urlscan.io logo urlscan.io
SecurityTrails logo

www.heb.com.mx Open in urlscan Pro
45.60.243.179  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://hebdigital.net/
Effective URL: https://www.heb.com.mx/
Submission: On March 18 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 45.60.243.179, located in United States and belongs to INCAPSULA, US. The main domain is www.heb.com.mx. The Cisco Umbrella rank of the primary domain is 416153.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on May 10th 2022. Valid for: a year.
This is the only time www.heb.com.mx was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 3.143.134.239 16509 (AMAZON-02)
6 45.60.243.179 19551 (INCAPSULA)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
8 4
Apex Domain
Subdomains		 Transfer
6 heb.com.mx
www.heb.com.mx — Cisco Umbrella Rank: 416153
96 KB
1 gstatic.com
fonts.gstatic.com
38 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 34
1 KB
1 hebdigital.net
hebdigital.net
5 KB
8 4
Domain Requested by
6 www.heb.com.mx www.heb.com.mx
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com www.heb.com.mx
1 hebdigital.net 1 redirects
8 4

This site contains no links.

Subject Issuer Validity Valid
*.heb.com.mx
DigiCert TLS RSA SHA256 2020 CA1		 2022-05-10 -
2023-06-10		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-03-02 -
2023-05-25		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-03-02 -
2023-05-25		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://www.heb.com.mx/
Frame ID: E481EF0EE0B0C4ED570290013C8BC357
Requests: 5 HTTP requests in this frame

Frame: https://www.heb.com.mx/_Incapsula_Resource?CWUDNSAI=23&xinfo=4-26198233-0%200NNN%20RT%281679106595259%2042%29%20q%280%20-1%20-1%200%29%20r%280%20-1%29%20B16%20U24&incident_id=472001070050584190-127042787594476228&edet=16&cinfo=ffffffff&rpinfo=0&mth=GET
Frame ID: 3B1448E300424986E127C68CAD710DB0
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://hebdigital.net/ HTTP 302
    https://www.heb.com.mx/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /_Incapsula_Resource

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

135 kB
Transfer

412 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://hebdigital.net/ HTTP 302
    https://www.heb.com.mx/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.heb.com.mx/
Redirect Chain
  • https://hebdigital.net/
  • https://www.heb.com.mx/
922 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.heb.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.243.179 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
261458cb9a31e91fbe4b68c6c46e61c9a513d0b312aff43907f7f8d63cb14ae5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, no-store
content-length
922
content-security-policy-report-only
default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: *.doubleclick.net cdn.noibu.com www.paypal.com websdk.appsflyer.com www.youtube.com www.paypalobjects.com imgs.cdn-btsg.com *.mathtag.com js-agent.newrelic.com www.googletagmanager.com *.facebook.com sorotele.yachts *.googleapis.com www.google-analytics.com capig.pubsa.mx banner.appsflyer.com fonts.gstatic.com api.exponea.com t.paypal.com www.heb.com.mx *.tiktok.com bereelec.quest *.googlesyndication.com *.online-metrix.net *.facebook.net adservice.google.com cdn.appsflyer.com impressions.onelink.me maps.gstatic.com flowit.pics www.google.com *.clarity.ms www.google.com.mx analytics.google.com creatives-cdn.appsflyer.com *.googleusercontent.com a.omappapi.com c.bing.com maxcdn.bootstrapcdn.com input.noibu.com bam.nr-data.net wss://input.noibu.com kritec.pics api.omappapi.com ipgeolocation.abstractapi.com bat.bing.com syndicate.synthrone.com www.cdn-net.com a.opmnstr.com proxy-heb.hebdigital.net www.gstatic.com *.googleadservices.com ads01.groovinads.com; form-action *.facebook.com www.heb.com.mx www.cdn-net.com; frame-ancestors 'self' ; report-uri /csp_report
content-type
text/html
strict-transport-security
max-age=31536000
x-iinfo
4-26198233-0 0NNN RT(1679106595259 42) q(0 -1 -1 0) r(0 -1) B16 U24

Redirect headers

access-control-allow-headers
DNT,Authorization,X-CustomHeader,Keep-Alive,User-Agent,Origin,Referer,X-HTTP-Method-Override,X-Accept-Charset,X-Accept,Accept,Access-Control-Request-Method,Access-Control-Request-Headers,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, no-cache, no-store
content-encoding
gzip
content-security-policy
upgrade-insecure-requests;
content-security-policy-report-only
rabbitmq *.amazonaws.com; font-src maxcdn.bootstrapcdn.com fonts.gstatic.com 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com *.cdn-net.com 'self' 'unsafe-inline'; frame-ancestors 'self' 'unsafe-inline'; frame-src https://*.online-metrix.net https://imgs.signifyd.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com *.cdn-net.com amc.demdex.net www.paypal.com heb.secure.force.com vars.hotjar.com syndicate.synthrone.com content.syndigo.com event.syndigo.com *.google.com *.veinteractive.com *.adform.net *.googleapis.com *.hotjar.com *.doubleclick.net *.google.com.mx *.taboola.com *.googletagmanager.com *.facebook.net *.facebook.com *.googleadservices.com *.bing.com *.gstatic.com *.googleusercontent.com *.edge-generalmills.com *.omappapi.com *.youtube.com *.synthrone.com/* *.syndigo.com/* lsw.instaleap.io https://6x4cg2qvi8.execute-api.us-east-1.amazonaws.com *.opencontrol.mx *.kaptcha.com *.openpay.mx 'self' 'unsafe-inline'; img-src https://imgs.signifyd.com https://*.online-metrix.net www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com maps.googleapis.com data: stats.g.doubleclick.net *.doubleclick.net maps.gstatic.com *.heb.com.mx www.googletagmanager.com www.facebook.com trc.taboola.com cds.taboola.com bat.bing.com www.google.com *.groovinads.com syndicate.synthrone.com content.syndigo.com event.syndigo.com websdk.appsflyer.com *.google.com *.veinteractive.com *.adform.net *.googleapis.com *.hotjar.com *.google.com.mx *.taboola.com *.googletagmanager.com *.facebook.net *.facebook.com *.googleadservices.com *.bing.com *.gstatic.com *.googleusercontent.com *.edge-generalmills.com *.omappapi.com *.cloudfront.net *.synthrone.com *.syndigo.com *.appsflyer.com 'self' 'unsafe-inline'; script-src https://cdn-scripts.signifyd.com https://imgs.signifyd.com test.authorize.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com js.authorize.net jstest.authorize.net www.googleadservices.com www.google-analytics.com www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com js.braintreegateway.com s.ytimg.com video.google.com vimeo.com www.vimeo.com cdn-scripts.signifyd.com www.youtube.com *.cdn-net.com maps.googleapis.com *.newrelic.com www.google.com www.googletagmanager.com tagmanager.google.com *.opmnstr.com bat.bing.com connect.facebook.net www.facebook.com *.groovinads.com *.adform.net cdn.taboola.com url.defense.com trc.taboola.com static.hotjar.com script.hotjar.com a2.adform.com googleads.g.doubleclick.net bam.nr-data.net configusa.veinteractive.com ajax.googleapis.com instaleap.hebdigital.net:8085 syndicate.synthrone.com content.syndigo.com event.syndigo.com websdk.appsflyer.com *.google.com *.veinteractive.com *.googleapis.com *.hotjar.com *.doubleclick.net *.google.com.mx *.taboola.com *.googletagmanager.com *.facebook.net *.facebook.com *.googleadservices.com *.bing.com *.gstatic.com *.googleusercontent.com *.edge-generalmills.com *.omappapi.com *.youtube.com *.exponea.com *.exponea.com/* *.synthrone.com/* *.syndigo.com/* *.appsflyer.com https://6x4cg2qvi8.execute-api.us-east-1.amazonaws.com https://proxy-heb.hebdigital.net *.s3.amazonaws.com *.google-analytics.com *.google.com/recaptcha/ *.gstatic.com/recaptcha/ 'self' 'unsafe-inline' 'unsafe-eval'; style-src getfirebug.com maxcdn.bootstrapcdn.com fonts.googleapis.com syndicate.synthrone.com content.syndigo.com event.syndigo.com websdk.appsflyer.com *.google.com *.veinteractive.com *.adform.net *.googleapis.com *.hotjar.com *.doubleclick.net *.google.com.mx *.taboola.com *.googletagmanager.com *.facebook.net *.facebook.com *.googleadservices.com *.bing.com *.gstatic.com *.googleusercontent.com *.edge-generalmills.com *.omappapi.com *.synthrone.com/* *.syndigo.com/* *.appsflyer.com 'self' 'unsafe-inline'; object-src lsw.instaleap.io https://6x4cg2qvi8.execute-api.us-east-1.amazonaws.com 'self' 'unsafe-inline'; media-src 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src https://imgs.signifyd.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com *.cdn-net.com *.abstractapi.com *.omappapi.com dpm.demdex.net/ s2.adform.com webchannel-content.eservice.emarsys.net googleads.g.doubleclick.net bam.nr-data.net instaleap.hebdigital.net:8085 syndicate.synthrone.com content.syndigo.com event.syndigo.com *.google.com *.veinteractive.com *.adform.net *.googleapis.com *.hotjar.com *.doubleclick.net *.google.com.mx *.taboola.com *.googletagmanager.com *.facebook.net *.facebook.com *.googleadservices.com *.bing.com *.gstatic.com *.googleusercontent.com *.edge-generalmills.com *.youtube.com *.exponea.com *.synthrone.com/* *.syndigo.com/* https://6x4cg2qvi8.execute-api.us-east-1.amazonaws.com https://proxy-heb.hebdigital.net *.openpay.mx 'self' 'unsafe-inline'; child-src 'self' 'unsafe-inline'; default-src https://6x4cg2qvi8.execute-api.us-east-1.amazonaws.com https://proxy-heb.hebdigital.net 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline';
content-type
text/html; charset=UTF-8
date
Sat, 18 Mar 2023 02:29:55 GMT
expires
Fri, 18 Mar 2022 02:29:55 GMT
location
https://www.heb.com.mx/
pragma
no-cache
server
nginx/1.17.9
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-te-atendio
Web-1
x-xss-protection
1; mode=block
_Incapsula_Resource
www.heb.com.mx/ 		141 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.heb.com.mx/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3
Requested by
Host: www.heb.com.mx
URL: https://www.heb.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.243.179 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
c70cff8a6361799b4c95005ce4c2dae85d7a49f5542fb292d0d3b8463d112944
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.heb.com.mx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
cache-control
no-cache, no-store
content-encoding
gzip
x-robots-tag
noindex
content-length
20397
content-security-policy-report-only
default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: *.doubleclick.net cdn.noibu.com www.paypal.com websdk.appsflyer.com www.youtube.com www.paypalobjects.com imgs.cdn-btsg.com *.mathtag.com js-agent.newrelic.com www.googletagmanager.com *.facebook.com sorotele.yachts *.googleapis.com www.google-analytics.com capig.pubsa.mx banner.appsflyer.com fonts.gstatic.com api.exponea.com t.paypal.com www.heb.com.mx *.tiktok.com bereelec.quest *.googlesyndication.com *.online-metrix.net *.facebook.net adservice.google.com cdn.appsflyer.com impressions.onelink.me maps.gstatic.com flowit.pics www.google.com *.clarity.ms www.google.com.mx analytics.google.com creatives-cdn.appsflyer.com *.googleusercontent.com a.omappapi.com c.bing.com maxcdn.bootstrapcdn.com input.noibu.com bam.nr-data.net wss://input.noibu.com kritec.pics api.omappapi.com ipgeolocation.abstractapi.com bat.bing.com syndicate.synthrone.com www.cdn-net.com a.opmnstr.com proxy-heb.hebdigital.net www.gstatic.com *.googleadservices.com ads01.groovinads.com; form-action *.facebook.com www.heb.com.mx www.cdn-net.com; frame-ancestors 'self' ; report-uri /csp_report
content-type
application/javascript
I-of-back-thou-see-Shipwrace-he-sles-our-Gummons
www.heb.com.mx/ 		212 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.heb.com.mx/I-of-back-thou-see-Shipwrace-he-sles-our-Gummons
Requested by
Host: www.heb.com.mx
URL: https://www.heb.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.243.179 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
bon /
Resource Hash
dc9e9e1a099e394b34cb30d75ef70af6effdc5e7d95ad56dd106d08161c2c9af
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.heb.com.mx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 02:29:55 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000
server
bon
x-cdn
Imperva
content-security-policy-report-only
default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: *.doubleclick.net cdn.noibu.com www.paypal.com websdk.appsflyer.com www.youtube.com www.paypalobjects.com imgs.cdn-btsg.com *.mathtag.com js-agent.newrelic.com www.googletagmanager.com *.facebook.com sorotele.yachts *.googleapis.com www.google-analytics.com capig.pubsa.mx banner.appsflyer.com fonts.gstatic.com api.exponea.com t.paypal.com www.heb.com.mx *.tiktok.com bereelec.quest *.googlesyndication.com *.online-metrix.net *.facebook.net adservice.google.com cdn.appsflyer.com impressions.onelink.me maps.gstatic.com flowit.pics www.google.com *.clarity.ms www.google.com.mx analytics.google.com creatives-cdn.appsflyer.com *.googleusercontent.com a.omappapi.com c.bing.com maxcdn.bootstrapcdn.com input.noibu.com bam.nr-data.net wss://input.noibu.com kritec.pics api.omappapi.com ipgeolocation.abstractapi.com bat.bing.com syndicate.synthrone.com www.cdn-net.com a.opmnstr.com proxy-heb.hebdigital.net www.gstatic.com *.googleadservices.com ads01.groovinads.com; form-action *.facebook.com www.heb.com.mx www.cdn-net.com; frame-ancestors 'self' ; report-uri /csp_report
content-type
text/javascript
access-control-allow-origin
*
x-iinfo
5-34204969-34204979 NNNN CT(5 5 0) RT(1679106595478 47) q(0 0 0 -1) r(0 0)
cache-control
max-age=0
server-timing
bon, total;dur=9.67484
content-length
70094
_Incapsula_Resource
www.heb.com.mx/ 		1 B
37 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.heb.com.mx/_Incapsula_Resource?SWKMTFSR=1&e=0.560544169230397
Requested by
Host: www.heb.com.mx
URL: https://www.heb.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.243.179 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.heb.com.mx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
1
content-security-policy-report-only
default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: *.doubleclick.net cdn.noibu.com www.paypal.com websdk.appsflyer.com www.youtube.com www.paypalobjects.com imgs.cdn-btsg.com *.mathtag.com js-agent.newrelic.com www.googletagmanager.com *.facebook.com sorotele.yachts *.googleapis.com www.google-analytics.com capig.pubsa.mx banner.appsflyer.com fonts.gstatic.com api.exponea.com t.paypal.com www.heb.com.mx *.tiktok.com bereelec.quest *.googlesyndication.com *.online-metrix.net *.facebook.net adservice.google.com cdn.appsflyer.com impressions.onelink.me maps.gstatic.com flowit.pics www.google.com *.clarity.ms www.google.com.mx analytics.google.com creatives-cdn.appsflyer.com *.googleusercontent.com a.omappapi.com c.bing.com maxcdn.bootstrapcdn.com input.noibu.com bam.nr-data.net wss://input.noibu.com kritec.pics api.omappapi.com ipgeolocation.abstractapi.com bat.bing.com syndicate.synthrone.com www.cdn-net.com a.opmnstr.com proxy-heb.hebdigital.net www.gstatic.com *.googleadservices.com ads01.groovinads.com; form-action *.facebook.com www.heb.com.mx www.cdn-net.com; frame-ancestors 'self' ; report-uri /csp_report
content-type
text/plain
_Incapsula_Resource
www.heb.com.mx/ Frame 3B14 		9 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.heb.com.mx/_Incapsula_Resource?CWUDNSAI=23&xinfo=4-26198233-0%200NNN%20RT%281679106595259%2042%29%20q%280%20-1%20-1%200%29%20r%280%20-1%29%20B16%20U24&incident_id=472001070050584190-127042787594476228&edet=16&cinfo=ffffffff&rpinfo=0&mth=GET
Requested by
Host: www.heb.com.mx
URL: https://www.heb.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.243.179 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
8cdf086c6c002f700eb10353d2b18c7beab86ccc7e99a35e000b372a9ec85b49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www.heb.com.mx/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, no-store
content-encoding
gzip
content-length
3745
content-security-policy-report-only
default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: *.doubleclick.net cdn.noibu.com www.paypal.com websdk.appsflyer.com www.youtube.com www.paypalobjects.com imgs.cdn-btsg.com *.mathtag.com js-agent.newrelic.com www.googletagmanager.com *.facebook.com sorotele.yachts *.googleapis.com www.google-analytics.com capig.pubsa.mx banner.appsflyer.com fonts.gstatic.com api.exponea.com t.paypal.com www.heb.com.mx *.tiktok.com bereelec.quest *.googlesyndication.com *.online-metrix.net *.facebook.net adservice.google.com cdn.appsflyer.com impressions.onelink.me maps.gstatic.com flowit.pics www.google.com *.clarity.ms www.google.com.mx analytics.google.com creatives-cdn.appsflyer.com *.googleusercontent.com a.omappapi.com c.bing.com maxcdn.bootstrapcdn.com input.noibu.com bam.nr-data.net wss://input.noibu.com kritec.pics api.omappapi.com ipgeolocation.abstractapi.com bat.bing.com syndicate.synthrone.com www.cdn-net.com a.opmnstr.com proxy-heb.hebdigital.net www.gstatic.com *.googleadservices.com ads01.groovinads.com; form-action *.facebook.com www.heb.com.mx www.cdn-net.com; frame-ancestors 'self' ; report-uri /csp_report
content-type
text/html
strict-transport-security
max-age=31536000
x-robots-tag
noindex
css2
fonts.googleapis.com/ Frame 3B14 		9 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;700&display=swap
Requested by
Host: www.heb.com.mx
URL: https://www.heb.com.mx/_Incapsula_Resource?CWUDNSAI=23&xinfo=4-26198233-0%200NNN%20RT%281679106595259%2042%29%20q%280%20-1%20-1%200%29%20r%280%20-1%29%20B16%20U24&incident_id=472001070050584190-127042787594476228&edet=16&cinfo=ffffffff&rpinfo=0&mth=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a6308a060ce27ea2c61de54a2259b0f504bd2d5ab1ed16e224e1c4efc783e8be
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.heb.com.mx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 18 Mar 2023 02:29:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 18 Mar 2023 01:47:15 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 18 Mar 2023 02:29:56 GMT
truncated
/ Frame 3B14 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fefd82032600b1979cc5f02c1786044b8d91109a5d5c52051f05356ae41861fc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v12/ Frame 3B14 		37 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.heb.com.mx
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 09:17:36 GMT
x-content-type-options
nosniff
age
148340
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37924
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 20:54:46 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 15 Mar 2024 09:17:36 GMT
I-of-back-thou-see-Shipwrace-he-sles-our-Gummons
www.heb.com.mx/ 		774 B
936 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.heb.com.mx/I-of-back-thou-see-Shipwrace-he-sles-our-Gummons?d=www.heb.com.mx
Requested by
Host: www.heb.com.mx
URL: https://www.heb.com.mx/I-of-back-thou-see-Shipwrace-he-sles-our-Gummons
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.243.179 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
bon /
Resource Hash
6bbddedab35325cd4fff31ec60c5bed0061d6698c1585436bf3257e7be3e3181
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
application/json; charset=utf-8
Referer
https://www.heb.com.mx/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain; charset=utf-8

Response headers

date
Sat, 18 Mar 2023 02:29:56 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
server
bon
x-cdn
Imperva
content-security-policy-report-only
default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: *.doubleclick.net cdn.noibu.com www.paypal.com websdk.appsflyer.com www.youtube.com www.paypalobjects.com imgs.cdn-btsg.com *.mathtag.com js-agent.newrelic.com www.googletagmanager.com *.facebook.com sorotele.yachts *.googleapis.com www.google-analytics.com capig.pubsa.mx banner.appsflyer.com fonts.gstatic.com api.exponea.com t.paypal.com www.heb.com.mx *.tiktok.com bereelec.quest *.googlesyndication.com *.online-metrix.net *.facebook.net adservice.google.com cdn.appsflyer.com impressions.onelink.me maps.gstatic.com flowit.pics www.google.com *.clarity.ms www.google.com.mx analytics.google.com creatives-cdn.appsflyer.com *.googleusercontent.com a.omappapi.com c.bing.com maxcdn.bootstrapcdn.com input.noibu.com bam.nr-data.net wss://input.noibu.com kritec.pics api.omappapi.com ipgeolocation.abstractapi.com bat.bing.com syndicate.synthrone.com www.cdn-net.com a.opmnstr.com proxy-heb.hebdigital.net www.gstatic.com *.googleadservices.com ads01.groovinads.com; form-action *.facebook.com www.heb.com.mx www.cdn-net.com; frame-ancestors 'self' ; report-uri /csp_report
content-type
application/json
access-control-allow-origin
*
x-iinfo
5-34204969-34204979 PNYN RT(1679106595478 541) q(0 0 0 -1) r(1 1) U6
cache-control
no-cache, no-store
server-timing
bon, total;dur=83.344172

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless function| a1_0x1741 function| a1_0x3df2 object| reese84 function| reese84interrogator function| initializeProtection function| protectionSubmitCaptcha

4 Cookies

Domain/Path Name / Value
.heb.com.mx/ Name: visid_incap_2805704
Value: sO4CfylfTLiVrTxyrPmXBiMiFWQAAAAAQUIPAAAAAABPUH5gJKL67ecb0flLTlCv
.heb.com.mx/ Name: incap_ses_472_2805704
Value: jB6UEMGukVl+JvjxeOKMBiMiFWQAAAAAUHA12ysgqLsvrW6XwWPJtA==
.heb.com.mx/ Name: nlbi_2805704_2147483392
Value: QEshXsVdyXdeu4BUTi1aRAAAAAAk95z+ELE5TjSjfk0pD5CV
.www.heb.com.mx/ Name: reese84
Value: 3:6nMmCgDV55T643XBUuD2Nw==:VUi1qpVvmNSGnH+LRGyQ70ggWzM7GmqYU0sliNTmADSTAUsGEQlMvLWRIx+9dmiY3WcBHQEz153csDvyme7XhwQhFOxV6PAFW9xcBUE0weAC71yZhCbQ/UAvM/hOxtutisxvHV8azoQztIfJ9q6cR+xMkZNjB5HbitrVTF7I7VZG3QNasRFIi4RwEJIZ6F0WsWNcgl/DywxdHr+vrmaR+QrcQY5zic3ngQy/KVv/YyVd6sIWufqXsezOZGWX66mmZWPW5SfIGi0iSSuZTFMQk9ALPQU/D/uNFLAM2XHhDAUYPCcxGInHhBJnusASU2kGHmQber+RzyaYk0gFjlBUi4ElMRRbCBrn6vmxg6diXQWecxAGOlp/1EuxmVGJDlB6jt+BZkjdQ1YuOY/dH78/qzMLdOk909i3x7OrJP80+Snyln75y3HpfGxeL04NKVlUH/yjziWVki1bNtXB+xWRttQLEd2h/Rm7UgfgLqyvbHgZYggTjW13dAQ0yXmQwN3t85UCA7uV4POQFQcfuiZXvDv6ell8sK5Gc1bvVo35i68NgtQ8DVmYgHIzQCwLAsUVCbXkkHGA/YEBB60D78z9HZta/sjXbAX1SEYSVG2rEp1b1D+nmd4bEHBzdIfUwbPB:kmt8M7NOLxBmJd+TrXCmYq9ZYEecDRVMRfBidQ0ekHI=

1 Console Messages

Source Level URL
Text
network error URL: https://www.heb.com.mx/
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000