creditcardportal.corpmerchandise.com Open in urlscan Pro
137.116.32.213 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
Submission: On November 14 via manual (November 14th 2023, 7:22:30 am UTC) from IN — Scanned from DE

Summary HTTP 70 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 9 IPs in 2 countries across 7 domains to perform 70 HTTP transactions. The main IP is 137.116.32.213, located in Boydton, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is creditcardportal.corpmerchandise.com.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on April 26th 2023. Valid for: a year.

This is the only time creditcardportal.corpmerchandise.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
21	137.116.32.213 137.116.32.213	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	18.66.122.116 18.66.122.116	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
14	52.222.236.93 52.222.236.93	16509 (AMAZON-02) (AMAZON-02)
1	143.204.98.16 143.204.98.16	16509 (AMAZON-02) (AMAZON-02)
1	54.158.1.224 54.158.1.224	14618 (AMAZON-AES) (AMAZON-AES)
7	23.199.220.207 23.199.220.207	16625 (AKAMAI-AS) (AKAMAI-AS)
9	2a02:26f0:300... 2a02:26f0:300::215:8552	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
70	9

21 137.116.32.213 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

creditcardportal.corpmerchandise.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.66.122.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-116.fra60.r.cloudfront.net

consent.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 52.222.236.93 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-93.fra56.r.cloudfront.net

consent-pref.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.16 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-16.fra50.r.cloudfront.net

consent-st.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.158.1.224 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-158-1-224.compute-1.amazonaws.com

prefmgr-cookie.truste-svc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 23.199.220.207 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-199-220-207.deploy.static.akamaitechnologies.com

app.staplespay.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:26f0:300::215:8552 (Berlin, Germany)

ASN20940 (AKAMAI-ASN1, NL)

eu-prod.oppwa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	corpmerchandise.com creditcardportal.corpmerchandise.com	573 KB
19	trustarc.com consent.trustarc.com — Cisco Umbrella Rank: 3316 consent-pref.trustarc.com — Cisco Umbrella Rank: 14459 consent-st.trustarc.com — Cisco Umbrella Rank: 36562	218 KB
9	oppwa.com eu-prod.oppwa.com — Cisco Umbrella Rank: 74893	1 MB
7	staplespay.com app.staplespay.com — Cisco Umbrella Rank: 927967	97 KB
1	truste-svc.net prefmgr-cookie.truste-svc.net — Cisco Umbrella Rank: 36689	2 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	1 KB
0	staplespromo.com Failed staplespromo.com Failed
70	7

	Domain	Requested by
21	creditcardportal.corpmerchandise.com	creditcardportal.corpmerchandise.com
14	consent-pref.trustarc.com	consent.trustarc.com consent-pref.trustarc.com prefmgr-cookie.truste-svc.net
9	eu-prod.oppwa.com	app.staplespay.com eu-prod.oppwa.com
7	app.staplespay.com	creditcardportal.corpmerchandise.com app.staplespay.com
4	consent.trustarc.com	creditcardportal.corpmerchandise.com consent.trustarc.com
1	prefmgr-cookie.truste-svc.net	creditcardportal.corpmerchandise.com
1	consent-st.trustarc.com	consent-pref.trustarc.com
1	fonts.googleapis.com	creditcardportal.corpmerchandise.com
0	staplespromo.com Failed	creditcardportal.corpmerchandise.com
70	9

This site contains links to these domains. Also see Links.

Domain
www.staplespromo.com
spponeimages.azureedge.net
staplespromotionalproducts.com

Subject Issuer	Validity	Valid
*.corpmerchandise.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-26` - `2024-05-26`	a year	crt.sh
*.trustarc.com Amazon RSA 2048 M02	`2023-04-17` - `2024-05-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.truste-svc.net Amazon RSA 2048 M01	`2023-04-23` - `2024-05-21`	a year	crt.sh
app.staplespay.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-10` - `2024-06-07`	a year	crt.sh
eu-test.oppwa.com R3	`2023-09-12` - `2023-12-11`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
Frame ID: A5C944E9682EF0285B5F92B2C4FB9950
Requests: 38 HTTP requests in this frame

Frame: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
Frame ID: 12C4071FE587203C6749A12565B4DCBA
Requests: 13 HTTP requests in this frame

Frame: https://consent-pref.trustarc.com/defaultpreferencemanager/A9C0FF58CA469E40741F487C4C79DD16.cache.html
Frame ID: 5F4F876B184024F4E8462667A412D35D
Requests: 1 HTTP requests in this frame

Frame: https://prefmgr-cookie.truste-svc.net/cookie_js/cookie_iframe.html?parent=https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
Frame ID: 5EEDD15925E88ED2F7B559F64B79FB79
Requests: 1 HTTP requests in this frame

Frame: https://consent-pref.trustarc.com/cookie_inneriframe.html
Frame ID: 34FBF506F5F98CCF22481685C765F9C8
Requests: 1 HTTP requests in this frame

Frame: https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en
Frame ID: 64C5E6653B3483176F53B9475CDA9C90
Requests: 12 HTTP requests in this frame

Frame: https://eu-prod.oppwa.com/v1/pciIframe.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09
Frame ID: 30CF7A4F68C40F9BE0705C5BC5A276E7
Requests: 2 HTTP requests in this frame

Frame: https://eu-prod.oppwa.com/v1/internalRequestIframe.html
Frame ID: F14FFA6C71B18968C1CA144F367C3FBD
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Credit Card Portal

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Stimulus (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-controller

TrustArc (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

consent\.trustarc\.com

Page Statistics

70
Requests

83 %
HTTPS

25 %
IPv6

7
Domains

9
Subdomains

9
IPs

2
Countries

2360 kB
Transfer

6345 kB
Size

10
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.staplespromo.com/terms-and-conditions
Title: Terms and Conditions

Search URL Search Domain Scan URL

URL: https://spponeimages.azureedge.net/prod/a0a97d40-c357-4f21-a90e-6cb929bf686aVulnerability-Disclosure-Policy-v1.0.pdf?v=0
Title: Vulnerability Disclosure Policy

Search URL Search Domain Scan URL

URL: https://staplespromotionalproducts.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://staplespromotionalproducts.com/california-notice
Title: California Notice

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

70 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Checkout Show response
creditcardportal.corpmerchandise.com/AdvancedCCCheckout/ 60 KB
20 KB 1686ms
1290ms Document
text/html 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

ed7bee17cec5cd8e0c962a58bef5f8abc06eeac96c46afe730736a7d93e2b386

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'nonce-SGlnaFJhZGl1cw' 'nonce-U3RvcmVBbmFseXRpY3M' 'nonce-X0lubGluZVRlbXBsYXRlcy10bXBsLXR5cGVhaGVhZC1yZXN1bHRz' 'nonce-X0lubGluZVRlbXBsYXRlcy10bXBsLWFsZXJ0bWVzc2FnZQ' 'nonce-X1dpZGdldExpbmtQcm9kdWN0TGlzdA' 'nonce-UG93ZXJCSVJlcG9ydA' 'nonce-V2lkZ2V0SGVhZGVy' 'nonce-V2lkZ2V0SGVhZGVyQ29va2ll' 'nonce-X1JlY29tZW5kZWRQcm9kdWN0' 'nonce-RXh0ZXJuYWxsb2dpbmNhbGxiYWNr' 'sha256-QHnjPL4iULCyhEiTHTyqdII9BeZoW8bGzgxixmfChps=' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private
Content-Encoding: gzip
Content-Length: 17796
Content-Security-Policy: script-src 'self' 'nonce-SGlnaFJhZGl1cw' 'nonce-U3RvcmVBbmFseXRpY3M' 'nonce-X0lubGluZVRlbXBsYXRlcy10bXBsLXR5cGVhaGVhZC1yZXN1bHRz' 'nonce-X0lubGluZVRlbXBsYXRlcy10bXBsLWFsZXJ0bWVzc2FnZQ' 'nonce-X1dpZGdldExpbmtQcm9kdWN0TGlzdA' 'nonce-UG93ZXJCSVJlcG9ydA' 'nonce-V2lkZ2V0SGVhZGVy' 'nonce-V2lkZ2V0SGVhZGVyQ29va2ll' 'nonce-X1JlY29tZW5kZWRQcm9kdWN0' 'nonce-RXh0ZXJuYWxsb2dpbmNhbGxiYWNr' 'sha256-QHnjPL4iULCyhEiTHTyqdII9BeZoW8bGzgxixmfChps=' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Content-Type: text/html; charset=utf-8
Date: Tue, 14 Nov 2023 07:22:21 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload max-age=31536000;includeSubDomains;redirectHttpToHttps
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
sha256: QHnjPL4iULCyhEiTHTyqdII9BeZoW8bGzgxixmfChps=

GET
H/1.1 200
OK jquery Show response
creditcardportal.corpmerchandise.com/bundles/ 377 KB
146 KB 3133ms
3113ms Script
text/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/bundles/jquery?v=brvkvpKIMlvf23HGfjv1mtiJfPpdjviXSAqVjDmBFnw1

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a725fbc9d0cd17aa95561463dc5eee3606bbe0ec692ec000af00a4b88756f7cd

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Tue, 14 Nov 2023 07:22:24 GMT
Date: Tue, 14 Nov 2023 07:22:23 GMT
Transfer-Encoding: chunked
Vary: User-Agent,Accept-Encoding
Content-Type: text/javascript; charset=utf-8
X-Frame-Options: DENY
Cache-Control: public
Expires: Wed, 13 Nov 2024 07:22:24 GMT

GET
H/1.1 200
OK bootstrap.min.css
creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Content/bootstrap/css/ 118 KB
28 KB 3517ms
289ms Stylesheet
text/css 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Content/bootstrap/css/bootstrap.min.css

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

ee3e2ee232f9b6c47c3f06a2cdea044196963b87ce4d91eb823a80aca27a3d08

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Mon, 06 Nov 2023 13:41:54 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
ETag: "1DA10B700D6FD00"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: text/css
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 27389
Expires: Wed, 15 Nov 2023 07:22:24 GMT

GET
H/1.1 200
OK site.css
creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Content/css/ 50 KB
15 KB 3629ms
400ms Stylesheet
text/css 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Content/css/site.css

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

dfd185b063c53b8258925d784d06d5852a8f016cfce65df3111a2245d9921ba4

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Mon, 16 Oct 2023 14:01:58 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
ETag: "1DA003953CE0F00"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: text/css
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 13675
Expires: Wed, 15 Nov 2023 07:22:24 GMT

GET
H/1.1 200
OK bootstrap.min.js Show response
creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Content/bootstrap/js/ 37 KB
14 KB 116ms
113ms Script
application/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Content/bootstrap/js/bootstrap.min.js

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

11fb05cec237a37307acae14ef62372749501cd112a84049b36855876c62fd82

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Mon, 06 Nov 2023 13:41:56 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
ETag: "1DA10B702082A00"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 13226
Expires: Wed, 15 Nov 2023 07:22:25 GMT

GET
H/1.1 200
OK event.min.js Show response
creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Scripts/lib/ 27 KB
11 KB 3473ms
245ms Script
application/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Scripts/lib/event.min.js

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8ede402fa7211fe1ed99b6ce8f631002a7ebcab6e24eed44367149beff6851fe

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Mon, 06 Nov 2023 13:41:56 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
ETag: "1DA10B702082A00"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 9687
Expires: Wed, 15 Nov 2023 07:22:24 GMT

GET
H/1.1 200
OK _PaymentOptions.js Show response
creditcardportal.corpmerchandise.com/Scripts/Core/Znode/ 5 KB
3 KB 3351ms
124ms Script
application/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/Scripts/Core/Znode/_PaymentOptions.js

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

507918b5edb3cd7d9e5dab59b915d1c6e157c202aab05d6b28ee7689b557e8ea

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Mon, 06 Nov 2023 13:43:36 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
ETag: "1DA10B73DA2F400"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 1339
Expires: Wed, 15 Nov 2023 07:22:24 GMT

GET
H/1.1 200
OK _CreateAddress.js Show response
creditcardportal.corpmerchandise.com/Scripts/Core/Znode/ 1 KB
2 KB 3596ms
372ms Script
application/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/Scripts/Core/Znode/_CreateAddress.js

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

edc1303d6ff582803d54c3b851c045885760bcb022f619eace79c990a25aefa2

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Mon, 06 Nov 2023 13:43:36 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
ETag: "1DA10B73DA2F400"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 516
Expires: Wed, 15 Nov 2023 07:22:24 GMT

GET
H/1.1 200
OK _SinglePage.js Show response
creditcardportal.corpmerchandise.com/Scripts/Core/Znode/ 3 KB
2 KB 3453ms
105ms Script
application/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/Scripts/Core/Znode/_SinglePage.js

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

9452d4220c2dd9b50a6117769bcfb18a677f47e925b9cec90be06f42ff1a215e

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Mon, 06 Nov 2023 13:43:36 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
ETag: "1DA10B73DA2F400"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 1106
Expires: Wed, 15 Nov 2023 07:22:24 GMT

GET
H/1.1 200
OK _EditAddress.js Show response
creditcardportal.corpmerchandise.com/Scripts/Core/Znode/ 5 KB
3 KB 3569ms
114ms Script
application/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/Scripts/Core/Znode/_EditAddress.js

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7bd1c10f436724c762640e79a7aba295bfbbaf8aa578919c91aa0863dae0795d

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Mon, 06 Nov 2023 13:43:36 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
ETag: "1DA10B73DA2F400"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 1694
Expires: Wed, 15 Nov 2023 07:22:24 GMT

GET
H2 200 notice Show response
consent.trustarc.com/ 14 KB
6 KB 110ms
58ms Script
text/javascript 18.66.122.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/notice?domain=spp.com&c=teconsent&js=nj&noticeType=bb&text=true&irmc=irmlink&gtm=1

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-122-116.fra60.r.cloudfront.net

Software

Resource Hash

350fd7ab7e099d2f8ab43e76b1397eb22f13fb03ddff11f1fa914715f2da8e0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://creditcardportal.corpmerchandise.com/
Origin: https://creditcardportal.corpmerchandise.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 07:22:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d71acb203a3e8fc7db2c1cf9725d51da.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
x-cache: Miss from cloudfront
cloudfront-viewer-country: DE
content-length: 5315
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=3600
cloudfront-viewer-country-region: RP
timing-allow-origin: *
x-amz-cf-id: WsPgh16l7TkkBD7K2YL7ueNiYiUSZ-9Y8qBzSMhE_4TT78Wg5HgwZA==
expires: Tue, 14 Nov 2023 08:22:25 GMT

GET
H/1.1 200
OK CoreJs Show response
creditcardportal.corpmerchandise.com/bundles/ 212 KB
56 KB 3576ms
110ms Script
text/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/bundles/CoreJs

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8fdc191c90032d4c9b52c52ba7752a1a8c146d2bd3dec1af8aa6d5b3c1887f84

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Tue, 14 Nov 2023 07:22:24 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
Vary: User-Agent,Accept-Encoding
X-Frame-Options: DENY
Content-Type: text/javascript; charset=utf-8
Cache-Control: public
Content-Length: 55602
Expires: Wed, 13 Nov 2024 07:22:24 GMT

GET
H/1.1 200
OK ZnodeCoreJs Show response
creditcardportal.corpmerchandise.com/bundles/ 328 KB
99 KB 3643ms
109ms Script
text/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/bundles/ZnodeCoreJs

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

dde92d0fa1aa132ec4aa2aa600a371f3279515295a832ad7679fa50d806015df

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Tue, 14 Nov 2023 07:22:24 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
Transfer-Encoding: chunked
Vary: User-Agent,Accept-Encoding
Content-Type: text/javascript; charset=utf-8
X-Frame-Options: DENY
Cache-Control: public
Expires: Wed, 13 Nov 2024 07:22:24 GMT

GET
H/1.1 200
OK SPPCustomJs Show response
creditcardportal.corpmerchandise.com/bundles/ 462 KB
141 KB 3674ms
108ms Script
text/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/bundles/SPPCustomJs

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2d797c0428f0a42eed74b218987a976664642f5181c9ee328ca5eb3f73972119

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Tue, 14 Nov 2023 07:22:25 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
Transfer-Encoding: chunked
Vary: User-Agent,Accept-Encoding
Content-Type: text/javascript; charset=utf-8
X-Frame-Options: DENY
Cache-Control: public
Expires: Wed, 13 Nov 2024 07:22:25 GMT

GET
H/1.1 200
OK ZnodeLayout.js Show response
creditcardportal.corpmerchandise.com/Scripts/Core/Common/ 1 KB
2 KB 3697ms
107ms Script
application/javascript 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/Scripts/Core/Common/ZnodeLayout.js

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

991879720fe454242fb43bea5f1a0f4f9aac9da29780f169e1abec1bff3f43e0

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
Last-Modified: Mon, 06 Nov 2023 13:43:36 GMT
Date: Tue, 14 Nov 2023 07:22:24 GMT
ETag: "1DA10B73DA2F400"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 597
Expires: Wed, 15 Nov 2023 07:22:25 GMT

GET
H2 200 css
fonts.googleapis.com/ 8 KB
1 KB 79ms
21ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,600

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Content/css/site.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

93c9b0c2e8b47042c9f1cff90e635f3fe72d3a0384ea73b0a122dd28dd33316d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 14 Nov 2023 07:22:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 05:48:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Nov 2023 07:22:25 GMT

GET 80df7bea-6463-4826-8b7f-e6b817f69d59.woff2
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/ 0
0

GET c8b589aa-c568-429c-b229-c37741fb2416.woff2
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/ 0
0

GET 13ea0c68-dc7b-456d-b558-ece393288bb8.woff2
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5200032/ 0
0

GET
H/1.1 200
OK RedPanda.ttf
creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Fonts/ 21 KB
22 KB 105ms
104ms Font
application/octet-stream 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Fonts/RedPanda.ttf?giwujd

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Content/css/site.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

9770dfd37d3f1543c48f4dbf05a2acf627ea5e6f7ab1f9c95c28e99e179d634d

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://creditcardportal.corpmerchandise.com/Views/Themes/QuartzQuetzal/Content/css/site.css
Origin: https://creditcardportal.corpmerchandise.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
X-Content-Type-Options: nosniff
Date: Tue, 14 Nov 2023 07:22:24 GMT
Last-Modified: Mon, 06 Nov 2023 13:41:56 GMT
ETag: "02a82b710da1:0"
X-Frame-Options: DENY
Content-Type: application/octet-stream
Cache-Control: public,max-age=25920000
Accept-Ranges: bytes
Content-Length: 21596

GET e9cc9f52-843b-432b-ab66-92544b0f0bde.woff2
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/ 0
0

GET
H2 200 v1.7-1064 Show response
consent.trustarc.com/asset/notice.js/v/ 88 KB
26 KB 17ms
14ms Script
text/javascript 18.66.122.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/asset/notice.js/v/v1.7-1064

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=spp.com&c=teconsent&js=nj&noticeType=bb&text=true&irmc=irmlink&gtm=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-122-116.fra60.r.cloudfront.net

Software

Resource Hash

f45a4b7d84fcba68fee4db26859810d7021314e50fca1a716449a2a7beeb97e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://creditcardportal.corpmerchandise.com/
Origin: https://creditcardportal.corpmerchandise.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 06:26:30 GMT
content-encoding: gzip
via: 1.1 d71acb203a3e8fc7db2c1cf9725d51da.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P2
age: 3355
x-cache: Hit from cloudfront
pragma: public
last-modified: Mon, 23 Oct 2023 05:12:34 GMT
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: bOIA5B0zAFRQPH6SklzU4xrApLb3PesH2m4xvue1qqZh8xTcUgWIBw==
expires: Thu, 14 Dec 2023 06:26:30 GMT

GET
H2 200 log
consent.trustarc.com/ 43 B
430 B 66ms
41ms Image
image/gif 18.66.122.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/log?domain=spp.com&country=de&state=&behavior=expressed&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW&c=687d&referer=https://creditcardportal.corpmerchandise.com

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-122-116.fra60.r.cloudfront.net

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 07:22:25 GMT
via: 1.1 4b07e670df891a80bcae1d5be052af3c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P2
vary: Origin
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: 9j5cxOKwZZfkJQxnRjNGn_tL2F2KceRvLwOOMHeCz2Bt08D9MYMkeQ==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 / Show response
consent-pref.trustarc.com/ Frame 12C4 5 KB
3 KB 466ms
38ms Document
text/html 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/asset/notice.js/v/v1.7-1064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

9f565b4cdf200b503b4c09d2e4644a1fbec24230e60b873ab7e09ae969a6fc1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://creditcardportal.corpmerchandise.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 14 Nov 2023 07:22:25 GMT
etag: W/"5111-1696834446000"
expect-ct: max-age=86400; enforce;
last-modified: Mon, 09 Oct 2023 06:54:06 GMT
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Origin
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-amz-cf-id: _WbKMUBS8d9G3AOwA6k7YTu5scHA_4-zNzS2OJ-hLgcZqIfi4zXSOQ==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1

GET
H2 200 noticemsg
consent.trustarc.com/ 43 B
426 B 40ms
39ms Image
image/gif 18.66.122.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/noticemsg?action=consent&domain=spp.com&behavior=expressed&country=de&language=en&rand=0.6569865503235826&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW&referer=https://creditcardportal.corpmerchandise.com

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-122-116.fra60.r.cloudfront.net

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creditcardportal.corpmerchandise.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 07:22:25 GMT
via: 1.1 4b07e670df891a80bcae1d5be052af3c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P2
vary: Origin
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: XI2E__ba1elaiboXVa1u2TBOS7M6_nA_9r4eY6f5M9iQGB0STtWsPg==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK getpaymentdetails Show response
creditcardportal.corpmerchandise.com/checkout/ 1 KB
3 KB 222ms
222ms XHR
application/json 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/checkout/getpaymentdetails?paymentsettingid=155

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/bundles/jquery?v=brvkvpKIMlvf23HGfjv1mtiJfPpdjviXSAqVjDmBFnw1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

f148775fac1dc76a355c3c88852946f31e8f48568f6de412b32945f54d03d3de

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
X-Content-Type-Options: nosniff
Date: Tue, 14 Nov 2023 07:22:25 GMT
X-Frame-Options: DENY
Content-Type: application/json; charset=utf-8
Cache-Control: private
Content-Length: 1419

GET
H/1.1 200
OK getstaplespaywalletconfiguration Show response
creditcardportal.corpmerchandise.com/customcheckout/ 733 B
2 KB 309ms
305ms XHR
application/json 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/customcheckout/getstaplespaywalletconfiguration?paymentcode=staplespayacius&isstaplespay=false&linccompanycode=oa&_=1699946544934

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/bundles/jquery?v=brvkvpKIMlvf23HGfjv1mtiJfPpdjviXSAqVjDmBFnw1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

1d7f178549e21b6e1dd799ec38b37ece4ad7e23e1c48dfefc97de2f275b87040

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
X-Content-Type-Options: nosniff
Date: Tue, 14 Nov 2023 07:22:25 GMT
Last-Modified: Tue, 14 Nov 2023 07:22:25 GMT
Vary: *
X-Frame-Options: DENY
Content-Type: application/json; charset=utf-8
Cache-Control: public, no-store, max-age=0
Content-Length: 733
Expires: Tue, 14 Nov 2023 07:22:25 GMT

GET
H2 200 defaultpreferencemanager.nocache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 12C4 5 KB
3 KB 38ms
38ms Script
application/javascript 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/defaultpreferencemanager.nocache.js

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

5a1239e59fef1fc369bb2339c810999caa4d063949f1ae78acb073c8acbd250a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 07:22:25 GMT
content-encoding: gzip
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 06:54:26 GMT
server: nginx
etag: W/"4867-1696834466000"
expect-ct: max-age=86400; enforce;
vary: Accept-Encoding, Origin
content-type: application/javascript; charset=UTF-8
cache-control: no-cache
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: Qd-jg533_HtxQoFQrMbqM0vFL05127yuI__YlDlZ55qdsLKzZf2oyA==
expires: Tue, 14 Nov 2023 07:22:24 GMT

GET
H2 200 get Show response
consent-st.trustarc.com/ Frame 12C4 20 KB
5 KB 79ms
0ms Script
text/javascript 143.204.98.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-st.trustarc.com/get?name=combined_static_cm_minified.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-16.fra50.r.cloudfront.net

Software

Resource Hash

f1ba71d3bf034aeceecb8895e71a44f4806dbb5bcc44e46fd8fc461a774eb880

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: public
date: Sun, 15 Oct 2023 16:39:18 GMT
content-encoding: gzip
via: 1.1 e64eb476d8f76c461d21278e018e194e.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA50-C1
age: 2558588
vary: Origin
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: hoprZpXazgcKUG4QIrh0MOoEbEaU3XCxMcKJNM0RqdljHCGoyNkk1A==
expires: Tue, 14 Nov 2023 16:39:18 GMT

GET
H2 200 loading.gif
consent-pref.trustarc.com/images/ Frame 12C4 3 KB
3 KB 12ms
11ms Image
image/gif 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent-pref.trustarc.com/images/loading.gif

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

eb7cfd3d959b2e09c170f532e29f8b825f9bc770b2279fde58e595617753e244

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 06:55:31 GMT
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 1619
x-cache: Hit from cloudfront
content-length: 2608
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 06:54:06 GMT
server: nginx
etag: W/"2608-1696834446000"
expect-ct: max-age=86400; enforce;
vary: Origin
content-type: image/gif
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
accept-ranges: bytes
x-amz-cf-id: aUXmKPL8Og1jnObfxQA3QjAF-WGj7BLBkANrDDfOPZHFRdVTgSBShA==

GET
H2 200 A9C0FF58CA469E40741F487C4C79DD16.cache.html Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 5F4F 141 KB
46 KB 32ms
4ms Document
text/html 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/A9C0FF58CA469E40741F487C4C79DD16.cache.html

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/defaultpreferencemanager.nocache.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

ebbe09ce80b9c406ffb23539c11f2061b6b3a413b72a35c3f8ccfda49858bf52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1909964
cache-control: max-age=315360000
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 23 Oct 2023 04:49:42 GMT
etag: W/"144103-1696834466000"
expect-ct: max-age=86400; enforce;
expires: Thu, 31 Dec 2037 23:55:55 GMT
last-modified: Mon, 09 Oct 2023 06:54:26 GMT
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Origin
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-amz-cf-id: WsJLK4ZtZDcwJ__bnpoWBSpAYKJBNm3f7Is9FKSkV9VSQoEzG5SbzA==
x-amz-cf-pop: FRA56-P4
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1

GET ab79ccac-516f-49fe-8ebe-a921beb3e994.woff
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/ 0
0

GET 8cfa81a2-0daa-4f42-9945-20e602bd8fac.woff
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/ 0
0

GET 2f95f162-ea19-4ffa-9b08-652175b9d1e3.woff
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5200032/ 0
0

GET 1c549c92-2fdf-4995-81c1-b980f5b08d32.woff
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/ 0
0

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 12C4 1 KB
1 KB 51ms
42ms XHR
application/json 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/A9C0FF58CA469E40741F487C4C79DD16.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

365c4e4e15bb05abb8135ba921b7ff58c93459e1b8eda9e1835c13ba7ecec1b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: A9C0FF58CA469E40741F487C4C79DD16
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 07:22:26 GMT
content-encoding: gzip
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
content-disposition: attachment
content-length: 481
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
server: nginx
expect-ct: max-age=86400; enforce;
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: P7hNfQpFR2-mlvECCQMzcBm_dgCeto1FLIkxm-3yUxSkFTBR68r6oQ==

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 12C4 48 B
622 B 53ms
45ms XHR
application/json 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/A9C0FF58CA469E40741F487C4C79DD16.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

bbd46349fb3a61bfa8473624409bdbc67c7781a885290aa43bac65f4fb6671d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: A9C0FF58CA469E40741F487C4C79DD16
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 07:22:26 GMT
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
content-disposition: attachment
content-length: 48
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
server: nginx
expect-ct: max-age=86400; enforce;
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: 8IvVdZQ6XQ2BRhzT-Sa2ouuIj_OaE0RvUkAhvfJffefhRKWeehPqLA==

GET ed1af56d-1ad8-46cf-bf48-dc970d7ba174.ttf
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/ 0
0

GET
H2 200 EuPreferenceManager.css
consent-pref.trustarc.com/ Frame 12C4 30 KB
7 KB 12ms
5ms Stylesheet
text/css 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/EuPreferenceManager.css

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/A9C0FF58CA469E40741F487C4C79DD16.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

176f46d1332bd15e158ba501961d4614a40522c0b622bc981036251478694812

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 07:16:07 GMT
content-encoding: gzip
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 388
x-cache: Hit from cloudfront
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 06:54:06 GMT
server: nginx
etag: W/"30603-1696834446000"
expect-ct: max-age=86400; enforce;
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: no-cache
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: JKv9uFIMzrHjkueSDcaGDkqihSYCBGGDf6Q7GPa-EZ6pl5EvQABsIQ==
expires: Tue, 14 Nov 2023 07:15:57 GMT

GET
H2 200 11.cache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/A9C0FF58CA469E40741F487C4C79DD16/ Frame 12C4 266 KB
91 KB 14ms
7ms XHR
application/javascript 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/A9C0FF58CA469E40741F487C4C79DD16/11.cache.js

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/A9C0FF58CA469E40741F487C4C79DD16.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

53a209d677bcf8346ee7650210fc3cb7fd7cd448832297e3c9186f05a2301659

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 04:50:23 GMT
content-encoding: gzip
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 1909923
x-cache: Hit from cloudfront
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 06:54:26 GMT
server: nginx
etag: W/"272572-1696834466000"
expect-ct: max-age=86400; enforce;
vary: Accept-Encoding, Origin
content-type: application/javascript; charset=UTF-8
cache-control: max-age=315360000
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: aw_YSafjNaoTyvildFJ_Hk6HtBpGE2KbG5uFilKS637TEsGGsLF6UA==
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET 3a63a34c-a24f-4f20-9ef3-b22f7c3ea45c.ttf
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/ 0
0

GET b764fdd8-925a-47d3-bee2-70423c2fddb8.ttf
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/ 0
0

GET 761709ac-5688-498e-942f-219f72e5923a.ttf
staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/ 0
0

GET
H2 200 1.cache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/A9C0FF58CA469E40741F487C4C79DD16/ Frame 12C4 20 KB
9 KB 10ms
8ms XHR
application/javascript 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/A9C0FF58CA469E40741F487C4C79DD16/1.cache.js

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/A9C0FF58CA469E40741F487C4C79DD16.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

4946599a26d4b4702c629c4faeeb37fe6ac01b11c82ea11aa973692170e9f665

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 04:50:23 GMT
content-encoding: gzip
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 1909923
x-cache: Hit from cloudfront
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 06:54:26 GMT
server: nginx
etag: W/"20966-1696834466000"
expect-ct: max-age=86400; enforce;
vary: Accept-Encoding, Origin
content-type: application/javascript; charset=UTF-8
cache-control: max-age=315360000
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: gC5IQALsQKmWa2US-PqZFNxycygeZITNLO5T2pYXt6J4IHcURtWuYw==
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK generateordernumber Show response
creditcardportal.corpmerchandise.com/checkout/ 35 B
1 KB 114ms
114ms XHR
application/json 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/checkout/generateordernumber?portalId=937&_=1699946544935

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/bundles/jquery?v=brvkvpKIMlvf23HGfjv1mtiJfPpdjviXSAqVjDmBFnw1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

c55885bbcea71f3e65ae0a679b0eae66f6c91f6bfbb95cc14201b0e53f775a6b

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
X-Content-Type-Options: nosniff
Date: Tue, 14 Nov 2023 07:22:26 GMT
Last-Modified: Tue, 14 Nov 2023 07:22:26 GMT
Vary: *
X-Frame-Options: DENY
Content-Type: application/json; charset=utf-8
Cache-Control: public, no-store, max-age=0
Content-Length: 35
Expires: Tue, 14 Nov 2023 07:22:26 GMT

GET
H/1.1 200
OK getstaplespayguid Show response
creditcardportal.corpmerchandise.com/customcheckout/ 147 B
1 KB 111ms
111ms XHR
application/json 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/customcheckout/getstaplespayguid?_=1699946544936

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/bundles/jquery?v=brvkvpKIMlvf23HGfjv1mtiJfPpdjviXSAqVjDmBFnw1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5743ef847f22d64b77b0808e86878596c65b9453a15479489a48e087ebff59ac

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
X-Content-Type-Options: nosniff
Date: Tue, 14 Nov 2023 07:22:26 GMT
X-Frame-Options: DENY
Content-Type: application/json; charset=utf-8
Cache-Control: private
Content-Length: 147

GET
H2 200 cookie_iframe.html Show response
prefmgr-cookie.truste-svc.net/cookie_js/ Frame 5EED 5 KB
2 KB 554ms
106ms Document
text/html 54.158.1.224
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://prefmgr-cookie.truste-svc.net/cookie_js/cookie_iframe.html?parent=https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.158.1.224 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-158-1-224.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e5356c4d200584b116d9ac14f89d883b120dbe4d7878914a4fa22358074c74f8

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://consent-pref.trustarc.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Tue, 14 Nov 2023 07:22:27 GMT
etag: W/"5014-1657163800000"
expect-ct: max-age=31536000
last-modified: Thu, 07 Jul 2022 03:16:40 GMT
permissions-policy: geolocation=(), microphone=(), payment=()
referrer-policy: origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 12C4 787 B
949 B 35ms
34ms XHR
application/json 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/A9C0FF58CA469E40741F487C4C79DD16.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

3582dfccb5b38f3a2642420bd13ac681bdaf8c4493cd7d485b7a9488666f0dfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: A9C0FF58CA469E40741F487C4C79DD16
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 07:22:26 GMT
content-encoding: gzip
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
content-disposition: attachment
content-length: 356
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
server: nginx
expect-ct: max-age=86400; enforce;
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: DUvPhKKAwGZY67PLrrWqDhF83KB63tNbreO82j9MGg0PCLUXcgnN_g==

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 12C4 24 KB
7 KB 34ms
34ms XHR
application/json 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/A9C0FF58CA469E40741F487C4C79DD16.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

0c2862c75cc917edde4a1b96149ca50b3b33f0e4922a931c408544515a5d53f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: A9C0FF58CA469E40741F487C4C79DD16
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 07:22:26 GMT
content-encoding: gzip
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
content-disposition: attachment
content-length: 6234
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
server: nginx
expect-ct: max-age=86400; enforce;
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: p1CIfogAhH89y3MJthJIHIgjKzL3DLkZeYpen0f7dyI72zms1AjBew==

POST
H/1.1 200
OK getstaplespayacicheckoutid Show response
creditcardportal.corpmerchandise.com/customcheckout/ 501 B
2 KB 1085ms
1085ms XHR
application/json 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/customcheckout/getstaplespayacicheckoutid

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/bundles/jquery?v=brvkvpKIMlvf23HGfjv1mtiJfPpdjviXSAqVjDmBFnw1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7e3a7784b0a2dba238e8b904adcbe544ea86a153b26c8d08fe5a637cac521833

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
X-Content-Type-Options: nosniff
Date: Tue, 14 Nov 2023 07:22:27 GMT
X-Frame-Options: DENY
Content-Type: application/json; charset=utf-8
Cache-Control: private
Content-Length: 501

GET
H2 200 trustarc-logo-small.png
consent-pref.trustarc.com/images/ Frame 12C4 4 KB
5 KB 19ms
19ms Image
image/png 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent-pref.trustarc.com/images/trustarc-logo-small.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

91c4a6c4295f8889e8b04339a4a2c2e86d5eef71ba808164e641d0d8a6435004

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 06:48:07 GMT
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 2076
x-cache: Hit from cloudfront
content-length: 4197
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 06:54:06 GMT
server: nginx
etag: W/"4197-1696834446000"
expect-ct: max-age=86400; enforce;
vary: Origin
content-type: image/png
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
accept-ranges: bytes
x-amz-cf-id: P2vXUIV5r8ZgvCCKuQsz92Y-f0VRjWkquybK4Gnwp1kgSLK7LuMoMg==

GET
H2 200 6.cache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/A9C0FF58CA469E40741F487C4C79DD16/ Frame 12C4 7 KB
4 KB 10ms
8ms XHR
application/javascript 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/A9C0FF58CA469E40741F487C4C79DD16/6.cache.js

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/A9C0FF58CA469E40741F487C4C79DD16.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

84564ffaf2ad066235fbf5e6ffca74b4347faf5c61be31c00b7138d4b70a5117

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 04:50:25 GMT
content-encoding: gzip
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 1909922
x-cache: Hit from cloudfront
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 06:54:26 GMT
server: nginx
etag: W/"7462-1696834466000"
expect-ct: max-age=86400; enforce;
vary: Accept-Encoding, Origin
content-type: application/javascript; charset=UTF-8
cache-control: max-age=315360000
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: hahgGix-CsWp_sbFBOlsnQ7nYUIKCRE5J1HTt6DG-3o8-pbi8MKUgw==
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cookie_inneriframe.html Show response
consent-pref.trustarc.com/ Frame 34FB 2 KB
1 KB 10ms
9ms Document
text/html 52.222.236.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/cookie_inneriframe.html

Requested by

Host: prefmgr-cookie.truste-svc.net
URL: https://prefmgr-cookie.truste-svc.net/cookie_js/cookie_iframe.html?parent=https://consent-pref.trustarc.com/?type=spp_eu&site=spp.com&action=notice&country=de&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9&userType=NEW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-93.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

a2de091c86c5a7b6dcc572eb6e5a76c2cd72ce27a2042a8dc2974f15b33566ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://prefmgr-cookie.truste-svc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2078
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 14 Nov 2023 06:48:28 GMT
etag: W/"2008-1696834446000"
expect-ct: max-age=86400; enforce;
last-modified: Mon, 09 Oct 2023 06:54:06 GMT
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Origin
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-amz-cf-id: 5b4BJf3ASbNo3Uf17QUDDFXG7hcUBy-mz3bKES3ZhfRspvLR3NMTCQ==
x-amz-cf-pop: FRA56-P4
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1

GET
H/1.1 200
OK gethttpcookie Show response
creditcardportal.corpmerchandise.com/home/ 7 B
1 KB 109ms
109ms XHR
application/json 137.116.32.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://creditcardportal.corpmerchandise.com/home/gethttpcookie?cookieName=culture_Y3JlZGl0Y2FyZHBvcnRhbC5jb3JwbWVyY2hhbmRpc2UuY29t

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/bundles/jquery?v=brvkvpKIMlvf23HGfjv1mtiJfPpdjviXSAqVjDmBFnw1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.116.32.213 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

c528452300440f47b4505e15d80ef5fb68d030675ad944dd54d1b8b6b9d45294

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, max-age=31536000;includeSubDomains;redirectHttpToHttps
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jsonip.com *.artifi.net *.jquery.com *.trustarc.com *.corpmerchandise.com *.googletagmanager.com *.marketo.com *.google-analytics.com *.zmags.com *.issuu.com *.marketo.net *.googleadservices.com connect.facebook.net cdnjs.cloudflare.com *.staples.com googleads.g.doubleclick.net polyfill.io *.staplespromo.com *.staples-static.com *.inside-graph.com *.newrelic.com *.nr-data.net countdown.omegawatches.com https://*.kaptcha.com *.cloudfront.net *.retentionscience.com *.lightboxcdn.com lightboxapi.azurewebsites.net *.boldchat.com *.licdn.com *.linkedin.com *.btttag.com *.attentivemobile.com *.attn.tv *.contentsquare.net *.contentsquare.com *.bing.com *.dynamicyield.com *.azureedge.net *.mczbf.com;
X-Content-Type-Options: nosniff
Date: Tue, 14 Nov 2023 07:22:27 GMT
X-Frame-Options: DENY
Content-Type: application/json; charset=utf-8
Cache-Control: private
Content-Length: 7

GET
H2 200 xchangeStackView.html Show response
app.staplespay.com/STPayAciViews/view/P80016/807/ Frame 64C5 588 B
2 KB 923ms
763ms Document
text/html 23.199.220.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en

Requested by

Host: creditcardportal.corpmerchandise.com
URL: https://creditcardportal.corpmerchandise.com/bundles/jquery?v=brvkvpKIMlvf23HGfjv1mtiJfPpdjviXSAqVjDmBFnw1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.199.220.207 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-199-220-207.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

e77dead84fed850362729f45e91fdaaea5559382daae45fbafeee971ffcc91c4

Security Headers

Name

Value

Content-Security-Policy

default-src 'self'; script-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline' 'unsafe-eval'; connect-src https: 'self' oppwa.com eu-prod.oppwa.com; img-src https: 'self' oppwa.com eu-prod.oppwa.com; style-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline'; child-src https: 'self' oppwa.com eu-prod.oppwa.com; frame-ancestors https: 'self' *.staples.com *.staplesadvantage.com *.bureauengrosprivilege.ca *.staplespreferred.ca *.bluetarp.com *.quill.com *.quillcorp.com *.hitouchbusinessservices.com *.southwestordering.com;

Request headers

Referer: https://creditcardportal.corpmerchandise.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=2592000
content-encoding: gzip
content-length: 371
content-security-policy: default-src 'self'; script-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline' 'unsafe-eval'; connect-src https: 'self' oppwa.com eu-prod.oppwa.com; img-src https: 'self' oppwa.com eu-prod.oppwa.com; style-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline'; child-src https: 'self' oppwa.com eu-prod.oppwa.com; frame-ancestors https: 'self' *.staples.com *.staplesadvantage.com *.bureauengrosprivilege.ca *.staplespreferred.ca *.bluetarp.com *.quill.com *.quillcorp.com *.hitouchbusinessservices.com *.southwestordering.com;
content-type: text/html
date: Tue, 14 Nov 2023 07:22:28 GMT
etag: "0x8DBAE8EC65CBDEC"
expires: Thu, 14 Dec 2023 07:22:28 GMT
last-modified: Wed, 06 Sep 2023 04:07:23 GMT
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
vary: Accept-Encoding
x-ms-request-id: add02b2a-401e-0047-02cb-167ea1000000
x-ms-version: 2018-03-28

GET
H2 200 staplesPayOverride-custom.min.css
app.staplespay.com/STPayAciViews/view/P80016/807/css/ Frame 64C5 3 KB
1 KB 27ms
26ms Stylesheet
text/css 23.199.220.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://app.staplespay.com/STPayAciViews/view/P80016/807/css/staplesPayOverride-custom.min.css?v=2023042801

Requested by

Host: app.staplespay.com
URL: https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.199.220.207 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-199-220-207.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

fcbfa38f478dd4f66003d6becd48eb6043e972bb238141c7997263b77cc3bf26

Security Headers

Name

Value

Content-Security-Policy

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 07:22:28 GMT
content-encoding: gzip
content-security-policy: default-src 'self'; script-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline' 'unsafe-eval'; connect-src https: 'self' oppwa.com eu-prod.oppwa.com; img-src https: 'self' oppwa.com eu-prod.oppwa.com; style-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline'; child-src https: 'self' oppwa.com eu-prod.oppwa.com; frame-ancestors https: 'self' *.staples.com *.staplesadvantage.com *.bureauengrosprivilege.ca *.staplespreferred.ca *.bluetarp.com *.quill.com *.quillcorp.com *.hitouchbusinessservices.com *.southwestordering.com;
last-modified: Wed, 06 Sep 2023 04:07:20 GMT
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-md5: pGWCVomNgig0yOipkX6A/w==
etag: "0x8DBAE8EC478B92B"
vary: Accept-Encoding
content-type: text/css
x-ms-request-id: 6ffb9179-301e-00e4-70e7-0b1b64000000
cache-control: max-age=1394754
x-ms-version: 2018-03-28
accept-ranges: bytes
content-length: 795
expires: Thu, 30 Nov 2023 10:48:22 GMT

GET
H2 200 xchangeAciOverride-custom.min.js Show response
app.staplespay.com/STPayAciViews/view/P80016/807/js/ Frame 64C5 32 KB
8 KB 30ms
29ms Script
application/javascript 23.199.220.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://app.staplespay.com/STPayAciViews/view/P80016/807/js/xchangeAciOverride-custom.min.js?v=2023090101

Requested by

Host: app.staplespay.com
URL: https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.199.220.207 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-199-220-207.deploy.static.akamaitechnologies.com

Software

Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

ebc5e210bf6a1c56b1064b29e3920b24afba08650a27bccd954b8111fdbdd497

Security Headers

Name

Value

Content-Security-Policy

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 07:22:28 GMT
content-encoding: gzip
content-security-policy: default-src 'self'; script-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline' 'unsafe-eval'; connect-src https: 'self' oppwa.com eu-prod.oppwa.com; img-src https: 'self' oppwa.com eu-prod.oppwa.com; style-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline'; child-src https: 'self' oppwa.com eu-prod.oppwa.com; frame-ancestors https: 'self' *.staples.com *.staplesadvantage.com *.bureauengrosprivilege.ca *.staplespreferred.ca *.bluetarp.com *.quill.com *.quillcorp.com *.hitouchbusinessservices.com *.southwestordering.com;
last-modified: Wed, 06 Sep 2023 04:07:22 GMT
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-md5: 9jwZ21rq6MPPHN05Bqyufw==
etag: "0x8DBAE8EC56E3A08"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: 9a6adbbd-801e-0077-72b2-f5c06e000000
cache-control: max-age=1289875
x-ms-version: 2018-03-28
accept-ranges: bytes
content-length: 7284
expires: Wed, 29 Nov 2023 05:40:23 GMT

GET
H2 200 DN3UB Show response
app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/ Frame 64C5 214 KB
81 KB 31ms
31ms Script
application/javascript 23.199.220.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/DN3UB

Requested by

Host: app.staplespay.com
URL: https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.199.220.207 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-199-220-207.deploy.static.akamaitechnologies.com

Software

Resource Hash

5516c738033ef1e7d0e3062c67d58fad3f44fc33083f9a5189c4c7832535fce7

Security Headers

Name

Value

Content-Security-Policy

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 07:22:28 GMT
content-encoding: br
content-security-policy: default-src 'self'; script-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline' 'unsafe-eval'; connect-src https: 'self' oppwa.com eu-prod.oppwa.com; img-src https: 'self' oppwa.com eu-prod.oppwa.com; style-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline'; child-src https: 'self' oppwa.com eu-prod.oppwa.com; frame-ancestors https: 'self' *.staples.com *.staplesadvantage.com *.bureauengrosprivilege.ca *.staplespreferred.ca *.bluetarp.com *.quill.com *.quillcorp.com *.hitouchbusinessservices.com *.southwestordering.com;
last-modified: Wed, 02 Aug 2023 16:14:35 GMT
etag: "3dd9706bc878d2fa9f052a144bb312c0c70d7e9f11e8c527926ae3f932d6c897"
stored-attribute-sha-checksum: 5516c738033ef1e7d0e3062c67d58fad3f44fc33083f9a5189c4c7832535fce7
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=21600
content-length: 81453
expires: Wed, 13 Dec 2023 18:18:50 GMT

POST
H2 201 DN3UB Show response
app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/ Frame 64C5 18 B
1 KB 47ms
46ms XHR
application/json 23.199.220.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/DN3UB

Requested by

Host: app.staplespay.com
URL: https://app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/DN3UB

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.199.220.207 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-199-220-207.deploy.static.akamaitechnologies.com

Software

Resource Hash

fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Security Headers

Name

Value

Content-Security-Policy

Request headers

Referer: https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 07:22:28 GMT
content-security-policy: default-src 'self'; script-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline' 'unsafe-eval'; connect-src https: 'self' oppwa.com eu-prod.oppwa.com; img-src https: 'self' oppwa.com eu-prod.oppwa.com; style-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline'; child-src https: 'self' oppwa.com eu-prod.oppwa.com; frame-ancestors https: 'self' *.staples.com *.staplesadvantage.com *.bureauengrosprivilege.ca *.staplespreferred.ca *.bluetarp.com *.quill.com *.quillcorp.com *.hitouchbusinessservices.com *.southwestordering.com;
vary: Origin
content-type: application/json
access-control-allow-origin: https://app.staplespay.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 18

GET
H2 200 paymentWidgets.js Show response
eu-prod.oppwa.com/v1/ Frame 64C5 3 KB
2 KB 211ms
96ms Script
application/javascript 2a02:26f0:300::215:8552
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://eu-prod.oppwa.com/v1/paymentWidgets.js?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09

Requested by

Host: app.staplespay.com
URL: https://app.staplespay.com/STPayAciViews/view/P80016/807/js/xchangeAciOverride-custom.min.js?v=2023090101

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:300::215:8552 Berlin, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

ACI /

Resource Hash

c450394c3ec2a52e9b03b4cd50f186fe3d4849f8c7e8b1f31a3d57c176260e12

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.staplespay.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 14 Nov 2023 07:22:28 GMT
server: ACI
vary: Accept-Encoding
content-language: de-DE
content-type: application/javascript;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
tls-ciphers: TLS_AES_256_GCM_SHA384
content-length: 1522
x-xss-protection: 1; mode=block
expires: Tue, 14 Nov 2023 07:22:28 GMT

GET
H2 200 static.min.js Show response
eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/js/ Frame 64C5 1006 KB
248 KB 41ms
41ms Script
application/javascript 2a02:26f0:300::215:8552
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/js/static.min.js

Requested by

Host: eu-prod.oppwa.com
URL: https://eu-prod.oppwa.com/v1/paymentWidgets.js?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:300::215:8552 Berlin, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

ACI /

Resource Hash

84c593e92812dbfd086350a5dfd02a1f94fad0e1c86ab655ef5176107d3ebe31

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.staplespay.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 14 Nov 2023 07:22:29 GMT
last-modified: Thu, 09 Nov 2023 08:07:04 GMT
server: ACI
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31123510
access-control-allow-credentials: true
tls-ciphers: TLS_AES_256_GCM_SHA384
accept-ranges: bytes
content-length: 253771
x-xss-protection: 1; mode=block

GET
H2 200 pciIframe.html Show response
eu-prod.oppwa.com/v1/ Frame 30CF 2 KB
2 KB 81ms
81ms Document
text/html 2a02:26f0:300::215:8552
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://eu-prod.oppwa.com/v1/pciIframe.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09

Requested by

Host: eu-prod.oppwa.com
URL: https://eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/js/static.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:300::215:8552 Berlin, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

ACI /

Resource Hash

ad54fa2117ae3c8d779b6f381a575be3cbddbd2c8813c64ba913cce6cdb2c534

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://app.staplespay.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
content-language: de-DE
content-length: 1678
content-type: text/html;charset=utf-8
date: Tue, 14 Nov 2023 07:22:29 GMT
expires: Tue, 14 Nov 2023 07:22:29 GMT
pragma: no-cache
server: ACI
strict-transport-security: max-age=63072000; includeSubdomains; preload
tls-ciphers: TLS_AES_256_GCM_SHA384
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 plain.min.css
eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/css/ Frame 64C5 54 KB
54 KB 33ms
32ms Stylesheet
text/css 2a02:26f0:300::215:8552
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/css/plain.min.css

Requested by

Host: eu-prod.oppwa.com
URL: https://eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/js/static.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:300::215:8552 Berlin, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

ACI /

Resource Hash

3cffd25f2e3346b7f54129243ec3c70cce7d6ef4a0520c9594fcdfbded536edd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.staplespay.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
date: Tue, 14 Nov 2023 07:22:29 GMT
x-content-type-options: nosniff
last-modified: Thu, 09 Nov 2023 08:07:04 GMT
server: ACI
content-type: text/css
cache-control: public, max-age=31123511
access-control-allow-credentials: true
tls-ciphers: TLS_AES_256_GCM_SHA384
accept-ranges: bytes
content-length: 55158
x-xss-protection: 1; mode=block

GET
H2 200 svg.min.css
eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/css/ Frame 64C5 459 KB
459 KB 42ms
42ms Stylesheet
text/css 2a02:26f0:300::215:8552
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/css/svg.min.css

Requested by

Host: eu-prod.oppwa.com
URL: https://eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/js/static.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:300::215:8552 Berlin, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

ACI /

Resource Hash

10e651f41dddfc3f452b9b3bdbc2f1717acf3bad10aebf71de4476628bb73c0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.staplespay.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
date: Tue, 14 Nov 2023 07:22:29 GMT
x-content-type-options: nosniff
last-modified: Thu, 09 Nov 2023 08:07:04 GMT
server: ACI
content-type: text/css
cache-control: public, max-age=31123685
access-control-allow-credentials: true
tls-ciphers: TLS_AES_256_GCM_SHA384
accept-ranges: bytes
content-length: 469724
x-xss-protection: 1; mode=block

GET
H2 200 internalRequestIframe.html Show response
eu-prod.oppwa.com/v1/ Frame F14F 805 B
2 KB 88ms
88ms Document
text/html 2a02:26f0:300::215:8552
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://eu-prod.oppwa.com/v1/internalRequestIframe.html

Requested by

Host: eu-prod.oppwa.com
URL: https://eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/js/static.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:300::215:8552 Berlin, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

ACI /

Resource Hash

67d47b8b990543a3dea8e8115d836bcb81d21a9e033303c5f326b01f59bc440f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://app.staplespay.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
content-language: de-DE
content-length: 805
content-type: text/html;charset=utf-8
date: Tue, 14 Nov 2023 07:22:29 GMT
expires: Tue, 14 Nov 2023 07:22:29 GMT
pragma: no-cache
server: ACI
strict-transport-security: max-age=63072000; includeSubdomains; preload
tls-ciphers: TLS_AES_256_GCM_SHA384
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 201 DN3UB Show response
app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/ Frame 64C5 18 B
1 KB 26ms
26ms XHR
application/json 23.199.220.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/DN3UB

Requested by

Host: app.staplespay.com
URL: https://app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/DN3UB

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.199.220.207 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-199-220-207.deploy.static.akamaitechnologies.com

Software

Resource Hash

fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Security Headers

Name

Value

Content-Security-Policy

Request headers

Referer: https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 07:22:29 GMT
content-security-policy: default-src 'self'; script-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline' 'unsafe-eval'; connect-src https: 'self' oppwa.com eu-prod.oppwa.com; img-src https: 'self' oppwa.com eu-prod.oppwa.com; style-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline'; child-src https: 'self' oppwa.com eu-prod.oppwa.com; frame-ancestors https: 'self' *.staples.com *.staplesadvantage.com *.bureauengrosprivilege.ca *.staplespreferred.ca *.bluetarp.com *.quill.com *.quillcorp.com *.hitouchbusinessservices.com *.southwestordering.com;
vary: Origin
content-type: application/json
access-control-allow-origin: https://app.staplespay.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 18

GET
H2 200 static.min.js Show response
eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/js/ Frame 30CF 1006 KB
248 KB 33ms
32ms Script
application/javascript 2a02:26f0:300::215:8552
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/js/static.min.js

Requested by

Host: eu-prod.oppwa.com
URL: https://eu-prod.oppwa.com/v1/pciIframe.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:300::215:8552 Berlin, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

ACI /

Resource Hash

84c593e92812dbfd086350a5dfd02a1f94fad0e1c86ab655ef5176107d3ebe31

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eu-prod.oppwa.com/v1/pciIframe.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 14 Nov 2023 07:22:29 GMT
last-modified: Thu, 09 Nov 2023 08:07:04 GMT
server: ACI
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31123510
access-control-allow-credentials: true
tls-ciphers: TLS_AES_256_GCM_SHA384
accept-ranges: bytes
content-length: 253771
x-xss-protection: 1; mode=block

GET
H2 200 static.min.js Show response
eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/js/ Frame F14F 1006 KB
248 KB 41ms
40ms Script
application/javascript 2a02:26f0:300::215:8552
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/js/static.min.js

Requested by

Host: eu-prod.oppwa.com
URL: https://eu-prod.oppwa.com/v1/internalRequestIframe.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:300::215:8552 Berlin, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

ACI /

Resource Hash

84c593e92812dbfd086350a5dfd02a1f94fad0e1c86ab655ef5176107d3ebe31

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eu-prod.oppwa.com/v1/internalRequestIframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 14 Nov 2023 07:22:29 GMT
last-modified: Thu, 09 Nov 2023 08:07:04 GMT
server: ACI
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31123510
access-control-allow-credentials: true
tls-ciphers: TLS_AES_256_GCM_SHA384
accept-ranges: bytes
content-length: 253771
x-xss-protection: 1; mode=block

GET
H2 200 brand.png
eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/img/ Frame 64C5 205 KB
205 KB 57ms
57ms Image
image/png 2a02:26f0:300::215:8552
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eu-prod.oppwa.com/v1/static/9cb53703997bd67f972a443fbac80131/img/brand.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:300::215:8552 Berlin, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

ACI /

Resource Hash

3e03dc27f56428322e8662a009109bd293a173ebe4ed7faf227904500e25b888

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.staplespay.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
date: Tue, 14 Nov 2023 07:22:29 GMT
x-content-type-options: nosniff
last-modified: Thu, 09 Nov 2023 08:07:04 GMT
server: ACI
content-type: image/png
cache-control: public, max-age=3600
access-control-allow-credentials: true
tls-ciphers: TLS_AES_256_GCM_SHA384
accept-ranges: bytes
content-length: 209899
x-xss-protection: 1; mode=block
expires: Tue, 14 Nov 2023 08:22:29 GMT

POST
H2 201 DN3UB Show response
app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/ Frame 64C5 18 B
1 KB 48ms
48ms XHR
application/json 23.199.220.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/DN3UB

Requested by

Host: app.staplespay.com
URL: https://app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/DN3UB

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.199.220.207 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-199-220-207.deploy.static.akamaitechnologies.com

Software

Resource Hash

fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Security Headers

Name

Value

Content-Security-Policy

Request headers

Referer: https://app.staplespay.com/STPayAciViews/view/P80016/807/xchangeStackView.html?checkoutId=A67B40F02083A3C96200A24C43A08957.prod02-vm-tx09&locale=en
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 07:22:30 GMT
content-security-policy: default-src 'self'; script-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline' 'unsafe-eval'; connect-src https: 'self' oppwa.com eu-prod.oppwa.com; img-src https: 'self' oppwa.com eu-prod.oppwa.com; style-src https: 'self' oppwa.com eu-prod.oppwa.com 'unsafe-inline'; child-src https: 'self' oppwa.com eu-prod.oppwa.com; frame-ancestors https: 'self' *.staples.com *.staplesadvantage.com *.bureauengrosprivilege.ca *.staplespreferred.ca *.bluetarp.com *.quill.com *.quillcorp.com *.hitouchbusinessservices.com *.southwestordering.com;
vary: Origin
content-type: application/json
access-control-allow-origin: https://app.staplespay.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 18

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/80df7bea-6463-4826-8b7f-e6b817f69d59.woff2

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/c8b589aa-c568-429c-b229-c37741fb2416.woff2

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5200032/13ea0c68-dc7b-456d-b558-ece393288bb8.woff2

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/e9cc9f52-843b-432b-ab66-92544b0f0bde.woff2

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/ab79ccac-516f-49fe-8ebe-a921beb3e994.woff

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/8cfa81a2-0daa-4f42-9945-20e602bd8fac.woff

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5200032/2f95f162-ea19-4ffa-9b08-652175b9d1e3.woff

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/1c549c92-2fdf-4995-81c1-b980f5b08d32.woff

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/ed1af56d-1ad8-46cf-bf48-dc970d7ba174.ttf

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/3a63a34c-a24f-4f20-9ef3-b22f7c3ea45c.ttf

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/b764fdd8-925a-47d3-bee2-70423c2fddb8.ttf

Domain: staplespromo.com
URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/761709ac-5688-498e-942f-219f72e5923a.ttf

Verdicts & Comments Add Verdict or Comment

164 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
creditcardportal.corpmerchandise.com/	1970-01-20 16:12:30	Name: _WebStoreculture_Y3JlZGl0Y2FyZHBvcnRhbC5jb3JwbWVyY2hhbmRpc2UuY29t Value: 1
creditcardportal.corpmerchandise.com/	1970-01-20 16:12:30	Name: portal_Y3JlZGl0Y2FyZHBvcnRhbC5jb3JwbWVyY2hhbmRpc2UuY29t Value: 937
creditcardportal.corpmerchandise.com/	1970-01-20 16:12:30	Name: publishstate_Y3JlZGl0Y2FyZHBvcnRhbC5jb3JwbWVyY2hhbmRpc2UuY29t Value: PRODUCTION
creditcardportal.corpmerchandise.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: 5avbywoi2vkcpzuw4y5uh0dv
creditcardportal.corpmerchandise.com/	1970-01-20 16:12:30	Name: culture_Y3JlZGl0Y2FyZHBvcnRhbC5jb3JwbWVyY2hhbmRpc2UuY29t Value: en-US
creditcardportal.corpmerchandise.com/	1969-12-31 23:59:59	Name: __RequestVerificationToken Value: 4THk0lU6x--U8ZRnft9uQkrAlcBVMa_qDIuB6a8ZOpl3fJBMt1-ZOLIlP5fuQ7cFBeJkdll7scIp4MpC4PYcMFLUCIyNEdwDIvrjntC0JJE1
.creditcardportal.corpmerchandise.com/	1970-01-20 16:12:28	Name: TAsessionID Value: d90342aa-a4d1-4244-9eb4-9bf30b2dbcf9\|NEW
.creditcardportal.corpmerchandise.com/	1969-12-31 23:59:59	Name: notice_behavior Value: expressed,eu
prefmgr-cookie.truste-svc.net/	1970-01-20 16:12:26	Name: cookie_3rdparty Value: enabled
consent-pref.trustarc.com/	1970-01-20 16:12:26	Name: token_test Value: Tue Nov 14 2023 08:22:27 GMT+0100 (Central European Standard Time)

29 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921(Line 696) Message: Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-SGlnaFJhZGl1cw' 'nonce-U3RvcmVBbmFseXRpY3M' 'nonce-X0lubGluZVRlbXBsYXRlcy10bXBsLXR5cGVhaGVhZC1yZXN1bHRz' 'nonce-X0lubGluZVRlbXBsYXRlcy10bXBsLWFsZXJ0bWVzc2FnZQ' 'nonce-X1dpZGdldExpbmtQcm9kdWN0TGlzdA' 'nonce-UG93ZXJCSVJlcG9ydA' 'nonce-V2lkZ2V0SGVhZGVy' 'nonce-V2lkZ2V0SGVhZGVyQ29va2ll' 'nonce-X1JlY29tZW5kZWRQcm9kdWN0' 'nonce-RXh0ZXJuYWxsb2dpbmNhbGxiYWNr' 'sha256-QHnjPL4iULCyhEiTHTyqdII9BeZoW8bGzgxixmfChps=' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com". Either the 'unsafe-inline' keyword, a hash ('sha256-rIDPkqm2uopU+51ZpDe2jHaG+nam2Mq+JikmbleD2sE='), or a nonce ('nonce-...') is required to enable inline execution.
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/c8b589aa-c568-429c-b229-c37741fb2416.woff2' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/c8b589aa-c568-429c-b229-c37741fb2416.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/80df7bea-6463-4826-8b7f-e6b817f69d59.woff2' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/80df7bea-6463-4826-8b7f-e6b817f69d59.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5200032/13ea0c68-dc7b-456d-b558-ece393288bb8.woff2' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5200032/13ea0c68-dc7b-456d-b558-ece393288bb8.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/e9cc9f52-843b-432b-ab66-92544b0f0bde.woff2' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/e9cc9f52-843b-432b-ab66-92544b0f0bde.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/ab79ccac-516f-49fe-8ebe-a921beb3e994.woff' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/ab79ccac-516f-49fe-8ebe-a921beb3e994.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/8cfa81a2-0daa-4f42-9945-20e602bd8fac.woff' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/8cfa81a2-0daa-4f42-9945-20e602bd8fac.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5200032/2f95f162-ea19-4ffa-9b08-652175b9d1e3.woff' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5200032/2f95f162-ea19-4ffa-9b08-652175b9d1e3.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/1c549c92-2fdf-4995-81c1-b980f5b08d32.woff' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/1c549c92-2fdf-4995-81c1-b980f5b08d32.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/ed1af56d-1ad8-46cf-bf48-dc970d7ba174.ttf' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5228550/ed1af56d-1ad8-46cf-bf48-dc970d7ba174.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/b764fdd8-925a-47d3-bee2-70423c2fddb8.ttf' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/b764fdd8-925a-47d3-bee2-70423c2fddb8.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/761709ac-5688-498e-942f-219f72e5923a.ttf' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5225082/761709ac-5688-498e-942f-219f72e5923a.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://creditcardportal.corpmerchandise.com/AdvancedCCCheckout/Checkout?Order=027211921 Message: Access to font at 'https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/3a63a34c-a24f-4f20-9ef3-b22f7c3ea45c.ttf' from origin 'https://creditcardportal.corpmerchandise.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://t.contentsquare.net, https://c.az.contentsquare.net, https://k-us1.az.contentsquare.net', but only one is allowed.
network	error	URL: https://staplespromo.com/Views/Themes/QuartzQuetzal/Fonts/Fonts/Motiva/5363573/3a63a34c-a24f-4f20-9ef3-b22f7c3ea45c.ttf Message: Failed to load resource: net::ERR_FAILED
security	error	URL: https://creditcardportal.corpmerchandise.com/bundles/SPPCustomJs Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://app.staplespay.com') does not match the recipient window's origin ('https://creditcardportal.corpmerchandise.com').
deprecation	warning	URL: https://app.staplespay.com/STPayAciViews/view/P80016/807/js/xchangeAciOverride-custom.min.js?v=2023090101 Message: Listener added for a synchronous 'DOMNodeInserted' DOM Mutation Event. This event type is deprecated (https://w3c.github.io/uievents/#legacy-event-types) and work is underway to remove it from this browser. Usage of this event listener will cause performance issues today, and represents a risk of future incompatibility. Consider using MutationObserver instead.
javascript	warning	URL: https://app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/DN3UB Message: The deviceorientation events are blocked by permissions policy. See https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
javascript	warning	URL: https://app.staplespay.com/0idhbpDIIqW5d1enAb7xRTAZSbE/ONYikbJfwp/EEchPA/ax1BBmc/DN3UB Message: The devicemotion events are blocked by permissions policy. See https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	script-src 'self' 'nonce-SGlnaFJhZGl1cw' 'nonce-U3RvcmVBbmFseXRpY3M' 'nonce-X0lubGluZVRlbXBsYXRlcy10bXBsLXR5cGVhaGVhZC1yZXN1bHRz' 'nonce-X0lubGluZVRlbXBsYXRlcy10bXBsLWFsZXJ0bWVzc2FnZQ' 'nonce-X1dpZGdldExpbmtQcm9kdWN0TGlzdA' 'nonce-UG93ZXJCSVJlcG9ydA' 'nonce-V2lkZ2V0SGVhZGVy' 'nonce-V2lkZ2V0SGVhZGVyQ29va2ll' 'nonce-X1JlY29tZW5kZWRQcm9kdWN0' 'nonce-RXh0ZXJuYWxsb2dpbmNhbGxiYWNr' 'sha256-QHnjPL4iULCyhEiTHTyqdII9BeZoW8bGzgxixmfChps=' https://jsonip.com .artifi.net .jquery.com .trustarc.com .corpmerchandise.com .googletagmanager.com .marketo.com .google-analytics.com .zmags.com .issuu.com .marketo.net .googleadservices.com connect.facebook.net cdnjs.cloudflare.com .staples.com googleads.g.doubleclick.net polyfill.io .staplespromo.com .staples-static.com .inside-graph.com .newrelic.com .nr-data.net countdown.omegawatches.com https://.kaptcha.com .cloudfront.net .retentionscience.com .lightboxcdn.com lightboxapi.azurewebsites.net .boldchat.com .licdn.com .linkedin.com .btttag.com .attentivemobile.com .attn.tv .contentsquare.net .contentsquare.com .bing.com .dynamicyield.com .azureedge.net *.mczbf.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000;includeSubDomains;redirectHttpToHttps
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.staplespay.com
consent-pref.trustarc.com
consent-st.trustarc.com
consent.trustarc.com
creditcardportal.corpmerchandise.com
eu-prod.oppwa.com
fonts.googleapis.com
prefmgr-cookie.truste-svc.net
staplespromo.com
staplespromo.com
137.116.32.213
143.204.98.16
18.66.122.116
23.199.220.207
2a00:1450:4001:80f::200a
2a02:26f0:300::215:8552
52.222.236.93
54.158.1.224
0c2862c75cc917edde4a1b96149ca50b3b33f0e4922a931c408544515a5d53f3
10e651f41dddfc3f452b9b3bdbc2f1717acf3bad10aebf71de4476628bb73c0c
11fb05cec237a37307acae14ef62372749501cd112a84049b36855876c62fd82
176f46d1332bd15e158ba501961d4614a40522c0b622bc981036251478694812
1d7f178549e21b6e1dd799ec38b37ece4ad7e23e1c48dfefc97de2f275b87040
2d797c0428f0a42eed74b218987a976664642f5181c9ee328ca5eb3f73972119
350fd7ab7e099d2f8ab43e76b1397eb22f13fb03ddff11f1fa914715f2da8e0b
3582dfccb5b38f3a2642420bd13ac681bdaf8c4493cd7d485b7a9488666f0dfd
365c4e4e15bb05abb8135ba921b7ff58c93459e1b8eda9e1835c13ba7ecec1b4
3cffd25f2e3346b7f54129243ec3c70cce7d6ef4a0520c9594fcdfbded536edd
3e03dc27f56428322e8662a009109bd293a173ebe4ed7faf227904500e25b888
4946599a26d4b4702c629c4faeeb37fe6ac01b11c82ea11aa973692170e9f665
507918b5edb3cd7d9e5dab59b915d1c6e157c202aab05d6b28ee7689b557e8ea
53a209d677bcf8346ee7650210fc3cb7fd7cd448832297e3c9186f05a2301659
5516c738033ef1e7d0e3062c67d58fad3f44fc33083f9a5189c4c7832535fce7
5743ef847f22d64b77b0808e86878596c65b9453a15479489a48e087ebff59ac
5a1239e59fef1fc369bb2339c810999caa4d063949f1ae78acb073c8acbd250a
67d47b8b990543a3dea8e8115d836bcb81d21a9e033303c5f326b01f59bc440f
7bd1c10f436724c762640e79a7aba295bfbbaf8aa578919c91aa0863dae0795d
7e3a7784b0a2dba238e8b904adcbe544ea86a153b26c8d08fe5a637cac521833
84564ffaf2ad066235fbf5e6ffca74b4347faf5c61be31c00b7138d4b70a5117
84c593e92812dbfd086350a5dfd02a1f94fad0e1c86ab655ef5176107d3ebe31
8ede402fa7211fe1ed99b6ce8f631002a7ebcab6e24eed44367149beff6851fe
8fdc191c90032d4c9b52c52ba7752a1a8c146d2bd3dec1af8aa6d5b3c1887f84
91c4a6c4295f8889e8b04339a4a2c2e86d5eef71ba808164e641d0d8a6435004
93c9b0c2e8b47042c9f1cff90e635f3fe72d3a0384ea73b0a122dd28dd33316d
9452d4220c2dd9b50a6117769bcfb18a677f47e925b9cec90be06f42ff1a215e
9770dfd37d3f1543c48f4dbf05a2acf627ea5e6f7ab1f9c95c28e99e179d634d
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
991879720fe454242fb43bea5f1a0f4f9aac9da29780f169e1abec1bff3f43e0
9f565b4cdf200b503b4c09d2e4644a1fbec24230e60b873ab7e09ae969a6fc1b
a2de091c86c5a7b6dcc572eb6e5a76c2cd72ce27a2042a8dc2974f15b33566ed
a725fbc9d0cd17aa95561463dc5eee3606bbe0ec692ec000af00a4b88756f7cd
ad54fa2117ae3c8d779b6f381a575be3cbddbd2c8813c64ba913cce6cdb2c534
bbd46349fb3a61bfa8473624409bdbc67c7781a885290aa43bac65f4fb6671d8
c450394c3ec2a52e9b03b4cd50f186fe3d4849f8c7e8b1f31a3d57c176260e12
c528452300440f47b4505e15d80ef5fb68d030675ad944dd54d1b8b6b9d45294
c55885bbcea71f3e65ae0a679b0eae66f6c91f6bfbb95cc14201b0e53f775a6b
dde92d0fa1aa132ec4aa2aa600a371f3279515295a832ad7679fa50d806015df
dfd185b063c53b8258925d784d06d5852a8f016cfce65df3111a2245d9921ba4
e5356c4d200584b116d9ac14f89d883b120dbe4d7878914a4fa22358074c74f8
e77dead84fed850362729f45e91fdaaea5559382daae45fbafeee971ffcc91c4
eb7cfd3d959b2e09c170f532e29f8b825f9bc770b2279fde58e595617753e244
ebbe09ce80b9c406ffb23539c11f2061b6b3a413b72a35c3f8ccfda49858bf52
ebc5e210bf6a1c56b1064b29e3920b24afba08650a27bccd954b8111fdbdd497
ed7bee17cec5cd8e0c962a58bef5f8abc06eeac96c46afe730736a7d93e2b386
edc1303d6ff582803d54c3b851c045885760bcb022f619eace79c990a25aefa2
ee3e2ee232f9b6c47c3f06a2cdea044196963b87ce4d91eb823a80aca27a3d08
f148775fac1dc76a355c3c88852946f31e8f48568f6de412b32945f54d03d3de
f1ba71d3bf034aeceecb8895e71a44f4806dbb5bcc44e46fd8fc461a774eb880
f45a4b7d84fcba68fee4db26859810d7021314e50fca1a716449a2a7beeb97e2
fcbfa38f478dd4f66003d6becd48eb6043e972bb238141c7997263b77cc3bf26
fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

creditcardportal.corpmerchandise.com Open in urlscan Pro 137.116.32.213 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

70 Requests

83 %HTTPS

25 %IPv6

7 Domains

9 Subdomains

9 IPs

2 Countries

2360 kBTransfer

6345 kBSize

10 Cookies

4 Outgoing links

Redirected requests

70 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

creditcardportal.corpmerchandise.com Open in urlscan Pro
137.116.32.213 Public Scan

Screenshot
Live screenshot

Full Image

70
Requests

83 %
HTTPS

25 %
IPv6

7
Domains

9
Subdomains

9
IPs

2
Countries

2360 kB
Transfer

6345 kB
Size

10
Cookies

70 HTTP transactions
0 data transactions