form.respondi.app Open in urlscan Pro
172.67.43.15  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request yhgbpo40 Show response form.respondi.app/	21 KB 6 KB	436ms 344ms	Document text/html	172.67.43.15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form.respondi.app/yhgbpo40 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.43.15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5315286efe1ef341c36f60603d4eb3bd431c8a34f3504e16574ebc90319cf0c9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store cf-cache-status MISS cf-ray 8d30f596cb7353f5-YYZ content-encoding br content-type text/html; charset=utf-8 date Tue, 15 Oct 2024 15:49:29 GMT nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} report-to {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1729007368&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=RL4zVgz%2B6Q0EesYDsg5%2Bp2f8MRAWCS874uyD3iIk3Go%3D"}]} reporting-endpoints heroku-nel=https://nel.heroku.com/reports?ts=1729007368&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=RL4zVgz%2B6Q0EesYDsg5%2Bp2f8MRAWCS874uyD3iIk3Go%3D server cloudflare server-timing cfExtPri vary Accept-Encoding via 1.1 vegur x-respondent-id 7d4f170a-2f78-4ccb-b481-b37664f558e1
GET H3	200	8ac90e9.js Show response form.respondi.app/_nuxt/	2 KB 2 KB	112ms 111ms	Script application/javascript	172.67.43.15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form.respondi.app/_nuxt/8ac90e9.js Requested by Host: form.respondi.app URL: https://form.respondi.app/yhgbpo40 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.43.15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6e96f9c1eff1e40c620c97291682287ff3d61efa81534713571ed91b95acaf40 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/yhgbpo40 Response headers content-encoding gzip cf-cache-status REVALIDATED etag W/"975-1928c91ea90" report-to {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1728935660&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=pR9SUpxzZudaAU9u2vjbr8hu6BcQI8zPngTNll8vf3c%3D"}]} alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript; charset=UTF-8 last-modified Mon, 14 Oct 2024 19:47:06 GMT vary Accept-Encoding reporting-endpoints heroku-nel=https://nel.heroku.com/reports?ts=1728935660&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=pR9SUpxzZudaAU9u2vjbr8hu6BcQI8zPngTNll8vf3c%3D cache-control public, max-age=31536000, no-store nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} via 1.1 vegur cf-ray 8d30f598fd0153f5-YYZ server cloudflare
GET H3	200	a0a3d81.js Show response form.respondi.app/_nuxt/	249 KB 86 KB	86ms 84ms	Script application/javascript	172.67.43.15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form.respondi.app/_nuxt/a0a3d81.js Requested by Host: form.respondi.app URL: https://form.respondi.app/yhgbpo40 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.43.15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67d62ac8c281bb6714213d08ad7066eb36e2efc787d212a02be308c17c6ab627 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/yhgbpo40 Response headers content-encoding gzip cf-cache-status REVALIDATED etag W/"3e4cd-1928c91ea90" report-to {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1728936333&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=aMeNZ6w6kuTY2VDoy1mXH0%2BKtkBAWDVJthfoX%2BHRRtY%3D"}]} alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript; charset=UTF-8 last-modified Mon, 14 Oct 2024 19:47:06 GMT vary Accept-Encoding reporting-endpoints heroku-nel=https://nel.heroku.com/reports?ts=1728936333&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=aMeNZ6w6kuTY2VDoy1mXH0%2BKtkBAWDVJthfoX%2BHRRtY%3D cache-control public, max-age=31536000, no-store nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} via 1.1 vegur cf-ray 8d30f598fd0653f5-YYZ server cloudflare
GET H3	200	8217cfb.js Show response form.respondi.app/_nuxt/	411 KB 131 KB	170ms 169ms	Script application/javascript	172.67.43.15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form.respondi.app/_nuxt/8217cfb.js Requested by Host: form.respondi.app URL: https://form.respondi.app/yhgbpo40 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.43.15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a2b7070ab7424960120e3ce5820193d5da9afe4909e73951c425ddab9ff32667 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/yhgbpo40 Response headers content-encoding gzip cf-cache-status REVALIDATED etag W/"66cc7-1928c91ea90" report-to {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1728936333&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=aMeNZ6w6kuTY2VDoy1mXH0%2BKtkBAWDVJthfoX%2BHRRtY%3D"}]} alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript; charset=UTF-8 last-modified Mon, 14 Oct 2024 19:47:06 GMT vary Accept-Encoding reporting-endpoints heroku-nel=https://nel.heroku.com/reports?ts=1728936333&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=aMeNZ6w6kuTY2VDoy1mXH0%2BKtkBAWDVJthfoX%2BHRRtY%3D cache-control public, max-age=31536000, no-store nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} via 1.1 vegur cf-ray 8d30f598fd0853f5-YYZ server cloudflare
GET H3	200	87d2b73.js Show response form.respondi.app/_nuxt/	65 KB 20 KB	200ms 199ms	Script application/javascript	172.67.43.15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form.respondi.app/_nuxt/87d2b73.js Requested by Host: form.respondi.app URL: https://form.respondi.app/yhgbpo40 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.43.15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0995c3ebc9205062e85a2100815a065d4df3cdb358e628354b889cf8d27f2442 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/yhgbpo40 Response headers content-encoding gzip cf-cache-status REVALIDATED etag W/"10210-1928c91ea90" report-to {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1728935660&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=pR9SUpxzZudaAU9u2vjbr8hu6BcQI8zPngTNll8vf3c%3D"}]} alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript; charset=UTF-8 last-modified Mon, 14 Oct 2024 19:47:06 GMT vary Accept-Encoding reporting-endpoints heroku-nel=https://nel.heroku.com/reports?ts=1728935660&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=pR9SUpxzZudaAU9u2vjbr8hu6BcQI8zPngTNll8vf3c%3D cache-control public, max-age=31536000, no-store nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} via 1.1 vegur cf-ray 8d30f598fd0a53f5-YYZ server cloudflare
GET H3	200	40144fb.js Show response form.respondi.app/_nuxt/	290 KB 72 KB	201ms 199ms	Script application/javascript	172.67.43.15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form.respondi.app/_nuxt/40144fb.js Requested by Host: form.respondi.app URL: https://form.respondi.app/yhgbpo40 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.43.15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cb6e7ad01a56529e06018e82289d4abeb4ca5f8ba1ecf8e39fddfb5d82646d21 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/yhgbpo40 Response headers content-encoding gzip cf-cache-status REVALIDATED etag W/"48864-1928c91ea90" report-to {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1728935661&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=8XXYWjKgfP2n9Wt51aPsxMxaK4w%2FtMKyBB3Zp4abkY0%3D"}]} alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript; charset=UTF-8 last-modified Mon, 14 Oct 2024 19:47:06 GMT vary Accept-Encoding reporting-endpoints heroku-nel=https://nel.heroku.com/reports?ts=1728935661&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=8XXYWjKgfP2n9Wt51aPsxMxaK4w%2FtMKyBB3Zp4abkY0%3D cache-control public, max-age=31536000, no-store nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} via 1.1 vegur cf-ray 8d30f598fd0c53f5-YYZ server cloudflare
GET H3	200	a2f9490.js Show response form.respondi.app/_nuxt/	48 KB 17 KB	223ms 222ms	Script application/javascript	172.67.43.15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form.respondi.app/_nuxt/a2f9490.js Requested by Host: form.respondi.app URL: https://form.respondi.app/yhgbpo40 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.43.15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1a137fd0d4651a300c790020e55f7ee6f7f7338a92d0cb67388aba52d0dc0d32 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/yhgbpo40 Response headers content-encoding gzip cf-cache-status REVALIDATED etag W/"bfd5-1928c91ea90" report-to {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1728936333&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=aMeNZ6w6kuTY2VDoy1mXH0%2BKtkBAWDVJthfoX%2BHRRtY%3D"}]} alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript; charset=UTF-8 last-modified Mon, 14 Oct 2024 19:47:06 GMT vary Accept-Encoding reporting-endpoints heroku-nel=https://nel.heroku.com/reports?ts=1728936333&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=aMeNZ6w6kuTY2VDoy1mXH0%2BKtkBAWDVJthfoX%2BHRRtY%3D cache-control public, max-age=31536000, no-store nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} via 1.1 vegur cf-ray 8d30f598fd0e53f5-YYZ server cloudflare
GET H3	200	9e5a57e.js Show response form.respondi.app/_nuxt/	845 KB 251 KB	224ms 223ms	Script application/javascript	172.67.43.15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form.respondi.app/_nuxt/9e5a57e.js Requested by Host: form.respondi.app URL: https://form.respondi.app/yhgbpo40 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.43.15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fbc283504d84f28fb2aad1db73a4969f3d34a74e1f2f3050a9656fcef5a08ea5 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/yhgbpo40 Response headers content-encoding gzip cf-cache-status REVALIDATED etag W/"d34a6-1928c91ea90" report-to {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1728936333&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=aMeNZ6w6kuTY2VDoy1mXH0%2BKtkBAWDVJthfoX%2BHRRtY%3D"}]} alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript; charset=UTF-8 last-modified Mon, 14 Oct 2024 19:47:06 GMT vary Accept-Encoding reporting-endpoints heroku-nel=https://nel.heroku.com/reports?ts=1728936333&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=aMeNZ6w6kuTY2VDoy1mXH0%2BKtkBAWDVJthfoX%2BHRRtY%3D cache-control public, max-age=31536000, no-store nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} via 1.1 vegur cf-ray 8d30f598fd1053f5-YYZ server cloudflare
GET H3	200	rocket-loader.min.js Show response form.respondi.app/cdn-cgi/scripts/7d0fa10a/cloudflare-static/	12 KB 4 KB	30ms 29ms	Script application/javascript	172.67.43.15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form.respondi.app/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Requested by Host: form.respondi.app URL: https://form.respondi.app/yhgbpo40 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.43.15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/yhgbpo40 Response headers cache-control max-age=172800, public content-encoding gzip etag W/"67055fd4-302c" x-content-type-options nosniff cf-ray 8d30f5992d3953f5-YYZ expires Thu, 17 Oct 2024 15:49:29 GMT server-timing cfExtPri date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript last-modified Tue, 08 Oct 2024 16:37:40 GMT vary Accept-Encoding server cloudflare x-frame-options DENY
GET H2	200	gtm.js Show response www.googletagmanager.com/	295 KB 102 KB	160ms 94ms	Script application/javascript	2607:f8b0:4006:80c::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-KMM7VSN Requested by Host: form.respondi.app URL: https://form.respondi.app/_nuxt/87d2b73.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80c::2008 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b6241d7cce45754795ccc2a1b888ec5002accc1b272b55fecbb6cad5a274c29b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Tue, 15 Oct 2024 15:49:29 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Tue, 15 Oct 2024 15:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 104219 x-xss-protection 0 server Google Tag Manager
GET H3	200	fbevents.js Show response connect.facebook.net/en_US/	227 KB 58 KB	62ms 26ms	Script application/x-javascript	157.240.241.1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: form.respondi.app URL: https://form.respondi.app/_nuxt/87d2b73.js Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-lga3.fbcdn.net Software / Resource Hash 91aff3588efba0074124bbd204b45de0da882a853f29a1d73f7ec132291c5651 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Tue, 15 Oct 2024 15:49:29 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=25, rtx=0, c=23, mss=1232, tbw=4460, tp=9, tpl=0, uplat=0, ullat=-1 pragma public x-fb-debug vMcMAVuKnPSS9UDtGgKeTcuGh6Nq3sfDrS8pHnj+sFlPeRDMTuWZTxf/T9zIBxRSvOxl0fYkLk3gW+lNsfHVKw== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top content-length 59352 x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	nLbUorkU4rbjRSVmYVkmDTVChzYG1lbvo6TuHZBl.jpg respondiassets.sfo3.digitaloceanspaces.com/userfiles/19448/	52 KB 52 KB	353ms 170ms	Image image/jpeg	138.68.34.161 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://respondiassets.sfo3.digitaloceanspaces.com/userfiles/19448/nLbUorkU4rbjRSVmYVkmDTVChzYG1lbvo6TuHZBl.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 138.68.34.161 , United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS sfo3.digitaloceanspaces.com Software / Resource Hash fe2b334a795006ab221e3d452867b845112994806721ace9dc9bd8f220553039 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers strict-transport-security max-age=15552000; includeSubDomains; preload x-envoy-upstream-healthchecked-cluster etag "7a2c3e1654f0e7ca1cd3fcf5a5e61710" x-amz-request-id tx0000067b5182a25b82cc2-00670e8f09-5c26a2b3-sfo3a accept-ranges bytes content-length 52964 x-rgw-object-type Normal date Tue, 15 Oct 2024 15:49:29 GMT last-modified Fri, 21 Oct 2022 13:30:55 GMT content-type image/jpeg vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method
GET H3	200	normal.woff2 form.respondi.app/cf-fonts/s/lato/5.0.18/latin/400/	23 KB 23 KB	46ms 46ms	Font application/octet-stream	172.67.43.15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form.respondi.app/cf-fonts/s/lato/5.0.18/latin/400/normal.woff2 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.43.15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://form.respondi.app Referer https://form.respondi.app/yhgbpo40 Response headers cache-control public, max-age=31536000, immutable cf-cache-status HIT cf-ray 8d30f59bffa653f5-YYZ alt-svc h3=":443"; ma=86400 server-timing cfExtPri content-length 23580 date Tue, 15 Oct 2024 15:49:29 GMT vary Accept-Encoding server cloudflare
GET H2	200	js Show response www.googletagmanager.com/gtag/	309 KB 105 KB	77ms 75ms	Script application/javascript	2607:f8b0:4006:80c::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-K4SSW8GR9B&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMM7VSN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80c::2008 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 50c35e098c7b0d44ba195f4c2bffd327a157b9ce695bb9a6f52e7141e1f96774 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Tue, 15 Oct 2024 15:49:29 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 106808 x-xss-protection 0 server Google Tag Manager
GET H2	200	hotjar-2136024.js Show response static.hotjar.com/c/	13 KB 6 KB	156ms 104ms	Script application/javascript	108.138.106.49 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-2136024.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMM7VSN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.106.49 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-106-49.jfk50.r.cloudfront.net Software / Resource Hash 0ffb9bbd67307d63d109d61dbff5d07eede6c2910d3df9e9eac116cc0b617c8a Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=60 content-encoding br etag W/ec8fbc4e3ba9ccf4a366a97faf90d652 cross-origin-resource-policy cross-origin x-content-type-options nosniff x-cache-hit 1 via 1.1 8ef35b07fe667674a2922c9d83a75c52.cloudfront.net (CloudFront) access-control-allow-origin * x-cache RefreshHit from cloudfront x-amz-cf-id sSO77PpLcZVqE-Bdg785dSshT2E-ktAIjW3JFJI24kIT4Q5mN4gIYg== date Tue, 15 Oct 2024 15:49:29 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding x-amz-cf-pop JFK50-P3
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	90ms 27ms	Script text/javascript	2607:f8b0:4006:822::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMM7VSN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:822::200e , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers content-encoding gzip age 3172 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],} x-content-type-options nosniff expires Tue, 15 Oct 2024 16:56:37 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 15 Oct 2024 14:56:37 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0 cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 20994 server Golfe2
POST H2	200	collect Show response www.google-analytics.com/j/	15 B 435 B	41ms 40ms	XHR text/plain	2607:f8b0:4006:822::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=63725274&t=pageview&_s=1&dl=https%3A%2F%2Fform.respondi.app%2Fyhgbpo40&ul=en-ca&de=UTF-8&dt=Limpamos%20seu%20CPF%2FCNPJ%20ou%20devolvemos%20seu%20dinheiro.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=993022090&gjid=804521006&cid=525245929.1729007370&tid=UA-4782576-38&_gid=1908443847.1729007370&_r=1&_slc=1&gtm=45He4a90n81KMM7VSNv836227149za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101686685&z=1841290472 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:822::200e , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash defeacc663d1e51ce001dbc23ac644bc3f7061794318df4cb9b940b0b32011c7 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Content-Type text/plain Referer https://form.respondi.app/ Response headers report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],} x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 15 Oct 2024 15:49:29 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type text/plain cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0 access-control-allow-origin https://form.respondi.app cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 15 server Golfe2
POST H2	204	collect analytics.google.com/g/	0 0	294ms 50ms	Fetch text/plain	2001:4860:4802:38::181 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://analytics.google.com/g/collect?v=2&tid=G-K4SSW8GR9B&gtm=45je4a90v872321687z8836227149za200zb836227149&_p=1729007369518&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533421~101686685&cid=525245929.1729007370&ecid=1769229117&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1729007369&sct=1&seg=0&dl=https%3A%2F%2Fform.respondi.app%2Fyhgbpo40&dt=Limpamos%20seu%20CPF%2FCNPJ%20ou%20devolvemos%20seu%20dinheiro.&en=page_view&_fv=1&_ss=1&tfd=1310 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K4SSW8GR9B&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:38::181 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://form.respondi.app cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 15 Oct 2024 15:49:30 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 555 B	284ms 41ms	Ping text/plain	2607:f8b0:4004:c06::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-K4SSW8GR9B&cid=525245929.1729007370&gtm=45je4a90v872321687z8836227149za200zb836227149&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101533421~101686685 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K4SSW8GR9B&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c06::9c Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://form.respondi.app cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 15 Oct 2024 15:49:30 GMT content-type text/plain server Golfe2
GET		rul td.doubleclick.net/td/ga/ Frame E0FD	0 0
GET H3	200	ga-audiences www.google.ca/ads/	42 B 63 B	289ms 91ms	Image image/gif	142.250.64.99 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-K4SSW8GR9B&cid=525245929.1729007370&gtm=45je4a90v872321687z8836227149za200zb836227149&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101533421~101686685&tag_exp=101533421~101686685&z=570456242 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.64.99 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s31-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Tue, 15 Oct 2024 15:49:30 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	js Show response www.googletagmanager.com/gtag/	279 KB 98 KB	70ms 69ms	Script application/javascript	142.250.80.40 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-51QH4BM55R&cx=c&_slc=1 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.80.40 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s34-in-f8.1e100.net Software Google Tag Manager / Resource Hash ba9044498f8a653c7ea72b3d71bc7b9096d6b0b9241540e077e6765037555ffb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Tue, 15 Oct 2024 15:49:30 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 15 Oct 2024 15:49:30 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 100275 x-xss-protection 0 server Google Tag Manager
GET H2	200	modules.02161fb4f8ebb73fb3f8.js Show response script.hotjar.com/	225 KB 56 KB	196ms 28ms	Script application/javascript	18.164.96.77 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.02161fb4f8ebb73fb3f8.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-2136024.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.164.96.77 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-164-96-77.jfk50.r.cloudfront.net Software / Resource Hash 3c6fd07134c7c19a53b6119d41d6c250efae68f3e7384ae34971e63b21d01337 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers x-robots-tag none content-encoding br etag "dec0c1b6789c165b6cb6404022b9d8ab" age 114203 x-content-type-options nosniff x-cache Hit from cloudfront x-amz-cf-id Wg1CCDClbM2bfjmvJBNdiNYSWOhI8x1AmbX4q3aJW9LlHBny1uPdfA== date Mon, 14 Oct 2024 08:06:07 GMT content-type application/javascript; charset=utf-8 last-modified Mon, 14 Oct 2024 08:05:53 GMT vary Accept-Encoding strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=31536000 cross-origin-resource-policy cross-origin via 1.1 f8debc28b6c73eb3dc7540e2ac2f0e18.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 56680 x-amz-cf-pop JFK50-P5
POST H3	204	collect www.google-analytics.com/g/	0 0	40ms 40ms	Fetch text/plain	142.251.40.238 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-51QH4BM55R&gtm=45je4a90v9133802068za200&_p=1729007369518&gcd=13l3l3l3l2l1&npa=0&dma=0&tag_exp=101686685&ul=en-ca&sr=1600x1200&cid=525245929.1729007370&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fform.respondi.app%2Fyhgbpo40&dt=Limpamos%20seu%20CPF%2FCNPJ%20ou%20devolvemos%20seu%20dinheiro.&sid=1729007370&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1623 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-51QH4BM55R&cx=c&_slc=1 Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s39-in-f14.1e100.net Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://form.respondi.app cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 15 Oct 2024 15:49:30 GMT content-type text/plain server Golfe2
POST H2	200	httpapi Show response api2.amplitude.com/2/	94 B 218 B	102ms 102ms	Fetch application/json	52.36.87.142 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api2.amplitude.com/2/httpapi Requested by Host: form.respondi.app URL: https://form.respondi.app/_nuxt/8217cfb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.36.87.142 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-36-87-142.us-west-2.compute.amazonaws.com Software / Resource Hash 0782bafdb62d6093e5093c63f2e5e38bcec1bc4546b1296633fdc9081981a32a Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer https://form.respondi.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept */* Content-Type application/json Response headers strict-transport-security max-age=15768000 access-control-allow-origin * content-length 94 date Tue, 15 Oct 2024 15:49:30 GMT content-type application/json
OPTIONS H2	200	httpapi api2.amplitude.com/2/ Frame	0 0	277ms 92ms	Preflight	52.36.87.142 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api2.amplitude.com/2/httpapi Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.36.87.142 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-36-87-142.us-west-2.compute.amazonaws.com Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://form.respondi.app Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET, POST access-control-allow-origin * access-control-max-age 86400 content-length 0 date Tue, 15 Oct 2024 15:49:30 GMT strict-transport-security max-age=15768000
POST H2	204	collect analytics.google.com/g/	0 0	51ms 50ms	Fetch text/plain	2001:4860:4802:38::181 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://analytics.google.com/g/collect?v=2&tid=G-K4SSW8GR9B&gtm=45je4a90v872321687za200zb836227149&_p=1729007369518&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533421~101686685&cid=525245929.1729007370&ecid=1769229117&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1729007369&sct=1&seg=0&dl=https%3A%2F%2Fform.respondi.app%2Fyhgbpo40&dt=Limpamos%20seu%20CPF%2FCNPJ%20ou%20devolvemos%20seu%20dinheiro.&en=scroll&epn.percent_scrolled=90&_et=61&tfd=6376 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K4SSW8GR9B&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:38::181 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://form.respondi.app/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://form.respondi.app cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 15 Oct 2024 15:49:35 GMT content-type text/plain server Golfe2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

td.doubleclick.net

URL

https://td.doubleclick.net/td/ga/rul?tid=G-K4SSW8GR9B&gacid=525245929.1729007370&gtm=45je4a90v872321687z8836227149za200zb836227149&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533421~101686685&z=1518995491

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| __cfQR object| __NUXT__ boolean| __cfRLUnblockHandlers object| webpackJsonp function| installComponents object| regeneratorRuntime function| setImmediate function| clearImmediate object| onNuxtReadyCbs function| onNuxtReady object| FontAwesomeConfig object| ___FONT_AWESOME___ function| _ object| DD_LOGS function| __mp_recorder object| dataLayer function| fbq function| _fbq object| $nuxt object| analyticsConnectorInstances object| google_tag_manager object| google_tag_data function| hj object| _hjSettings string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData function| onYouTubeIframeAPIReady object| hjSiteSettings object| hjLazyModules function| hjBootstrap object| hjBootstrapCalled

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.respondi.app/	1970-01-21 09:02:23	Name: mp_ed67cac2f4025f89e1bca5f007130192_mixpanel Value: %7B%22distinct_id%22%3A%20%22%24device%3A19290debd4136e-0685d771618a76-1e462c6f-1d4c00-19290debd4136e%22%2C%22%24device_id%22%3A%20%2219290debd4136e-0685d771618a76-1e462c6f-1d4c00-19290debd4136e%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%2C%22__mps%22%3A%20%7B%7D%2C%22__mpso%22%3A%20%7B%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D%2C%22__mpus%22%3A%20%7B%7D%2C%22__mpa%22%3A%20%7B%7D%2C%22__mpu%22%3A%20%7B%7D%2C%22__mpr%22%3A%20%5B%5D%2C%22__mpap%22%3A%20%5B%5D%7D
			.respondi.app/	1970-01-21 09:02:23	Name: AMP_MKTG_d00395841a Value: JTdCJTdE
			.respondi.app/	1970-01-21 09:02:23	Name: AMP_d00395841a Value: JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjI2ODE5NTEyYi1jNzIxLTQ2MmUtOWJmNy1jMGM4NWY1YzNkNzglMjIlMkMlMjJ1c2VySWQlMjIlM0ElMjJ1c2VyX2NiNDE4ZU9ZMklhSEFvZm4lMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzI5MDA3MzY5NTYxJTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTcyOTAwNzM2OTY0MSUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCU3RA==
			.respondi.app/	1970-01-21 02:26:23	Name: _gcl_au Value: 1.1.439339696.1729007370
			.respondi.app/	1970-01-21 00:18:13	Name: _gid Value: GA1.2.1908443847.1729007370
			.respondi.app/	1970-01-21 00:16:47	Name: _gat_UA-4782576-38 Value: 1
			.respondi.app/	1970-01-21 09:52:47	Name: _ga Value: GA1.1.525245929.1729007370
			.respondi.app/	1970-01-21 09:52:47	Name: _ga_K4SSW8GR9B Value: GS1.1.1729007369.1.0.1729007370.59.0.1769229117
			.respondi.app/	1970-01-21 09:52:47	Name: _ga_51QH4BM55R Value: GS1.2.1729007370.1.0.1729007370.0.0.0
			.respondi.app/	1970-01-21 09:02:23	Name: _hjSessionUser_2136024 Value: eyJpZCI6IjYwMDk0N2Y5LTMzOGQtNTM3OS1iNzFjLTExZjJhMWU1NjFmMSIsImNyZWF0ZWQiOjE3MjkwMDczNzAzNDQsImV4aXN0aW5nIjpmYWxzZX0=
			.respondi.app/	1970-01-21 00:16:49	Name: _hjSession_2136024 Value: eyJpZCI6Ijg2NGFiMzk2LWZmODEtNGQ2Yi05YTU4LTc0NmRjN2RhMTVjNyIsImMiOjE3MjkwMDczNzAzNDYsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.google.com
api2.amplitude.com
connect.facebook.net
form.respondi.app
respondiassets.sfo3.digitaloceanspaces.com
script.hotjar.com
static.hotjar.com
stats.g.doubleclick.net
td.doubleclick.net
www.google-analytics.com
www.google.ca
www.googletagmanager.com
td.doubleclick.net
108.138.106.49
138.68.34.161
142.250.64.99
142.250.80.40
142.251.40.238
157.240.241.1
172.67.43.15
18.164.96.77
2001:4860:4802:38::181
2607:f8b0:4004:c06::9c
2607:f8b0:4006:80c::2008
2607:f8b0:4006:822::200e
52.36.87.142
0782bafdb62d6093e5093c63f2e5e38bcec1bc4546b1296633fdc9081981a32a
0995c3ebc9205062e85a2100815a065d4df3cdb358e628354b889cf8d27f2442
0ffb9bbd67307d63d109d61dbff5d07eede6c2910d3df9e9eac116cc0b617c8a
1a137fd0d4651a300c790020e55f7ee6f7f7338a92d0cb67388aba52d0dc0d32
3c6fd07134c7c19a53b6119d41d6c250efae68f3e7384ae34971e63b21d01337
50c35e098c7b0d44ba195f4c2bffd327a157b9ce695bb9a6f52e7141e1f96774
5315286efe1ef341c36f60603d4eb3bd431c8a34f3504e16574ebc90319cf0c9
67d62ac8c281bb6714213d08ad7066eb36e2efc787d212a02be308c17c6ab627
6e96f9c1eff1e40c620c97291682287ff3d61efa81534713571ed91b95acaf40
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
91aff3588efba0074124bbd204b45de0da882a853f29a1d73f7ec132291c5651
a2b7070ab7424960120e3ce5820193d5da9afe4909e73951c425ddab9ff32667
b6241d7cce45754795ccc2a1b888ec5002accc1b272b55fecbb6cad5a274c29b
ba9044498f8a653c7ea72b3d71bc7b9096d6b0b9241540e077e6765037555ffb
cb6e7ad01a56529e06018e82289d4abeb4ca5f8ba1ecf8e39fddfb5d82646d21
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
defeacc663d1e51ce001dbc23ac644bc3f7061794318df4cb9b940b0b32011c7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fbc283504d84f28fb2aad1db73a4969f3d34a74e1f2f3050a9656fcef5a08ea5
fe2b334a795006ab221e3d452867b845112994806721ace9dc9bd8f220553039