Submitted URL: https://events-c.mb.wealthyretirement.com/z/st0yt86r0shp04?uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&txnid=57ef6835-6630-4a3c-9873-59015ef3...
Effective URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342...
Submission: On July 14 via api from BE — Scanned from DE

Summary

This website contacted 14 IPs in 2 countries across 11 domains to perform 32 HTTP transactions. The main IP is 54.231.193.88, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is s3.amazonaws.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on May 25th 2024. Valid for: a year.
This is the only time s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2 192.135.136.168 11372 (14WEST-AS)
7 54.231.193.88 16509 (AMAZON-02)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2600:9000:20e... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 3.5.13.179 14618 (AMAZON-AES)
7 2606:4700:20:... 13335 (CLOUDFLAR...)
1 13.224.189.35 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 3.5.25.202 14618 (AMAZON-AES)
1 2a04:4e42::300 54113 (FASTLY)
4 18.245.60.65 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 35.166.170.248 16509 (AMAZON-02)
32 14
Apex Domain
Subdomains
Transfer
13 amazonaws.com
s3.amazonaws.com
portrait-tracker.s3.amazonaws.com — Cisco Umbrella Rank: 575780
dnzkifeab6.execute-api.us-east-1.amazonaws.com — Cisco Umbrella Rank: 520317
824 KB
7 lytics.io
c.lytics.io — Cisco Umbrella Rank: 12441
78 KB
3 gstatic.com
fonts.gstatic.com
62 KB
2 getblueshift.com
cdn.getblueshift.com — Cisco Umbrella Rank: 16850
api.getblueshift.com — Cisco Umbrella Rank: 15340
4 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 74
storage.googleapis.com — Cisco Umbrella Rank: 405
3 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 240
169 KB
2 oxfordclub.com
signup.oxfordclub.com
2 KB
1 taboola.com
trc.taboola.com — Cisco Umbrella Rank: 721
409 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 72
109 KB
1 web-purchases.com
images.web-purchases.com
89 KB
1 wealthyretirement.com
events-c.mb.wealthyretirement.com
2 KB
32 11
Domain Requested by
7 c.lytics.io portrait-tracker.s3.amazonaws.com
c.lytics.io
s3.amazonaws.com
7 s3.amazonaws.com s3.amazonaws.com
4 dnzkifeab6.execute-api.us-east-1.amazonaws.com portrait-tracker.s3.amazonaws.com
3 fonts.gstatic.com fonts.googleapis.com
2 portrait-tracker.s3.amazonaws.com s3.amazonaws.com
portrait-tracker.s3.amazonaws.com
2 cdnjs.cloudflare.com s3.amazonaws.com
cdnjs.cloudflare.com
2 signup.oxfordclub.com 2 redirects
1 api.getblueshift.com cdn.getblueshift.com
1 storage.googleapis.com c.lytics.io
1 trc.taboola.com s3.amazonaws.com
1 www.googletagmanager.com portrait-tracker.s3.amazonaws.com
1 cdn.getblueshift.com portrait-tracker.s3.amazonaws.com
1 fonts.googleapis.com s3.amazonaws.com
1 images.web-purchases.com s3.amazonaws.com
1 events-c.mb.wealthyretirement.com 1 redirects
32 15

This site contains links to these domains. Also see Links.

Domain
oxfordclub.com
privacyportal-cdn.onetrust.com
Subject Issuer Validity Valid
s3.amazonaws.com
Amazon RSA 2048 M01
2024-05-25 -
2025-05-02
a year crt.sh
cdnjs.cloudflare.com
E1
2024-06-02 -
2024-08-31
3 months crt.sh
images.web-purchases.com
Amazon RSA 2048 M03
2024-05-02 -
2025-05-31
a year crt.sh
upload.video.google.com
WR2
2024-06-24 -
2024-09-16
3 months crt.sh
*.gstatic.com
WR2
2024-06-24 -
2024-09-16
3 months crt.sh
*.s3.amazonaws.com
Amazon RSA 2048 M01
2024-04-22 -
2025-04-07
a year crt.sh
lytics.io
WE1
2024-07-12 -
2024-10-10
3 months crt.sh
*.getblueshift.com
Amazon RSA 2048 M02
2024-06-08 -
2025-07-06
a year crt.sh
*.google-analytics.com
WR2
2024-06-24 -
2024-09-16
3 months crt.sh
*.taboola.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-10-23 -
2024-11-22
a year crt.sh
*.execute-api.us-east-1.amazonaws.com
Amazon RSA 2048 M03
2024-01-08 -
2025-02-04
a year crt.sh
storage.googleapis.com
WR2
2024-06-24 -
2024-09-16
3 months crt.sh

This page contains 2 frames:

Primary Page: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Frame ID: EBCEBD611C2ABAAEA5F1F21C5DB410A5
Requests: 29 HTTP requests in this frame

Frame: https://portrait-tracker.s3.amazonaws.com/index.html
Frame ID: D99B8F8C7552D9F99B11FFF9DE62C246
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

The Oxford Club

Page URL History Show full URLs

  1. https://events-c.mb.wealthyretirement.com/z/st0yt86r0shp04?uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&txnid=57ef6835-663... HTTP 307
    https://signup.oxfordclub.com/2332968?bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d4... HTTP 301
    https://signup.oxfordclub.com/X3024691?bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d... HTTP 302
    https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js

Page Statistics

32
Requests

100 %
HTTPS

56 %
IPv6

11
Domains

15
Subdomains

14
IPs

2
Countries

1336 kB
Transfer

2084 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://events-c.mb.wealthyretirement.com/z/st0yt86r0shp04?uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&mid=6b051f58-0019-4a4d-9b87-a982650de1d3&utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_ek=2024-06-26T20:30:45Z&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE&bsft_mime_type=text&bsft_tv=12&bsft_lx=6) HTTP 307
    https://signup.oxfordclub.com/2332968?bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3A30%3A45Z&bsft_lx=6%29&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE HTTP 301
    https://signup.oxfordclub.com/X3024691?bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE HTTP 302
    https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.html
s3.amazonaws.com/assets.oxfordclub.com/offer-expired/
Redirect Chain
  • https://events-c.mb.wealthyretirement.com/z/st0yt86r0shp04?uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&mid=6b051f58-0019-4a4d-9b87-a982650de1d3&utid=7385b1cd...
  • https://signup.oxfordclub.com/2332968?bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c4...
  • https://signup.oxfordclub.com/X3024691?bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c...
  • https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email...
19 KB
20 KB
Document
General
Full URL
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.231.193.88 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
ae6b193647883af2819e11e6dde4b3c1b65712278f5a937b7d6d6bf51c652f46

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Content-Length
19775
Content-Type
text/html
Date
Sun, 14 Jul 2024 07:52:14 GMT
ETag
"07c94a68f66d98fcb0a00b3344ac7d12"
Last-Modified
Fri, 13 Jan 2023 22:06:54 GMT
Server
AmazonS3
x-amz-id-2
KcvGqewi7em8nBBn8mSfnL3Sc1TGxU+rgyveq9PHYpSQ/3Vg3bKGMe4zF9ylOhpM3XMdWbECskM=
x-amz-request-id
DV02Z7H1FVKC7JT7
x-amz-server-side-encryption
AES256
x-amz-version-id
r3sa3rMZvZ4WksWDTFHmW698tEfSmv28

Redirect headers

Cache-Control
private
Content-Length
909
Content-Type
text/html; charset=utf-8
Date
Sun, 14 Jul 2024 07:52:12 GMT
Location
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Referrer-Policy
no-referrer-when-downgrade
Strict-Transport-Security
max-age=63072000; includeSubDomains
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/
98 KB
17 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0df5a33710e433de1f5415b1d47e4130ca7466aee5b81955f1045c4844bbb3ed
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:52:13 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
152226
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
17041
last-modified
Tue, 22 Mar 2022 17:32:26 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"623a082a-4291"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WcOEkfQT4ZgtzFqMRhbU4GuSAl27cu2%2F2s%2FMKie4aFh0UU%2BOIOO8yikIDoKrcF%2FxR6pvP80FnUal49CBXYVQfZ9P8%2Fe%2FVxJIRjIMIN6AzpcmEl4Zy3tK4i1HzsnuehkP2e2%2FpR%2BkYYU0Wrz4qD1EgX6f"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8a2fee9b8a6591ea-FRA
expires
Fri, 04 Jul 2025 07:52:13 GMT
style.css
s3.amazonaws.com/assets.oxfordclub.com/offer-expired/
5 KB
5 KB
Stylesheet
General
Full URL
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/style.css
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.231.193.88 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
b1dbd75ca740585abeb799d14670b8961de7f043dbec65f5fde0ca0d4039b22c

Request headers

Referer
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sun, 14 Jul 2024 07:52:14 GMT
x-amz-version-id
a4L0X2pkqVAZQcNPDjlVCrc55cE5aUxQ
Last-Modified
Tue, 24 May 2022 23:54:06 GMT
Server
AmazonS3
x-amz-request-id
DV0A5MA00CN2EXG5
ETag
"0e524ca473e45038dae0b45899f11dd6"
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
4870
x-amz-id-2
chazrBJhoWrOfyyU+tXK08Fs2iWB5EOaMdkiutbhAO1Nv+Ig+u8RNa7aDRx6EJQ6XWxCexFN1iE=
main.css
s3.amazonaws.com/assets.oxfordclub.com/templates/css/
41 KB
41 KB
Stylesheet
General
Full URL
https://s3.amazonaws.com/assets.oxfordclub.com/templates/css/main.css
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.231.193.88 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
05a18efa3838c035fcc10ade9b8102ebb019d74f38804ede69c34da0e3743ec0

Request headers

Referer
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sun, 14 Jul 2024 07:52:14 GMT
x-amz-version-id
EkRyP.sW3sFKJ1W5uIeOKVsQls6uhaxm
Last-Modified
Mon, 04 Mar 2024 22:08:25 GMT
Server
AmazonS3
x-amz-request-id
DV0CJE4Z7P974V42
ETag
"187059d9d13d020afac4023deb66d1b4"
x-amz-server-side-encryption
AES256
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
41982
x-amz-id-2
Pw5OpOxCb/++fqN/EyO7+VuGGaOtqBMceC5VbZf+vKAjruFM9rPEQfI1sb8Sx/8X55MMeLFEVpE=
app.e0b3505d.js
s3.amazonaws.com/assets.oxfordclub.com/offer-expired/js/
12 KB
13 KB
Script
General
Full URL
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/js/app.e0b3505d.js
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.231.193.88 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
aad37a06cab88f3ece40245ea6d932a3b0e92245d7a452eb3061cb00ff6338bf

Request headers

Referer
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sun, 14 Jul 2024 07:52:14 GMT
x-amz-version-id
FziTebfF0O9Ij34LOeAA0O.5HawHng6i
Last-Modified
Tue, 24 May 2022 23:54:05 GMT
Server
AmazonS3
x-amz-request-id
DV06DWGA4YJEDGJY
ETag
"6d9addf9d6428a1b3538f5622d01f2c8"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
12476
x-amz-id-2
YijF/yBczNAccv116KQg0tDjfbkCpQ0PFWFswvZGLanttxzuCZx2mqcehx3jblsQA1CD9W8X+ww=
chunk-vendors.6e029b24.js
s3.amazonaws.com/assets.oxfordclub.com/offer-expired/js/
628 KB
628 KB
Script
General
Full URL
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/js/chunk-vendors.6e029b24.js
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.231.193.88 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
237100a2171bcaedd04953386fb451ed4e5bca58041b396071239f836b623bf5

Request headers

Referer
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sun, 14 Jul 2024 07:52:14 GMT
x-amz-version-id
zqr8s3d3hV4fSiGH4hjknL69VtAZ5R2R
Last-Modified
Tue, 24 May 2022 23:54:05 GMT
Server
AmazonS3
x-amz-request-id
DV0B8S86J6NNWM96
ETag
"cc6eee2a1d8d086cb804710ae63508b8"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
642653
x-amz-id-2
pjlH4r9+mUuisuDuxlByIjSc1LAhDRbt5VpUNIH0xa7sfbjmX/p0iErGS3oXd6Lylig4qd1E7/c=
club.svg
s3.amazonaws.com/assets.oxfordclub.com/templates/img/logos/
17 KB
17 KB
Image
General
Full URL
https://s3.amazonaws.com/assets.oxfordclub.com/templates/img/logos/club.svg
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Protocol
HTTP/1.1
Security
TLS 1.3, , CHACHA20_POLY1305
Server
54.231.193.88 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
81b96479150cc204ea824d0a2139434464bea24b86bfca92523c5fb9ec5ddb67

Request headers

Referer
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sun, 14 Jul 2024 07:52:14 GMT
x-amz-version-id
null
Last-Modified
Tue, 19 Nov 2019 18:50:54 GMT
Server
AmazonS3
x-amz-request-id
DV07JDAT8CM7ZBFR
ETag
"ded8376e6e0b8381295e11874af0ba43"
Content-Type
image/svg+xml
Accept-Ranges
bytes
Content-Length
16998
x-amz-id-2
79SHW0lKMYU+YXpjGPir7fO40f1bLhL9g/IEO/5L/MX5RjRHFCllGvbzCfyJw9PqyznK/U5GMPM=
vip_team.jpg
images.web-purchases.com/Library-14/
88 KB
89 KB
Image
General
Full URL
https://images.web-purchases.com/Library-14/vip_team.jpg
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:5a00:18:2d84:13c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a701c6c881955840582d9cc6255d4e5e062e7c1cc7450180d6f563a58c74e318

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-amz-version-id
dvTVb4fFdIZeIoFUps5IJjdhSLbnCbR4
date
Sun, 14 Jul 2024 07:50:14 GMT
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
120
x-cache
Hit from cloudfront
x-amz-replication-status
FAILED
content-length
90092
last-modified
Fri, 22 Jun 2018 12:28:49 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1529670473/ctime:1529670474/gid:1000/gname:opiumcdn/md5:ea545066176593508bc52ceb27092acc/mode:33188/mtime:1529670474/uid:1000/uname:opiumcdn
etag
"ea545066176593508bc52ceb27092acc"
vary
Accept-Encoding
content-type
image/jpeg
accept-ranges
bytes
x-amz-cf-id
kBKvXxH8feA46SzMIOZbNiqsi7cszvi5iQQOzzSIM7iSdlQRbLmYrA==
css
fonts.googleapis.com/
15 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=PT+Serif:400,400i,700,700i|Source+Sans+Pro:400,400i,700,700i&display=swap
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/templates/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4bbcf69bd383b8c4b713af7e0d1cf853151c78f4682b5b6e9c18eeb3ce1e71ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sun, 14 Jul 2024 07:52:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sun, 14 Jul 2024 07:52:13 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 14 Jul 2024 07:52:13 GMT
6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/
14 KB
14 KB
Font
General
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,400i,700,700i|Source+Sans+Pro:400,400i,700,700i&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s3.amazonaws.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 09 Jul 2024 09:37:53 GMT
x-content-type-options
nosniff
age
425660
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14712
x-xss-protection
0
last-modified
Thu, 01 Jun 2023 22:52:57 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Jul 2025 09:37:53 GMT
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,400i,700,700i|Source+Sans+Pro:400,400i,700,700i&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s3.amazonaws.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 09 Jul 2024 09:31:18 GMT
x-content-type-options
nosniff
age
426055
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14892
x-xss-protection
0
last-modified
Thu, 01 Jun 2023 22:52:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Jul 2025 09:31:18 GMT
EJRVQgYoZZY2vCFuvAFWzr8.woff2
fonts.gstatic.com/s/ptserif/v18/
32 KB
33 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ptserif/v18/EJRVQgYoZZY2vCFuvAFWzr8.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,400i,700,700i|Source+Sans+Pro:400,400i,700,700i&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4271064a37f3ffc0aac5f3806db8a72acc23e19447d1804e4e80d8796cbf6330
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s3.amazonaws.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 09 Jul 2024 09:38:17 GMT
x-content-type-options
nosniff
age
425636
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33116
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:52:25 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 09 Jul 2025 09:38:17 GMT
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/
151 KB
151 KB
Font
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d76fb4e841748a3f6bc63efa23156e02631c283bf41f84efcbdaf339ea3e1b73
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css
Origin
https://s3.amazonaws.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:52:13 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
181340
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
154228
last-modified
Tue, 22 Mar 2022 17:32:26 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"623a082a-25a74"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ECTN8db9GusYHCWYmmQzYjuVOYKSnfT0hDZCk%2F6GIYBT2Lvpz4QF9ieIAu4SFSB2Bnl2ip46TJZ3cy8qZ1J4i3%2FLMMAuZZcPZxGoFb71jkWpJiuSDaa3khjrXZY9RHDAOmIoiUI%2B7yI3sxTBy0oJcuef"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8a2fee9dbc0130f0-FRA
expires
Fri, 04 Jul 2025 07:52:13 GMT
all.js
portrait-tracker.s3.amazonaws.com/
38 KB
38 KB
Script
General
Full URL
https://portrait-tracker.s3.amazonaws.com/all.js
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/js/app.e0b3505d.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.5.13.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
s3-w.us-east-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
0d442120d2b60deb30df02e017358ba9e8057e57af2a52aadaceb08200dc5118

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sun, 14 Jul 2024 07:52:15 GMT
x-amz-version-id
DJTsKKAXZAjX88yytY8IZ9oo.cyFutLW
Last-Modified
Tue, 12 Mar 2024 18:03:33 GMT
Server
AmazonS3
x-amz-request-id
HN01DTNH2ZTFT1CF
ETag
"7a4866af82b3d9c4147211938ab5004d"
x-amz-server-side-encryption
AES256
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
38527
x-amz-id-2
4WzZYa4Cj7WxV8XIt7/YXFXydGlIsfIx7pJWZLqbKN/YvKL/21IUGuAT5STrzyMvj9oZ5xqGApMhVoTqNzQdyuAVB15BSECP5L39TLmerFo=
latest.min.js
c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/
68 KB
23 KB
Script
General
Full URL
https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js
Requested by
Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:316 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b84647256daa900e5c30a9d2ce23df4ce10661b09173492210bf5448296fca8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000;

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:52:14 GMT
content-encoding
gzip
via
1.1 google
strict-transport-security
max-age=63072000;
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
7158
last-modified
Sun, 14 Jul 2024 05:52:56 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5VBMg%2BGzMVDdt3C8nhiaTmL5jhvoEzIEfvLtpscXGcl2wC1zsvjl6YgO3rI1yt6Jb0ICOS6bej1nGHb69HK4paZ9Xy6Ly3Imxb0BSiCvmhBgq%2FHj29K296AquYTxBRU05sfdwjLM01p8"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=7200
x-lytics-trace
9b9290ddbbc9744d40185ebee23e534e
cf-ray
8a2feea47e3e65d6-FRA
blueshift.js
cdn.getblueshift.com/
6 KB
3 KB
Script
General
Full URL
https://cdn.getblueshift.com/blueshift.js
Requested by
Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.224.189.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-35.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a97c4e09767a155128f03c8a72efccc7d8e38e2e8e78daf14c8e5beaf72ff1a5

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sun, 14 Jul 2024 07:28:32 GMT
Content-Encoding
gzip
Via
1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2-C1
Age
1423
x-amz-server-side-encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
2826
Last-Modified
Wed, 24 Jan 2024 03:44:50 GMT
Server
AmazonS3
ETag
"bd39fba69cd2745738daf44e0e350f6e"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=3600
Accept-Ranges
bytes
X-Amz-Cf-Id
7YLjI_1ByWYdFC8hw6CwQtIa1H0ctaDUnZvkpVzCvL5IV5oxm1UAhg==
gtm.js
www.googletagmanager.com/
365 KB
109 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KTM4C7C
Requested by
Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a891ca7311acca486dcd486877a3a033bf45c320b727db6e6b6c200a2ea10f3a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:52:14 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
111092
x-xss-protection
0
last-modified
Sun, 14 Jul 2024 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 14 Jul 2024 07:52:14 GMT
index.html
portrait-tracker.s3.amazonaws.com/ Frame D99B
0
0
Document
General
Full URL
https://portrait-tracker.s3.amazonaws.com/index.html
Requested by
Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol
HTTP/1.1
Security
TLS 1.3, , CHACHA20_POLY1305
Server
3.5.25.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://s3.amazonaws.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Content-Length
2371
Content-Type
text/html
Date
Sun, 14 Jul 2024 07:52:16 GMT
ETag
"c029f674b13b082e9a03b16217c3f576"
Last-Modified
Wed, 03 Nov 2021 21:10:09 GMT
Server
AmazonS3
x-amz-id-2
F3UxzGTXsKpEBMetahh9kbQCNxaQQedmJnCdmMnC40h8u1lzmIcmSOrkA34ut1NeSWNzL1SCNbw+hm00B/PlINLYz+bdoB0s2mQeaPUkn3E=
x-amz-request-id
ZW8KC4T0SJDK2K00
x-amz-version-id
X1zblgbOV1d.Qkc55AyQidmgNGbabuW5
cccb8188-34c1-4432-8f84-93eab03a9b46
c.lytics.io/api/personalize/9c32784e3cc4888a693a7988ad64c63d/user/_uid/
91 KB
14 KB
Script
General
Full URL
https://c.lytics.io/api/personalize/9c32784e3cc4888a693a7988ad64c63d/user/_uid/cccb8188-34c1-4432-8f84-93eab03a9b46?segments=true&mergestate=true&state=%7B%22_uid%22%3A%22cccb8188-34c1-4432-8f84-93eab03a9b46%22%2C%22utm_medium%22%3A%22email%22%2C%22utm_source%22%3A%22blueshift%22%2C%22utm_campaign%22%3A%2220240626_WR_Green%22%2C%22_sesstart%22%3A%221%22%2C%22_tz%22%3A2%2C%22_ul%22%3A%22de-DE%22%2C%22_sz%22%3A%221600x1200%22%2C%22_nmob%22%3A%22t%22%2C%22_device%22%3A%22desktop%22%2C%22url%22%3A%22s3.amazonaws.com%2Fassets.oxfordclub.com%2Foffer-expired%2Findex.html%3Fcampaign%3DTOTBio%26bsft_aaid%3D782fb40b-7585-4cb2-b342-5e6bb6114589%26bsft_eid%3D7bcf2da9-3d47-407a-8406-d2bcd58d294e%26utm_medium%3Demail%26utm_source%3Dblueshift%26bsft_clkid%3Dc2c7b806-548d-4c42-af97-6512ed15afcd%26bsft_uid%3D7385b1cd-b78e-4ddb-9f53-a22cb8ce0718%26bsft_mid%3D6b051f58-0019-4a4d-9b87-a982650de1d3%26bsft_txnid%3D57ef6835-6630-4a3c-9873-59015ef3d6cb%26bsft_utid%3D7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE%26bsft_mime_type%3Dtext%26bsft_ek%3D2024-06-26T20%253a30%253a45Z%26bsft_lx%3D6)%26bsft_tv%3D12%26pk%3Db509e14c9b46959debc21bd642eb3f00%26utm_campaign%3D20240626_WR_Green%26vid2%3Dd89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5%26listCode%3DWEALTHRE%22%2C%22_v%22%3A%223.0.36%22%7D&ts=1720943534937&callback=u_17121394755893248
Requested by
Host: c.lytics.io
URL: https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:316 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7aeb61be747c85521151858e0583511fd3d2a072bf90eff934994c31806940c
Security Headers
Name Value
Strict-Transport-Security max-age=63072000;

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:52:15 GMT
content-encoding
gzip
via
1.1 google
strict-transport-security
max-age=63072000;
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A1%2BHR6pZacpx0YCdF4y%2FLUhg%2BPSxFk2im50jhXzhCu%2BdBilU8Bd91ErNFuiBbV%2BY4sjRzchMlHEH1VCNSFW1xaz6Q0lQvQxqyb31g29xj9gwjvf2wovTp22MyXKMAF2%2B1auNnQDnd1GP"}],"group":"cf-nel","max_age":604800}
x-lytics-trace
ea94238b5f13431419293057fca86ae9
cf-ray
8a2feea56fb065d6-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, Cookie, *
9c32784e3cc4888a693a7988ad64c63d
c.lytics.io/c/
35 B
601 B
Image
General
Full URL
https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d?_e=pv&utm_medium=email&utm_source=blueshift&utm_campaign=20240626_WR_Green&_sesstart=1&_tz=2&_ul=de-DE&_sz=1600x1200&_ts=1720943534934&_nmob=t&_device=desktop&url=s3.amazonaws.com%2Fassets.oxfordclub.com%2Foffer-expired%2Findex.html%3Fcampaign%3DTOTBio%26bsft_aaid%3D782fb40b-7585-4cb2-b342-5e6bb6114589%26bsft_eid%3D7bcf2da9-3d47-407a-8406-d2bcd58d294e%26utm_medium%3Demail%26utm_source%3Dblueshift%26bsft_clkid%3Dc2c7b806-548d-4c42-af97-6512ed15afcd%26bsft_uid%3D7385b1cd-b78e-4ddb-9f53-a22cb8ce0718%26bsft_mid%3D6b051f58-0019-4a4d-9b87-a982650de1d3%26bsft_txnid%3D57ef6835-6630-4a3c-9873-59015ef3d6cb%26bsft_utid%3D7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE%26bsft_mime_type%3Dtext%26bsft_ek%3D2024-06-26T20%253a30%253a45Z%26bsft_lx%3D6)%26bsft_tv%3D12%26pk%3Db509e14c9b46959debc21bd642eb3f00%26utm_campaign%3D20240626_WR_Green%26vid2%3Dd89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5%26listCode%3DWEALTHRE&_v=3.0.36&_uid=cccb8188-34c1-4432-8f84-93eab03a9b46&_getid=t
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:316 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=63072000;

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:52:15 GMT
strict-transport-security
max-age=63072000;
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length
35
pragma
no-cache
server
cloudflare
access-control-allow-methods
GET, POST
content-type
image/gif
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ot8HDtfJI6PIclywgvlUi1bzoG%2BPNxGMAI1SC%2FA1TAzjJ%2FBp%2BkiMozB4Z90Hbnr%2B4bpypgAxliZYUy1BiJUNDR3JoHUVzaBc1bArSkd1xXx%2BAP1XJIBo3v0QcqgQzMYRZiCmbntfPlhU"}],"group":"cf-nel","max_age":604800}
cache-control
no-cache, no-store, must-revalidate
x-lytics-trace
40f0aa95240567600d5670ac2b3cc5e9
cf-ray
8a2feea56fb265d6-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Cookie, *
expires
0
cm
trc.taboola.com/sg/lytics/1/
43 B
409 B
Image
General
Full URL
https://trc.taboola.com/sg/lytics/1/cm?redirect=https%3A%2F%2Fc.lytics.io%2Fc%2Fprovider%2Ftaboola%3Ftaboola_id%3D%3CTUID%3E%26_uid%3Dcccb8188-34c1-4432-8f84-93eab03a9b46%26account_id%3D9c32784e3cc4888a693a7988ad64c63d
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Sun, 14 Jul 2024 07:52:15 GMT
via
1.1 varnish
x-fastly-to-nlb-rtt
7443
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version
v1
x-served-by
cache-fra-etou8220078-FRA
pragma
no-cache
server
nginx
x-timer
S1720943535.218812,VS0,VE9
access-control-allow-origin
*
cache-control
no-cache, no-store
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
favicon.ico
s3.amazonaws.com/assets.oxfordclub.com/favicons/
4 KB
5 KB
Other
General
Full URL
https://s3.amazonaws.com/assets.oxfordclub.com/favicons/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.231.193.88 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
38c46a02f7c5dd1719fece73d0a0c572cc1a6863a59e8c553c6a486e96a51f0f

Request headers

Referer
https://s3.amazonaws.com/assets.oxfordclub.com/offer-expired/index.html?campaign=TOTBio&bsft_aaid=782fb40b-7585-4cb2-b342-5e6bb6114589&bsft_eid=7bcf2da9-3d47-407a-8406-d2bcd58d294e&utm_medium=email&utm_source=blueshift&bsft_clkid=c2c7b806-548d-4c42-af97-6512ed15afcd&bsft_uid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718&bsft_mid=6b051f58-0019-4a4d-9b87-a982650de1d3&bsft_txnid=57ef6835-6630-4a3c-9873-59015ef3d6cb&bsft_utid=7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE&bsft_mime_type=text&bsft_ek=2024-06-26T20%3a30%3a45Z&bsft_lx=6)&bsft_tv=12&pk=b509e14c9b46959debc21bd642eb3f00&utm_campaign=20240626_WR_Green&vid2=d89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5&listCode=WEALTHRE
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sun, 14 Jul 2024 07:52:16 GMT
x-amz-version-id
5Nvh2BlwWq7MT.e2waxFCMlmLlXzsOOw
Last-Modified
Tue, 30 Jan 2024 19:50:24 GMT
Server
AmazonS3
x-amz-request-id
ZW8WDRJP8NKF9EDW
ETag
"3b928fef3b28769a321e971289f6393e"
x-amz-server-side-encryption
AES256
Content-Type
image/x-icon
Accept-Ranges
bytes
Content-Length
4286
x-amz-id-2
yyF1e6Y9uVfUDqnxAbzQaZvtiliBU6lPjT4LbqZMXVsFh1hcXLGsXLM1Cqy2/qjQRE0IE68Vkdg=
GetBlueshiftUserData
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/
8 KB
9 KB
XHR
General
Full URL
https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetBlueshiftUserData
Requested by
Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.60.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-60-65.fra60.r.cloudfront.net
Software
/
Resource Hash
25170bb274fca75d88e7dc241fe902793c0556c5f62dac468cd30883b4799da7

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 14 Jul 2024 07:52:16 GMT
via
1.1 4d156fc02c81ad97b906c107779265e2.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P5
x-amzn-trace-id
Root=1-669383af-16c32f9052dccd6b1de8360a;Parent=57d22f4aff72c370;Sampled=0;lineage=1b8d1031:0
x-amzn-requestid
6269a2df-83e4-4633-8f4a-36839ef13db9
access-control-allow-methods
DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
content-type
application/json
access-control-allow-origin
*
x-cache
Miss from cloudfront
access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
x-amz-apigw-id
a5GDhF-EoAMEh0w=
content-length
8546
x-amz-cf-id
M0npRiew6n1ki0GMWyROwtVFMDZ4wmy5MtACrDoHCS89z0rs4cF8Cg==
GetBlueshiftUserData
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ Frame
0
0
Preflight
General
Full URL
https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetBlueshiftUserData
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.60.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-60-65.fra60.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://s3.amazonaws.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
*
content-length
3
content-type
application/json
date
Sun, 14 Jul 2024 07:52:15 GMT
via
1.1 4d156fc02c81ad97b906c107779265e2.cloudfront.net (CloudFront)
x-amz-apigw-id
a5GDeEdLIAMEJUw=
x-amz-cf-id
lgCWvEia2ifDHNJuh9cf_iCvJNsX86i-ON54l4l_LviKUVlTFxw8QA==
x-amz-cf-pop
FRA60-P5
x-amzn-requestid
f70fcbdb-adce-42be-88a8-e7bd31171f24
x-cache
Miss from cloudfront
pathfora.min.js
c.lytics.io/static/
103 KB
22 KB
Script
General
Full URL
https://c.lytics.io/static/pathfora.min.js
Requested by
Host: c.lytics.io
URL: https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:316 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f6e70fc4337b6769a4c498cf721491cb1f31a14e342cb9c584ccea00fee9d1b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000;

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:52:15 GMT
strict-transport-security
max-age=63072000;
via
1.1 google
cf-cache-status
HIT
last-modified
Sun, 14 Jul 2024 06:06:57 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6318
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CiLPbeZLK8qHnrsnp4UmuvLksLLLXsUjkTMxgqVzrgg1RtMLD%2B6QTVz6G5g8%2FcRcne%2B86AJpGwEehl5JFa3AYIiBnHFZELS4FndJXMhDnaFE7bePWuAyMSgDyNZZ4ukllCAISwcjZF%2FE"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
content-encoding
br
cache-control
max-age=7200
cf-ray
8a2feea9ffad65d6-FRA
pathfora.min.css
c.lytics.io/static/
20 KB
4 KB
Stylesheet
General
Full URL
https://c.lytics.io/static/pathfora.min.css
Requested by
Host: c.lytics.io
URL: https://c.lytics.io/static/pathfora.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:316 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
464ad5d70f6d5fe4adef4d3057e1ae91e4983b02ef4ec9db0b067dcad4e53685
Security Headers
Name Value
Strict-Transport-Security max-age=63072000;

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:52:15 GMT
strict-transport-security
max-age=63072000;
via
1.1 google
cf-cache-status
HIT
last-modified
Sun, 14 Jul 2024 07:15:58 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2177
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uY5qdCLzLyRBjIENXswF1TTH%2Ba6BQ%2B0hA4UcOhKokUU2MLP%2BsuaEAHPZEpFwzMzJatrh8gfNVsVk%2Fgi5EmOMcGgEJ%2FJXwYXPhDiQZ8mSt3y23CM1pfz7c3ZBMK0ewJ30YrQA5Ph1WLXX"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
content-encoding
br
cache-control
max-age=7200
cf-ray
8a2feeaa3ffb65d6-FRA
lytics_overrides.min.css
storage.googleapis.com/lioservices/2470-oxford-club/
602 B
1 KB
Stylesheet
General
Full URL
https://storage.googleapis.com/lioservices/2470-oxford-club/lytics_overrides.min.css
Requested by
Host: c.lytics.io
URL: https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::201b Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
0efd1a0f2f52ed3d1bbd90257616b1f3f057163e50e3ed7d36af06ffa10b7b06

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:50:03 GMT
age
132
x-guploader-uploadid
ACJd0NoEmcDDXCUZHNGP-q7qg9YLELQsA-ofX54bdylnblBshtSnB159vuAhy6efAqhzhHcQ3TE
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
602
last-modified
Thu, 04 Oct 2018 21:47:26 GMT
server
UploadServer
etag
"9df2d5ae6031369aa6e0f3685608cd8c"
x-goog-generation
1538689646128559
x-goog-hash
crc32c=VZEimQ==, md5=nfLVrmAxNpqm4PNoVgjNjA==
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-stored-content-length
602
accept-ranges
bytes
content-type
text/css
expires
Sun, 14 Jul 2024 08:50:03 GMT
config.js
c.lytics.io/api/experience/candidate/9c32784e3cc4888a693a7988ad64c63d/
197 KB
14 KB
Script
General
Full URL
https://c.lytics.io/api/experience/candidate/9c32784e3cc4888a693a7988ad64c63d/config.js
Requested by
Host: c.lytics.io
URL: https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:316 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
982f7da2aafd4a951d511eb60f4e2c35014500710c959c1dd0ec6fe48b33a24f
Security Headers
Name Value
Strict-Transport-Security max-age=63072000;

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:52:15 GMT
content-encoding
gzip
via
1.1 google
strict-transport-security
max-age=63072000;
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
7156
last-modified
Sun, 14 Jul 2024 05:52:59 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FNydckHkJ9CqLx2qkYdBuHOGWWWEyeimRVE8EuouTGfUmtSOb9nPw1hS%2Fh%2FqAT1s4doFQl5%2FStBS3tm6spBKc260nPMmFmdjnFSDrDaJxt75h6iKFL2IAY1F3PZPbhdrDaoQLxqPXZ%2FG"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=7200
x-lytics-trace
5343acc3d67ef21988d3805fa84b9dfb
cf-ray
8a2feeaaa8a365d6-FRA
GetLyticsUserData
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/
47 KB
48 KB
XHR
General
Full URL
https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetLyticsUserData
Requested by
Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.60.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-60-65.fra60.r.cloudfront.net
Software
/
Resource Hash
69ad1a9f93ccda948634b969ea66505ce0c617fe34c872a1c2bfca686fe52f34

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 14 Jul 2024 07:52:16 GMT
via
1.1 4d156fc02c81ad97b906c107779265e2.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P5
x-amzn-trace-id
Root=1-669383b0-58f918c42350d3f97c7d9a8f;Parent=75db2467403b3e62;Sampled=0;lineage=17be0e8a:0
x-amzn-requestid
f0b7ccba-5131-45bf-a5d1-27471051d441
access-control-allow-methods
DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
content-type
application/json
access-control-allow-origin
*
x-cache
Miss from cloudfront
access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
x-amz-apigw-id
a5GDrHPxoAMELjA=
content-length
48599
x-amz-cf-id
79r4GG4t-VDUno3FnRarHLxZ9rll5OP8WlRkOG7jo3A5Cgi1wv9iQA==
GetLyticsUserData
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ Frame
0
0
Preflight
General
Full URL
https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetLyticsUserData
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.60.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-60-65.fra60.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://s3.amazonaws.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
*
content-length
3
content-type
application/json
date
Sun, 14 Jul 2024 07:52:16 GMT
via
1.1 4d156fc02c81ad97b906c107779265e2.cloudfront.net (CloudFront)
x-amz-apigw-id
a5GDoGuXoAMEoxw=
x-amz-cf-id
VgY8K257JVUKyRPQ01d3AU8PDqfxRJo2eQ9IkOJ1TUsOog-8EIhXTw==
x-amz-cf-pop
FRA60-P5
x-amzn-requestid
7a56c8ba-d7f5-4afc-944b-925db20fe5b1
x-cache
Miss from cloudfront
9c32784e3cc4888a693a7988ad64c63d
c.lytics.io/c/
35 B
470 B
Image
General
Full URL
https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d?email=suspect%40safeonweb.be&_ts=1720943536288&_nmob=t&_device=desktop&url=s3.amazonaws.com%2Fassets.oxfordclub.com%2Foffer-expired%2Findex.html%3Fcampaign%3DTOTBio%26bsft_aaid%3D782fb40b-7585-4cb2-b342-5e6bb6114589%26bsft_eid%3D7bcf2da9-3d47-407a-8406-d2bcd58d294e%26utm_medium%3Demail%26utm_source%3Dblueshift%26bsft_clkid%3Dc2c7b806-548d-4c42-af97-6512ed15afcd%26bsft_uid%3D7385b1cd-b78e-4ddb-9f53-a22cb8ce0718%26bsft_mid%3D6b051f58-0019-4a4d-9b87-a982650de1d3%26bsft_txnid%3D57ef6835-6630-4a3c-9873-59015ef3d6cb%26bsft_utid%3D7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE%26bsft_mime_type%3Dtext%26bsft_ek%3D2024-06-26T20%253a30%253a45Z%26bsft_lx%3D6)%26bsft_tv%3D12%26pk%3Db509e14c9b46959debc21bd642eb3f00%26utm_campaign%3D20240626_WR_Green%26vid2%3Dd89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5%26listCode%3DWEALTHRE&_uid=cccb8188-34c1-4432-8f84-93eab03a9b46&_v=3.0.36&_uido=cccb8188-34c1-4432-8f84-93eab03a9b46
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:316 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=63072000;

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:52:16 GMT
strict-transport-security
max-age=63072000;
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length
35
pragma
no-cache
server
cloudflare
access-control-allow-methods
GET, POST
content-type
image/gif
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F%2BR5mdDCdPs8%2Bs8tb0lG69fPdBi7VdUQj1yVr%2BXwb0IeEYb43BvStmw7NduMuXOqGZVKQ5NZ%2FYvMBpEyKSsjpV43kUKblkZaWiHOE1wOXybkJ0GSz82yDdWZ3VLAlPeTYmPKSouGEhCe"}],"group":"cf-nel","max_age":604800}
cache-control
no-cache, no-store, must-revalidate
x-lytics-trace
5309de18c6707780b734cfab625511fe
cf-ray
8a2feeadec9b65d6-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Cookie, *
expires
0
unity.gif
api.getblueshift.com/
42 B
230 B
XHR
General
Full URL
https://api.getblueshift.com/unity.gif?t=1720943536&e=pageload&r=&z=974970&x=5475fa15fca6698857e67e2705849cfa&k=3c06974a-1e30-a9bd-1e53-9fd767950473&u=https%3A%2F%2Fs3.amazonaws.com%2Fassets.oxfordclub.com%2Foffer-expired%2Findex.html%3Fcampaign%3DTOTBio%26bsft_aaid%3D782fb40b-7585-4cb2-b342-5e6bb6114589%26bsft_eid%3D7bcf2da9-3d47-407a-8406-d2bcd58d294e%26utm_medium%3Demail%26utm_source%3Dblueshift%26bsft_clkid%3Dc2c7b806-548d-4c42-af97-6512ed15afcd%26bsft_uid%3D7385b1cd-b78e-4ddb-9f53-a22cb8ce0718%26bsft_mid%3D6b051f58-0019-4a4d-9b87-a982650de1d3%26bsft_txnid%3D57ef6835-6630-4a3c-9873-59015ef3d6cb%26bsft_utid%3D7385b1cd-b78e-4ddb-9f53-a22cb8ce0718-WEALTHRE%26bsft_mime_type%3Dtext%26bsft_ek%3D2024-06-26T20%253a30%253a45Z%26bsft_lx%3D6)%26bsft_tv%3D12%26pk%3Db509e14c9b46959debc21bd642eb3f00%26utm_campaign%3D20240626_WR_Green%26vid2%3Dd89e3a2e980d5d49a55624a94464cd1241f162b0d63dcde451105e6841b21924022f1daec4312d75c818ef80c44477a5%26listCode%3DWEALTHRE
Requested by
Host: cdn.getblueshift.com
URL: https://cdn.getblueshift.com/blueshift.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.166.170.248 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-166-170-248.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
https://s3.amazonaws.com
date
Sun, 14 Jul 2024 07:52:16 GMT
access-control-expose-headers
etag
content-length
42
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
image/gif

Verdicts & Comments Add Verdict or Comment

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| webpackJsonp string| event_api_key object| jstag string| _blueshiftid object| blueshift object| bundles object| portraitReady object| portraitLyticsLoaded object| portraitPageLoaded object| portraitPurchase object| portraitReversePurchase object| portraitIdentity object| portraitEventTrigger object| portraitXHRHook boolean| initIdentityCallComplete object| liosetup object| dataLayer object| Portrait object| __lytics__jstag__ object| google_tag_manager object| google_tag_data string| clientid object| pathfora object| _pfacfg string| ly_cookie_id string| req

7 Cookies

Domain/Path Name / Value
.events-c.mb.wealthyretirement.com/ Name: __cf_bm
Value: eezdmcGqLESlsc0Q.15jU5ZDXqk_vR2djmfbsTyMN4w-1720943532-1.0.1.1-.Cb58hkECO2zcjXdC4WZX6yG6x91cqSo85pThDbvM5A1uYgXO7abmoNsKca_aG1XPx3UwDnq0YTwZQ.IWk6pGQ
signup.oxfordclub.com/ Name: 2332968
Value: 2768185
signup.oxfordclub.com/ Name: BIGipServerIRIS_PROD_HTTPS_POOL
Value: 1526792202.47873.0000
s3.amazonaws.com/ Name: seerses
Value: e
s3.amazonaws.com/ Name: seerid
Value: cccb8188-34c1-4432-8f84-93eab03a9b46
.lytics.io/ Name: seerid
Value: cccb8188-34c1-4432-8f84-93eab03a9b46
s3.amazonaws.com/ Name: _bs
Value: 3c06974a-1e30-a9bd-1e53-9fd767950473

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.getblueshift.com
c.lytics.io
cdn.getblueshift.com
cdnjs.cloudflare.com
dnzkifeab6.execute-api.us-east-1.amazonaws.com
events-c.mb.wealthyretirement.com
fonts.googleapis.com
fonts.gstatic.com
images.web-purchases.com
portrait-tracker.s3.amazonaws.com
s3.amazonaws.com
signup.oxfordclub.com
storage.googleapis.com
trc.taboola.com
www.googletagmanager.com
13.224.189.35
18.245.60.65
192.135.136.168
2600:9000:20eb:5a00:18:2d84:13c0:93a1
2606:4700:20::681a:316
2606:4700::6811:180e
2606:4700::6811:1e55
2a00:1450:4001:81d::2003
2a00:1450:4001:827::2008
2a00:1450:4001:82a::201b
2a00:1450:4001:831::200a
2a04:4e42::300
3.5.13.179
3.5.25.202
35.166.170.248
54.231.193.88
05a18efa3838c035fcc10ade9b8102ebb019d74f38804ede69c34da0e3743ec0
0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce
0d442120d2b60deb30df02e017358ba9e8057e57af2a52aadaceb08200dc5118
0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94
0df5a33710e433de1f5415b1d47e4130ca7466aee5b81955f1045c4844bbb3ed
0efd1a0f2f52ed3d1bbd90257616b1f3f057163e50e3ed7d36af06ffa10b7b06
1f6e70fc4337b6769a4c498cf721491cb1f31a14e342cb9c584ccea00fee9d1b
237100a2171bcaedd04953386fb451ed4e5bca58041b396071239f836b623bf5
25170bb274fca75d88e7dc241fe902793c0556c5f62dac468cd30883b4799da7
38c46a02f7c5dd1719fece73d0a0c572cc1a6863a59e8c553c6a486e96a51f0f
4271064a37f3ffc0aac5f3806db8a72acc23e19447d1804e4e80d8796cbf6330
464ad5d70f6d5fe4adef4d3057e1ae91e4983b02ef4ec9db0b067dcad4e53685
4bbcf69bd383b8c4b713af7e0d1cf853151c78f4682b5b6e9c18eeb3ce1e71ce
69ad1a9f93ccda948634b969ea66505ce0c617fe34c872a1c2bfca686fe52f34
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762
81b96479150cc204ea824d0a2139434464bea24b86bfca92523c5fb9ec5ddb67
982f7da2aafd4a951d511eb60f4e2c35014500710c959c1dd0ec6fe48b33a24f
9b84647256daa900e5c30a9d2ce23df4ce10661b09173492210bf5448296fca8
a701c6c881955840582d9cc6255d4e5e062e7c1cc7450180d6f563a58c74e318
a891ca7311acca486dcd486877a3a033bf45c320b727db6e6b6c200a2ea10f3a
a97c4e09767a155128f03c8a72efccc7d8e38e2e8e78daf14c8e5beaf72ff1a5
aad37a06cab88f3ece40245ea6d932a3b0e92245d7a452eb3061cb00ff6338bf
ae6b193647883af2819e11e6dde4b3c1b65712278f5a937b7d6d6bf51c652f46
b1dbd75ca740585abeb799d14670b8961de7f043dbec65f5fde0ca0d4039b22c
d76fb4e841748a3f6bc63efa23156e02631c283bf41f84efcbdaf339ea3e1b73
e7aeb61be747c85521151858e0583511fd3d2a072bf90eff934994c31806940c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629