlaUkFER0paZmFhOUp0ajdreHl0T0-jY2lk2SB6ekxyNzhjcWJhN0RkdEJnUkFYRlFybFI3eFAwRkFiNA&client=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&protocol=oauth2&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Faccount.onepeloton.de%2Fcallback&response_type=code&response_mode=query&nonce=ZzkzLnB5TTdiR0l5V2tMM2pFZUFGfjVmdGJKUmRZSUVjS0xLZWtHZXZDSA%3D%3D&code_challenge=gikV0o6Y07Da9MWTCYbNhbqZvZNWRIARbJGbsCtXbtA&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjIuMS4zIn0%3D&scope=email%20offline_access%20openid%20peloton-api.members%3Adefault%20profile Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

206 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
account.test-vercel.onepeloton.de/ 8 KB
3 KB 47ms
21ms Document
text/html 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

b03d8e35950c6ed45101c701521c86504a339b562e6efcba408a4db09098c9f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
age: 25
cache-control: public, max-age=0, must-revalidate
content-disposition: inline
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 08 Jan 2025 21:13:03 GMT
etag: W/"77816f39ccf3d6f3814dc5d0101ebab5"
last-modified: Wed, 08 Jan 2025 21:12:38 GMT
server: Vercel
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-frame-options: DENY
x-vercel-cache: HIT
x-vercel-id: fra1::5qc67-1736370783762-70dd9ba7f5a2
x-xss-protection: 1; mode=block

GET
H2 200 newrelic.js Show response
account.test-vercel.onepeloton.de/account-scripts/ 0
176 B 137ms
136ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/account-scripts/newrelic.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:03 GMT
content-disposition: inline; filename="newrelic.js"
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 21:13:03 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::pf6lj-1736370783787-2584609f55ff

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
1 KB 57ms
23ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;900&display=swap

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0c9787eaa38917257431d71f65fe3c5fe573fbec6e980028f2e845d9d3b75cff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 08 Jan 2025 21:13:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:03 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 08 Jan 2025 21:13:03 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 polyfill.min.js Show response
polyfill-fastly.io/v3/ 104 B
351 B 107ms
34ms Script
text/javascript 2a04:4e42:200::347
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://polyfill-fastly.io/v3/polyfill.min.js?version=3.108.0&features=es2015%2Ces2016%2Ces2017%2Ces2019%2CIntersectionObserver%2CPromise.prototype.finally%2CResizeObserver%2Csmoothscroll
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::347 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2860c827fc3ab3562bd9394b8cfabbf35d37982e17903ea3789e80371a5778c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://account.test-vercel.onepeloton.de/

Response headers

cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800, immutable
content-encoding: br
access-control-allow-methods: GET,HEAD,OPTIONS
accept-ranges: none
access-control-allow-origin: *
date: Wed, 08 Jan 2025 21:13:03 GMT
content-type: text/javascript; charset=UTF-8
vary: User-Agent, Accept-Encoding
x-served-by: cache-mad2200145-MAD

GET
H2 200 / Show response
js.stripe.com/v3/ 696 KB
167 KB 49ms
11ms Script
text/javascript 13.33.187.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.187.45 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-187-45.fra60.r.cloudfront.net

Software

Cloudfront /

Resource Hash

221cd076e521ed0d936f0717d98f3cf406ed84320df8451971e055aa0cece425

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: br
etag: W/"0bf2e1ab69628d0ac5e41a167ee264fb"
age: 49
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: TzRXmy80bVEcXlR3RrlnOLj1z6PmSDtPKeJVqkDw6vd2ItEA-UVf4A==
date: Wed, 08 Jan 2025 21:12:15 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 19:19:43 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31556926; includeSubDomains; preload
cache-control: max-age=60
timing-allow-origin: *
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P9
server: Cloudfront

GET
H2 200 embed2.js Show response
static.ada.support/ 6 KB
3 KB 35ms
9ms Script
text/javascript 18.66.147.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.ada.support/embed2.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-95.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

43da18f909be2ce7b2a6908460d55c1e85440107401bb04706c2bf725ff55fe5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
access-control-expose-headers: ETag
content-encoding: gzip
x-amz-version-id: JTEe2QogZxw2trnqb5fj0lJ5svkPSon1
etag: W/"d556a4fd6f86b7c64ce2e54347438fb8"
age: 68329
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: bBreqXJNfg6_SWqF6mwDlwKPIoA7HCHHiKf61HsKW9tXaTyonM5e_A==
date: Wed, 08 Jan 2025 02:14:15 GMT
content-type: text/javascript
vary: accept-encoding
last-modified: Tue, 17 Sep 2024 18:14:41 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: max-age: 300
via: 1.1 b1c64361268fcbad3c03abbe37eb5cfa.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 58817.46a915eb.js Show response
account.test-vercel.onepeloton.de/account-assets/static/js/ 2 MB
577 KB 387ms
387ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

1dadfb9c08c7b4ebdcc01847c87fe2ceedd03b38380441addfd557f97106805a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: br
etag: W/"f935c4acae721f736a61e9bef63d1a68"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:04 GMT
content-disposition: inline; filename="58817.46a915eb.js"
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 21:13:04 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::2txhj-1736370783925-cb93f5f185d2

GET
H2 200 main.41d2a209.js Show response
account.test-vercel.onepeloton.de/account-assets/static/js/ 1010 KB
197 KB 207ms
206ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/account-assets/static/js/main.41d2a209.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

b1a78f491eee5460af9e11159ab7875ad99ecb8a4172cd12811a02e92f468526

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: br
etag: W/"3cfe8bfed968297942b1e99f1d61553e"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:04 GMT
content-disposition: inline; filename="main.41d2a209.js"
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 21:13:04 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::22r2l-1736370783943-e1301ffe5ed9

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 26ms
8ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

9297194dd8d8e70248648b111b520ee15eff904fac85685ff19908a65b852183

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-md5: zMp04RwmK4OMLJ3QzecAPg==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "cf53a0003f13233bf4111b3b63dd5725"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 08 Jan 2025 21:23:42 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 08 Jan 2025 21:13:03 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: c4e2ea9b3b195fa28fa16898bd765ced
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4502, tp=9, tpl=0, uplat=0, ullat=-1
x-fb-debug: dQMWeEirrb1wp12vRFuQFGWRuKvfUQhS6vYOTfZxyK64iK2+1QMVnqIqy0i7A0oqoY4s4yMIcZ5Y5BWMYsK/VQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 1686
origin-agent-cluster: ?1

GET
H2 200 embed-manifest.json Show response
static.ada.support/ 136 B
696 B 24ms
9ms Fetch
application/json 18.66.147.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.ada.support/embed-manifest.json

Requested by

Host: static.ada.support
URL: https://static.ada.support/embed2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-95.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

74796b8d1bac95a048704583e148718240e741e3b6bd242a6e17169679b12355

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
access-control-expose-headers: ETag
x-amz-version-id: NHmc3__GGDZaEKTYE4K174c1eL7Jxo63
etag: "beeee65ed006e7ac66e8c4f4660d573c"
age: 13629
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: ah6066Uzdy4d7c950h1Qje7dkejSoBur26hIvKAz4H80SD-zJOFGYA==
date: Wed, 08 Jan 2025 17:25:55 GMT
content-type: application/json
vary: accept-encoding
last-modified: Tue, 07 Jan 2025 17:25:51 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
via: 1.1 760a29e891ec10bba1274911260e1fc8.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 136
x-amz-cf-pop: FRA60-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 70 B
246 B 38ms
21ms Script
text/javascript 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cea2053be8e509589fe917b989317c05a16799e2d89ed1ea89b21870e3153631

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 8fef3077b854dbff-FRA
content-encoding: gzip
date: Wed, 08 Jan 2025 21:13:03 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 embed2.7423118.js Show response
static.ada.support/ 170 KB
53 KB 10ms
9ms Script
text/javascript 18.66.147.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.ada.support/embed2.7423118.js

Requested by

Host: static.ada.support
URL: https://static.ada.support/embed2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-95.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

b883b25122b10585806b8b7e90f4b01b15e0f0b6885ed9bce207272365caa87b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
access-control-expose-headers: ETag
content-encoding: gzip
x-amz-version-id: Bjo5pnx0bG8J3F9gkQplfIJvhGXZpkjX
etag: W/"55d490e3b1b6117efdf4777021150376"
age: 14796
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: wsn_WtSi0qSbrpuro38Fw3txdL2M3TkDDB7tvc0WH-07N-iurMGsNA==
date: Wed, 08 Jan 2025 17:06:28 GMT
content-type: text/javascript
vary: accept-encoding
last-modified: Tue, 07 Jan 2025 16:52:15 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: 172800
via: 1.1 b1c64361268fcbad3c03abbe37eb5cfa.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 254 KB
75 KB 11ms
10ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=ed505967c611414fac8f5ea34060ac26

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

54c15884f96515b03b64359982faae845b9b339f0b6aac568393748fa3169f65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-md5: Q1yla4VaCENgWkgmf+JC7w==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "b49c61a7b6e130e0afc43feedbc9ec22"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 08 Jan 2026 20:38:07 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 08 Jan 2025 21:13:03 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 4d16bee5be2274b304bfe39c6e008c81
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: UNKNOWN; q=-1, rtt=-1, rtx=0, c=20, mss=1232, tbw=1888, tp=5, tpl=0, uplat=2, ullat=-1
x-fb-debug: PP5dv/gAkCntEGwixc9t6oPwVlcv+aPyK2ZPDWKYRee0mIuEYOt2/yMwXFeZJ+uTOumciQ1bj4fvbZ9BSm94ig==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 76641
origin-agent-cluster: ?1

GET
H2 200 client.json Show response
rollout.ada.support/peloton-support/ 8 KB
8 KB 361ms
331ms XHR
application/json 13.33.187.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rollout.ada.support/peloton-support/client.json?ada_request_origin=embed
Requested by: Host: static.ada.support
URL: https://static.ada.support/embed2.7423118.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-68.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: abbbe99a1650b4e0a8f26e05e90dcab533af5e033033132dfc0562b8a3d21b2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 300
access-control-expose-headers: ETag
etag: "82e7996fe8c0057082e9c6edcceadc06"
access-control-allow-methods: GET, HEAD
x-cache: Miss from cloudfront
x-amz-cf-id: XeTTCF6BoiV1uSbz7-ysm9nsoPCUltaQ4ADxkg1eSk8gv0BJWLVpsw==
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: application/json
vary: Origin
last-modified: Sun, 17 Nov 2024 09:05:52 GMT
cache-control: no-cache
via: 1.1 46b6cb3d5daab7defe28d3658c3a54fe.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7699
x-amz-cf-pop: FRA60-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 chat-manifest.json Show response
static.ada.support/ 136 B
676 B 11ms
11ms Fetch
application/json 18.66.147.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.ada.support/chat-manifest.json

Requested by

Host: static.ada.support
URL: https://static.ada.support/embed2.7423118.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-95.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

18fdc64789026ce5298cdbba07a0ee33a7aea13738c1f960fcb6a36233834e4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
access-control-expose-headers: ETag
etag: "3d46ce43c0ce6a10f5de63c977e89db1"
x-amz-version-id: gEilsMYCWqaorgN9KN2S.rAtRsO.6G_m
age: 7991
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: Ozz0oFJWXVU_RmDIdU7m0uo_BCAor6QhVg-10s8NvqjOuxBwkTvidA==
date: Wed, 08 Jan 2025 18:59:54 GMT
content-type: application/json
last-modified: Wed, 08 Jan 2025 18:59:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
via: 1.1 760a29e891ec10bba1274911260e1fc8.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 136
x-amz-cf-pop: FRA60-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 index.html
peloton-support.ada.support/embed/x-storage/7423118/ Frame A0DD 0
0 39ms
8ms Document
text/html 18.66.147.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://peloton-support.ada.support/embed/x-storage/7423118/index.html

Requested by

Host: static.ada.support
URL: https://static.ada.support/embed2.7423118.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-53.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Referer: https://account.test-vercel.onepeloton.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 14796
cache-control: 172800
content-length: 237
content-type: text/html
date: Wed, 08 Jan 2025 17:06:29 GMT
etag: "9de74f7ad2e5dab10ee5461c55c0cbe4"
last-modified: Tue, 07 Jan 2025 16:52:15 GMT
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubdomains; preload
vary: accept-encoding
via: 1.1 307395f1eb3989f15e6f525475291c86.cloudfront.net (CloudFront)
x-amz-cf-id: grhEXYY3tzAIetVUxc4ph-0gfTpcrdZO0ACTFs2c8cKNyzsVztSsNw==
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: q9W3HtSx7FAT_qc5zzTKBNBiW3F.cX_o
x-cache: Hit from cloudfront

GET
H2 200 index.html
peloton-support.ada.support/embed/button/7423118/ Frame 8D76 0
0 32ms
10ms Document
text/html 18.66.147.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://peloton-support.ada.support/embed/button/7423118/index.html

Requested by

Host: static.ada.support
URL: https://static.ada.support/embed2.7423118.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-53.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Referer: https://account.test-vercel.onepeloton.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 14796
cache-control: 172800
content-encoding: gzip
content-type: text/html
date: Wed, 08 Jan 2025 17:06:29 GMT
etag: W/"3edde4849d0d77c3017f95618cda0595"
last-modified: Tue, 07 Jan 2025 16:52:15 GMT
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubdomains; preload
vary: accept-encoding
via: 1.1 307395f1eb3989f15e6f525475291c86.cloudfront.net (CloudFront)
x-amz-cf-id: oYI89GIVZw5OCVIRMB5x02Vv08rddO2DZD-WvduWp9gsb7DKWmVXaw==
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: a36qinHMTeljZx7Z.Jj4T1NrHcn9JBmO
x-cache: Hit from cloudfront

GET 15e6fcf7-e95d-403e-81c0-eb9776f2ddba
https://account.test-vercel.onepeloton.de/ Frame 0
0

OPTIONS
H2 204 plans
api.onepeloton.de/ecomm/store/de_webstore/digital_subscriptions/ Frame 0
0 350ms
314ms Preflight
text/plain 2606:4700::6810:8f9b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.onepeloton.de/ecomm/store/de_webstore/digital_subscriptions/plans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8f9b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: peloton-platform,x-requested-with
Access-Control-Request-Method: GET
Origin: https://account.test-vercel.onepeloton.de
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,Ecomm-Freemium,Exposed-Credential-Check,If-Modified-Since,Keep-Alive,Locale-Country,Locale-Language,Origin,Peloton-API-Deadline,Peloton-Client-Date,Peloton-Client-Details,Peloton-Create-User-Callback,Peloton-Ecomm-Client,Peloton-Ecomm-Client-Version,Peloton-Instructor-Api-Key,Peloton-Platform,Peloton-Studio-API-Key,User-Agent,X-CSRF-Token,X-CustomHeader,X-Requested-With,X-Secrets-Authorization
access-control-allow-methods: GET, OPTIONS, POST, PUT, DELETE
access-control-max-age: 1728000
cf-cache-status: DYNAMIC
cf-ray: 8fef307bba153831-FRA
content-length: 0
content-type: text/plain charset=UTF-8
date: Wed, 08 Jan 2025 21:13:04 GMT
server: cloudflare
strict-transport-security: max-age=15724800; includeSubDomains
vary: Origin

GET
H2 200 css
fonts.googleapis.com/ 11 KB
966 B 22ms
21ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6bb88125bf9791b4f1b29ace16454069152663f037096117fe60858053f9176a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 08 Jan 2025 21:13:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 08 Jan 2025 20:53:49 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 sxy3vgl.js Show response
use.typekit.net/ 17 KB
7 KB 203ms
144ms Script
text/javascript 2a02:26f0:2780:5e::210:a86d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/sxy3vgl.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:2780:5e::210:a86d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

nginx /

Resource Hash

73eb48e7611ce70741b07f3785e266ad61a2be5329c0becc5956e7da492df16c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
cache-control: public, max-age=600, stale-while-revalidate=604800
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 6742
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: text/javascript;charset=utf-8
vary: Accept-Encoding
server: nginx

GET
H2 200 analytics.min.js Show response
cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/ 106 KB
29 KB 67ms
10ms Script
text/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4b5fb218f1afb6f5b1d9590d456209d5dc4228845e7d02b8cc597212f0994609

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: TLebeQ2Ly.0dE6x20QD7s.8hFgP0D3.3
etag: W/"9c38a53299c5121a3d57d266621c3c49"
age: 26
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 2umWqFLJ8vjRpHefy5DcuyoCQv1Hf37qcaLTd4SpOaWtaHpmPWkk4A==
date: Wed, 08 Jan 2025 21:12:39 GMT
content-type: text/javascript; charset=utf-8
vary: accept-encoding
last-modified: Tue, 19 Nov 2024 20:34:09 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=120
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 Xg7J4fRn29xnpbNoufWCo.json Show response
cdn.optimizely.com/datafiles/ 74 KB
11 KB 136ms
117ms XHR
application/json 2606:4700::6812:4139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.optimizely.com/datafiles/Xg7J4fRn29xnpbNoufWCo.json
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:4139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab40b0627690c3a1de674229faa0f36bb8f1f9577428e42d1c5c9cf0ed22015e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 604800
content-encoding: gzip
cf-cache-status: HIT
etag: "63667139d53303eec85abce6ac7066ff"
x-amz-version-id: WdRL7SX5Kw9eNVt8cDJV3qEcqNDU9ezC
access-control-allow-methods: GET, HEAD, OPTIONS
date: Wed, 08 Jan 2025 21:13:04 GMT
x-amz-meta-revision: 1684
content-type: application/json; charset=utf-8
last-modified: Wed, 08 Jan 2025 16:41:08 GMT
vary: Accept-Encoding
x-amz-id-2: xITPvjr5wkDZLfa00QlnvCgwNEYKA+2UlP2k4zEsUo2P1F/f1SdTjqOXi6P3tLw7YB1h/LWNmCI=
access-control-allow-headers: *
x-amz-replication-status: PENDING
cache-control: max-age=120
x-amz-meta-pci_enabled: False
access-control-allow-credentials: false
x-amz-request-id: H19QC5QRE54P84NX
cf-ray: 8fef307b8f1ed3c0-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10469
server: cloudflare
x-amz-server-side-encryption: AES256

GET plans
api.onepeloton.de/ecomm/store/de_webstore/digital_subscriptions/ 0
0

GET
H3 200 UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
fonts.gstatic.com/s/inter/v18/ 47 KB
47 KB 57ms
35ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 167723
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Tue, 06 Jan 2026 22:37:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 06 Jan 2025 22:37:41 GMT
last-modified: Mon, 29 Jul 2024 22:51:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48444
x-xss-protection: 0
server: sffe

GET
H3 200 KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 58ms
38ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxIIzI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

96643bfad5a17eada947d707441559202c83a2cc9acb28aa860b7d64e3e55747

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 130548
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 08:57:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 08:57:16 GMT
last-modified: Thu, 01 Aug 2024 20:41:18 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18540
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 33ms
14ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

4dbd328e347e890a801d51f9a5f8d38a3efd51ec34c0aa22cc83d0a95d6d9d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 129748
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 09:10:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 09:10:36 GMT
last-modified: Thu, 01 Aug 2024 20:41:19 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18492
x-xss-protection: 0
server: sffe

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 34ms
15ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 130760
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 08:53:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 08:53:44 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 39ms
20ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 192299
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Tue, 06 Jan 2026 15:48:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 06 Jan 2025 15:48:05 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18588
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 44ms
25ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 130211
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 09:02:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 09:02:53 GMT
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18596
x-xss-protection: 0
server: sffe

GET
H2 200 settings Show response
cdn.segment.com/v1/projects/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/ 7 KB
2 KB 25ms
9ms Fetch
application/json 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/v1/projects/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/settings
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08a743d4862301ea040bca7aa5c1c185e38d6a005dd1313bb42a41e99a0fd2b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: qmsqweOPKA5MoeLsbJYuVoOjulzXwVHF
etag: W/"e55781cccd62c9f2ccb6aca0dd300298"
age: 7815
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: RMDKWHZYATNqdEdvYjTvzcklN6OnM4WauF_PrXLKl7sZsVUE7U9hZQ==
date: Wed, 08 Jan 2025 19:02:58 GMT
content-type: application/json; charset=utf-8
vary: accept-encoding
last-modified: Wed, 13 Nov 2024 18:35:32 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=10800
via: 1.1 d07eabeb1ed60c06da1457f35fb5c8c4.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 tsub-middleware.bundle.c0f5511a001f780f591f.js Show response
cdn.segment.com/analytics-next/bundles/ 18 KB
6 KB 8ms
6ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/tsub-middleware.bundle.c0f5511a001f780f591f.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 557c67c76c13a84e8b483ee1a0dfdd807399d960909266e7c6a83ddfadca9c81

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"f7b3d2021df83853b191aefa39a74b15"
x-amz-version-id: ot1syIPz_4SEEXctAcFzoJMAfu_hQEig
age: 14442525
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: xiPifcsZ1T6vS68IjaNKS__GSwiq2b8REVadxUSV8e6Hs3rjBSlwtQ==
date: Thu, 25 Jul 2024 17:24:20 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 23 Jul 2024 22:02:58 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 ajs-destination.bundle.ed53a26b6edc80c65d73.js Show response
cdn.segment.com/analytics-next/bundles/ 9 KB
3 KB 8ms
8ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.ed53a26b6edc80c65d73.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 129151ed0140041b198ce3b364a11861a3b5baa5bb60475ebf7bedb9b0fc94d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"00e9c65cbba11c07c4bf4a6e2727b8ea"
x-amz-version-id: 7HrcoEDii4CJjqNCahwryaG4L.vk9kns
age: 9671133
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: TyJOWtezVbvPuXhmoezTB0rcWQ6Ea5q5hDImdHo-kq4eiLSyKisYOw==
date: Wed, 18 Sep 2024 22:47:32 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 18 Sep 2024 22:21:40 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 202 rum Show response
rum.browser-intake-datadoghq.com/api/v2/ 53 B
287 B 464ms
232ms Fetch
application/json 2600:1f18:24e6:b902:3219:69a3:9bec:162d
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Aaccount%2Cversion%3A0b7cac011197aad772f37ec1e013fc79a561279a&dd-api-key=pub480f4cef7391531bc264b29e802177b7&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=cbd959c4-627a-48f2-b964-373b7063c0f4&batch_time=1736370784672

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:24e6:b902:3219:69a3:9bec:162d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

9e44588f804a9e422b87a47a0061bcdd1839951d5aeacfc13da76b6194976ac3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://account.test-vercel.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/json
dd-request-id: cbd959c4-627a-48f2-b964-373b7063c0f4

GET
H2 200 schemaFilter.bundle.5c2661f67b4b71a6d9bd.js Show response
cdn.segment.com/analytics-next/bundles/ 2 KB
1 KB 9ms
9ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.5c2661f67b4b71a6d9bd.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31892c21ae4fb908a875bbe29dbf0df74c2e84171cfbcac23540f3ad8222a35a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"3867b2388b619ff7fddc29ef359fc9aa"
x-amz-version-id: u16VcQlfwBtHRZyWZ3J5lA.kF3ts0Fc8
age: 9835294
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: j-XEUp3LplBZ3PwAPNUxS0S3UulSNP4gAkkP2eeDv0zTaCwQsxiIRQ==
date: Tue, 17 Sep 2024 01:11:31 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Mon, 16 Sep 2024 16:03:18 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 copy.de-DE.5aa214b7.js Show response
account.test-vercel.onepeloton.de/account-assets/static/js/ 425 KB
60 KB 388ms
387ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/account-assets/static/js/copy.de-DE.5aa214b7.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/main.41d2a209.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

74b8a809c83c27461f1f8694b42b2bc15194c0df384082bf2f3e06bcb50de001

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/orderhistory

Response headers

content-encoding: br
etag: W/"b2b7fc27b3a2b86d9fe26c1b23409870"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:05 GMT
content-disposition: inline; filename="copy.de-DE.5aa214b7.js"
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 21:13:05 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::22r2l-1736370784704-6181ccc2f85b

GET
H2 200 40324.da93449d.js Show response
account.test-vercel.onepeloton.de/account-assets/static/js/ 72 KB
19 KB 190ms
188ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/account-assets/static/js/40324.da93449d.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/main.41d2a209.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

b916d9871a9ad447630549f27cb7e1fcb0a84c81406ecbf323ecbaad1eba3e45

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/orderhistory

Response headers

content-encoding: br
etag: W/"d1b03fc852f7a699083f7e21d3f9ea85"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:04 GMT
content-disposition: inline; filename="40324.da93449d.js"
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 21:13:04 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::5qc67-1736370784706-90af3024a204

GET
H2 200 78199.1d811e4c.js Show response
account.test-vercel.onepeloton.de/account-assets/static/js/ 71 KB
26 KB 182ms
180ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/account-assets/static/js/78199.1d811e4c.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/main.41d2a209.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

aec6a512a615d913caa4bbd5dd28749d0a43ae982d95caf3a2857fe8d654ec19

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/orderhistory

Response headers

content-encoding: br
etag: W/"11d0daf5392c50891b25d485a1db786e"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:04 GMT
content-disposition: inline; filename="78199.1d811e4c.js"
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 21:13:04 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::k5wbw-1736370784706-902868f90cc8

GET
H2 200 16175.1d46f364.js Show response
account.test-vercel.onepeloton.de/account-assets/static/js/ 28 KB
8 KB 194ms
192ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/account-assets/static/js/16175.1d46f364.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/main.41d2a209.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

1fb57261e4b58b20af83c6d3266bacb9b7463da5bd3be0ae25239acbe8cba594

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/orderhistory

Response headers

content-encoding: br
etag: W/"040cd0fbbd6a454399d36a1afeba0d3c"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:04 GMT
content-disposition: inline; filename="16175.1d46f364.js"
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 21:13:04 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::x4sdp-1736370784743-c5133ddcdb6c

GET
H2 200 65978.2ee3f7a9.js Show response
account.test-vercel.onepeloton.de/account-assets/static/js/ 62 KB
10 KB 149ms
148ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/account-assets/static/js/65978.2ee3f7a9.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/main.41d2a209.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

4c489e4126cc9c8b248da303553f9a8ec959235de30fbc2da6cf0a33e136c2fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/orderhistory

Response headers

content-encoding: br
etag: W/"3ca00b0b4f3f26268fdfa5a86b7b899c"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:04 GMT
content-disposition: inline; filename="65978.2ee3f7a9.js"
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 21:13:04 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::fshx2-1736370784706-f22f86cc4ec6

GET
H2 200 71726.72f89b92.js Show response
account.test-vercel.onepeloton.de/account-assets/static/js/ 34 KB
9 KB 152ms
151ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/account-assets/static/js/71726.72f89b92.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/main.41d2a209.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

448d4362670a52342d3e8886246ff8fb3ae452cac58c2e0ed5ec4fbb90f9e717

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/orderhistory

Response headers

content-encoding: br
etag: W/"8930237afabcfca0338548e46e15a5bf"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:04 GMT
content-disposition: inline; filename="71726.72f89b92.js"
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 21:13:04 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::8srmv-1736370784706-baa16ba25451

GET
H2 200 OrderHistoryAccount.1894fcfb.js Show response
account.test-vercel.onepeloton.de/account-assets/static/js/ 28 KB
8 KB 164ms
163ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/account-assets/static/js/OrderHistoryAccount.1894fcfb.js

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/main.41d2a209.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

da2c3d36ad6548fd425dcfbb25dabfc258a97deaaa6f678f09355d3c285a8177

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/orderhistory

Response headers

content-encoding: br
etag: W/"5e08d315ac98dd85c0a0df5998d24c7c"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:04 GMT
content-disposition: inline; filename="OrderHistoryAccount.1894fcfb.js"
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 21:13:04 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::6cqwp-1736370784708-21479c307efa

GET
H2 200 client.json Show response
rollout.ada.support/peloton-support/ 8 KB
393 B 14ms
13ms XHR
application/json 13.33.187.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rollout.ada.support/peloton-support/client.json?ada_request_origin=embed
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-68.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: abbbe99a1650b4e0a8f26e05e90dcab533af5e033033132dfc0562b8a3d21b2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 300
access-control-expose-headers: ETag
etag: "82e7996fe8c0057082e9c6edcceadc06"
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: STAhFVAAeUQl3X_piNmCtjVe4MFA_W2yFN9Tr6iT5jP-COyxtG1KOA==
date: Wed, 08 Jan 2025 21:13:04 GMT
last-modified: Sun, 17 Nov 2024 09:05:52 GMT
vary: Origin
content-type: application/json
cache-control: no-cache
via: 1.1 46b6cb3d5daab7defe28d3658c3a54fe.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7699
x-amz-cf-pop: FRA60-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET me
api.onepeloton.de/api/ 0
0

OPTIONS
H2 204 me
api.onepeloton.de/api/ Frame 0
0 143ms
143ms Preflight
text/plain 2606:4700::6810:8f9b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.onepeloton.de/api/me

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8f9b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: peloton-platform,x-requested-with
Access-Control-Request-Method: GET
Origin: https://account.test-vercel.onepeloton.de
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,Ecomm-Freemium,Exposed-Credential-Check,If-Modified-Since,Keep-Alive,Locale-Country,Locale-Language,Origin,Peloton-API-Deadline,Peloton-Client-Date,Peloton-Client-Details,Peloton-Create-User-Callback,Peloton-Ecomm-Client,Peloton-Ecomm-Client-Version,Peloton-Instructor-Api-Key,Peloton-Platform,Peloton-Studio-API-Key,User-Agent,X-CSRF-Token,X-CustomHeader,X-Requested-With,X-Secrets-Authorization
access-control-allow-methods: GET, OPTIONS, POST, PUT, DELETE
access-control-max-age: 1728000
cf-cache-status: DYNAMIC
cf-ray: 8fef307c6a9b3831-FRA
content-length: 0
content-type: text/plain charset=UTF-8
date: Wed, 08 Jan 2025 21:13:04 GMT
server: cloudflare
strict-transport-security: max-age=15724800; includeSubDomains
vary: Origin

GET
H2 200 6da8bc62e6a46c8197ce.js Show response
cdn.segment.com/next-integrations/actions/braze-cloud-plugins/ 4 KB
2 KB 8ms
8ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/actions/braze-cloud-plugins/6da8bc62e6a46c8197ce.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0b9727b0a251438fa6b04d37abe7bf7bdad071195dfd73451eab9275e6236522

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: br
x-amz-version-id: NRxod.nPPutbHT4A.rM71UuX03uTV.fb
etag: W/"861e76f22332035c44b5ecfdcc807ec9"
age: 67303
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 1sVWrb3XadSUvnRvBzLsEUG4-CV89ZDZlBomqUQcEkkkIb1KSwZ-mw==
date: Wed, 08 Jan 2025 02:31:22 GMT
content-type: application/javascript
vary: accept-encoding
last-modified: Tue, 19 Nov 2024 11:09:32 GMT
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 202 replay Show response
session-replay.browser-intake-datadoghq.com/api/v2/ 53 B
287 B 389ms
153ms Fetch
application/json 2600:1f18:24e6:b900:1b9f:2fe7:7ce5:577a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://session-replay.browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Aaccount%2Cversion%3A0b7cac011197aad772f37ec1e013fc79a561279a&dd-api-key=pub480f4cef7391531bc264b29e802177b7&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=d467e24d-deb5-4a31-ab3b-2a2ed7300a13

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:24e6:b900:1b9f:2fe7:7ce5:577a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

3ccc8634464ba676580e8df08b99800da2004929913dc1e9e6c6c0d10bdd2a9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykVlmGDBBh7fkJEJg
Referer: https://account.test-vercel.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/json
dd-request-id: d467e24d-deb5-4a31-ab3b-2a2ed7300a13

GET
H2 200 449cd4534726259c2a8c.js Show response
cdn.segment.com/next-integrations/actions/845/ 28 KB
9 KB 8ms
8ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/actions/845/449cd4534726259c2a8c.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/actions/braze-cloud-plugins/6da8bc62e6a46c8197ce.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c664e784d6cba355616ea0a6eb59603579a7b0e49fc4b9595264ba736aeccb4d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: br
x-amz-version-id: EVVx1GCj7M7hpqtpgfo0MxQRbP40BXw2
etag: W/"4e4e40c0ccc652a7cc4cef7c2146c1f5"
age: 65713
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: Gwdy1OCcs-Uqb1TS3Ze1YQI7ka_el1QQN_NeSMY1E0yPFE9m7xjbPg==
date: Wed, 08 Jan 2025 02:57:52 GMT
content-type: application/javascript
vary: accept-encoding
last-modified: Tue, 19 Nov 2024 11:09:30 GMT
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 amplitude.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/amplitude/3.3.3/ 9 KB
4 KB 12ms
9ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/amplitude/3.3.3/amplitude.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bc4ae72d43593c2fc59ead95f45eb0c3b02cd465fd427b3fff5224e476d26259

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "41d391d5b119fb8c4fe6edd0c6fc1d21"
x-amz-version-id: dPEAOL7ExjtccGMMvRthKStk2d2FNhP0
age: 8434291
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 5ARvDsQfYzzZAWMXE5GYaPRHPsId4x5EwCdgOeaW5Kf292xrMoliKw==
date: Thu, 03 Oct 2024 06:21:34 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:16 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3181
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 google-tag-manager.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/google-tag-manager/2.5.1/ 3 KB
2 KB 12ms
10ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/google-tag-manager/2.5.1/google-tag-manager.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9e2189d573b1df3fd3c684ba1f9ad2ad5cd2f8394f14dde87b5fde495bea200c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "a2b1aa1a0e402b1f891c929f94449d47"
x-amz-version-id: _Aep7zFPD.gvTJG_YlZ3OByAwEPpZuwB
age: 5282409
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: hkE44-16-vJ3Y7bKl_NH-oPA3DuJHWFCks4SJRURD9yfSac9LmnucA==
date: Fri, 08 Nov 2024 17:52:56 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:16 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1343
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 google-analytics.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/google-analytics/2.18.5/ 16 KB
5 KB 15ms
12ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/google-analytics/2.18.5/google-analytics.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 86685e191878d9ecfd30ed1fe63cbb783bf9151607e9996342d64977013e3cff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "6a3ed21f9b6777c0c37e6e248ea22387"
x-amz-version-id: jiinLnhNKtSMsrpHvOzN4SxprXBvOKZw
age: 8428870
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 1_WFqozIKgjfwnfmp-WFsDT5KLDwhrQAsoGO5aI4oq5PyKUoq-JxVQ==
date: Thu, 03 Oct 2024 07:51:55 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:16 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4743
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 facebook-pixel.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/facebook-pixel/2.11.5/ 10 KB
4 KB 15ms
12ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/facebook-pixel/2.11.5/facebook-pixel.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4df53644d1c9fd651ccfd697977eb07d94cd744b0a4997568d67cc25ef44e483

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "a7cd49c834a0851140e3304c91cb34d0"
x-amz-version-id: j4m0DyDSierKPJq1r420lhjLq60dvugM
age: 8428870
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 9Ynz5QyQ6rPCVwB_f2ZM4XvwpKk2QR8s2TiUMEFKCu8ItcbVsbxh-g==
date: Thu, 03 Oct 2024 07:51:55 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:16 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3273
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 optimizely.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/optimizely/3.5.1/ 7 KB
3 KB 15ms
13ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/optimizely/3.5.1/optimizely.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1bafc9c6fe77db49f8ca2bbe80308499cf62cc2dc58638199c3f356b2f6c070b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "e79d390b30fe2288d7924077a9937ae4"
x-amz-version-id: nzjHmRy2.boZLjrvC.DzOyTcdepBqJMa
age: 8443399
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: UTEgsUAxpsrvXEA_lgr3Ktoxcjuuu_r1obulmk_MaXXwqs0wVqD0uw==
date: Thu, 03 Oct 2024 03:49:46 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:17 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2588
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 p Show response
api.segment.io/v1/ 21 B
186 B 537ms
177ms Fetch
application/json 52.12.47.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.segment.io/v1/p

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.12.47.65 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-12-47-65.us-west-2.compute.amazonaws.com

Software

Resource Hash

12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://account.test-vercel.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000
access-control-allow-origin: https://account.test-vercel.onepeloton.de
content-length: 21
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: application/json
vary: Origin

GET
H2 200 l
use.typekit.net/af/1da05b/0000000000000000000132df/27/ 26 KB
26 KB 55ms
14ms Font
application/font-woff2 2a02:26f0:2780:5e::210:a86d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/1da05b/0000000000000000000132df/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/orderhistory
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a86d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: c763917e443b5583abccb9674edfaf82deada941ad5894d28c672c632fcd64dc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://account.test-vercel.onepeloton.de/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "49d80c15efa35e0c65ed7e265d2c0333b309aa4e"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 26888
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/8f4e31/0000000000000000000132e3/27/ 27 KB
27 KB 68ms
27ms Font
application/font-woff2 2a02:26f0:2780:5e::210:a86d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/8f4e31/0000000000000000000132e3/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/orderhistory
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a86d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: fc19e2d873270cfa3ce69c2345fac36b8ab1b0fe2cd8983f0946a8c180f236b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://account.test-vercel.onepeloton.de/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "79f9defc7632bc87dc40a06c82c11882a3000992"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 27712
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/2f8f3d/0000000000000000000132dd/27/ 28 KB
28 KB 71ms
29ms Font
application/font-woff2 2a02:26f0:2780:5e::210:a86d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/2f8f3d/0000000000000000000132dd/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/orderhistory
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a86d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 7b3f9977e4430713707bd0c59d452f27a77ecf7df9fd5bf3441d7e33eb7bac2d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://account.test-vercel.onepeloton.de/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "64c9d90e55f2292243c241f35a0066529a28975c"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 28916
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/d8f71f/0000000000000000000132e1/27/ 29 KB
29 KB 57ms
16ms Font
application/font-woff2 2a02:26f0:2780:5e::210:a86d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/d8f71f/0000000000000000000132e1/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/orderhistory
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a86d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 831b24eb2e098f7593a23d342e3a3b0ad2c05c537cd1998dbee4d91bb3366332

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.test-vercel.onepeloton.de
Referer: https://account.test-vercel.onepeloton.de/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "f7b510c370fbf14452ab6f7d577ea16c0159b671"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 29348
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 commons.a61d7bea37d2de5d4b69.js.gz Show response
cdn.segment.com/next-integrations/integrations/vendor/ 70 KB
22 KB 9ms
8ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.a61d7bea37d2de5d4b69.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 265ac7549793e4b9d51f8ab19acc8518770ace94078790776b3ac34eb47e1bbd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "c467a63b2e7c3a99be423ace649014d8"
x-amz-version-id: JPDEPREw8gYM0wgzX9n.pVdsRblNlmAD
age: 455391
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: z_9UaGk7HLtiT98zVP4BThwf5vNnsO-m2Yv_NNy6LxlKWmGoSCdgMQ==
date: Fri, 03 Jan 2025 14:43:14 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:15 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21911
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 460 KB
122 KB 88ms
48ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MCBXHNH&l=dataLayer

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.a61d7bea37d2de5d4b69.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8d8ed45fa1225f060fe815022ac8a5bf4ea5386953071087803d9339fea48add

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Wed, 08 Jan 2025 21:13:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 123924
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 amplitude-5.2.2-min.gz.js Show response
cdn.amplitude.com/libs/ 54 KB
18 KB 40ms
9ms Script
application/javascript 18.245.86.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.a61d7bea37d2de5d4b69.js.gz
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.86.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-86-101.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2173f130ca59dc5554498343432f02f92ecce45c4f9381ea12b203a2978f33d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: gzip
etag: "b568e7b3c9d94da6a1d4845b18400f7a"
x-amz-version-id: aZB1RIRJqET7nosqRtOBVideRuh0jIV6
age: 40239
x-cache: Hit from cloudfront
x-amz-cf-id: IMZo_OD5hZzzQftq1QCTIAunIRR-Z7D3UEdqVusaVg8dNkC-3fEWoQ==
date: Wed, 08 Jan 2025 10:02:26 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2019 15:45:34 GMT
cache-control: max-age=31536000
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17889
x-amz-cf-pop: FRA60-P6
server: AmazonS3

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 239 KB
61 KB 11ms
10ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.a61d7bea37d2de5d4b69.js.gz

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

fac32cab54964005de0d608de8f7da3205a0d8d8120a4fdb248936b20fa96fe7

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-SEdmwKoL' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-SEdmwKoL' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=27, mss=1232, tbw=8878, tp=16, tpl=0, uplat=2, ullat=-1
pragma: public
x-fb-debug: 8SD+2T8Nh8GizyntKgYehZ0MU5TWsBkoFVQ4rIkU8U0OKDfIsUbqS1hUiODGpXt9pxZCDMhG0AusEwUDGZj/uQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62276
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 55ms
13ms Script
text/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.a61d7bea37d2de5d4b69.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: gzip
age: 1899
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Wed, 08 Jan 2025 22:41:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 20:41:25 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H3 200 401477200736972 Show response
connect.facebook.net/signals/config/ 303 KB
93 KB 257ms
257ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/401477200736972?v=2.9.179&r=c2&domain=account.test-vercel.onepeloton.de&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

c35c952ae0ec9b81bca14082d9db19570301ee37d1379c7a40bee06d1fd35c4d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-mwuf6Q7q' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-mwuf6Q7q' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=65, mss=1232, tbw=73310, tp=71, tpl=0, uplat=248, ullat=0
pragma: public
x-fb-debug: vl6HgBD81UbltdmHp/K5dECWY1+XIak97X8RRLwkVwNONnQtjG8H1KbDPDX2rONL3Wf1Rs1veqWOspjaGoiksQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 202 rum Show response
rum.browser-intake-datadoghq.com/api/v2/ 53 B
113 B 352ms
273ms Fetch
application/json 2600:1f18:24e6:b902:3219:69a3:9bec:162d
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Aaccount%2Cversion%3A0b7cac011197aad772f37ec1e013fc79a561279a&dd-api-key=pub480f4cef7391531bc264b29e802177b7&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=36651cb1-f31e-4084-8338-b9bf5e17b93e&batch_time=1736370784826

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:24e6:b902:3219:69a3:9bec:162d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

32751da10a79179d32f7858a53d89cc6484729c98616d9e7055c42b3123e7a51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://account.test-vercel.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/json
dd-request-id: 36651cb1-f31e-4084-8338-b9bf5e17b93e

GET
H2 200 p.gif
p.typekit.net/ 35 B
205 B 72ms
14ms Image
image/gif 2a02:26f0:2780:5e::210:a87d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.typekit.net/p.gif?s=1&k=sxy3vgl&ht=tk&h=account.test-vercel.onepeloton.de&f=10294.10296.10300.10302&a=8797212&js=1.21.0&app=typekit&e=js&_=1736370784831
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/orderhistory
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a87d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

cache-control: public, max-age=604800
etag: "6757dcc6-23"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 35
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: image/gif
last-modified: Tue, 10 Dec 2024 06:16:38 GMT
server: nginx

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
371 B 24ms
23ms XHR
text/plain 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=578876202&t=pageview&_s=1&dl=https%3A%2F%2Faccount.test-vercel.onepeloton.de%2Forderhistory&dp=%2Forderhistory&ul=de-de&de=UTF-8&dt=%2Forderhistory&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgEABAAAAACgCIAB~&jid=1467872438&gjid=2126390999&cid=1491942282.1736370785&tid=UA-34644111-15&_gid=1868704325.1736370785&_slc=1&z=1223123108

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://account.test-vercel.onepeloton.de/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:04 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://account.test-vercel.onepeloton.de
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 3
server: Golfe2

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
658 B 65ms
20ms XHR
text/plain 2a00:1450:400c:c02::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-34644111-15&cid=1491942282.1736370785&jid=1467872438&gjid=2126390999&_gid=1868704325.1736370785&_u=aGBAgEABAAAAAGgCIAD~&z=1374383088

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c02::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://account.test-vercel.onepeloton.de/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:149:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:04 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:149:0
access-control-allow-origin: https://account.test-vercel.onepeloton.de
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H2 200 collect
www.google-analytics.com/ 35 B
406 B 14ms
14ms Image
image/gif 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=578876202&t=event&ni=1&_s=2&dl=https%3A%2F%2Faccount.test-vercel.onepeloton.de%2Forderhistory&dp=%2Forderhistory&ul=de-de&de=UTF-8&dt=%2Forderhistory&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=All&ea=Viewed%20%2Forderhistory%20Page&ev=0&_u=aGBAgEABAAAAAGgCIAD~&jid=&gjid=&cid=1491942282.1736370785&tid=UA-34644111-15&_gid=1868704325.1736370785&z=1052688441

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/orderhistory

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

age: 2051
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 20:38:53 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
server: Golfe2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 402 KB
131 KB 35ms
34ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XR3WQZEXQG&l=dataLayer&cx=c&gtm=45He4cc1v813348577za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MCBXHNH&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c2e76418e33860f6a780f628500bd55bd225fa4142754595253e33f2867a4d27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 08 Jan 2025 21:13:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 133535
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 65460.js Show response
www.dwin1.com/ 44 KB
13 KB 46ms
11ms Script
application/javascript 2600:9000:214f:9000:f:8ce2:fb80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dwin1.com/65460.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MCBXHNH&l=dataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:9000:f:8ce2:fb80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d61b1f0c3f3cc5f4e38aede8f91eeb380953f9d04d0fa5087425a587a2b3a2ca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: gzip
x-amz-version-id: glYNbc4C9k.qJuKuDPRLHZ0a5p_nNw6c
etag: W/"d386d84f5a01de90fcee4a3e5dc8a06e"
age: 21
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: mbtp26ziG3SMt68dwROI1UxvgTtnVQ2hB-ZfNyRe941r-FtZR8j7UQ==
date: Wed, 08 Jan 2025 21:12:44 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
last-modified: Thu, 19 Dec 2024 08:27:38 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=600, s-maxage=600
via: 1.1 1f5757b46371746e677236d4fc67d364.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA53-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 202 rum Show response
rum.browser-intake-datadoghq.com/api/v2/ 53 B
112 B 266ms
262ms Fetch
application/json 2600:1f18:24e6:b902:3219:69a3:9bec:162d
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Aaccount%2Cversion%3A0b7cac011197aad772f37ec1e013fc79a561279a&dd-api-key=pub480f4cef7391531bc264b29e802177b7&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=1abae8db-db62-4460-8e9a-2c09509a4415&batch_time=1736370784985

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:24e6:b902:3219:69a3:9bec:162d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

5c0dd42dcb0df8c024486f2f8cd9506624c527dd200e8a2c282dd5252322b89b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://account.test-vercel.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/json
dd-request-id: 1abae8db-db62-4460-8e9a-2c09509a4415

POST
H2 200 graphql Show response
graph.prod.k8s.onepeloton.de/ 75 B
577 B 199ms
181ms Fetch
application/json 2606:4700:4400::6812:2a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://graph.prod.k8s.onepeloton.de/graphql
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2a5c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80d298ea799b1fd54f43f152111cc64e6c8c0a594dd82ade0c62364979431843

Request headers

x-datadog-origin: rum
x-datadog-parent-id: 8450218997425390810
Referer: https://account.test-vercel.onepeloton.de/
x-datadog-trace-id: 5309845886102814300
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
apollographql-client-version: 0b7cac011197aad772f37ec1e013fc79a561279a
content-type: application/json
apollographql-client-name: account
x-datadog-sampling-priority: 1

Response headers

access-control-expose-headers: Check-Maintenance
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"4b-+xeCbua8gV1FEFls1rHV101hDr0"
x-kong-proxy-latency: 12
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
cache-control: no-store
x-kong-request-id: e401341384847e67c4e0d1746fd8cb76
x-envoy-upstream-service-time: 8
access-control-allow-credentials: true
x-envoy-decorator-operation: graph.graph.svc.cluster.local:3000/*
via: kong/3.4.3.10-enterprise-edition
cf-ray: 8fef30819a53910d-FRA
x-kong-upstream-latency: 18
access-control-allow-origin: https://account.test-vercel.onepeloton.de
x-kong-ingress-class: kong
server: cloudflare

OPTIONS
H2 200 graphql
graph.prod.k8s.onepeloton.de/ Frame 0
0 281ms
246ms Preflight 2606:4700:4400::6812:2a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://graph.prod.k8s.onepeloton.de/graphql
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2a5c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: apollographql-client-name,apollographql-client-version,content-type,x-datadog-origin,x-datadog-parent-id,x-datadog-sampling-priority,x-datadog-trace-id
Access-Control-Request-Method: POST
Origin: https://account.test-vercel.onepeloton.de
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin,Accept,DNT,X-CustomHeader,X-Secrets-Authorization,Authorization,Keep-Alive,User-Agent,Content-Type,X-Requested-With,If-Modified-Since,Cache-Control,X-CSRF-Token,Peloton-Platform,Locale-Language,Locale-Country,Peloton-Client-Details,Peloton-Client-Date,Peloton-Ecomm-Client,Peloton-Ecomm-Client-Version,x-datadog-parent-id,x-datadog-sampled,x-datadog-sampling-priority,x-datadog-trace-id,x-datadog-origin,cf-access-client-id,cf-access-client-secret,apollographql-client-name,apollographql-client-version
access-control-allow-methods: GET,OPTIONS,POST,PUT,DELETE
access-control-allow-origin: https://account.test-vercel.onepeloton.de
access-control-max-age: 1728000
cf-cache-status: DYNAMIC
cf-ray: 8fef307fffdbd270-FRA
content-length: 0
date: Wed, 08 Jan 2025 21:13:05 GMT
server: cloudflare
vary: Origin
x-kong-ingress-class: kong
x-kong-request-id: 85635c47931e5d705da3207413c78410
x-kong-response-latency: 1

GET
H3 200 status Show response
www.facebook.com/x/oauth/ 0
108 B 136ms
124ms Fetch
text/plain 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=492491817438833&input_token&origin=1&redirect_uri=https%3A%2F%2Faccount.test-vercel.onepeloton.de%2Forderhistory&sdk=joey&wants_cookie_data=true

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra3.facebook.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-expose-headers: fb-s
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7457655736958951667"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: text/plain; charset=UTF-8
x-fb-debug: 3HJIbVtmAQfFyNl8y9Ee/SygeFsI78jqK6j7co8HsNCYnGf9aJh86SGvj5yb2cxROn6f7C8l7fynmnkIuZpodg==
priority: u=1,i
strict-transport-security: max-age=15552000; preload
reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7457655736958951667", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
cache-control: private, no-cache, no-store, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=23, mss=1232, tbw=4990, tp=15, tpl=0, uplat=115, ullat=0
pragma: no-cache
fb-s: unknown
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: https://account.test-vercel.onepeloton.de
content-length: 0
origin-agent-cluster: ?1

POST
H2 200 2fb6ab867a82782f9eb69daaa5f29be2217e1af44fa36ad923acc8d43f8761ae Show response
d1no8tpthtviug.cloudfront.net/events/ 0
492 B 223ms
190ms XHR
text/plain 2600:9000:2646:f400:1b:1628:8a00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1no8tpthtviug.cloudfront.net/events/2fb6ab867a82782f9eb69daaa5f29be2217e1af44fa36ad923acc8d43f8761ae
Requested by: Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/58817.46a915eb.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2646:f400:1b:1628:8a00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://account.test-vercel.onepeloton.de/

Response headers

access-control-allow-credentials: true
via: 1.1 5b17764336ffdab7d2a3e7707394867a.cloudfront.net (CloudFront)
access-control-allow-origin: https://account.test-vercel.onepeloton.de
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: 69NRXWojyyYaDFMgpKQyMui8CVlhOeQ1B-eykq89J6Pf7Wt3mBTPkA==
date: Wed, 08 Jan 2025 21:13:05 GMT
x-amz-cf-pop: FRA60-P5
vary: origin

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 17ms
9ms Image
text/plain 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=401477200736972&ev=PageView&dl=https%3A%2F%2Faccount.test-vercel.onepeloton.de%2Forderhistory&rl=&if=false&ts=1736370785261&sw=1600&sh=1200&v=2.9.179&r=c2&a=seg&ec=0&o=12318&fbp=fb.1.1736370785259.316845224145396210&ler=empty&cdl=API_unavailable&it=1736370784804&coo=false&dpo=LDU&dpoco=0&dpost=0&eid=ajs-next-1736370784729-5f94929d-4c0f-4c32-b02e-1d27295d1f32&rqm=GET

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/orderhistory

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=23, mss=1232, tbw=4599, tp=11, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
191 B 185ms
176ms Image
image/png 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=401477200736972&ev=PageView&dl=https%3A%2F%2Faccount.test-vercel.onepeloton.de%2Forderhistory&rl=&if=false&ts=1736370785261&sw=1600&sh=1200&v=2.9.179&r=c2&a=seg&ec=0&o=12318&fbp=fb.1.1736370785259.316845224145396210&ler=empty&cdl=API_unavailable&it=1736370784804&coo=false&dpo=LDU&dpoco=0&dpost=0&eid=ajs-next-1736370784729-5f94929d-4c0f-4c32-b02e-1d27295d1f32&rqm=FGET

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/orderhistory

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra3.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .oculuscdn.com https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7457655735702038911"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: 36Dj3wX/Tta4KBJY12kd3HQLfq0wcOKHpDCgv8sApA3NGMiZQ2GKjMY822o2fiOc/TORsPFoVMIHFwmhjawygQ==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7457655735702038911", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=25, mss=1232, tbw=6638, tp=18, tpl=0, uplat=167, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 favicon.png
account.test-vercel.onepeloton.de/ 5 KB
5 KB 14ms
14ms Other
image/png 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.test-vercel.onepeloton.de/favicon.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

c23a04be92733b59293473449d4c2b7dc7dce3d7214b9333fe6320f9973272eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.test-vercel.onepeloton.de/orderhistory

Response headers

etag: "f112a594d54cec5d8985653fba34d68a"
age: 22
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:05 GMT
content-disposition: inline; filename="favicon.png"
content-type: image/png
last-modified: Wed, 08 Jan 2025 21:12:43 GMT
x-frame-options: DENY
strict-transport-security: max-age=63072000
cache-control: public, max-age=0, must-revalidate
x-vercel-cache: HIT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4872
x-xss-protection: 1; mode=block
server: Vercel
x-vercel-id: fra1::rzm2m-1736370785460-450e2b0c6b7d

GET
H2 200 login Show response
account.onepeloton.de/ 8 KB
3 KB 177ms
128ms Document
text/html 2a05:d014:58f:6202::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Requested by

Host: account.test-vercel.onepeloton.de
URL: https://account.test-vercel.onepeloton.de/account-assets/static/js/main.41d2a209.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6202::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2a433bf98a13e0f961dfa64f22efc4d67eda8ef5d0385c39c65a0a65efb59a71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://account.test-vercel.onepeloton.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 0
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; fwd=stale
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 08 Jan 2025 21:13:05 GMT
etag: "85db6baf6ab9ef016b712d310c942119-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01JH3W73FF0V9KMTA84TDMS7P2
x-xss-protection: 1; mode=block

POST rum
rum.browser-intake-datadoghq.com/api/v2/ 0
0

POST replay
session-replay.browser-intake-datadoghq.com/api/v2/ 0
0

GET
H2 200 newrelic.js Show response
account.onepeloton.de/account-scripts/ 24 KB
8 KB 9ms
4ms Script
application/javascript 2a05:d014:58f:6202::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.onepeloton.de/account-scripts/newrelic.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6202::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

ff9354ac41f4bd2861bf3f160aa41885edda9da123777cb20024e7700090c4ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Response headers

content-encoding: br
etag: "b1f69eb38291a1ba45678a281959dd12-ssl-df"
age: 847
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 8538
x-nf-request-id: 01JH3W73KPZAC4VM7NW0NFKP54
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
0 0ms
0ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;900&display=swap

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0c9787eaa38917257431d71f65fe3c5fe573fbec6e980028f2e845d9d3b75cff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 08 Jan 2025 21:13:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:03 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 08 Jan 2025 21:13:03 GMT
x-frame-options: SAMEORIGIN
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 polyfill.min.js Show response
polyfill-fastly.io/v3/ 104 B
0 0ms
0ms Script
text/javascript 2a04:4e42:200::347
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://polyfill-fastly.io/v3/polyfill.min.js?version=3.108.0&features=es2015%2Ces2016%2Ces2017%2Ces2019%2CIntersectionObserver%2CPromise.prototype.finally%2CResizeObserver%2Csmoothscroll
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::347 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2860c827fc3ab3562bd9394b8cfabbf35d37982e17903ea3789e80371a5778c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://account.onepeloton.de/

Response headers

cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800, immutable
content-encoding: br
access-control-allow-methods: GET,HEAD,OPTIONS
accept-ranges: none
access-control-allow-origin: *
date: Wed, 08 Jan 2025 21:13:03 GMT
content-type: text/javascript; charset=UTF-8
vary: User-Agent, Accept-Encoding
x-served-by: cache-mad2200145-MAD

GET
H2 200 / Show response
js.stripe.com/v3/ 696 KB
0 2ms
1ms Script
text/javascript 13.33.187.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.187.45 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-187-45.fra60.r.cloudfront.net

Software

Cloudfront /

Resource Hash

221cd076e521ed0d936f0717d98f3cf406ed84320df8451971e055aa0cece425

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-encoding: br
etag: W/"0bf2e1ab69628d0ac5e41a167ee264fb"
age: 49
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: TzRXmy80bVEcXlR3RrlnOLj1z6PmSDtPKeJVqkDw6vd2ItEA-UVf4A==
date: Wed, 08 Jan 2025 21:12:15 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2025 19:19:43 GMT
vary: Accept-Encoding
cache-control: max-age=60
timing-allow-origin: *
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P9
server: Cloudfront

GET
H2 200 embed2.js Show response
static.ada.support/ 6 KB
0 3ms
3ms Script
text/javascript 18.66.147.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ada.support/embed2.js
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-95.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 43da18f909be2ce7b2a6908460d55c1e85440107401bb04706c2bf725ff55fe5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
access-control-expose-headers: ETag
content-encoding: gzip
x-amz-version-id: JTEe2QogZxw2trnqb5fj0lJ5svkPSon1
etag: W/"d556a4fd6f86b7c64ce2e54347438fb8"
age: 68329
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: bBreqXJNfg6_SWqF6mwDlwKPIoA7HCHHiKf61HsKW9tXaTyonM5e_A==
date: Wed, 08 Jan 2025 02:14:15 GMT
content-type: text/javascript
vary: accept-encoding
last-modified: Tue, 17 Sep 2024 18:14:41 GMT
cache-control: max-age: 300
via: 1.1 b1c64361268fcbad3c03abbe37eb5cfa.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 58817.46a915eb.js Show response
account.onepeloton.de/account-assets/static/js/ 2 MB
580 KB 9ms
9ms Script
application/javascript 2a05:d014:58f:6202::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6202::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

1dadfb9c08c7b4ebdcc01847c87fe2ceedd03b38380441addfd557f97106805a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Response headers

content-encoding: br
etag: "534a866f4cb3009170934956564690d5-ssl-df"
age: 847
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 592980
x-nf-request-id: 01JH3W73M7B0GFCHBTSBZG2246
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 main.8edbee05.js Show response
account.onepeloton.de/account-assets/static/js/ 1010 KB
193 KB 24ms
23ms Script
application/javascript 2a05:d014:58f:6202::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.onepeloton.de/account-assets/static/js/main.8edbee05.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6202::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

4d02cb435d29371a8381fd73ef9a55f9edd640825ab4d8fc0cb14a8cc6c8eead

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Response headers

content-encoding: br
etag: "83434374cde0f637154ef163172652a8-ssl-df"
age: 847
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 196911
x-nf-request-id: 01JH3W73M9G1DBXHKNYE93B9AG
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
0 1ms
1ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

9297194dd8d8e70248648b111b520ee15eff904fac85685ff19908a65b852183

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: zMp04RwmK4OMLJ3QzecAPg==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "cf53a0003f13233bf4111b3b63dd5725"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 08 Jan 2025 21:23:42 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 08 Jan 2025 21:13:03 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: c4e2ea9b3b195fa28fa16898bd765ced
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4502, tp=9, tpl=0, uplat=0, ullat=-1
x-fb-debug: dQMWeEirrb1wp12vRFuQFGWRuKvfUQhS6vYOTfZxyK64iK2+1QMVnqIqy0i7A0oqoY4s4yMIcZ5Y5BWMYsK/VQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 1686
origin-agent-cluster: ?1

GET
H2 200 embed-manifest.json Show response
static.ada.support/ 136 B
518 B 11ms
11ms Fetch
application/json 18.66.147.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.ada.support/embed-manifest.json

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-95.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

74796b8d1bac95a048704583e148718240e741e3b6bd242a6e17169679b12355

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
access-control-expose-headers: ETag
x-amz-version-id: NHmc3__GGDZaEKTYE4K174c1eL7Jxo63
age: 13631
etag: "beeee65ed006e7ac66e8c4f4660d573c"
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 9zq5QOQN5NZwSnToMLZhixivTQRGrYIdTDP6fANgrvuqx6RKgWxeaA==
date: Wed, 08 Jan 2025 17:25:55 GMT
last-modified: Tue, 07 Jan 2025 17:25:51 GMT
vary: accept-encoding
content-type: application/json
strict-transport-security: max-age=63072000; includeSubdomains; preload
via: 1.1 760a29e891ec10bba1274911260e1fc8.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 136
x-amz-cf-pop: FRA60-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 70 B
160 B 24ms
21ms Script
text/javascript 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cea2053be8e509589fe917b989317c05a16799e2d89ed1ea89b21870e3153631

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 8fef308439abdbff-FRA
content-encoding: gzip
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/7cc03490-8b5a-42f1-ad79-19a14a986dc6/ 37 KB
5 KB 57ms
27ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/7cc03490-8b5a-42f1-ad79-19a14a986dc6/OtAutoBlock.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a401df33dc7df3eb020d8deae2c55ea773ac4b8ef51138c02dac72eab0a3fbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: Nu+3abgmc1+iAWAckOy40w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC5D7BD73A9C83
age: 52067
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Thu, 09 Jan 2025 21:13:06 GMT
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/javascript
last-modified: Mon, 15 Apr 2024 18:42:45 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: ffac3a81-601e-00bd-544c-268506000000
cf-ray: 8fef30846e2e37cc-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5267
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 51ms
22ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52e5401f96ca9a7fc38248bf9469bdc7006f53de52d7abfec96f4a39cf665d6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: TR3+yr7DZCz8Fh2PJMSBjQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD2E8F03BC0C3C
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 69769
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/javascript
last-modified: Mon, 06 Jan 2025 20:16:33 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ed4b110f-001e-00a6-16ca-60ab94000000
cf-ray: 8fef30846e2a37cc-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7211
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 254 KB
0 0ms
0ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=ed505967c611414fac8f5ea34060ac26

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

54c15884f96515b03b64359982faae845b9b339f0b6aac568393748fa3169f65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://account.onepeloton.de/

Response headers

content-md5: Q1yla4VaCENgWkgmf+JC7w==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "b49c61a7b6e130e0afc43feedbc9ec22"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 08 Jan 2026 20:38:07 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 08 Jan 2025 21:13:03 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 4d16bee5be2274b304bfe39c6e008c81
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: UNKNOWN; q=-1, rtt=-1, rtx=0, c=20, mss=1232, tbw=1888, tp=5, tpl=0, uplat=2, ullat=-1
x-fb-debug: PP5dv/gAkCntEGwixc9t6oPwVlcv+aPyK2ZPDWKYRee0mIuEYOt2/yMwXFeZJ+uTOumciQ1bj4fvbZ9BSm94ig==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 76641
origin-agent-cluster: ?1

GET
H2 200 embed2.7423118.js Show response
static.ada.support/ 170 KB
537 B 14ms
14ms Script
text/javascript 18.66.147.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.ada.support/embed2.7423118.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-95.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

b883b25122b10585806b8b7e90f4b01b15e0f0b6885ed9bce207272365caa87b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
access-control-expose-headers: ETag
content-encoding: gzip
x-amz-version-id: Bjo5pnx0bG8J3F9gkQplfIJvhGXZpkjX
age: 14798
etag: W/"55d490e3b1b6117efdf4777021150376"
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: LvDr3tHJoMWKWj0C_-TsgTH3IF2PP0gbiIs5eb8pj3BPD6mGcJ-IzA==
date: Wed, 08 Jan 2025 17:06:28 GMT
last-modified: Tue, 07 Jan 2025 16:52:15 GMT
vary: accept-encoding
content-type: text/javascript
strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: 172800
via: 1.1 b1c64361268fcbad3c03abbe37eb5cfa.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 client.json Show response
rollout.ada.support/peloton-support/ 8 KB
402 B 10ms
9ms XHR
application/json 13.33.187.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rollout.ada.support/peloton-support/client.json?ada_request_origin=embed
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-68.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: abbbe99a1650b4e0a8f26e05e90dcab533af5e033033132dfc0562b8a3d21b2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 300
access-control-expose-headers: ETag
etag: "82e7996fe8c0057082e9c6edcceadc06"
age: 298
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: vcNebW9GA9zjO9LK7yQdvQJ3oW2mJiHWv2UNnzZD1KGBgSQE0Zllsw==
date: Wed, 08 Jan 2025 21:13:05 GMT
content-type: application/json
vary: Origin
last-modified: Sun, 17 Nov 2024 09:05:52 GMT
cache-control: no-cache
via: 1.1 46b6cb3d5daab7defe28d3658c3a54fe.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7699
x-amz-cf-pop: FRA60-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 chat-manifest.json Show response
static.ada.support/ 136 B
497 B 12ms
11ms Fetch
application/json 18.66.147.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.ada.support/chat-manifest.json

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-95.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

18fdc64789026ce5298cdbba07a0ee33a7aea13738c1f960fcb6a36233834e4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
access-control-expose-headers: ETag
x-amz-version-id: gEilsMYCWqaorgN9KN2S.rAtRsO.6G_m
age: 7992
etag: "3d46ce43c0ce6a10f5de63c977e89db1"
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: K6o39QEmP1geFuD9rde4QVJ7Eed4_pAi6Af_T1VDDqPECUHPCQazPg==
date: Wed, 08 Jan 2025 18:59:54 GMT
last-modified: Wed, 08 Jan 2025 18:59:50 GMT
content-type: application/json
strict-transport-security: max-age=63072000; includeSubdomains; preload
via: 1.1 760a29e891ec10bba1274911260e1fc8.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 136
x-amz-cf-pop: FRA60-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 index.html
peloton-support.ada.support/embed/x-storage/7423118/ Frame E07B 0
0 9ms
9ms Document
text/html 18.66.147.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://peloton-support.ada.support/embed/x-storage/7423118/index.html

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-53.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Referer: https://account.onepeloton.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 14798
cache-control: 172800
content-length: 237
content-type: text/html
date: Wed, 08 Jan 2025 17:06:29 GMT
etag: "9de74f7ad2e5dab10ee5461c55c0cbe4"
last-modified: Tue, 07 Jan 2025 16:52:15 GMT
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubdomains; preload
vary: accept-encoding
via: 1.1 307395f1eb3989f15e6f525475291c86.cloudfront.net (CloudFront)
x-amz-cf-id: Wu2LhONaMVZRHVNZ-C7wRClqqCWhs4_ptHhf-KwvNiNieiJJzo1tCA==
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: q9W3HtSx7FAT_qc5zzTKBNBiW3F.cX_o
x-cache: Hit from cloudfront

GET
H2 200 index.html
peloton-support.ada.support/embed/button/7423118/ Frame DA22 0
0 10ms
10ms Document
text/html 18.66.147.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://peloton-support.ada.support/embed/button/7423118/index.html

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-53.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Referer: https://account.onepeloton.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 14798
cache-control: 172800
content-encoding: gzip
content-type: text/html
date: Wed, 08 Jan 2025 17:06:29 GMT
etag: W/"3edde4849d0d77c3017f95618cda0595"
last-modified: Tue, 07 Jan 2025 16:52:15 GMT
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubdomains; preload
vary: accept-encoding
via: 1.1 307395f1eb3989f15e6f525475291c86.cloudfront.net (CloudFront)
x-amz-cf-id: 8tXXA7Ax5DGEnt38U-CzS9k6mmmHqtUMB-T65uXMEF9WzEy8pbCWiA==
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: a36qinHMTeljZx7Z.Jj4T1NrHcn9JBmO
x-cache: Hit from cloudfront

GET
H2 200 7cc03490-8b5a-42f1-ad79-19a14a986dc6.json Show response
cdn.cookielaw.org/consent/7cc03490-8b5a-42f1-ad79-19a14a986dc6/ 4 KB
2 KB 41ms
26ms XHR
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/7cc03490-8b5a-42f1-ad79-19a14a986dc6/7cc03490-8b5a-42f1-ad79-19a14a986dc6.json

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

171bd4c9fb210e7c9053aa0eecefcb16a23eccdb03a9c592bdbaafe167cf757f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: JDsoLndmvNpZQwx7UBblxg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC5D7BD73DD05D
age: 3518
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Thu, 09 Jan 2025 21:13:06 GMT
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json
last-modified: Mon, 15 Apr 2024 18:42:45 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 9b2ea783-c01e-007c-114d-260ebf000000
cf-ray: 8fef3084f962dc54-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1655
x-ms-blob-type: BlockBlob
server: cloudflare

GET 51d0e437-7430-472f-b07f-063a11377a2e
https://account.onepeloton.de/ Frame 0
0

OPTIONS
H2 204 plans
api.onepeloton.de/ecomm/store/de_webstore/digital_subscriptions/ Frame 0
0 117ms
117ms Preflight
text/plain 2606:4700::6810:8f9b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.onepeloton.de/ecomm/store/de_webstore/digital_subscriptions/plans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8f9b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: peloton-platform,x-requested-with
Access-Control-Request-Method: GET
Origin: https://account.onepeloton.de
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,Ecomm-Freemium,Exposed-Credential-Check,If-Modified-Since,Keep-Alive,Locale-Country,Locale-Language,Origin,Peloton-API-Deadline,Peloton-Client-Date,Peloton-Client-Details,Peloton-Create-User-Callback,Peloton-Ecomm-Client,Peloton-Ecomm-Client-Version,Peloton-Instructor-Api-Key,Peloton-Platform,Peloton-Studio-API-Key,User-Agent,X-CSRF-Token,X-CustomHeader,X-Requested-With,X-Secrets-Authorization
access-control-allow-methods: GET, OPTIONS, POST, PUT, DELETE
access-control-allow-origin: https://account.onepeloton.de
access-control-max-age: 1728000
cf-cache-status: DYNAMIC
cf-ray: 8fef3085e93b3831-FRA
content-length: 0
content-type: text/plain charset=UTF-8
date: Wed, 08 Jan 2025 21:13:06 GMT
server: cloudflare
strict-transport-security: max-age=15724800; includeSubDomains
vary: Origin

GET
H2 200 css
fonts.googleapis.com/ 11 KB
0 0ms
0ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6bb88125bf9791b4f1b29ace16454069152663f037096117fe60858053f9176a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 08 Jan 2025 21:13:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 08 Jan 2025 20:53:49 GMT
x-frame-options: SAMEORIGIN
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 sxy3vgl.js Show response
use.typekit.net/ 17 KB
0 0ms
0ms Script
text/javascript 2a02:26f0:2780:5e::210:a86d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/sxy3vgl.js
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a86d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 73eb48e7611ce70741b07f3785e266ad61a2be5329c0becc5956e7da492df16c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

cache-control: public, max-age=600, stale-while-revalidate=604800
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 6742
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: text/javascript;charset=utf-8
vary: Accept-Encoding
server: nginx

GET
H2 200 analytics.min.js Show response
cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/ 106 KB
0 0ms
0ms Script
text/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics.js/v1/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/analytics.min.js
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4b5fb218f1afb6f5b1d9590d456209d5dc4228845e7d02b8cc597212f0994609

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: TLebeQ2Ly.0dE6x20QD7s.8hFgP0D3.3
etag: W/"9c38a53299c5121a3d57d266621c3c49"
age: 26
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 2umWqFLJ8vjRpHefy5DcuyoCQv1Hf37qcaLTd4SpOaWtaHpmPWkk4A==
date: Wed, 08 Jan 2025 21:12:39 GMT
content-type: text/javascript; charset=utf-8
vary: accept-encoding
last-modified: Tue, 19 Nov 2024 20:34:09 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=120
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 Xg7J4fRn29xnpbNoufWCo.json Show response
cdn.optimizely.com/datafiles/ 74 KB
0 0ms
0ms XHR
application/json 2606:4700::6812:4139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.optimizely.com/datafiles/Xg7J4fRn29xnpbNoufWCo.json
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:4139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab40b0627690c3a1de674229faa0f36bb8f1f9577428e42d1c5c9cf0ed22015e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 604800
content-encoding: gzip
cf-cache-status: HIT
etag: "63667139d53303eec85abce6ac7066ff"
x-amz-version-id: WdRL7SX5Kw9eNVt8cDJV3qEcqNDU9ezC
access-control-allow-methods: GET, HEAD, OPTIONS
date: Wed, 08 Jan 2025 21:13:04 GMT
x-amz-meta-revision: 1684
content-type: application/json; charset=utf-8
last-modified: Wed, 08 Jan 2025 16:41:08 GMT
vary: Accept-Encoding
x-amz-id-2: xITPvjr5wkDZLfa00QlnvCgwNEYKA+2UlP2k4zEsUo2P1F/f1SdTjqOXi6P3tLw7YB1h/LWNmCI=
access-control-allow-headers: *
x-amz-replication-status: PENDING
cache-control: max-age=120
x-amz-meta-pci_enabled: False
access-control-allow-credentials: false
x-amz-request-id: H19QC5QRE54P84NX
cf-ray: 8fef307b8f1ed3c0-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10469
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 plans
api.onepeloton.de/ecomm/store/de_webstore/digital_subscriptions/ 11 KB
2 KB 45ms
26ms XHR
application/json 2606:4700::6810:8f9b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.onepeloton.de/ecomm/store/de_webstore/digital_subscriptions/plans

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8f9b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://account.onepeloton.de/
X-Requested-With: XmlHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Peloton-Platform: web

Response headers

access-control-max-age: 86400
peloton-activity-id: 8fef1e2fc9c3dcad-ARN
access-control-expose-headers: Check-Maintenance, Invalidate-Token, Auth-Method
content-encoding: gzip
cf-cache-status: HIT
age: 750
access-control-allow-methods: GET, OPTIONS, POST, PUT, DELETE
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json
vary: Accept-Encoding, peloton-platform, Origin
last-modified: Wed, 08 Jan 2025 21:00:36 GMT
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,Ecomm-Freemium,Exposed-Credential-Check,If-Modified-Since,Keep-Alive,Locale-Country,Locale-Language,Origin,Peloton-API-Deadline,Peloton-Client-Date,Peloton-Client-Details,Peloton-Create-User-Callback,Peloton-Ecomm-Client,Peloton-Ecomm-Client-Version,Peloton-Instructor-Api-Key,Peloton-Platform,Peloton-Studio-API-Key,User-Agent,X-CSRF-Token,X-CustomHeader,X-Requested-With,X-Secrets-Authorization
strict-transport-security: max-age=15724800; includeSubDomains
cache-control: max-age=600, public
access-control-allow-credentials: true
cf-ray: 8fef3086cbdaa043-FRA
access-control-allow-origin: https://account.onepeloton.de
server: cloudflare

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
295 B 43ms
27ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: application/json
Referer: https://account.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8fef30860b314d31-FRA
access-control-allow-origin: *
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

POST
H2 202 rum
rum.browser-intake-datadoghq.com/api/v2/ 53 B
113 B 277ms
271ms Fetch
application/json 2600:1f18:24e6:b902:3219:69a3:9bec:162d
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Aaccount%2Cversion%3Abab0d4863b10cb7ca42ca66f9a7e271b1069f8a7&dd-api-key=pub480f4cef7391531bc264b29e802177b7&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=a2cc5653-e829-4b71-9f47-c933ad9b151c&batch_time=1736370786265

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:24e6:b902:3219:69a3:9bec:162d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://account.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json
dd-request-id: a2cc5653-e829-4b71-9f47-c933ad9b151c

GET
H3 200 UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
fonts.gstatic.com/s/inter/v18/ 47 KB
0 0ms
0ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 167723
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Tue, 06 Jan 2026 22:37:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 06 Jan 2025 22:37:41 GMT
last-modified: Mon, 29 Jul 2024 22:51:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48444
x-xss-protection: 0
server: sffe

GET
H2 200 l
use.typekit.net/af/1da05b/0000000000000000000132df/27/ 26 KB
0 0ms
0ms Font
application/font-woff2 2a02:26f0:2780:5e::210:a86d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/1da05b/0000000000000000000132df/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a86d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: c763917e443b5583abccb9674edfaf82deada941ad5894d28c672c632fcd64dc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://account.onepeloton.de/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "49d80c15efa35e0c65ed7e265d2c0333b309aa4e"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 26888
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/8f4e31/0000000000000000000132e3/27/ 27 KB
0 2ms
2ms Font
application/font-woff2 2a02:26f0:2780:5e::210:a86d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/8f4e31/0000000000000000000132e3/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a86d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: fc19e2d873270cfa3ce69c2345fac36b8ab1b0fe2cd8983f0946a8c180f236b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://account.onepeloton.de/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "79f9defc7632bc87dc40a06c82c11882a3000992"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 27712
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/2f8f3d/0000000000000000000132dd/27/ 28 KB
0 4ms
4ms Font
application/font-woff2 2a02:26f0:2780:5e::210:a86d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/2f8f3d/0000000000000000000132dd/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a86d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 7b3f9977e4430713707bd0c59d452f27a77ecf7df9fd5bf3441d7e33eb7bac2d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://account.onepeloton.de/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "64c9d90e55f2292243c241f35a0066529a28975c"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 28916
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/d8f71f/0000000000000000000132e1/27/ 29 KB
0 6ms
6ms Font
application/font-woff2 2a02:26f0:2780:5e::210:a86d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/d8f71f/0000000000000000000132e1/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a86d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 831b24eb2e098f7593a23d342e3a3b0ad2c05c537cd1998dbee4d91bb3366332

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://account.onepeloton.de/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "f7b510c370fbf14452ab6f7d577ea16c0159b671"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 29348
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 settings Show response
cdn.segment.com/v1/projects/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/ 7 KB
0 6ms
6ms Fetch
application/json 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/v1/projects/kDc1tm2P9YautyYiubgJz49Gl32s1mDh/settings
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08a743d4862301ea040bca7aa5c1c185e38d6a005dd1313bb42a41e99a0fd2b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: qmsqweOPKA5MoeLsbJYuVoOjulzXwVHF
etag: W/"e55781cccd62c9f2ccb6aca0dd300298"
age: 7815
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: RMDKWHZYATNqdEdvYjTvzcklN6OnM4WauF_PrXLKl7sZsVUE7U9hZQ==
date: Wed, 08 Jan 2025 19:02:58 GMT
content-type: application/json; charset=utf-8
vary: accept-encoding
last-modified: Wed, 13 Nov 2024 18:35:32 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=10800
via: 1.1 d07eabeb1ed60c06da1457f35fb5c8c4.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202304.1.0/ 401 KB
97 KB 25ms
10ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202304.1.0/otBannerSdk.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1114132a79b42ce8e5064f57a1560a3b3f0e1659afc33e4698bab53e1301fbfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: f9AvZgohx9TU9t078cCRXA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB51E951BA9202
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 65609
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/javascript
last-modified: Thu, 11 May 2023 06:31:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 86cecdf8-e01e-008e-44d3-42dc2b000000
cf-ray: 8fef30865f9037cc-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 99020
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
0 6ms
6ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxIIzI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

96643bfad5a17eada947d707441559202c83a2cc9acb28aa860b7d64e3e55747

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 130548
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 08:57:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 08:57:16 GMT
last-modified: Thu, 01 Aug 2024 20:41:18 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18540
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
0 7ms
7ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

4dbd328e347e890a801d51f9a5f8d38a3efd51ec34c0aa22cc83d0a95d6d9d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 129748
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 09:10:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 09:10:36 GMT
last-modified: Thu, 01 Aug 2024 20:41:19 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18492
x-xss-protection: 0
server: sffe

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
0 8ms
8ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 130760
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 08:53:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 08:53:44 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
0 9ms
9ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 192299
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Tue, 06 Jan 2026 15:48:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 06 Jan 2025 15:48:05 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18588
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
0 11ms
11ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://account.onepeloton.de
Referer: https://fonts.googleapis.com/

Response headers

age: 130211
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 09:02:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 09:02:53 GMT
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18596
x-xss-protection: 0
server: sffe

GET
H2 200 p.gif
p.typekit.net/ 35 B
205 B 17ms
14ms Image
image/gif 2a02:26f0:2780:5e::210:a87d
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.typekit.net/p.gif?s=1&k=sxy3vgl&ht=tk&h=account.onepeloton.de&f=10294.10296.10300.10302&a=8797212&js=1.21.0&app=typekit&e=js&_=1736370786297
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:5e::210:a87d , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

cache-control: public, max-age=604800
etag: "6757dcc6-23"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 35
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: image/gif
last-modified: Tue, 10 Dec 2024 06:16:38 GMT
server: nginx

GET
H2 200 AuthLoginPage.ff956c78.js
account.onepeloton.de/account-assets/static/js/ 1 KB
860 B 124ms
124ms Script
application/javascript 2a05:d014:58f:6202::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.onepeloton.de/account-assets/static/js/AuthLoginPage.ff956c78.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6202::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Response headers

content-encoding: br
etag: "11c0e3b3f04de9e170c43b7fbd3a3a92-ssl-df"
age: 0
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 767
x-nf-request-id: 01JH3W7404RVNHJ1DGETVKAEP2
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; fwd=stale
server: Netlify

GET
H2 200 tsub-middleware.bundle.c0f5511a001f780f591f.js Show response
cdn.segment.com/analytics-next/bundles/ 18 KB
0 0ms
0ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/tsub-middleware.bundle.c0f5511a001f780f591f.js
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 557c67c76c13a84e8b483ee1a0dfdd807399d960909266e7c6a83ddfadca9c81

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"f7b3d2021df83853b191aefa39a74b15"
x-amz-version-id: ot1syIPz_4SEEXctAcFzoJMAfu_hQEig
age: 14442525
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: xiPifcsZ1T6vS68IjaNKS__GSwiq2b8REVadxUSV8e6Hs3rjBSlwtQ==
date: Thu, 25 Jul 2024 17:24:20 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 23 Jul 2024 22:02:58 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 copy.de-DE.5aa214b7.js Show response
account.onepeloton.de/account-assets/static/js/ 425 KB
61 KB 10ms
10ms Script
application/javascript 2a05:d014:58f:6202::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.onepeloton.de/account-assets/static/js/copy.de-DE.5aa214b7.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6202::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

74b8a809c83c27461f1f8694b42b2bc15194c0df384082bf2f3e06bcb50de001

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5

Response headers

content-encoding: br
etag: "94463cbe4b36973a1d7f939c8a0ec932-ssl-df"
age: 847
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 62057
x-nf-request-id: 01JH3W740A98M9HVZ6YTHE3YJ5
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 401 me
api.onepeloton.de/api/ 88 B
196 B 137ms
135ms XHR
application/json 2606:4700::6810:8f9b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.onepeloton.de/api/me

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8f9b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://account.onepeloton.de/
X-Requested-With: XmlHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Peloton-Platform: web

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
peloton-activity-id: 8fef30874c52a043-FRA
cf-cache-status: DYNAMIC
www-authenticate: FormBased realm="Peloton"
access-control-allow-credentials: true
cf-ray: 8fef30874c52a043-FRA
access-control-allow-origin: https://account.onepeloton.de
content-length: 88
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json
vary: peloton-platform
server: cloudflare

OPTIONS
H2 204 me
api.onepeloton.de/api/ Frame 0
0 128ms
128ms Preflight
text/plain 2606:4700::6810:8f9b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.onepeloton.de/api/me

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8f9b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: peloton-platform,x-requested-with
Access-Control-Request-Method: GET
Origin: https://account.onepeloton.de
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,Ecomm-Freemium,Exposed-Credential-Check,If-Modified-Since,Keep-Alive,Locale-Country,Locale-Language,Origin,Peloton-API-Deadline,Peloton-Client-Date,Peloton-Client-Details,Peloton-Create-User-Callback,Peloton-Ecomm-Client,Peloton-Ecomm-Client-Version,Peloton-Instructor-Api-Key,Peloton-Platform,Peloton-Studio-API-Key,User-Agent,X-CSRF-Token,X-CustomHeader,X-Requested-With,X-Secrets-Authorization
access-control-allow-methods: GET, OPTIONS, POST, PUT, DELETE
access-control-allow-origin: https://account.onepeloton.de
access-control-max-age: 1728000
cf-cache-status: DYNAMIC
cf-ray: 8fef308679af3831-FRA
content-length: 0
content-type: text/plain charset=UTF-8
date: Wed, 08 Jan 2025 21:13:06 GMT
server: cloudflare
strict-transport-security: max-age=15724800; includeSubDomains
vary: Origin

GET
H2 200 ajs-destination.bundle.ed53a26b6edc80c65d73.js Show response
cdn.segment.com/analytics-next/bundles/ 9 KB
0 0ms
0ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.ed53a26b6edc80c65d73.js
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 129151ed0140041b198ce3b364a11861a3b5baa5bb60475ebf7bedb9b0fc94d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"00e9c65cbba11c07c4bf4a6e2727b8ea"
x-amz-version-id: 7HrcoEDii4CJjqNCahwryaG4L.vk9kns
age: 9671133
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: TyJOWtezVbvPuXhmoezTB0rcWQ6Ea5q5hDImdHo-kq4eiLSyKisYOw==
date: Wed, 18 Sep 2024 22:47:32 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 18 Sep 2024 22:21:40 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 schemaFilter.bundle.5c2661f67b4b71a6d9bd.js Show response
cdn.segment.com/analytics-next/bundles/ 2 KB
0 1ms
0ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.5c2661f67b4b71a6d9bd.js
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31892c21ae4fb908a875bbe29dbf0df74c2e84171cfbcac23540f3ad8222a35a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"3867b2388b619ff7fddc29ef359fc9aa"
x-amz-version-id: u16VcQlfwBtHRZyWZ3J5lA.kF3ts0Fc8
age: 9835294
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: j-XEUp3LplBZ3PwAPNUxS0S3UulSNP4gAkkP2eeDv0zTaCwQsxiIRQ==
date: Tue, 17 Sep 2024 01:11:31 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Mon, 16 Sep 2024 16:03:18 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 6da8bc62e6a46c8197ce.js Show response
cdn.segment.com/next-integrations/actions/braze-cloud-plugins/ 4 KB
0 1ms
1ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/actions/braze-cloud-plugins/6da8bc62e6a46c8197ce.js
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0b9727b0a251438fa6b04d37abe7bf7bdad071195dfd73451eab9275e6236522

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: br
x-amz-version-id: NRxod.nPPutbHT4A.rM71UuX03uTV.fb
etag: W/"861e76f22332035c44b5ecfdcc807ec9"
age: 67303
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 1sVWrb3XadSUvnRvBzLsEUG4-CV89ZDZlBomqUQcEkkkIb1KSwZ-mw==
date: Wed, 08 Jan 2025 02:31:22 GMT
content-type: application/javascript
vary: accept-encoding
last-modified: Tue, 19 Nov 2024 11:09:32 GMT
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 449cd4534726259c2a8c.js Show response
cdn.segment.com/next-integrations/actions/845/ 28 KB
0 0ms
0ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/actions/845/449cd4534726259c2a8c.js
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c664e784d6cba355616ea0a6eb59603579a7b0e49fc4b9595264ba736aeccb4d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: br
x-amz-version-id: EVVx1GCj7M7hpqtpgfo0MxQRbP40BXw2
etag: W/"4e4e40c0ccc652a7cc4cef7c2146c1f5"
age: 65713
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: Gwdy1OCcs-Uqb1TS3Ze1YQI7ka_el1QQN_NeSMY1E0yPFE9m7xjbPg==
date: Wed, 08 Jan 2025 02:57:52 GMT
content-type: application/javascript
vary: accept-encoding
last-modified: Tue, 19 Nov 2024 11:09:30 GMT
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 amplitude.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/amplitude/3.3.3/ 9 KB
0 1ms
1ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/amplitude/3.3.3/amplitude.dynamic.js.gz
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bc4ae72d43593c2fc59ead95f45eb0c3b02cd465fd427b3fff5224e476d26259

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "41d391d5b119fb8c4fe6edd0c6fc1d21"
x-amz-version-id: dPEAOL7ExjtccGMMvRthKStk2d2FNhP0
age: 8434291
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 5ARvDsQfYzzZAWMXE5GYaPRHPsId4x5EwCdgOeaW5Kf292xrMoliKw==
date: Thu, 03 Oct 2024 06:21:34 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:16 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3181
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 google-tag-manager.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/google-tag-manager/2.5.1/ 3 KB
0 2ms
2ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/google-tag-manager/2.5.1/google-tag-manager.dynamic.js.gz
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9e2189d573b1df3fd3c684ba1f9ad2ad5cd2f8394f14dde87b5fde495bea200c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "a2b1aa1a0e402b1f891c929f94449d47"
x-amz-version-id: _Aep7zFPD.gvTJG_YlZ3OByAwEPpZuwB
age: 5282409
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: hkE44-16-vJ3Y7bKl_NH-oPA3DuJHWFCks4SJRURD9yfSac9LmnucA==
date: Fri, 08 Nov 2024 17:52:56 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:16 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1343
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 google-analytics.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/google-analytics/2.18.5/ 16 KB
0 4ms
4ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/google-analytics/2.18.5/google-analytics.dynamic.js.gz
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 86685e191878d9ecfd30ed1fe63cbb783bf9151607e9996342d64977013e3cff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "6a3ed21f9b6777c0c37e6e248ea22387"
x-amz-version-id: jiinLnhNKtSMsrpHvOzN4SxprXBvOKZw
age: 8428870
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 1_WFqozIKgjfwnfmp-WFsDT5KLDwhrQAsoGO5aI4oq5PyKUoq-JxVQ==
date: Thu, 03 Oct 2024 07:51:55 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:16 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4743
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 facebook-pixel.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/facebook-pixel/2.11.5/ 10 KB
0 5ms
5ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/facebook-pixel/2.11.5/facebook-pixel.dynamic.js.gz
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4df53644d1c9fd651ccfd697977eb07d94cd744b0a4997568d67cc25ef44e483

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "a7cd49c834a0851140e3304c91cb34d0"
x-amz-version-id: j4m0DyDSierKPJq1r420lhjLq60dvugM
age: 8428870
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 9Ynz5QyQ6rPCVwB_f2ZM4XvwpKk2QR8s2TiUMEFKCu8ItcbVsbxh-g==
date: Thu, 03 Oct 2024 07:51:55 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:16 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3273
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 optimizely.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/optimizely/3.5.1/ 7 KB
0 6ms
6ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/optimizely/3.5.1/optimizely.dynamic.js.gz
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1bafc9c6fe77db49f8ca2bbe80308499cf62cc2dc58638199c3f356b2f6c070b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "e79d390b30fe2288d7924077a9937ae4"
x-amz-version-id: nzjHmRy2.boZLjrvC.DzOyTcdepBqJMa
age: 8443399
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: UTEgsUAxpsrvXEA_lgr3Ktoxcjuuu_r1obulmk_MaXXwqs0wVqD0uw==
date: Thu, 03 Oct 2024 03:49:46 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:17 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2588
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 commons.a61d7bea37d2de5d4b69.js.gz Show response
cdn.segment.com/next-integrations/integrations/vendor/ 70 KB
0 4ms
4ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.a61d7bea37d2de5d4b69.js.gz
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 265ac7549793e4b9d51f8ab19acc8518770ace94078790776b3ac34eb47e1bbd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "c467a63b2e7c3a99be423ace649014d8"
x-amz-version-id: JPDEPREw8gYM0wgzX9n.pVdsRblNlmAD
age: 455391
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: z_9UaGk7HLtiT98zVP4BThwf5vNnsO-m2Yv_NNy6LxlKWmGoSCdgMQ==
date: Fri, 03 Jan 2025 14:43:14 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:15 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21911
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 202 rum
rum.browser-intake-datadoghq.com/api/v2/ 53 B
135 B 156ms
151ms Fetch
application/json 2600:1f18:24e6:b902:3219:69a3:9bec:162d
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Aaccount%2Cversion%3Abab0d4863b10cb7ca42ca66f9a7e271b1069f8a7&dd-api-key=pub480f4cef7391531bc264b29e802177b7&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=bde40494-435d-4182-9e55-de67b059e284&batch_time=1736370786337

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:24e6:b902:3219:69a3:9bec:162d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://account.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json
dd-request-id: bde40494-435d-4182-9e55-de67b059e284

GET
H2 200 de.json
cdn.cookielaw.org/consent/7cc03490-8b5a-42f1-ad79-19a14a986dc6/b50e63be-504a-4d30-bf31-ae4b4aa16f35/ 67 KB
18 KB 25ms
24ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/7cc03490-8b5a-42f1-ad79-19a14a986dc6/b50e63be-504a-4d30-bf31-ae4b4aa16f35/de.json

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: m8BeDuCDtkY61TvFvLSl1A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC5D7BDB878273
age: 3411
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Thu, 09 Jan 2025 21:13:06 GMT
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json
last-modified: Mon, 15 Apr 2024 18:42:52 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: c861826c-701e-0065-334d-2622d7000000
cf-ray: 8fef3086bd22dc54-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18009
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 amplitude-5.2.2-min.gz.js
cdn.amplitude.com/libs/ 54 KB
0 0ms
0ms Script
application/javascript 18.245.86.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.86.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-86-101.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-encoding: gzip
etag: "b568e7b3c9d94da6a1d4845b18400f7a"
x-amz-version-id: aZB1RIRJqET7nosqRtOBVideRuh0jIV6
age: 40239
x-cache: Hit from cloudfront
x-amz-cf-id: IMZo_OD5hZzzQftq1QCTIAunIRR-Z7D3UEdqVusaVg8dNkC-3fEWoQ==
date: Wed, 08 Jan 2025 10:02:26 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2019 15:45:34 GMT
cache-control: max-age=31536000
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17889
x-amz-cf-pop: FRA60-P6
server: AmazonS3

GET
H2 200 gtm.js
www.googletagmanager.com/ 460 KB
0 0ms
0ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MCBXHNH&l=dataLayer

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Wed, 08 Jan 2025 21:13:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 123924
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js
www.google-analytics.com/ 52 KB
0 1ms
1ms Script
text/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-encoding: gzip
age: 1899
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Wed, 08 Jan 2025 22:41:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 20:41:25 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H3 200 fbevents.js
connect.facebook.net/en_US/ 239 KB
0 2ms
2ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-SEdmwKoL' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-SEdmwKoL' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=27, mss=1232, tbw=8878, tp=16, tpl=0, uplat=2, ullat=-1
pragma: public
x-fb-debug: 8SD+2T8Nh8GizyntKgYehZ0MU5TWsBkoFVQ4rIkU8U0OKDfIsUbqS1hUiODGpXt9pxZCDMhG0AusEwUDGZj/uQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62276
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 401477200736972
connect.facebook.net/signals/config/ 303 KB
93 KB 278ms
277ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/401477200736972?v=2.9.179&r=c2&domain=account.onepeloton.de&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-HBqXevJ2' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-HBqXevJ2' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=104, mss=1232, tbw=171662, tp=160, tpl=0, uplat=269, ullat=0
pragma: public
x-fb-debug: 17hyZ+QB7wIgN/i9d1up6oEOpV4z1dIUvvN6aas2Vs3WCuwxPS7gnIoxNNJ9y0g5Ad2/5Gg4hnWpnrGncR5TpA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 js
www.googletagmanager.com/gtag/ 402 KB
0 0ms
0ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XR3WQZEXQG&l=dataLayer&cx=c&gtm=45He4cc1v813348577za200

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 08 Jan 2025 21:13:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:04 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 133535
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 otFloatingRoundedCorner.json
cdn.cookielaw.org/scripttemplates/202304.1.0/assets/ 10 KB
3 KB 23ms
22ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202304.1.0/assets/otFloatingRoundedCorner.json

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: ARPh7C8dpQ+TTRKHRGFiSQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB51E94F24B1B3
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 60108
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json
last-modified: Thu, 11 May 2023 06:31:10 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f51b8431-701e-0008-77ca-cd88f9000000
cf-ray: 8fef30872e0edc54-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2606
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcCenter.json
cdn.cookielaw.org/scripttemplates/202304.1.0/assets/ 62 KB
15 KB 17ms
16ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202304.1.0/assets/otPcCenter.json

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: 7yLwUOtnxjidZ+gYZ6sWoQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB51E94E8F15F9
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 39656
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json
last-modified: Thu, 11 May 2023 06:31:09 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: a722acb9-501e-00be-52c0-318601000000
cf-ray: 8fef30872e10dc54-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14750
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCookieSettingsButton.json
cdn.cookielaw.org/scripttemplates/202304.1.0/assets/ 5 KB
2 KB 20ms
19ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202304.1.0/assets/otCookieSettingsButton.json

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: XOE37UhksLgCWIl0MIJwPw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB51E94F3BB8FA
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 61001
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json
last-modified: Thu, 11 May 2023 06:31:10 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 8b4f35b2-d01e-005e-2b43-84d263000000
cf-ray: 8fef30872e12dc54-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1762
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202304.1.0/assets/ 21 KB
4 KB 21ms
20ms Fetch
text/css 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202304.1.0/assets/otCommonStyles.css

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: oWkBTLgDDXvrUsd93y/Zxg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 51335
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: text/css
last-modified: Thu, 11 May 2023 06:31:18 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 672011df-401e-0044-5cfa-424fe6000000
cf-ray: 8fef30872e13dc54-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2

200

Primary Request login Show response
auth.onepeloton.com/
Redirect Chain

https://auth.onepeloton.com/authorize?client_id=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&scope=openid+profile+email+offline_access&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Fac...
https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTlaUkFER0paZmFhOUp0ajdreHl0T0-jY2lk2SB6ekxyNzhjcWJhN0RkdEJnUkFYRlFybFI3eFAwR...

20 KB
20 KB

265ms
265ms

Document
text/html

2606:4700::6811:4ff9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTlaUkFER0paZmFhOUp0ajdreHl0T0-jY2lk2SB6ekxyNzhjcWJhN0RkdEJnUkFYRlFybFI3eFAwRkFiNA&client=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&protocol=oauth2&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Faccount.onepeloton.de%2Fcallback&response_type=code&response_mode=query&nonce=ZzkzLnB5TTdiR0l5V2tMM2pFZUFGfjVmdGJKUmRZSUVjS0xLZWtHZXZDSA%3D%3D&code_challenge=gikV0o6Y07Da9MWTCYbNhbqZvZNWRIARbJGbsCtXbtA&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjIuMS4zIn0%3D&scope=email%20offline_access%20openid%20peloton-api.members%3Adefault%20profile

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-assets/static/js/58817.46a915eb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4ff9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f646e416e3399950b6351a39e411fb650b2ad1ed9a7582f7f4b7b214e99b869a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://account.onepeloton.de/login?redirectUrl=aHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: no-store, max-age=0, no-transform
cf-cache-status: DYNAMIC
cf-ray: 8fef308a4bcb914d-FRA
content-security-policy: frame-ancestors 'none'
content-type: text/html; charset=utf-8
date: Wed, 08 Jan 2025 21:13:07 GMT
etag: W/"4eb9-gjDuDseWOghX0doHnRyCxAwnc/Y"
pragma: no-cache
referrer-policy: same-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-auth0-l: 0.013
x-auth0-requestid: bf52632d1ad62173548a
x-content-type-options: nosniff
x-frame-options: deny
x-ratelimit-limit: 1500
x-ratelimit-remaining: 1499
x-ratelimit-reset: 1736370789
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block

Redirect headers

auth-orca: proxy
cache-control: no-store, max-age=0, no-transform
cf-cache-status: DYNAMIC
cf-ray: 8fef3087791d914d-FRA
content-length: 0
content-type: text/html
date: Wed, 08 Jan 2025 21:13:06 GMT
location: /login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTlaUkFER0paZmFhOUp0ajdreHl0T0-jY2lk2SB6ekxyNzhjcWJhN0RkdEJnUkFYRlFybFI3eFAwRkFiNA&client=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&protocol=oauth2&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Faccount.onepeloton.de%2Fcallback&response_type=code&response_mode=query&nonce=ZzkzLnB5TTdiR0l5V2tMM2pFZUFGfjVmdGJKUmRZSUVjS0xLZWtHZXZDSA%3D%3D&code_challenge=gikV0o6Y07Da9MWTCYbNhbqZvZNWRIARbJGbsCtXbtA&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjIuMS4zIn0%3D&scope=email%20offline_access%20openid%20peloton-api.members%3Adefault%20profile
pragma: no-cache
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept, Accept-Encoding
x-auth0-l: 0.052
x-auth0-requestid: 5c7c8ebe2e0b7f23257d
x-content-type-options: nosniff
x-envoy-upstream-service-time: 102
x-ratelimit-limit: 1500
x-ratelimit-remaining: 1460
x-ratelimit-reset: 1736370788

POST
H2 202 rum
rum.browser-intake-datadoghq.com/api/v2/ 0
0 155ms
148ms Ping
application/json 2600:1f18:24e6:b902:3219:69a3:9bec:162d
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Abeacon%2Cenv%3Aproduction%2Cservice%3Aaccount%2Cversion%3Abab0d4863b10cb7ca42ca66f9a7e271b1069f8a7&dd-api-key=pub480f4cef7391531bc264b29e802177b7&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=d9858128-b10c-45cd-b311-488e40d10557&batch_time=1736370786433
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-assets/static/js/58817.46a915eb.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f18:24e6:b902:3219:69a3:9bec:162d Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://account.onepeloton.de/

Response headers

POST
H3 200 collect
www.google-analytics.com/j/ 3 B
26 B 21ms
21ms XHR
text/plain 142.250.74.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=774021037&t=event&_s=1&dl=https%3A%2F%2Faccount.onepeloton.de%2Flogin%3FredirectUrl%3DaHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5&dr=https%3A%2F%2Faccount.test-vercel.onepeloton.de%2F&ul=de-de&de=UTF-8&dt=Peloton&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=OneTrust%20Cookie%20Consent&ea=Click&el=No%20interaction&_u=CCCAgEABAAAAACAAIAB~&jid=&gjid=&cid=1491942282.1736370785&tid=UA-34644111-15&_gid=1868704325.1736370785&_slc=1&z=2052437242

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.206 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://account.onepeloton.de/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:06 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://account.onepeloton.de
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 3
server: Golfe2

POST
H2 201 consentreceipts
privacyportal.onetrust.com/request/v1/ 0
187 B 207ms
175ms Ping
text/plain 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://privacyportal.onetrust.com/request/v1/consentreceipts

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202304.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://account.onepeloton.de/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
cf-ray: 8fef30876a271c26-FRA
access-control-allow-origin: *
content-length: 0
date: Wed, 08 Jan 2025 21:13:06 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
server: cloudflare

POST
H2 202 replay
session-replay.browser-intake-datadoghq.com/api/v2/ 0
0 173ms
167ms Ping
application/json 2600:1f18:24e6:b900:1b9f:2fe7:7ce5:577a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://session-replay.browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Abeacon%2Cenv%3Aproduction%2Cservice%3Aaccount%2Cversion%3Abab0d4863b10cb7ca42ca66f9a7e271b1069f8a7&dd-api-key=pub480f4cef7391531bc264b29e802177b7&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=d1bc00cf-0676-464b-8074-a6bc9f4f100f
Requested by: Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-assets/static/js/58817.46a915eb.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f18:24e6:b900:1b9f:2fe7:7ce5:577a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygalff0Mm5U6iB23A
Referer: https://account.onepeloton.de/

Response headers

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
601 B 18ms
17ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 60136
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: image/svg+xml
last-modified: Mon, 06 Jan 2025 20:16:35 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 9886331d-401e-00ee-4fc5-609909000000
cf-ray: 8fef3087886237cc-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_guard_logo.svg
cdn.cookielaw.org/logos/static/ 497 B
539 B 20ms
19ms Fetch
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: account.onepeloton.de
URL: https://account.onepeloton.de/account-scripts/newrelic.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 69125
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: image/svg+xml
last-modified: Mon, 06 Jan 2025 20:16:34 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 57bd700d-001e-0103-1237-61d6d8000000
cf-ray: 8fef30879f18dc54-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_company_logo.png
cdn.cookielaw.org/logos/static/ 4 KB
4 KB 19ms
19ms Image
image/png 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_company_logo.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: E8+sk/ECzKgTUVtDLikiIA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DD2E8F05065322
age: 70639
cf-cache-status: HIT
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: image/png
last-modified: Mon, 06 Jan 2025 20:16:35 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 5db19a11-701e-002a-5dc8-60e6cf000000
cf-ray: 8fef3087a87b37cc-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4036
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 21ms
21ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://account.onepeloton.de/

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 52877
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: image/svg+xml
last-modified: Wed, 08 Jan 2025 03:27:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: de4754fc-d01e-008d-0189-61df2c000000
cf-ray: 8fef3087a87c37cc-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 dotsLeft.svg
auth-deviceflow.onepeloton.com/universal-login/ 23 KB
3 KB 54ms
22ms Image
image/svg+xml 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/dotsLeft.svg

Requested by

Host: auth.onepeloton.com
URL: https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTlaUkFER0paZmFhOUp0ajdreHl0T0-jY2lk2SB6ekxyNzhjcWJhN0RkdEJnUkFYRlFybFI3eFAwRkFiNA&client=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&protocol=oauth2&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Faccount.onepeloton.de%2Fcallback&response_type=code&response_mode=query&nonce=ZzkzLnB5TTdiR0l5V2tMM2pFZUFGfjVmdGJKUmRZSUVjS0xLZWtHZXZDSA%3D%3D&code_challenge=gikV0o6Y07Da9MWTCYbNhbqZvZNWRIARbJGbsCtXbtA&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjIuMS4zIn0%3D&scope=email%20offline_access%20openid%20peloton-api.members%3Adefault%20profile

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

154622ca7dcf193a1b87ebe6dcfac1edee5d0652e7a5a812e4634c84ddb709bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "35f80856c2bc752b1b893809fae54cdc-ssl-df"
age: 27954
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: image/svg+xml
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3406
x-nf-request-id: 01JH3W74WYNC4J7T5JTSEM9NMD
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 dotsRight.svg
auth-deviceflow.onepeloton.com/universal-login/ 24 KB
4 KB 40ms
8ms Image
image/svg+xml 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/dotsRight.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

7d1eff3b4683e642f85e2a86ab2ae845471804151199038fc684fc98b89a768b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "c275b3678e3725eb5eca28335864050c-ssl-df"
age: 27954
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: image/svg+xml
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3854
x-nf-request-id: 01JH3W74WY376NGBJKVZ50Y6HA
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 fontAndBackground.css
auth-deviceflow.onepeloton.com/universal-login/ 447 B
543 B 48ms
15ms Stylesheet
text/css 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/fontAndBackground.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

278a98f434d57994d09311e4dd373f6b83b54f93cf64ff9dfc837f44ce9f2f7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-store
etag: "f4592ef90192b4d35510d41c05c3cc70-ssl"
age: 25344
x-content-type-options: nosniff
accept-ranges: bytes
access-control-allow-origin: *
content-length: 447
x-nf-request-id: 01JH3W74WXHVYGVWP2YYSF7434
cache-status: "Netlify Edge"; hit
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: text/css; charset=UTF-8
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY

GET
H2 200 main.min.js Show response
client.px-cloud.net/PXIRnC16B3/ 167 KB
70 KB 350ms
291ms Script
application/javascript 2a02:26f0:2780:66::217:e3d5
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://client.px-cloud.net/PXIRnC16B3/main.min.js
Requested by: Host: auth.onepeloton.com
URL: https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTlaUkFER0paZmFhOUp0ajdreHl0T0-jY2lk2SB6ekxyNzhjcWJhN0RkdEJnUkFYRlFybFI3eFAwRkFiNA&client=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&protocol=oauth2&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Faccount.onepeloton.de%2Fcallback&response_type=code&response_mode=query&nonce=ZzkzLnB5TTdiR0l5V2tMM2pFZUFGfjVmdGJKUmRZSUVjS0xLZWtHZXZDSA%3D%3D&code_challenge=gikV0o6Y07Da9MWTCYbNhbqZvZNWRIARbJGbsCtXbtA&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjIuMS4zIn0%3D&scope=email%20offline_access%20openid%20peloton-api.members%3Adefault%20profile
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:66::217:e3d5 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 239e75bf2052fd597cc3ed84d8bebfcebd23ca849c2eb3aee9d175aa5e474226

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=600
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
content-encoding: gzip
etag: "1eae47c15a32d2a81ede4d28b778e2a7"
active-cdn: Akamai
expires: Wed, 08 Jan 2025 21:20:36 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 71039
date: Wed, 08 Jan 2025 21:13:07 GMT
last-modified: Wed, 08 Jan 2025 21:07:52 GMT
content-type: application/javascript; charset=utf-8
server: UploadServer
vary: Accept-Encoding

GET
H2 200 4353.css
auth-deviceflow.onepeloton.com/universal-login/_next/static/css/ 29 KB
4 KB 51ms
19ms Stylesheet
text/css 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/css/4353.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

4ae01e328d8a3f076724fa03e74de76296303ab4c634878cd3d29cac222a5215

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "8bb334eafe7ec990d57e9032fac01c78-ssl-df"
age: 27954
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3627
x-nf-request-id: 01JH3W74WXD90KENX0MZZGDJG7
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 _app.css
auth-deviceflow.onepeloton.com/universal-login/_next/static/css/pages/ 1 KB
735 B 50ms
18ms Stylesheet
text/css 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/css/pages/_app.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

282f73a65b01f706504e703ecf17d19db3ed4e70229360882628296a17bd8389

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "e7a9f27c9f87138d9ade06456d01508d-ssl-df"
age: 27954
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 639
x-nf-request-id: 01JH3W74WXTMMKFGSW2G5H9K3E
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 webpack.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/ 5 KB
2 KB 13ms
8ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/webpack.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3f543b1032dcce3a7c7483e27ed1f5010a3876781df65590927e5283f7f68e08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "5f5b48cb1d6cde8caeff48712fe9b811-ssl-df"
age: 27954
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2188
x-nf-request-id: 01JH3W74XQQFJEQRQWE16GT5FX
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 framework.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/ 137 KB
42 KB 16ms
11ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/framework.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

70621bd9db9915c0de2e43601e530d1a3f567daaecdd29d3f02ad71330c0ea7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "c6ecfbf0277079de53392a19e48962d2-ssl-df"
age: 27057
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43351
x-nf-request-id: 01JH3W74XQVC6XNMZ1D4VMA7X0
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 faa57d2c.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/ 223 KB
60 KB 39ms
34ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/faa57d2c.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

e0dc135b262fd043b817efa3c76b4dc4cf3f69d0bcd773478d620b449e5e99c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "1a0e8938b48e9ecd6e7414f956d8caf7-ssl-df"
age: 27057
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 61443
x-nf-request-id: 01JH3W74XQBWBTCJD6F8JSZ2BN
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 dde21195.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/ 457 KB
136 KB 38ms
35ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f1b208df2bdcac2dc6ba8b1d9d084f0ccdd303756e56d70f50dd39b02950d1ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "4f0b179dfda6db110eb13a19a88ae394-ssl-df"
age: 27057
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 139313
x-nf-request-id: 01JH3W74XQFQN1E4QW53TGSE6Q
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 main.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/ 162 B
251 B 16ms
13ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/main.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

42c83f678b4ec7237a73a5558ee70dbfebca78f2575210b418eefcd76d25a879

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-store
etag: "e432a1ca3d1cb36a8cdda7990725bf1a-ssl"
age: 25344
x-content-type-options: nosniff
accept-ranges: bytes
access-control-allow-origin: *
content-length: 162
x-nf-request-id: 01JH3W74XQQ9M35W3365Y1AQSG
cache-status: "Netlify Edge"; hit
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY

GET
H2 200 6113.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/ 993 KB
232 KB 30ms
27ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/6113.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

a0af8b5fd9182e1b7f254319a3d524e1707e621f7258028e7717585e96ff9212

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "b2794e37dfd6219d8989886969ee5213-ssl-df"
age: 27057
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 237729
x-nf-request-id: 01JH3W74XQKVVX7B9BW21BHZX6
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 6920.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/ 217 KB
63 KB 20ms
17ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/6920.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

da71ba8136f0abe1f6b5869084c9af2d8b0da264cf63d0a67591550fa27c8e1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "2fd6dfb34b60f18fc5a8c7e82cb1dc3b-ssl-df"
age: 27057
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 64881
x-nf-request-id: 01JH3W74XQ7X9ECJ4EVQ1QW4K8
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 4353.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/ 292 KB
66 KB 28ms
25ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/4353.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

63792c455c0a9eec6295f427bae6d1759da01c706ea0f0893f21115f89ce7bc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "6a4b3546b19d5dc3e230f65f12af50e3-ssl-df"
age: 27057
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 67460
x-nf-request-id: 01JH3W74XQXY35CTTW44NXQWXA
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 _app.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/pages/ 338 B
430 B 14ms
11ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/pages/_app.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

70f938a3fcad8718327c0a11607e5a31afcec1be7799fb5b60cffc8f813cc5b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-store
etag: "a630b4566d2726b29b60d3246d6028f6-ssl"
age: 25344
x-content-type-options: nosniff
accept-ranges: bytes
access-control-allow-origin: *
content-length: 338
x-nf-request-id: 01JH3W74XQ84TVAF2JPX90QX6Q
cache-status: "Netlify Edge"; hit
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY

GET
H2 200 b96f54bd.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/ 57 KB
18 KB 19ms
16ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/b96f54bd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

5939e1101c8a2152ca04cf65d10194fd178f11ea541480606dc0977993b8d806

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "1a26ae1fbaf9faf46ae7350a3cd32e85-ssl-df"
age: 27057
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18223
x-nf-request-id: 01JH3W74XQMSD5KXEDM5YHS9G4
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 index.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/pages/ 9 KB
1 KB 27ms
25ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/pages/index.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

b20668648681257c8e4902be4f4d1a45ba47801a90afb6a343ed62bd22c6c94c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "04f39fbc6c1b78875fdae17e9b42fa6e-ssl-df"
age: 27954
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1238
x-nf-request-id: 01JH3W74XQRWV4PGB32M2PC574
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

GET
H2 200 _buildManifest.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/js/ 429 B
519 B 28ms
25ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/js/_buildManifest.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

1f8b947d8e006e73e40d14076551bcc3445569146eb2138d34493ec3162d4180

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-store
etag: "bfcd4e17b87f593a92131f3a02d4752d-ssl"
age: 25344
x-content-type-options: nosniff
accept-ranges: bytes
access-control-allow-origin: *
content-length: 429
x-nf-request-id: 01JH3W74XQAK4R7AWC76MHFAM3
cache-status: "Netlify Edge"; hit
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY

GET
H2 200 _ssgManifest.js Show response
auth-deviceflow.onepeloton.com/universal-login/_next/static/js/ 77 B
167 B 19ms
17ms Script
application/javascript 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/_next/static/js/_ssgManifest.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-store
etag: "91ab52e6d8cac4739ba7dac271263d1f-ssl"
age: 25344
x-content-type-options: nosniff
accept-ranges: bytes
access-control-allow-origin: *
content-length: 77
x-nf-request-id: 01JH3W74XQRSVR8H33PVGWJWMJ
cache-status: "Netlify Edge"; hit
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY

GET
H2 200 inlinedStyles.css
auth-deviceflow.onepeloton.com/universal-login/ 16 KB
2 KB 41ms
10ms Stylesheet
text/css 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/inlinedStyles.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6cb607e7aa55a7d45ae1d3f352fcd137fd20ed64423f0d9dd79ac466027d531c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: "90647fce249c7254b9ae6625babf9119-ssl-df"
age: 27954
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
strict-transport-security: max-age=31536000
cache-control: no-store
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1816
x-nf-request-id: 01JH3W74WX2ZTFAQVP070RRPJS
x-xss-protection: 1; mode=block
cache-status: "Netlify Edge"; hit
server: Netlify

POST
H2 202 rum Show response
rum.browser-intake-datadoghq.com/api/v2/ 53 B
288 B 448ms
221ms Fetch
application/json 2600:1f18:24e6:b901:5b01:a51e:fe46:50f5
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Afetch%2Cenv%3Aprod%2Cservice%3Auniversal-login&dd-api-key=pubfaf988ee52c62553df5c3b4497a7a464&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=6a81c825-1b50-44b5-9436-8b7375894440&batch_time=1736370787421

Requested by

Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:24e6:b901:5b01:a51e:fe46:50f5 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

bd258ccdfbff0ab0351a3aee3f365e14020afa9649758f81e3b213c7794fd256

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/json
dd-request-id: 6a81c825-1b50-44b5-9436-8b7375894440

POST
H2 202 rum Show response
rum.browser-intake-datadoghq.com/api/v2/ 53 B
111 B 548ms
321ms Fetch
application/json 2600:1f18:24e6:b901:5b01:a51e:fe46:50f5
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Afetch%2Cenv%3Aprod%2Cservice%3Auniversal-login&dd-api-key=pubfaf988ee52c62553df5c3b4497a7a464&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=5a4a2a06-fcc1-44d9-b171-b27ae9700910&batch_time=1736370787423

Requested by

Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:24e6:b901:5b01:a51e:fe46:50f5 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

fa62fbe9f68a3d29a3d195476e8c058d1d0863b316596cac0ab9c8b3f70e8892

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/json
dd-request-id: 5a4a2a06-fcc1-44d9-b171-b27ae9700910

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
1 KB 79ms
26ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;900&display=swap

Requested by

Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/faa57d2c.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0c9787eaa38917257431d71f65fe3c5fe573fbec6e980028f2e845d9d3b75cff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 08 Jan 2025 21:13:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 08 Jan 2025 21:13:07 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 analytics.min.js Show response
cdn.segment.com/analytics.js/v1/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/ 106 KB
28 KB 27ms
10ms Script
text/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics.js/v1/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/analytics.min.js
Requested by: Host: auth.onepeloton.com
URL: https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTlaUkFER0paZmFhOUp0ajdreHl0T0-jY2lk2SB6ekxyNzhjcWJhN0RkdEJnUkFYRlFybFI3eFAwRkFiNA&client=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&protocol=oauth2&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Faccount.onepeloton.de%2Fcallback&response_type=code&response_mode=query&nonce=ZzkzLnB5TTdiR0l5V2tMM2pFZUFGfjVmdGJKUmRZSUVjS0xLZWtHZXZDSA%3D%3D&code_challenge=gikV0o6Y07Da9MWTCYbNhbqZvZNWRIARbJGbsCtXbtA&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjIuMS4zIn0%3D&scope=email%20offline_access%20openid%20peloton-api.members%3Adefault%20profile
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 13f291e92688d2dfc3cc58a8d2a78be5abf20dd0e2b1adc347025b190507132a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: br
x-amz-version-id: ZflvwanHLko1snwQu0tAXcEUdBo830HV
etag: W/"b7d0203dbb408d31187d20e71c133ab5"
age: 85
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: JVV91xn03KmOaId0N0FVQAhvuzJbjzKJ3fqKdV2Pf4JFHEsIH_CH4Q==
date: Wed, 08 Jan 2025 21:11:43 GMT
content-type: text/javascript; charset=utf-8
vary: accept-encoding
last-modified: Wed, 20 Nov 2024 00:19:33 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=120
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0Q5nw.woff2
fonts.gstatic.com/s/inter/v18/ 47 KB
47 KB 36ms
15ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0Q5nw.woff2

Requested by

Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/inlinedStyles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

c88db2401bef7e1203e0933cc5525a0f81863bfd076756db12acea5596f089ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://auth.onepeloton.com
Referer: https://auth-deviceflow.onepeloton.com/

Response headers

age: 130358
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 09:00:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 09:00:29 GMT
last-modified: Mon, 29 Jul 2024 22:44:12 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48556
x-xss-protection: 0
server: sffe

GET
H2 200 settings Show response
cdn.segment.com/v1/projects/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/ 3 KB
2 KB 25ms
8ms Fetch
application/json 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/v1/projects/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/settings
Requested by: Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8bdfb39f40a051a553089a1596f8790101a03663731854361720c79cf930e360

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: br
x-amz-version-id: ahb25r3oCQN7qeYyqanxMCEUjcNmAh3O
etag: W/"cf2276b4c194cac012d80f800dc9c562"
age: 5721
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: lbDJHIVIXrgtCPi-RWu3boDTnSqtY_0eagGiFYzWy4LyqhRz5bvJbg==
date: Wed, 08 Jan 2025 19:38:41 GMT
content-type: application/json; charset=utf-8
vary: accept-encoding
last-modified: Wed, 13 Nov 2024 22:56:01 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=10800
via: 1.1 d3039ad83798b26ecb9f9f1e666afe26.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 settings Show response
cdn.segment.com/v1/projects/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/ 3 KB
0 25ms
25ms Fetch
application/json 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/v1/projects/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/settings
Requested by: Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8bdfb39f40a051a553089a1596f8790101a03663731854361720c79cf930e360

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: br
x-amz-version-id: ahb25r3oCQN7qeYyqanxMCEUjcNmAh3O
etag: W/"cf2276b4c194cac012d80f800dc9c562"
age: 5721
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: lbDJHIVIXrgtCPi-RWu3boDTnSqtY_0eagGiFYzWy4LyqhRz5bvJbg==
date: Wed, 08 Jan 2025 19:38:41 GMT
content-type: application/json; charset=utf-8
vary: accept-encoding
last-modified: Wed, 13 Nov 2024 22:56:01 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=10800
via: 1.1 d3039ad83798b26ecb9f9f1e666afe26.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 ajs-destination.bundle.ed53a26b6edc80c65d73.js Show response
cdn.segment.com/analytics-next/bundles/ 9 KB
3 KB 9ms
8ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.ed53a26b6edc80c65d73.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 129151ed0140041b198ce3b364a11861a3b5baa5bb60475ebf7bedb9b0fc94d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"00e9c65cbba11c07c4bf4a6e2727b8ea"
x-amz-version-id: 7HrcoEDii4CJjqNCahwryaG4L.vk9kns
age: 9671136
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: e0k32iSh7NJD1Z6K73ep5GuaLVE3c6jC2XU_qtOH7VXhcAr9wtCeMA==
date: Wed, 18 Sep 2024 22:47:32 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 18 Sep 2024 22:21:40 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 schemaFilter.bundle.5c2661f67b4b71a6d9bd.js Show response
cdn.segment.com/analytics-next/bundles/ 2 KB
1 KB 9ms
9ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.5c2661f67b4b71a6d9bd.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31892c21ae4fb908a875bbe29dbf0df74c2e84171cfbcac23540f3ad8222a35a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"3867b2388b619ff7fddc29ef359fc9aa"
x-amz-version-id: u16VcQlfwBtHRZyWZ3J5lA.kF3ts0Fc8
age: 9835297
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: OdHyd4O7KBBn-J-fjn0VuRjLXKbuwAI869Tnc9kUHe9huhP0lOcrRA==
date: Tue, 17 Sep 2024 01:11:31 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Mon, 16 Sep 2024 16:03:18 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 amplitude.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/amplitude/3.3.3/ 9 KB
4 KB 9ms
8ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/amplitude/3.3.3/amplitude.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bc4ae72d43593c2fc59ead95f45eb0c3b02cd465fd427b3fff5224e476d26259

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "41d391d5b119fb8c4fe6edd0c6fc1d21"
x-amz-version-id: dPEAOL7ExjtccGMMvRthKStk2d2FNhP0
age: 8434294
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: Qpm5W7ouUXLkaPFiYR-2E3FXJjoYMEJvpiQVs9lNhp8WUnqJtTpIXA==
date: Thu, 03 Oct 2024 06:21:34 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:16 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3181
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 appboy.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/appboy/1.16.1/ 18 KB
5 KB 10ms
9ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/appboy/1.16.1/appboy.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ea427dd36bbcb476cbc5658d968dcb858d41316067cb9881b046bf41ae091542

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "1f3d73cab21f643e135a3e2ff914b025"
x-amz-version-id: Ev9wIay40Pez3CGZF90aeYsC_GFL2fKY
age: 7377153
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: T4dtXWv7qrfxlwM14x_FI7dXI01UrK5EBHWcwZM0foypFTmG71wZBQ==
date: Tue, 15 Oct 2024 12:00:35 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:16 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4664
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 t Show response
api.segment.io/v1/ 21 B
176 B 529ms
175ms Fetch
application/json 35.163.144.222
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.segment.io/v1/t

Requested by

Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.163.144.222 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-163-144-222.us-west-2.compute.amazonaws.com

Software

Resource Hash

12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
access-control-allow-origin: https://auth.onepeloton.com
content-length: 21
date: Wed, 08 Jan 2025 21:13:08 GMT
content-type: application/json
vary: Origin

GET
H2 200 commons.a61d7bea37d2de5d4b69.js.gz Show response
cdn.segment.com/next-integrations/integrations/vendor/ 70 KB
22 KB 9ms
9ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.a61d7bea37d2de5d4b69.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/zcOKJNJNisvk9S1wm2NtQ1yDUqh5cBbQ/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 265ac7549793e4b9d51f8ab19acc8518770ace94078790776b3ac34eb47e1bbd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "c467a63b2e7c3a99be423ace649014d8"
x-amz-version-id: JPDEPREw8gYM0wgzX9n.pVdsRblNlmAD
age: 455394
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: rG4nW3itNUKpvqn6H78LrkUJRrq5TL-EWtMgVZaJyH61nKZlQj0vmw==
date: Fri, 03 Jan 2025 14:43:14 GMT
content-type: application/javascript
last-modified: Tue, 01 Oct 2024 11:20:15 GMT
cache-control: public,max-age=31536000,immutable
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21911
x-amz-cf-pop: FRA6-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 202 rum Show response
rum.browser-intake-datadoghq.com/api/v2/ 53 B
113 B 382ms
310ms Fetch
application/json 2600:1f18:24e6:b901:5b01:a51e:fe46:50f5
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Afetch%2Cenv%3Aprod%2Cservice%3Auniversal-login&dd-api-key=pubfaf988ee52c62553df5c3b4497a7a464&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=8d693453-55a6-451e-af34-6d356e0ed602&batch_time=1736370787577

Requested by

Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:24e6:b901:5b01:a51e:fe46:50f5 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

4d757fbc9eec457dec98cf8985399c6b41d6a4b7f92c811d3ced96710c229613

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/json
dd-request-id: 8d693453-55a6-451e-af34-6d356e0ed602

GET
H2 200 amplitude-5.2.2-min.gz.js Show response
cdn.amplitude.com/libs/ 54 KB
18 KB 27ms
12ms Script
application/javascript 18.245.86.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.a61d7bea37d2de5d4b69.js.gz
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.86.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-86-69.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2173f130ca59dc5554498343432f02f92ecce45c4f9381ea12b203a2978f33d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: "b568e7b3c9d94da6a1d4845b18400f7a"
x-amz-version-id: aZB1RIRJqET7nosqRtOBVideRuh0jIV6
age: 40242
x-cache: Hit from cloudfront
x-amz-cf-id: -ZDggyxkiVIsINAp_8z555VowAPXupN3q3Zb7MCqlc1FEEfAeGQ2xg==
date: Wed, 08 Jan 2025 10:02:26 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2019 15:45:34 GMT
cache-control: max-age=31536000
via: 1.1 81cb77eb84eee291ebbd90b4c274c1c4.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17889
x-amz-cf-pop: FRA60-P6
server: AmazonS3

GET
H2 200 appboy.min.js Show response
js.appboycdn.com/web-sdk/2.4/ 186 KB
47 KB 42ms
20ms Script
application/javascript 2606:4700::6810:7809
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.appboycdn.com/web-sdk/2.4/appboy.min.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.a61d7bea37d2de5d4b69.js.gz
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:7809 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fd9f160495e13ca8b9261831a698e2195ee4dc67c92253b6353af84511431f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: W/"dce4574b1646058ce5d0902f54d4b49d"
age: 3195
x-amz-request-id: R9E8KFA61TS2WPR3
expires: Thu, 09 Jan 2025 01:13:07 GMT
cf-ray: 8fef308e98271c11-FRA
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 11 Dec 2019 16:29:39 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: d3vhv15zQpv+qHV49vddTbb43baxK4h3Ei7AgT5NeXQqRt3AAE0vklcLe5RKcDtzGNtjafsRMKD9ERhZ+B7PSA==

GET
H/1.1 200
OK ns Show response
stk.px-cloud.net/ 350 B
484 B 86ms
20ms XHR
text/html 34.107.199.61
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://stk.px-cloud.net/ns?c=5b750a10-ce05-11ef-8728-b7238fd63283
Requested by: Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.107.199.61 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 61.199.107.34.bc.googleusercontent.com
Software: /
Resource Hash: b393e30809aa2bafc0762eeae8257a29b458bfc0b5d68ed2c5831daf5a4dc75c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Access-Control-Allow-Origin: *
Content-Length: 350
Date: Wed, 08 Jan 2025 21:13:07 GMT
Content-Type: text/html

POST
H2 200 collector Show response
collector-pxirnc16b3.px-cloud.net/api/v2/ 588 B
834 B 212ms
146ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxirnc16b3.px-cloud.net/api/v2/collector
Requested by: Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 91b357a6d36166772c1fc0e42742d407497f675df7c5bc635c2814a9b656e1e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://auth.onepeloton.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 588
date: Wed, 08 Jan 2025 21:13:06 GMT
content-type: application/json; charset=utf-8

OPTIONS
H2 200 /
sdk.iad-01.braze.com/api/v3/data/ Frame 0
0 150ms
113ms Preflight 104.18.39.68
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-01.braze.com/api/v3/data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.39.68 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-triggersrequest,x-requested-with
Access-Control-Request-Method: POST
Origin: https://auth.onepeloton.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-triggersrequest,x-requested-with
access-control-allow-methods: POST, GET
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
cf-cache-status: DYNAMIC
cf-ray: 8fef308f2a454d95-FRA
content-encoding: gzip
date: Wed, 08 Jan 2025 21:13:07 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

POST
H2 201 / Show response
sdk.iad-01.braze.com/api/v3/data/ 8 KB
4 KB 233ms
232ms XHR
application/json 104.18.39.68
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-01.braze.com/api/v3/data/

Requested by

Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.39.68 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca65b60d2d4528a401f5fe2d9b894dba1d81ff8f99a3b4c77c3b39875edc86cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
X-Requested-With: XMLHttpRequest
X-Braze-TriggersRequest: true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
X-Braze-Api-Key: 57db7a4a-6f34-4ec9-9300-3bc6fe2e2a7a
X-Braze-DataRequest: true

Response headers

access-control-max-age: 7200
x-request-id: ec16f313-6e20-420d-97bf-2bde4b0e1558
access-control-expose-headers
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"ca65b60d2d4528a401f5fe2d9b894dba"
access-control-allow-methods: POST, GET
date: Wed, 08 Jan 2025 21:13:08 GMT
content-type: application/json
vary: Origin,Accept-Encoding
x-runtime: 0.120522
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=0, private, must-revalidate
x-ratelimit-reset: 1736370789
cf-ray: 8fef308fdaab4d95-FRA
x-ratelimit-remaining: 401.8716880263012
access-control-allow-origin: *
x-ratelimit-limit: 604.8716880263012
server: cloudflare

GET
H2 200 favicon.png
auth-deviceflow.onepeloton.com/universal-login/ 5 KB
5 KB 9ms
8ms Other
image/png 2a05:d014:58f:6201::1f4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-deviceflow.onepeloton.com/universal-login/favicon.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:58f:6201::1f4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c23a04be92733b59293473449d4c2b7dc7dce3d7214b9333fe6320f9973272eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-store
etag: "02d7114efa555136e4062016bdaa3400-ssl"
age: 20727
x-content-type-options: nosniff
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4872
x-nf-request-id: 01JH3W75ARP7FB5BHG3RW28ACX
cache-status: "Netlify Edge"; hit
date: Wed, 08 Jan 2025 21:13:07 GMT
content-type: image/png
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY

HEAD
H2 200 main.min.js Show response
client.px-cloud.net/PXIRnC16B3/ 0
0 0ms
0ms XHR
application/javascript 2a02:26f0:2780:66::217:e3d5
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://client.px-cloud.net/PXIRnC16B3/main.min.js
Requested by: Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:66::217:e3d5 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=600
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
content-encoding: gzip
etag: "1eae47c15a32d2a81ede4d28b778e2a7"
active-cdn: Akamai
expires: Wed, 08 Jan 2025 21:20:36 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 71039
date: Wed, 08 Jan 2025 21:13:07 GMT
last-modified: Wed, 08 Jan 2025 21:07:52 GMT
content-type: application/javascript; charset=utf-8
server: UploadServer
vary: Accept-Encoding

OPTIONS
H2 200 sync
sdk.iad-01.braze.com/api/v3/content_cards/ Frame 0
0 111ms
111ms Preflight 104.18.39.68
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-01.braze.com/api/v3/content_cards/sync

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.39.68 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-braze-api-key,x-braze-contentcardsrequest,x-braze-datarequest,x-requested-with
Access-Control-Request-Method: POST
Origin: https://auth.onepeloton.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-braze-api-key,x-braze-contentcardsrequest,x-braze-datarequest,x-requested-with
access-control-allow-methods: POST, GET
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
cf-cache-status: DYNAMIC
cf-ray: 8fef3091ac224d95-FRA
content-encoding: gzip
date: Wed, 08 Jan 2025 21:13:08 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

POST
H2 201 sync Show response
sdk.iad-01.braze.com/api/v3/content_cards/ 59 B
214 B 138ms
136ms XHR
application/json 104.18.39.68
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-01.braze.com/api/v3/content_cards/sync

Requested by

Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.39.68 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56ed64ba1a0f1af7b481c5ae8ea4124175048757a70b7e2defa1038edf0c8cf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
X-Braze-Api-Key: 57db7a4a-6f34-4ec9-9300-3bc6fe2e2a7a
X-Braze-DataRequest: true
X-Braze-ContentCardsRequest: true

Response headers

access-control-max-age: 7200
x-request-id: 385a78bd-bfa9-4517-9e3d-93dafac8a79b
access-control-expose-headers
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"56ed64ba1a0f1af7b481c5ae8ea41241"
access-control-allow-methods: POST, GET
date: Wed, 08 Jan 2025 21:13:08 GMT
content-type: application/json
vary: Origin,Accept-Encoding
x-runtime: 0.018736
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=0, private, must-revalidate
x-ratelimit-reset: 1736370789
cf-ray: 8fef30925cdc4d95-FRA
x-ratelimit-remaining: 331.0
access-control-allow-origin: *
x-ratelimit-limit: 500.0
server: cloudflare

POST
H2 202 rum Show response
rum.browser-intake-datadoghq.com/api/v2/ 53 B
135 B 158ms
154ms Fetch
application/json 2600:1f18:24e6:b901:5b01:a51e:fe46:50f5
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Afetch%2Cenv%3Aprod%2Cservice%3Auniversal-login&dd-api-key=pubfaf988ee52c62553df5c3b4497a7a464&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=391664a2-d840-4f20-bc59-640a031e4454&batch_time=1736370788353

Requested by

Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:24e6:b901:5b01:a51e:fe46:50f5 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

2fb9a61f4560bb2a05a4953343f01f962effbeecbdf6294a3101eaa042a659fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Wed, 08 Jan 2025 21:13:08 GMT
content-type: application/json
dd-request-id: 391664a2-d840-4f20-bc59-640a031e4454

POST
H2 200 collector Show response
collector-pxirnc16b3.px-cloud.net/api/v2/ 600 B
655 B 201ms
196ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxirnc16b3.px-cloud.net/api/v2/collector
Requested by: Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ed2fc7b295c23f51e035c374c3485063651851b99eb87aac11afa40155fd60db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://auth.onepeloton.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 600
date: Wed, 08 Jan 2025 21:13:08 GMT
content-type: application/json; charset=utf-8

POST
H3 200 collector Show response
collector-pxirnc16b3.px-cloud.net/api/v2/ 600 B
618 B 172ms
170ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxirnc16b3.px-cloud.net/api/v2/collector
Requested by: Host: auth-deviceflow.onepeloton.com
URL: https://auth-deviceflow.onepeloton.com/universal-login/_next/static/chunks/dde21195.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 86390f0570bbbcb0422f2010525d91acec6ad267231539252df92ec1830f4bc0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://auth.onepeloton.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 600
date: Wed, 08 Jan 2025 21:13:09 GMT
content-type: application/json; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: account.test-vercel.onepeloton.de
URL: blob:https://account.test-vercel.onepeloton.de/15e6fcf7-e95d-403e-81c0-eb9776f2ddba

Domain: api.onepeloton.de
URL: https://api.onepeloton.de/ecomm/store/de_webstore/digital_subscriptions/plans

Domain: api.onepeloton.de
URL: https://api.onepeloton.de/api/me

Domain: rum.browser-intake-datadoghq.com
URL: https://rum.browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Abeacon%2Cenv%3Aproduction%2Cservice%3Aaccount%2Cversion%3A0b7cac011197aad772f37ec1e013fc79a561279a&dd-api-key=pub480f4cef7391531bc264b29e802177b7&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=a64a2e96-4a7a-4933-b64e-957eec68948a&batch_time=1736370785720

Domain: session-replay.browser-intake-datadoghq.com
URL: https://session-replay.browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A4.50.1%2Capi%3Abeacon%2Cenv%3Aproduction%2Cservice%3Aaccount%2Cversion%3A0b7cac011197aad772f37ec1e013fc79a561279a&dd-api-key=pub480f4cef7391531bc264b29e802177b7&dd-evp-origin-version=4.50.1&dd-evp-origin=browser&dd-request-id=06fa5be0-72cb-4328-a5c6-ce5c3817a426

Domain: account.onepeloton.de
URL: blob:https://account.onepeloton.de/51d0e437-7430-472f-b07f-063a11377a2e

Verdicts & Comments Add Verdict or Comment

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.d1no8tpthtviug.cloudfront.net/events/2fb6ab867a82782f9eb69daaa5f29be2217e1af44fa36ad923acc8d43f8761ae	1970-01-21 04:29:06	Name: cee Value: mSPfUt7D7LFy93QaJqLHgkIGrvKRbIRDSYmiQcFbCk0%3D.%7B%7D
auth.onepeloton.com/usernamepassword/login	1970-01-21 02:33:54	Name: _csrf Value: ymIBKkleFhiYs0bzoU5njqWk
account.test-vercel.onepeloton.de/	1970-01-21 02:29:35	Name: accountOptimizelyEndUserId Value: 0abc87ad-67a1-424d-a0d4-09d7f444a49e
.onepeloton.de/	1970-01-21 11:05:06	Name: ajs_anonymous_id Value: 94929d4c-0fec-42b0-ae1d-27295d1f329b
.onepeloton.de/	1969-12-31 23:59:59	Name: amplitude_idundefinedonepeloton.de Value: eyJvcHRPdXQiOmZhbHNlLCJzZXNzaW9uSWQiOm51bGwsImxhc3RFdmVudFRpbWUiOm51bGwsImV2ZW50SWQiOjAsImlkZW50aWZ5SWQiOjAsInNlcXVlbmNlTnVtYmVyIjowfQ==
.onepeloton.de/	1970-01-21 11:55:30	Name: _ga Value: GA1.2.1491942282.1736370785
.onepeloton.de/	1970-01-21 02:20:57	Name: _gid Value: GA1.2.1868704325.1736370785
.onepeloton.de/	1970-01-21 02:19:30	Name: _gat Value: 1
.onepeloton.de/	1970-01-21 04:29:06	Name: _fbp Value: fb.1.1736370785259.316845224145396210
account.test-vercel.onepeloton.de/	1970-01-21 02:19:31	Name: _dd_s Value: rum=1&id=5698bc37-b2cd-44f0-a7bd-c080b3d14df6&created=1736370784524&expire=1736371684524
account.onepeloton.de/	1970-01-21 02:29:35	Name: accountOptimizelyEndUserId Value: aebd8ada-d96b-4ced-96a0-2e92bb72ac88
.onepeloton.de/	1970-01-21 11:55:30	Name: amplitude_id_ddcbf4f536a371f11f997a581e72d974onepeloton.de Value: eyJkZXZpY2VJZCI6ImI0ODEwMDE5LWUyNDktNDQ3Yi05NDVkLTY1NjE1NDgzY2RiYlIiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTczNjM3MDc4NDgyNCwibGFzdEV2ZW50VGltZSI6MTczNjM3MDc4NjQwMSwiZXZlbnRJZCI6MSwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjF9
.onepeloton.de/	1970-01-21 11:05:06	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Wed+Jan+08+2025+22%3A13%3A06+GMT%2B0100+(Mitteleurop%C3%A4ische+Normalzeit)&version=202304.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=06a9bf0e-1dc4-491e-86bc-6d4d4cdef658&interactionCount=1&landingPath=https%3A%2F%2Faccount.onepeloton.de%2Flogin%3FredirectUrl%3DaHR0cHM6Ly9hY2NvdW50Lm9uZXBlbG90b24uZGUvb3JkZXJoaXN0b3J5&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
auth.onepeloton.com/	1970-01-21 11:05:28	Name: did Value: s%3Av0%3Aa186d090-48af-40f0-b70c-409aeba48bf9.%2F081U56uzNEl51PDbXUD5fCBAYL6Iw9mJOU%2FHeI5gNI
auth.onepeloton.com/	1970-01-21 02:23:49	Name: auth0 Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQHKfQibcfuVpIfCgx6-Mgo2mrPrMAFRHb1HQa8CPkQMSEjmEFNymii0QP-5neD-ZqLo75EkIlncaEYJgQb8pxxOmY29va2llg6dleHBpcmVz1__MUyEAZ4Le4q5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.VfOz2RS6j2vmghpYMRI55xAkbeoKvd8P9rQZ3ASJYWQ
auth.onepeloton.com/	1970-01-21 11:05:28	Name: did_compat Value: s%3Av0%3Aa186d090-48af-40f0-b70c-409aeba48bf9.%2F081U56uzNEl51PDbXUD5fCBAYL6Iw9mJOU%2FHeI5gNI
auth.onepeloton.com/	1970-01-21 02:23:49	Name: auth0_compat Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQHKfQibcfuVpIfCgx6-Mgo2mrPrMAFRHb1HQa8CPkQMSEjmEFNymii0QP-5neD-ZqLo75EkIlncaEYJgQb8pxxOmY29va2llg6dleHBpcmVz1__MUyEAZ4Le4q5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.VfOz2RS6j2vmghpYMRI55xAkbeoKvd8P9rQZ3ASJYWQ
.onepeloton.com/	1970-01-21 02:19:32	Name: __cf_bm Value: DbJOIqSt4cMoJEK68ugOvQMDy_EUBr.SnA6xo6bpkAU-1736370786-1.0.1.1-iXxUFGBfgcQvb9V8TzoXPdbhJGK1geNYla0QQfV9D6d_3bRZh8IVKPwxMZ.qKijmHf35cyZ..Rw.Xs47LIwp4A
.onepeloton.com/	1969-12-31 23:59:59	Name: _cfuvid Value: bC8TTF.18fuR66NRpnaA8FnF5ypJ709TgJsNCy6We0g-1736370786917-0.0.1.1-604800000
account.onepeloton.de/	1970-01-21 02:19:31	Name: _dd_s Value: rum=1&id=9ed9107e-2d18-4da7-9592-0ea6f94138f1&created=1736370786190&expire=1736371686190
.onepeloton.com/	1970-01-21 11:05:06	Name: ajs_anonymous_id Value: dc011f40-6092-4410-b4dd-164aa5af755a
.onepeloton.com/	1969-12-31 23:59:59	Name: amplitude_idundefinedonepeloton.com Value: eyJvcHRPdXQiOmZhbHNlLCJzZXNzaW9uSWQiOm51bGwsImxhc3RFdmVudFRpbWUiOm51bGwsImV2ZW50SWQiOjAsImlkZW50aWZ5SWQiOjAsInNlcXVlbmNlTnVtYmVyIjowfQ==
.onepeloton.com/	1970-01-21 11:55:30	Name: amplitude_id_2df4dea1ca3baeecc41f78bd670e80c6onepeloton.com Value: eyJkZXZpY2VJZCI6ImE2YzhmNGVhLWQ1YzctNDFkMi04OTBhLTUxODZjMGQ2NWIwYlIiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTczNjM3MDc4NzYyNSwibGFzdEV2ZW50VGltZSI6MTczNjM3MDc4NzYyNSwiZXZlbnRJZCI6MCwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjB9
.onepeloton.com/	1970-01-21 11:05:27	Name: ab.storage.sessionId.57db7a4a-6f34-4ec9-9300-3bc6fe2e2a7a Value: %7B%22g%22%3A%225e3af6b7-4cbf-f37f-1efa-8cfd1782378d%22%2C%22e%22%3A1736370817663%2C%22c%22%3A1736370787663%2C%22l%22%3A1736370787663%7D
.onepeloton.com/	1970-01-21 11:05:27	Name: ab.storage.deviceId.57db7a4a-6f34-4ec9-9300-3bc6fe2e2a7a Value: %7B%22g%22%3A%2231e37271-cd8b-d7d7-3bf8-858f76173d00%22%2C%22c%22%3A1736370787664%2C%22l%22%3A1736370787664%7D
.onepeloton.com/	1969-12-31 23:59:59	Name: pxcts Value: 5b8c44d1-ce05-11ef-9a57-dc58a2ac856b
.onepeloton.com/	1970-01-21 11:05:06	Name: _pxvid Value: 5b8c35be-ce05-11ef-9a57-cc345f89e418
.onepeloton.com/	1970-01-21 02:19:31	Name: _px3 Value: 2ed8ce810c50ace5b93b44af43f2a1db4b7fc2671938cdaf794e86b78f239965:4dkybO/mckten8biOdL5mGX8dppLvXdMM5hylzw1aF3XgCentPkH5j2E6BGBvid6xdVaxUeXoQCfrpB9Li6s8w==:1000:U42Eh+cvaaGRDojvcdwOxjzqK8bb/a6EWKLlK56D5uun5U/XAxO6ikQ6kfTsKV+32+7tAw+hLFJcGEZaFxCSph0D2sOOjXbz0DgmLFdTHq0ES99GZJuyn1E6VnADTW1u/m6LjMKDaPJ1j4yK3BnRnOTF65fa9Tywc1dd4g3YvbGcIf7v8mIO+0nVCi0dq+NYVMF42EmreLONRQBUP5Wvk/Y4vm2tShzxc1KkmHrWVtI=
auth.onepeloton.com/	1970-01-21 02:19:31	Name: _dd_s Value: rum=2&id=2f82ece8-d166-4823-82d9-159806a0c6ac&created=1736370787375&expire=1736371687375

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://account.test-vercel.onepeloton.de/orderhistory Message: Access to XMLHttpRequest at 'https://api.onepeloton.de/api/me' from origin 'https://account.test-vercel.onepeloton.de' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.onepeloton.de/api/me Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://account.test-vercel.onepeloton.de/orderhistory Message: Access to XMLHttpRequest at 'https://api.onepeloton.de/ecomm/store/de_webstore/digital_subscriptions/plans' from origin 'https://account.test-vercel.onepeloton.de' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.onepeloton.de/ecomm/store/de_webstore/digital_subscriptions/plans Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://api.onepeloton.de/api/me Message: Failed to load resource: the server responded with a status of 401 ()
recommendation	verbose	URL: https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTlaUkFER0paZmFhOUp0ajdreHl0T0-jY2lk2SB6ekxyNzhjcWJhN0RkdEJnUkFYRlFybFI3eFAwRkFiNA&client=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&protocol=oauth2&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Faccount.onepeloton.de%2Fcallback&response_type=code&response_mode=query&nonce=ZzkzLnB5TTdiR0l5V2tMM2pFZUFGfjVmdGJKUmRZSUVjS0xLZWtHZXZDSA%3D%3D&code_challenge=gikV0o6Y07Da9MWTCYbNhbqZvZNWRIARbJGbsCtXbtA&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjIuMS4zIn0%3D&scope=email%20offline_access%20openid%20peloton-api.members%3Adefault%20profile#{%22message%22:%22%22} Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
rendering	warning	URL: https://auth.onepeloton.com/login?state=hKFo2SBYaXZFeU5XRWNMYkdGbWhvZmhSTnNMYUVQX1AyWFlCdKFupWxvZ2luo3RpZNkgTjl4ZGxHZ01NSTlaUkFER0paZmFhOUp0ajdreHl0T0-jY2lk2SB6ekxyNzhjcWJhN0RkdEJnUkFYRlFybFI3eFAwRkFiNA&client=zzLr78cqba7DdtBgRAXFQrlR7xP0FAb4&protocol=oauth2&audience=https%3A%2F%2Fapi.onepeloton.com%2F&redirect_uri=https%3A%2F%2Faccount.onepeloton.de%2Fcallback&response_type=code&response_mode=query&nonce=ZzkzLnB5TTdiR0l5V2tMM2pFZUFGfjVmdGJKUmRZSUVjS0xLZWtHZXZDSA%3D%3D&code_challenge=gikV0o6Y07Da9MWTCYbNhbqZvZNWRIARbJGbsCtXbtA&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjIuMS4zIn0%3D&scope=email%20offline_access%20openid%20peloton-api.members%3Adefault%20profile#{%22message%22:%22%22} Message: [GroupMarkerNotSet(crbug.com/242999)!:A000110C3C2B0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.onepeloton.de
account.test-vercel.onepeloton.de
api.onepeloton.de
api.segment.io
auth-deviceflow.onepeloton.com
auth.onepeloton.com
cdn.amplitude.com
cdn.cookielaw.org
cdn.optimizely.com
cdn.segment.com
client.px-cloud.net
collector-pxirnc16b3.px-cloud.net
connect.facebook.net
d1no8tpthtviug.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
graph.prod.k8s.onepeloton.de
js.appboycdn.com
js.stripe.com
p.typekit.net
peloton-support.ada.support
polyfill-fastly.io
privacyportal.onetrust.com
rollout.ada.support
rum.browser-intake-datadoghq.com
sdk.iad-01.braze.com
session-replay.browser-intake-datadoghq.com
static.ada.support
stats.g.doubleclick.net
stk.px-cloud.net
use.typekit.net
www.dwin1.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
account.onepeloton.de
account.test-vercel.onepeloton.de
api.onepeloton.de
rum.browser-intake-datadoghq.com
session-replay.browser-intake-datadoghq.com
104.18.39.68
13.33.187.45
13.33.187.68
142.250.184.227
142.250.74.206
157.240.0.35
157.240.0.6
18.245.86.101
18.245.86.69
18.66.147.53
18.66.147.95
2600:1f18:24e6:b900:1b9f:2fe7:7ce5:577a
2600:1f18:24e6:b901:5b01:a51e:fe46:50f5
2600:1f18:24e6:b902:3219:69a3:9bec:162d
2600:9000:214f:9000:f:8ce2:fb80:93a1
2600:9000:2646:f400:1b:1628:8a00:21
2606:4700:4400::6812:2089
2606:4700:4400::6812:2a5c
2606:4700:4400::ac40:9b77
2606:4700::6810:7809
2606:4700::6810:8f9b
2606:4700::6811:4ff9
2606:4700::6812:4139
2606:4700::6812:562a
2a00:1450:4001:803::200a
2a00:1450:4001:803::200e
2a00:1450:4001:80b::2008
2a00:1450:400c:c02::9d
2a02:26f0:2780:5e::210:a86d
2a02:26f0:2780:5e::210:a87d
2a02:26f0:2780:66::217:e3d5
2a04:4e42:200::347
2a05:d014:58f:6201::1f4
2a05:d014:58f:6202::1f4
34.107.199.61
35.163.144.222
35.190.10.96
52.12.47.65
76.76.21.61
99.86.8.175
08a743d4862301ea040bca7aa5c1c185e38d6a005dd1313bb42a41e99a0fd2b8
0b9727b0a251438fa6b04d37abe7bf7bdad071195dfd73451eab9275e6236522
0c9787eaa38917257431d71f65fe3c5fe573fbec6e980028f2e845d9d3b75cff
1114132a79b42ce8e5064f57a1560a3b3f0e1659afc33e4698bab53e1301fbfd
129151ed0140041b198ce3b364a11861a3b5baa5bb60475ebf7bedb9b0fc94d6
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254
13f291e92688d2dfc3cc58a8d2a78be5abf20dd0e2b1adc347025b190507132a
154622ca7dcf193a1b87ebe6dcfac1edee5d0652e7a5a812e4634c84ddb709bd
171bd4c9fb210e7c9053aa0eecefcb16a23eccdb03a9c592bdbaafe167cf757f
18fdc64789026ce5298cdbba07a0ee33a7aea13738c1f960fcb6a36233834e4b
1bafc9c6fe77db49f8ca2bbe80308499cf62cc2dc58638199c3f356b2f6c070b
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1dadfb9c08c7b4ebdcc01847c87fe2ceedd03b38380441addfd557f97106805a
1f8b947d8e006e73e40d14076551bcc3445569146eb2138d34493ec3162d4180
1fb57261e4b58b20af83c6d3266bacb9b7463da5bd3be0ae25239acbe8cba594
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
2173f130ca59dc5554498343432f02f92ecce45c4f9381ea12b203a2978f33d4
221cd076e521ed0d936f0717d98f3cf406ed84320df8451971e055aa0cece425
239e75bf2052fd597cc3ed84d8bebfcebd23ca849c2eb3aee9d175aa5e474226
265ac7549793e4b9d51f8ab19acc8518770ace94078790776b3ac34eb47e1bbd
278a98f434d57994d09311e4dd373f6b83b54f93cf64ff9dfc837f44ce9f2f7a
282f73a65b01f706504e703ecf17d19db3ed4e70229360882628296a17bd8389
2860c827fc3ab3562bd9394b8cfabbf35d37982e17903ea3789e80371a5778c9
2a433bf98a13e0f961dfa64f22efc4d67eda8ef5d0385c39c65a0a65efb59a71
2fb9a61f4560bb2a05a4953343f01f962effbeecbdf6294a3101eaa042a659fb
31892c21ae4fb908a875bbe29dbf0df74c2e84171cfbcac23540f3ad8222a35a
32751da10a79179d32f7858a53d89cc6484729c98616d9e7055c42b3123e7a51
3ccc8634464ba676580e8df08b99800da2004929913dc1e9e6c6c0d10bdd2a9c
3f543b1032dcce3a7c7483e27ed1f5010a3876781df65590927e5283f7f68e08
3fd9f160495e13ca8b9261831a698e2195ee4dc67c92253b6353af84511431f4
42c83f678b4ec7237a73a5558ee70dbfebca78f2575210b418eefcd76d25a879
43da18f909be2ce7b2a6908460d55c1e85440107401bb04706c2bf725ff55fe5
448d4362670a52342d3e8886246ff8fb3ae452cac58c2e0ed5ec4fbb90f9e717
4ae01e328d8a3f076724fa03e74de76296303ab4c634878cd3d29cac222a5215
4b5fb218f1afb6f5b1d9590d456209d5dc4228845e7d02b8cc597212f0994609
4c489e4126cc9c8b248da303553f9a8ec959235de30fbc2da6cf0a33e136c2fa
4d02cb435d29371a8381fd73ef9a55f9edd640825ab4d8fc0cb14a8cc6c8eead
4d757fbc9eec457dec98cf8985399c6b41d6a4b7f92c811d3ced96710c229613
4dbd328e347e890a801d51f9a5f8d38a3efd51ec34c0aa22cc83d0a95d6d9d71
4df53644d1c9fd651ccfd697977eb07d94cd744b0a4997568d67cc25ef44e483
52e5401f96ca9a7fc38248bf9469bdc7006f53de52d7abfec96f4a39cf665d6d
54c15884f96515b03b64359982faae845b9b339f0b6aac568393748fa3169f65
557c67c76c13a84e8b483ee1a0dfdd807399d960909266e7c6a83ddfadca9c81
56ed64ba1a0f1af7b481c5ae8ea4124175048757a70b7e2defa1038edf0c8cf1
5939e1101c8a2152ca04cf65d10194fd178f11ea541480606dc0977993b8d806
5c0dd42dcb0df8c024486f2f8cd9506624c527dd200e8a2c282dd5252322b89b
63792c455c0a9eec6295f427bae6d1759da01c706ea0f0893f21115f89ce7bc5
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bb88125bf9791b4f1b29ace16454069152663f037096117fe60858053f9176a
6cb607e7aa55a7d45ae1d3f352fcd137fd20ed64423f0d9dd79ac466027d531c
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
70621bd9db9915c0de2e43601e530d1a3f567daaecdd29d3f02ad71330c0ea7c
70f938a3fcad8718327c0a11607e5a31afcec1be7799fb5b60cffc8f813cc5b5
73eb48e7611ce70741b07f3785e266ad61a2be5329c0becc5956e7da492df16c
74796b8d1bac95a048704583e148718240e741e3b6bd242a6e17169679b12355
74b8a809c83c27461f1f8694b42b2bc15194c0df384082bf2f3e06bcb50de001
7b3f9977e4430713707bd0c59d452f27a77ecf7df9fd5bf3441d7e33eb7bac2d
7d1eff3b4683e642f85e2a86ab2ae845471804151199038fc684fc98b89a768b
80d298ea799b1fd54f43f152111cc64e6c8c0a594dd82ade0c62364979431843
831b24eb2e098f7593a23d342e3a3b0ad2c05c537cd1998dbee4d91bb3366332
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86390f0570bbbcb0422f2010525d91acec6ad267231539252df92ec1830f4bc0
86685e191878d9ecfd30ed1fe63cbb783bf9151607e9996342d64977013e3cff
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
8bdfb39f40a051a553089a1596f8790101a03663731854361720c79cf930e360
8d8ed45fa1225f060fe815022ac8a5bf4ea5386953071087803d9339fea48add
91b357a6d36166772c1fc0e42742d407497f675df7c5bc635c2814a9b656e1e0
9297194dd8d8e70248648b111b520ee15eff904fac85685ff19908a65b852183
96643bfad5a17eada947d707441559202c83a2cc9acb28aa860b7d64e3e55747
9a401df33dc7df3eb020d8deae2c55ea773ac4b8ef51138c02dac72eab0a3fbc
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9e2189d573b1df3fd3c684ba1f9ad2ad5cd2f8394f14dde87b5fde495bea200c
9e44588f804a9e422b87a47a0061bcdd1839951d5aeacfc13da76b6194976ac3
a0af8b5fd9182e1b7f254319a3d524e1707e621f7258028e7717585e96ff9212
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab40b0627690c3a1de674229faa0f36bb8f1f9577428e42d1c5c9cf0ed22015e
abbbe99a1650b4e0a8f26e05e90dcab533af5e033033132dfc0562b8a3d21b2c
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6
aec6a512a615d913caa4bbd5dd28749d0a43ae982d95caf3a2857fe8d654ec19
b03d8e35950c6ed45101c701521c86504a339b562e6efcba408a4db09098c9f5
b1a78f491eee5460af9e11159ab7875ad99ecb8a4172cd12811a02e92f468526
b20668648681257c8e4902be4f4d1a45ba47801a90afb6a343ed62bd22c6c94c
b393e30809aa2bafc0762eeae8257a29b458bfc0b5d68ed2c5831daf5a4dc75c
b883b25122b10585806b8b7e90f4b01b15e0f0b6885ed9bce207272365caa87b
b916d9871a9ad447630549f27cb7e1fcb0a84c81406ecbf323ecbaad1eba3e45
bc4ae72d43593c2fc59ead95f45eb0c3b02cd465fd427b3fff5224e476d26259
bd258ccdfbff0ab0351a3aee3f365e14020afa9649758f81e3b213c7794fd256
c23a04be92733b59293473449d4c2b7dc7dce3d7214b9333fe6320f9973272eb
c2e76418e33860f6a780f628500bd55bd225fa4142754595253e33f2867a4d27
c35c952ae0ec9b81bca14082d9db19570301ee37d1379c7a40bee06d1fd35c4d
c664e784d6cba355616ea0a6eb59603579a7b0e49fc4b9595264ba736aeccb4d
c763917e443b5583abccb9674edfaf82deada941ad5894d28c672c632fcd64dc
c88db2401bef7e1203e0933cc5525a0f81863bfd076756db12acea5596f089ec
ca65b60d2d4528a401f5fe2d9b894dba1d81ff8f99a3b4c77c3b39875edc86cc
cea2053be8e509589fe917b989317c05a16799e2d89ed1ea89b21870e3153631
d61b1f0c3f3cc5f4e38aede8f91eeb380953f9d04d0fa5087425a587a2b3a2ca
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
da2c3d36ad6548fd425dcfbb25dabfc258a97deaaa6f678f09355d3c285a8177
da71ba8136f0abe1f6b5869084c9af2d8b0da264cf63d0a67591550fa27c8e1d
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0dc135b262fd043b817efa3c76b4dc4cf3f69d0bcd773478d620b449e5e99c5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea427dd36bbcb476cbc5658d968dcb858d41316067cb9881b046bf41ae091542
ed2fc7b295c23f51e035c374c3485063651851b99eb87aac11afa40155fd60db
f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af
f1b208df2bdcac2dc6ba8b1d9d084f0ccdd303756e56d70f50dd39b02950d1ce
f646e416e3399950b6351a39e411fb650b2ad1ed9a7582f7f4b7b214e99b869a
fa62fbe9f68a3d29a3d195476e8c058d1d0863b316596cac0ab9c8b3f70e8892
fac32cab54964005de0d608de8f7da3205a0d8d8120a4fdb248936b20fa96fe7
fc19e2d873270cfa3ce69c2345fac36b8ab1b0fe2cd8983f0946a8c180f236b3
ff9354ac41f4bd2861bf3f160aa41885edda9da123777cb20024e7700090c4ce

auth.onepeloton.com Open in urlscan Pro 2606:4700::6811:4ff9 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

206 Requests

97 %HTTPS

57 %IPv6

25 Domains

36 Subdomains

41 IPs

5 Countries

4080 kBTransfer

17945 kBSize

29 Cookies

16 Outgoing links

Page URL History

Redirected requests

206 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

auth.onepeloton.com Open in urlscan Pro
2606:4700::6811:4ff9 Public Scan

Screenshot
Live screenshot

Full Image

206
Requests

97 %
HTTPS

57 %
IPv6

25
Domains

36
Subdomains

41
IPs

5
Countries

4080 kB
Transfer

17945 kB
Size

29
Cookies

206 HTTP transactions
0 data transactions