urlscan.io logo urlscan.io
SecurityTrails logo

offer-k.getvi-shift.com Open in urlscan Pro
2a06:98c1:3120::3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://mw03trk.com/WDT8K/2JKMHWN/0.7941124397532682
Effective URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1...
Submission: On November 19 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 27 IPs in 5 countries across 20 domains to perform 88 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is offer-k.getvi-shift.com.
TLS certificate: Issued by WE1 on October 16th 2024. Valid for: 3 months.
This is the only time offer-k.getvi-shift.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 35.241.35.107 396982 (GOOGLE-CL...)
4 2a06:98c1:312... 13335 (CLOUDFLAR...)
6 142.250.185.200 15169 (GOOGLE)
1 1 2606:4700::68... 13335 (CLOUDFLAR...)
1 104.18.94.41 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
3 34.117.205.107 396982 (GOOGLE-CL...)
1 172.67.220.100 13335 (CLOUDFLAR...)
1 104.17.24.14 13335 (CLOUDFLAR...)
2 3.5.28.200 14618 (AMAZON-AES)
30 188.114.97.3 13335 (CLOUDFLAR...)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2400:52e0:1e0... 60068 (CDN77 Dat...)
1 2a04:4e42:600... 54113 (FASTLY)
3 172.217.18.3 15169 (GOOGLE)
3 151.101.66.133 54113 (FASTLY)
2 2620:1ec:bdf::45 8075 (MICROSOFT...)
1 142.250.186.100 15169 (GOOGLE)
2 151.101.194.133 54113 (FASTLY)
3 2a00:1450:400... 15169 (GOOGLE)
4 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 216.58.206.35 15169 (GOOGLE)
3 20.122.63.128 8075 (MICROSOFT...)
5 2a00:1450:400... 15169 (GOOGLE)
1 172.217.23.106 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 216.239.32.36 15169 (GOOGLE)
88 27
1    35.241.35.107 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 107.35.241.35.bc.googleusercontent.com
mw03trk.com
4    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
offer-k.getvi-shift.com
6    142.250.185.200 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f8.1e100.net
www.googletagmanager.com
1    2606:4700::6812:5f29 (United States)

ASN13335 (CLOUDFLARENET, US)
challenges.cloudflare.com
1    104.18.94.41 (None, )

ASN13335 (CLOUDFLARENET, US)
challenges.cloudflare.com
2    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
3    34.117.205.107 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 107.205.117.34.bc.googleusercontent.com
www.mxj5trk.com
1    172.67.220.100 (United States)

ASN13335 (CLOUDFLARENET, US)
offer.getrivalsmartwatch.com
1    104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    3.5.28.200 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: s3-1-w.amazonaws.com
holidayofferbadges.s3.amazonaws.com
30    188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
offer-k.getvi-shift.com
randomuser.me
offer.buyvi-shift.com
1    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
offer.getbiobandwatch.com
1    2400:52e0:1e00::1079:1 (Germany)

ASN60068 (CDN77 Datacamp Limited, GB)
images.dmca.com
1    2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
3    172.217.18.3 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f3.1e100.net
fonts.gstatic.com
3    151.101.66.133 (San Francisco, United States)

ASN54113 (FASTLY, US)
static.klaviyo.com
2    2620:1ec:bdf::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.clarity.ms
1    142.250.186.100 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f4.1e100.net
www.google.com
2    151.101.194.133 (San Francisco, United States)

ASN54113 (FASTLY, US)
static-tracking.klaviyo.com
3    2a00:1450:4001:806::2014 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
gtm-khd4rlt-owq2o.uc.r.appspot.com
4    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.analytics.google.com
2    2a00:1450:400c:c04::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
3    216.58.206.35 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s10-in-f3.1e100.net
www.google.de
3    20.122.63.128 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
p.clarity.ms
5    2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
maps.googleapis.com
1    172.217.23.106 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f10.1e100.net
maps.googleapis.com
2    2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
maps.gstatic.com
1    216.239.32.36 (United States)

ASN15169 (GOOGLE, US)
region1.analytics.google.com
Apex Domain
Subdomains		 Transfer
32 getvi-shift.com
offer-k.getvi-shift.com
820 KB
6 googleapis.com
maps.googleapis.com — Cisco Umbrella Rank: 466
276 KB
6 google.com
www.google.com — Cisco Umbrella Rank: 3
region1.analytics.google.com — Cisco Umbrella Rank: 4108
371 B
6 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
552 KB
5 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 625
p.clarity.ms — Cisco Umbrella Rank: 9040
30 KB
5 klaviyo.com
static.klaviyo.com — Cisco Umbrella Rank: 3108
static-tracking.klaviyo.com — Cisco Umbrella Rank: 3673
42 KB
5 gstatic.com
fonts.gstatic.com
maps.gstatic.com
49 KB
5 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 3147
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225
48 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 10745
189 B
3 appspot.com
gtm-khd4rlt-owq2o.uc.r.appspot.com — Cisco Umbrella Rank: 325194
2 KB
3 mxj5trk.com
www.mxj5trk.com — Cisco Umbrella Rank: 334691
19 KB
2 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 135
608 B
2 amazonaws.com
holidayofferbadges.s3.amazonaws.com — Cisco Umbrella Rank: 448941
26 KB
1 buyvi-shift.com
offer.buyvi-shift.com
18 KB
1 randomuser.me
randomuser.me — Cisco Umbrella Rank: 201556
7 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 847
31 KB
1 dmca.com
images.dmca.com — Cisco Umbrella Rank: 17094
795 B
1 getbiobandwatch.com
offer.getbiobandwatch.com
13 KB
1 getrivalsmartwatch.com
offer.getrivalsmartwatch.com
318 KB
1 mw03trk.com
mw03trk.com
892 B
88 20
Domain Requested by
32 offer-k.getvi-shift.com offer-k.getvi-shift.com
6 maps.googleapis.com code.jquery.com
maps.googleapis.com
6 www.googletagmanager.com offer-k.getvi-shift.com
www.googletagmanager.com
5 region1.analytics.google.com www.googletagmanager.com
offer-k.getvi-shift.com
3 p.clarity.ms www.clarity.ms
3 www.google.de offer-k.getvi-shift.com
3 gtm-khd4rlt-owq2o.uc.r.appspot.com www.googletagmanager.com
offer-k.getvi-shift.com
3 static.klaviyo.com offer-k.getvi-shift.com
static.klaviyo.com
3 fonts.gstatic.com offer-k.getvi-shift.com
3 www.mxj5trk.com offer-k.getvi-shift.com
www.mxj5trk.com
3 cdnjs.cloudflare.com offer-k.getvi-shift.com
2 maps.gstatic.com
2 stats.g.doubleclick.net www.googletagmanager.com
offer-k.getvi-shift.com
2 static-tracking.klaviyo.com static.klaviyo.com
2 www.clarity.ms offer-k.getvi-shift.com
www.clarity.ms
2 holidayofferbadges.s3.amazonaws.com offer-k.getvi-shift.com
2 challenges.cloudflare.com 1 redirects offer-k.getvi-shift.com
1 offer.buyvi-shift.com
1 randomuser.me offer-k.getvi-shift.com
1 www.google.com www.googletagmanager.com
1 code.jquery.com offer-k.getvi-shift.com
1 images.dmca.com offer-k.getvi-shift.com
1 offer.getbiobandwatch.com offer-k.getvi-shift.com
1 offer.getrivalsmartwatch.com offer-k.getvi-shift.com
1 mw03trk.com 1 redirects
88 25

This site contains links to these domains. Also see Links.

Domain
www.dmca.com
Subject Issuer Validity Valid
getvi-shift.com
WE1		 2024-10-16 -
2025-01-14		 3 months crt.sh
*.google-analytics.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
cdnjs.cloudflare.com
WE1		 2024-09-28 -
2024-12-27		 3 months crt.sh
mxj5trk.com
Starfield Secure Certificate Authority - G2		 2024-03-26 -
2025-04-27		 a year crt.sh
getrivalsmartwatch.com
WE1		 2024-10-09 -
2025-01-07		 3 months crt.sh
*.s3.amazonaws.com
Amazon RSA 2048 M01		 2024-04-22 -
2025-04-07		 a year crt.sh
getbiobandwatch.com
WE1		 2024-10-08 -
2025-01-06		 3 months crt.sh
images.dmca.com
R11		 2024-10-13 -
2025-01-11		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
*.gstatic.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
static.klaviyo.com
R10		 2024-11-08 -
2025-02-06		 3 months crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1		 2024-09-04 -
2025-09-04		 a year crt.sh
*.google.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
static-tracking.klaviyo.com
R10		 2024-11-16 -
2025-02-14		 3 months crt.sh
*.appspot.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
*.g.doubleclick.net
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
*.google.de
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
a.clarity.ms
Microsoft Azure RSA TLS Issuing CA 08		 2024-06-23 -
2025-06-18		 a year crt.sh
randomuser.me
WE1		 2024-10-25 -
2025-01-23		 3 months crt.sh
buyvi-shift.com
WE1		 2024-10-09 -
2025-01-07		 3 months crt.sh
upload.video.google.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Frame ID: 530F6B63AEB3DA891FE4994CE96D7367
Requests: 88 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Foffer-k.getvi-shift.com
Frame ID: 07ACD56FF81D1C99699F590D8ABFF16D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Vi-Shift

Page URL History Show full URLs

  1. https://mw03trk.com/WDT8K/2JKMHWN/0.7941124397532682 HTTP 302
    https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=122... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • //maps\.google(?:apis)?\.com/maps/api/js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • klaviyo\.com
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

88
Requests

99 %
HTTPS

43 %
IPv6

20
Domains

25
Subdomains

27
IPs

5
Countries

2252 kB
Transfer

6184 kB
Size

13
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://mw03trk.com/WDT8K/2JKMHWN/0.7941124397532682 HTTP 302
    https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://challenges.cloudflare.com/turnstile/v0/api.js HTTP 302
  • https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js

88 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
offer-k.getvi-shift.com/offer/1/checkout-now-v3/
Redirect Chain
  • https://mw03trk.com/WDT8K/2JKMHWN/0.7941124397532682
  • https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43...
62 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50ba099b396a9f8d48f9642be89c1f59200fb4008ed78974b1aa66b71e43bdaa

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
8e50f74e9825d35e-FRA
content-encoding
zstd
content-type
text/html
date
Tue, 19 Nov 2024 14:42:18 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
last-modified
Thu, 04 Jul 2024 11:45:09 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a1Mc21UYeecFrsqigYrLsfyKAZJDWK3MrF4l3vb%2FywcJzCC69LGvTZ8KLLw%2BUh3Bewtr0kiC3tq2khGJ6Si2NVupq8nOnQ6vdTumAFs4EZuLLqh5FYqRrSkiCgk4%2BstHketTiHCiFOLydinrDNG0oMLYxiLWRw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=58697&sent=8&recv=12&lost=0&retrans=0&sent_bytes=3988&recv_bytes=2480&delivery_rate=63433&cwnd=254&unsent_bytes=0&cid=0518d7b89fb74a44&ts=344&x=0"
vary
Accept-Encoding
via
1.1 google

Redirect headers

accept-ch
Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
305
content-type
text/html; charset=utf-8
date
Tue, 19 Nov 2024 14:42:17 GMT
location
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
server
nginx
vary
Origin
via
1.1 google
x-eflow-request-id
512d6330-c102-4a8b-9f87-262473ed81c2
js
www.googletagmanager.com/gtag/ 		210 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
478f0dd54ca86db9b05426d5246f559f21baa33f02d72047f3cf9722a925afd6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Tue, 19 Nov 2024 14:42:18 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:18 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Tue, 19 Nov 2024 12:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
77338
x-xss-protection
0
server
Google Tag Manager
api.js
challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/
Redirect Chain
  • https://challenges.cloudflare.com/turnstile/v0/api.js
  • https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js
47 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Server
104.18.94.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b7595c3d2e94df7416308fa2ccf5ae8832137c76d2e9a8b02e6ed2cb2d92e2f7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

server
cloudflare
cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding
br
cross-origin-resource-policy
cross-origin
cf-ray
8e50f753cf4ce513-TXL
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 19 Nov 2024 14:42:18 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Mon, 28 Oct 2024 19:08:47 GMT
vary
Accept-Encoding
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
location
/turnstile/v0/b/22755d9a86c9/api.js
cross-origin-resource-policy
cross-origin
cf-ray
8e50f751c8b23a52-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
date
Tue, 19 Nov 2024 14:42:18 GMT
vary
Accept-Encoding
server
cloudflare
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/ 		58 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"613fa20b-28de"
age
420670
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vPiLX30HUXSLgpA%2B2bJgVeBPiVsaejS5ZhN0RupL3qEda2ZRHmaBl5VfaCz5Q%2FtOXCXMlFM0CtuHsMVQKV78w0Pb8QKmdb%2BHk4kstg1csp3cLp0MOjgB3e4sI3JLShop7pm8TqwaaKPJJIR54wGxL00C"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 14:42:18 GMT
alt-svc
h3=":443"; ma=86400
date
Tue, 19 Nov 2024 14:42:18 GMT
content-type
text/css; charset=utf-8
last-modified
Mon, 13 Sep 2021 19:10:03 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8e50f751dba09f37-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
10462
server
cloudflare
bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/bootstrap/4.6.1/css/ 		158 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/bootstrap/4.6.1/css/bootstrap.min.css
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c5ed985fdbddc027124d4e6879ce1a1860832cda85e2b517c18d8fbd2fffc06
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"617ad19a-453d"
age
1022314
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uebU8AIXf4l3ePH5K5x36LjQyTgaVGwXNcjHq75ze2cTbV%2B9D24tqrunynxRSr9xGSMwmz%2FJuB6ER3Zd%2BMpjxnuW0C2yysJJcqwjzHQh1i5WlGinUGETFqBOzZdoC3yV2mRktEGtuhwMNuZJUlCAuLAb"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 14:42:18 GMT
alt-svc
h3=":443"; ma=86400
date
Tue, 19 Nov 2024 14:42:18 GMT
content-type
text/css; charset=utf-8
last-modified
Thu, 28 Oct 2021 16:36:42 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8e50f751dba29f37-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
17725
server
cloudflare
main.min.css
offer-k.getvi-shift.com/ 		2 MB
213 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ed13e360c27fe4bc9d1f0e54d6ff228ae27a3c091d64d99dc1dea57bf496bd2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"66868b43-1ab751"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eKPJX%2FYVaNuvl5rCAkKQEEA6PliBmTJ1leFeOy5byLif6QMUDGl8Rh%2FeMdjlkYsUZNerSFTA5quXkFQXn4eKz6wnjV2iET0FKHTBhfrGxrrikFvJpS0WWyDv5HLhjav6Y4gwSihT9XUimLGTyxOMnqGRY4%2Fa9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=74120&sent=50&recv=26&lost=9&retrans=9&sent_bytes=36850&recv_bytes=2913&delivery_rate=164909&cwnd=258&unsent_bytes=0&cid=0518d7b89fb74a44&ts=505&x=0"
date
Tue, 19 Nov 2024 14:42:18 GMT
content-type
text/css
last-modified
Thu, 04 Jul 2024 11:45:07 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f750afc0d35e-FRA
server
cloudflare
everflow.js
www.mxj5trk.com/scripts/sdk/ 		60 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mxj5trk.com/scripts/sdk/everflow.js
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.205.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
107.205.117.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
314b074d0362794037beb8b4d12d2493de3cf35848391a80bfe5ff55ee8b0844

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
max-age=14400
content-encoding
gzip
accept-ch
Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
via
1.1 google
x-eflow-request-id
93f7a20a-03e0-40e1-af5f-4427c687f87c
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
text/javascript
vary
Origin
server
nginx
black-trans2.png
offer.getrivalsmartwatch.com/offer/1/app/desktop/images/checkout-now-v2/ 		317 KB
318 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer.getrivalsmartwatch.com/offer/1/app/desktop/images/checkout-now-v2/black-trans2.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.220.100 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
044d376e1a48dfd95023145c6ad3c2c829b257ef495ce3fa4ccc137971273b8e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cf-cache-status
HIT
etag
"6734a5e6-4f416"
age
487099
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nfO2IKcCPJ9YxgrEhjlhktX5Ol9DPW3UOWIxRxqE9NkEwdfugPvWB4qwnqTLROAmSRxX1iMW%2FUWGoTx0jqrsWyq867KRqiYkuTRJ%2FGVBx4RFuKL23sDxo9%2FiffkCCZp0ctnacO3npmDIFcgyHFWV"}],"group":"cf-nel","max_age":604800}
expires
Fri, 13 Dec 2024 23:23:59 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=92305&sent=11&recv=7&lost=0&retrans=0&sent_bytes=4151&recv_bytes=4359&delivery_rate=35684&cwnd=12000&unsent_bytes=0&cid=91eff587fb8bfd30&ts=179&x=1", cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:18 GMT
content-type
image/png
last-modified
Wed, 13 Nov 2024 13:13:10 GMT
vary
Accept-Encoding
cache-control
public, max-age=2592000, must-revalidate, proxy-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
public
cf-ray
8e50f751cea53735-FRA
accept-ranges
bytes
content-length
324630
server
cloudflare
lazysizes.min.js
cdnjs.cloudflare.com/ajax/libs/lazysizes/5.3.2/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/lazysizes/5.3.2/lazysizes.min.js
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d9120fa621da6d613c1698b7014ec6bdf4620366e8f2b7b547059f4b6f6272b
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"60641588-1ed1"
age
413505
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LP%2BPRwAME%2FhrDlA8bUSqDc2nLZLQ5bAuHjwFuF6OEcuVpZp5pXfIW1ijGK5TMq6KgLBg02WSRp6efmUwH5EMY%2BCfIu3WtbEcupkpyidmqEinuBLiI6QayybSmZSAF6rKlD2NSgEK"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 14:42:19 GMT
alt-svc
h3=":443"; ma=86400
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
application/javascript; charset=utf-8
last-modified
Wed, 31 Mar 2021 06:24:08 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8e50f7556f1892a7-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
3150
server
cloudflare
Mobile_Reconstruction_1.png
holidayofferbadges.s3.amazonaws.com/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://holidayofferbadges.s3.amazonaws.com/Mobile_Reconstruction_1.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.5.28.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
5100f5ee3b88b4929df84d101feb7d43ea2f1230546865d0647a6c6f21848ed7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

x-amz-id-2
mxeUll54ol8p97JLCu/zJoXRRsHxTQXt4VK7SmcrgWUbUykYJ+bJ9Mqwd3X+XPxQuZ1dSt9z258IZf57Xk4PmDSLqwc32Zmaa136MmSgJaY=
ETag
"d7c1b46cfa13d15f7362c5f63293e128"
x-amz-request-id
D44XH7VX9Q3CBZVC
Accept-Ranges
bytes
Content-Length
6161
Date
Tue, 19 Nov 2024 14:42:19 GMT
Last-Modified
Fri, 08 Nov 2024 18:42:42 GMT
Content-Type
image/png
Server
AmazonS3
x-amz-server-side-encryption
AES256
imageLoading.gif
offer-k.getvi-shift.com/images/loading/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/loading/imageLoading.gif
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9cee4d46d01279944e2f6e2ca0279922d6aaaa148aaa986d67cfa820875f7f6d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3e-239d"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WcdkkHMm5hTWVJPmhY3QoTwreeTAARjPp00iF%2BxvOoF8ZrA5Q%2FTR8ioIndJlzBFzye62mHvZmE0KaXbBWQLrSYKYIzf1opZxcwLRtjf0JGnQx%2BbmT82ACMVvC1l%2FL1AJg1gHjLNkkPVXaZDSZOacxAtvcgZf2g%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=74120&sent=40&recv=26&lost=9&retrans=9&sent_bytes=26995&recv_bytes=2913&delivery_rate=164909&cwnd=258&unsent_bytes=0&cid=0518d7b89fb74a44&ts=504&x=0"
date
Tue, 19 Nov 2024 14:42:18 GMT
content-type
image/gif
last-modified
Thu, 04 Jul 2024 11:45:02 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f750afc6d35e-FRA
accept-ranges
bytes
content-length
9117
server
cloudflare
money-back-30-en.png
offer-k.getvi-shift.com/images/new/ 		48 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/new/money-back-30-en.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd20e0e4cc9d566f505ddbd503877a2f657418e8fa7d86ecaf2c1009b79e3de4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3e-c1ce"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K3RxjeMFbzv49pGud01SXP%2B5QMwFaMUZReZIAQCEfqkkvH3k1hiQRHoMOlphT0zkADFirR4ONn%2Fs8mTJzA%2BURoemRrApwupIr5Y1vlJMlnqXHLrrnY0bqwFjC33yajI6fUUOvgey4titTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=48394&sent=12&recv=7&lost=0&retrans=0&sent_bytes=4229&recv_bytes=4488&delivery_rate=67120&cwnd=12000&unsent_bytes=0&cid=e05695eb41a94b91&ts=88&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:18 GMT
content-type
image/png
last-modified
Thu, 04 Jul 2024 11:45:02 GMT
vary
Accept-Encoding
priority
u=2,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7511868d35d-FRA
accept-ranges
bytes
content-length
49614
server
cloudflare
gtm.js
www.googletagmanager.com/ 		387 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NZC3P9WD
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
7220b7706d036813ef75226d14dc2a5886a60ff453864af7eb230ac906334a97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires
Tue, 19 Nov 2024 14:42:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Tue, 19 Nov 2024 12:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
118920
x-xss-protection
0
server
Google Tag Manager
red-arrow.png
offer-k.getvi-shift.com/images/checkout/ 		200 B
908 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/checkout/red-arrow.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e528b84ff29b9f80f3ed6f6e1c52c3d106c6140bf9593881f70105e83a2d17f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3d-c8"
age
1955
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CR3NyyJLn17GACmGLPCOw%2Ff0uwQnXYiArvxSrhtLgvmcEKt7yzO6Hli%2FDSxbkOkv20rtdQ34al9KpGvVQ%2Bq0q15h5qjNSRcYcBaqMc0GvbfUam0hkK3KwnGZ3ToTgLHrfL8yEvbqvnxC3A%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=114322&sent=74&recv=29&lost=21&retrans=21&sent_bytes=72809&recv_bytes=5940&delivery_rate=50723&cwnd=9996&unsent_bytes=0&cid=e05695eb41a94b91&ts=519&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:18 GMT
content-type
image/png
last-modified
Thu, 04 Jul 2024 11:45:01 GMT
vary
Accept-Encoding
priority
u=2,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f753d8e6d35d-FRA
accept-ranges
bytes
content-length
200
server
cloudflare
secure-icon.png
offer.getbiobandwatch.com/offer/2/app/desktop/images/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer.getbiobandwatch.com/offer/2/app/desktop/images/secure-icon.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
575b2b383474606bcd11802527835c93cc1de6cb326b895bfe4ce75e0d11cfb7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cf-cache-status
HIT
age
3014336
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SbDNuC0hQBrGC%2FlyIbANl70LzQUojiPvyX639o7k7M%2FiCTAn%2BGfDzHd2EBq95l8aOTi6lrjiuNX6KiV7qgT274rUOljkldzORXfc6RTyrucriYsM9DZXSLUGCbmM6r1PMX%2BhA5gZWHFvPgM%2FEW7ZhajcCPQBhTci"}],"group":"cf-nel","max_age":604800}
expires
Wed, 15 Oct 2025 17:23:23 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=113061&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3936&recv_bytes=2232&delivery_rate=48010&cwnd=140&unsent_bytes=0&cid=53dd6134659a027e&ts=117&x=0"
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/png
last-modified
Thu, 04 Jul 2024 09:29:33 GMT
vary
Accept-Encoding
cache-control
public, max-age=31536000, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8e50f757fa4ed0b3-CDG
accept-ranges
bytes
content-length
12658
server
cloudflare
DMCABadgeHelper.min.js
images.dmca.com/Badges/ 		465 B
795 B 		Script
General
Check archive.org
Download Go to
Full URL
https://images.dmca.com/Badges/DMCABadgeHelper.min.js
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / ASP.NET
Resource Hash
e8021f1a9dad409f7e699457ac334653bf800464df69900237c4de1c29e275d0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cdn-status
200
content-encoding
br
etag
"26b181f16d28d51:0"
date
Tue, 19 Nov 2024 14:42:19 GMT
last-modified
Fri, 21 Jun 2019 20:14:34 GMT
cdn-cachedat
11/11/2024 09:23:44
vary
Accept-Encoding
content-type
application/javascript
cdn-requestpullcode
200
cdn-cache
HIT
link
<https://dmca-images.azurewebsites.net/Badges/DMCABadgeHelper.min.js>; rel="canonical"
cache-control
public, max-age=31536000
cdn-requestpullsuccess
True
cdn-requesttime
0
cdn-uid
c136c664-112d-4533-8247-f90f6849ab39
cdn-requestid
989e29fe3672c804f35c6971663ebf14
cdn-pullzone
1574055
cdn-proxyver
1.06
cdn-edgestorageid
1080
x-powered-by
ASP.NET
server
BunnyCDN-DE1-1079
cdn-requestcountrycode
DE
xclose.png
offer-k.getvi-shift.com/images/blissy/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/blissy/xclose.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfd6dfbf348462f8e35aac00960d50d182a964d6a35e6cce108530179b913bba

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3d-9c2"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yIYVlRv%2FqohG8z3eztX5BrVuuWyHFNGbRWrt3stDQv2k2JXkgLlTC9xCKzB%2BmjWG0odo08RcFBiAWXvi0I2JUj4g9PIsiRSTMbuFALR4jujoY6hb0KF4EDcVPi2kRrQhdtym5wJeTQUd%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=135497&sent=95&recv=48&lost=24&retrans=24&sent_bytes=88867&recv_bytes=9736&delivery_rate=42990&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=773&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/png
last-modified
Thu, 04 Jul 2024 11:45:01 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7556d30d35d-FRA
accept-ranges
bytes
content-length
2498
server
cloudflare
bf_cm_en.png
offer-k.getvi-shift.com/images/new/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/new/bf_cm_en.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e2975080484cbd155df2640cf883b661d04c8d800b73d763d493445640326cb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3e-132f"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CrShROAy9oJPHMCr%2F2kyrW07w5U3TU9OfdwUqQAGlSKm3IfrKRjHIl8QkftnW%2Bfi1SPFZjWVrt06Am6PGbybvo%2BcQOVPtqcMjuWMrAPiuBtWxIG8eSKvr88BHj6aPttGrGfE1B01X8VNGA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=135497&sent=101&recv=48&lost=24&retrans=24&sent_bytes=94830&recv_bytes=9736&delivery_rate=42990&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=774&x=1", cfExtPri, cfHdrFlush;dur=85
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/png
last-modified
Thu, 04 Jul 2024 11:45:02 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7556d31d35d-FRA
accept-ranges
bytes
content-length
4911
server
cloudflare
jquery-3.5.1.min.js
code.jquery.com/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
gzip
etag
W/"28feccc0-15d84"
age
7184069
x-cache
HIT, HIT
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
388150, 192546
x-served-by
cache-lga21981-LGA, cache-mxp6961-MXP
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1732027339.208222,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30879
server
nginx
main.min.js
offer-k.getvi-shift.com/js/ 		58 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/js/main.min.js?b7eef3fb04d47b928ec96100cb63f14d
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0206eade0adcf1138aae421f0b9d912f3f34a7754852b55e962a010c7b68275

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"66868b44-e7d1"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PExo2M1wcjVHhLdXxbKTJHzXe%2FWNfRmZ58yg8HnpsP9G5AN0ebywNoexQNV9xfiJxUE9vxCquUTrP%2FOYUvapI5zQFl8uamWiPs7%2Ba45P%2Fe48%2FQryk99g7Vu8yabFHhjG5SeprZJlAZU88g%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=135497&sent=95&recv=48&lost=24&retrans=24&sent_bytes=88867&recv_bytes=9736&delivery_rate=42990&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=773&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
application/javascript
last-modified
Thu, 04 Jul 2024 11:45:08 GMT
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7556d33d35d-FRA
server
cloudflare
checkout.min.js
offer-k.getvi-shift.com/js/ 		58 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/js/checkout.min.js?aef169cae5014f691b993c8032bff52a
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b408a2eec9bf39d8510a4787dd5459738d1ee43e54f8982684bbe63ba387684

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"66868b44-e8bd"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XP54DIiSafxaEPSzxMtEbhuGhoSYACpdokR3150lmWbBoYCMb12UluetzoJlrsfVUSIsvg3tlCFVlBlxPGovCxt8PMby0eHHNnf14aP1WGIu3nHo%2Bk9Oxdb0Youdpy4OF9eW6giTKn9gCw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=135497&sent=101&recv=48&lost=24&retrans=24&sent_bytes=94830&recv_bytes=9736&delivery_rate=42990&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=780&x=1", cfExtPri, cfHdrFlush;dur=79
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
application/javascript
last-modified
Thu, 04 Jul 2024 11:45:08 GMT
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7556d34d35d-FRA
server
cloudflare
address-auto-complete.min.js
offer-k.getvi-shift.com/js/ 		46 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/js/address-auto-complete.min.js?ad088f04c6cfc5feb6ed45f9c83e5c1f
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
135e1609cea84f4ea3fa70e166f5466cdecb288abc2f96212f586dbfa206f34b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"66868b44-b766"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wZLEHZpjy%2B2Yb80UoPE0jy6iNkT6pBGgcE3N1%2BFg6ulfb9YapgpBbHDYJFyj28VOK6SO0O8KdloBVPxZvWbHwBvBhgrU59%2FJ7Y%2BZ%2F5%2Fr1xHtx1gNtgJnj06pYD2r%2BUaAsC2s%2B7OdBhW2DA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=135497&sent=101&recv=48&lost=24&retrans=24&sent_bytes=94830&recv_bytes=9736&delivery_rate=42990&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=774&x=1", cfExtPri, cfHdrFlush;dur=85
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
application/javascript
last-modified
Thu, 04 Jul 2024 11:45:08 GMT
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7556d35d35d-FRA
server
cloudflare
instantpage-5.2.0.js
offer-k.getvi-shift.com/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/js/instantpage-5.2.0.js
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9e6077900d21940206069ce5b05bae5e2ef6f100187cfe49dda6c41a10863e7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"66868b3f-b8f"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XaeghhtQW42Y%2F0X0Clmq%2Fn1lfcrXT%2Fc1X6g7lr1Zfdpfou6TIxMpZGm8zx%2FMznt6Al2O3BIsM7hUok6287qKENC7KnGn7V8uhnK3rMe4EsjFFid%2F%2FHNfUC2EnMTbvfECJJP9aVGxl7T0FQkwnxOJtI5DJuPMbg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=57607&sent=122&recv=45&lost=0&retrans=9&sent_bytes=120275&recv_bytes=3030&delivery_rate=393254&cwnd=258&unsent_bytes=32425&cid=0518d7b89fb74a44&ts=561&x=0"
date
Tue, 19 Nov 2024 14:42:18 GMT
content-type
application/javascript
last-modified
Thu, 04 Jul 2024 11:45:03 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f750f8b1d35e-FRA
server
cloudflare
jquery.sticky.js
offer-k.getvi-shift.com/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/js/jquery.sticky.js
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cf7833ee174c4af5765d79030bd45b759e7c1d47799e4062b8ad64cf7b3d581

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"66868b3f-1004"
age
4985
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mrDSr3qtLN%2BT%2FkynR8mCbfB0CKC4n72%2FhEswuZLCLo2kn%2B1t6m8npdg0DlfOblIlF2cPH%2FMY4JXpuR6m%2F2WIQkIy%2Fq0TbPTXVe1PvcHO7DcWpkGkZeh%2FpE3PEK%2F2Vb8Vbi%2B3wh54VXOcMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=118176&sent=87&recv=41&lost=23&retrans=23&sent_bytes=83862&recv_bytes=6905&delivery_rate=125996&cwnd=9996&unsent_bytes=0&cid=e05695eb41a94b91&ts=666&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
application/javascript
last-modified
Thu, 04 Jul 2024 11:45:03 GMT
vary
Accept-Encoding
priority
u=2,i=?0
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f754cb6ad35d-FRA
server
cloudflare
select.webp
offer-k.getvi-shift.com/images/kinetic/ 		966 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/kinetic/select.webp
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3799f765df5a2e9762262f0c98f9275ef5861cf426b0091b082372fe4af554dd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40

Response headers

cf-cache-status
HIT
etag
"66868b3d-3c6"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GW45XwVQIyXEjjqVqB4VFOaQYIzY%2F9vf4fis4%2BP1w53JWYE6m%2Be6l7PbJxk68BnKUwChA%2FzbdqsIhpV%2Fbcsj5onJ5a5srnH1NZu%2BwYmMwIUuFIxutposY2OvcJQbHMVhXyn0PHm8UEWp%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=118176&sent=91&recv=42&lost=23&retrans=23&sent_bytes=86070&recv_bytes=7294&delivery_rate=125996&cwnd=9996&unsent_bytes=0&cid=e05695eb41a94b91&ts=704&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:01 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f754fc03d35d-FRA
accept-ranges
bytes
content-length
966
server
cloudflare
SFProText-Regular.woff2
offer-k.getvi-shift.com/fonts/ 		92 KB
93 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/fonts/SFProText-Regular.woff2
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d5aaceac1817ecaf4402f1f68c31ffc8eafe08a277cf8d79ae715afb300bfbf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40

Response headers

cf-cache-status
HIT
etag
"66868b3b-170fc"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FqCzB2irkieLpc9OOo1bgdTPt8SA6PQrCYryG5Fh2I9BPLg2Jfw1wlfwIo%2FX%2Bidx7PvusNFlvgPAizm7fzk9Kcao2K6U7fzOM%2BixGhbAvQ9YxgfkmWjDFea088VzCdkExHy4d61VfBcTOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=105&recv=52&lost=25&retrans=25&sent_bytes=98682&recv_bytes=11549&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=869&x=1", cfExtPri, cfHdrFlush;dur=86
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
font/woff2
last-modified
Thu, 04 Jul 2024 11:44:59 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7560ebfd35d-FRA
accept-ranges
bytes
content-length
94460
server
cloudflare
SFProText-Semibold.woff2
offer-k.getvi-shift.com/fonts/ 		101 KB
102 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/fonts/SFProText-Semibold.woff2
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9805fc9909ab10d7945503b34a461d4f9c95276e32b9898a42e919d156b82f2e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40

Response headers

cf-cache-status
HIT
etag
"66868b3b-195ec"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tMe1GeJm5I6yksfDegki%2BlYwynogUfstwleM7LXQzvTbibT%2FoaZHoG0oLhXiBY6u%2F2Ro2t75Zoakddqwnu22LB8xvzksOmBjsi%2BLDGi%2F0XIqlVOcP%2BI1E8Mnuxuz%2FLtTKoFajI1tM%2Bk4SQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=105&recv=52&lost=25&retrans=25&sent_bytes=98682&recv_bytes=11549&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=867&x=1", cfExtPri, cfHdrFlush;dur=88
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
font/woff2
last-modified
Thu, 04 Jul 2024 11:44:59 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7560ec3d35d-FRA
accept-ranges
bytes
content-length
103916
server
cloudflare
SFProText-Medium.woff2
offer-k.getvi-shift.com/fonts/ 		102 KB
102 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/fonts/SFProText-Medium.woff2
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57a18f291f8730968d03c67ac7952dc209649f6aea4b78ff1b2c652aa6f02d19

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40

Response headers

cf-cache-status
HIT
etag
"66868b3b-19650"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YinCNm0CeKq1BsKuWvNcIMRnX%2BBOBac1NgPK5QtT4hjGP%2Br8hNc28wtCtVMZHCa9Kp01JFX26ngC5BBZpicS3AmSApllw%2B8JjXtuHnQc2PQ%2F5bSST4s%2BbEg420yBuxCvOxyQ0Noh%2FsAyhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=105&recv=52&lost=25&retrans=25&sent_bytes=98682&recv_bytes=11549&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=870&x=1", cfExtPri, cfHdrFlush;dur=120
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
font/woff2
last-modified
Thu, 04 Jul 2024 11:44:59 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7560ec4d35d-FRA
accept-ranges
bytes
content-length
104016
server
cloudflare
SFProText-Bold.woff2
offer-k.getvi-shift.com/fonts/ 		100 KB
100 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/fonts/SFProText-Bold.woff2
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0ecd2276289f78980151b3a4e7e9e81e44255add441c9c2976853d264f7c73b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40

Response headers

cf-cache-status
HIT
etag
"66868b3b-18e9c"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cEKsXFb4UaFCFO0udk6RRTYdKGuhjuiwmQKERFQ3jdqz%2BQdJy2ULUSefwdKOn6XAEY4NNxEHu9amO7i9Kbg6W6oRDtfuJ4tKk%2F5V2HB%2BAhMHZaUfHVg0%2BisG7kn5ZC8csRVcLY7CpJ9lHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=105&recv=52&lost=25&retrans=25&sent_bytes=98682&recv_bytes=11549&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=868&x=1", cfExtPri, cfHdrFlush;dur=225
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
font/woff2
last-modified
Thu, 04 Jul 2024 11:44:59 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7560ec7d35d-FRA
accept-ranges
bytes
content-length
102044
server
cloudflare
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f3.1e100.net
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/

Response headers

age
374876
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sat, 15 Nov 2025 06:34:23 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 15 Nov 2024 06:34:23 GMT
last-modified
Wed, 11 May 2022 19:24:42 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
15860
x-xss-protection
0
server
sffe
mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v15/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f3.1e100.net
Software
sffe /
Resource Hash
482994b911cc3e869aa8ace6d9932d67b68de83ea2885207ce165ff04c38d7bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/

Response headers

age
329992
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sat, 15 Nov 2025 19:02:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 15 Nov 2024 19:02:27 GMT
last-modified
Wed, 11 Oct 2017 21:49:43 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
14720
x-xss-protection
0
server
sffe
mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v15/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFVZ0b.woff2
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f3.1e100.net
Software
sffe /
Resource Hash
3b98b0dc3bed9d40f43e64adba5de47c76895338a96f0a5a314676cd6287eca9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/

Response headers

age
365033
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sat, 15 Nov 2025 09:18:26 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 15 Nov 2024 09:18:26 GMT
last-modified
Wed, 11 Oct 2017 21:49:43 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
14048
x-xss-protection
0
server
sffe
ProximaNova-Semibold.woff2
offer-k.getvi-shift.com/fonts/ 		18 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/fonts/ProximaNova-Semibold.woff2
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1282871d2cfb4ee07dd96583248c7acfbc9143620042d6d4ec78b24473838f0c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/main.min.css?151eaa9069ca7b47396fe4ec01fb8f40

Response headers

cf-cache-status
HIT
etag
"66868b3b-4818"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0DOV0Fr54el1WHKdKn2w3W5B%2BcLZbttsdOLh6Mh5d07Ph4PNAswfxWHyQxvJQzsod9c8ILVL8yBOnNGtvs8kfju6RZl1%2Fnn6abwnTkgCtuqCqpSv8ixBkoUbWMboObLURsB8BRseOjoXVw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=105&recv=52&lost=25&retrans=25&sent_bytes=98682&recv_bytes=11549&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=872&x=1", cfExtPri, cfHdrFlush;dur=7500
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
font/woff2
last-modified
Thu, 04 Jul 2024 11:44:59 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7560ec8d35d-FRA
accept-ranges
bytes
content-length
18456
server
cloudflare
Black_Friday_top.png
holidayofferbadges.s3.amazonaws.com/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://holidayofferbadges.s3.amazonaws.com/Black_Friday_top.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.5.28.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
cd7cb5b0082f01431a155460632b954dd952166e4136c156dfea87015511cf7b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

x-amz-id-2
m0Ap6awZRintvtXzMzzwXc31qKDeiduPP6a6ejP7qvkDA89w6PDzNuO+zdhoPpqZ1VyIIzNjdjeJA7MqSSUl4Xhq4nzmWBMqD+C11mXYOkw=
ETag
"cb22d0967743450fe153e91f526870ab"
x-amz-request-id
MN04EDW561N4VM8M
Accept-Ranges
bytes
Content-Length
19199
Date
Tue, 19 Nov 2024 14:42:20 GMT
Last-Modified
Fri, 08 Nov 2024 18:42:43 GMT
Content-Type
image/png
Server
AmazonS3
x-amz-server-side-encryption
AES256
logo-2.webp
offer-k.getvi-shift.com/upload/300/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/upload/300/logo-2.webp
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8888c8ae4780d3cf032e8fa768148b09a5cdc32fbdd666850b0344001a35634b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3f-d20"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J7ojTPFZDDswkzlbtalGS4q2rWYGw7sryTKjjdHdpVcTN1OlUayYafvzmGbhGy7nfm38vepFU3doi6yuVq4z83MW6eXhEF%2FoYmXNDTs5RUGCUa6hz7OwxkHslSrGGgafEwdLboAl7Cu1EQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=107&recv=58&lost=25&retrans=25&sent_bytes=98734&recv_bytes=14581&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=892&x=1", cfExtPri, cfHdrFlush;dur=7480
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:03 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7562f25d35d-FRA
accept-ranges
bytes
content-length
3360
server
cloudflare
60-day.webp
offer-k.getvi-shift.com/images/kinetic/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/kinetic/60-day.webp
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0689dabda813659e82ce24a8cf8163085dde5bcb93d2a1f723444fa654a7e6f9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3d-2aa6"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8zU6dB7rF3wExPbJ7Y3p9enQrf4Pr3%2FrywoDXz3G20M9VgOuF%2BVeR%2Bh%2FP3IBH9lcrE7O4g50EdUWey%2FnL2JZt%2F6bnx7jZPCXhTwnozf5VloUnrJZi23xGbQ7EN89Q%2BHP%2F4%2FO7IEVXfYhAw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=107&recv=58&lost=25&retrans=25&sent_bytes=98734&recv_bytes=14581&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=890&x=1", cfExtPri, cfHdrFlush;dur=7482
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:01 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7562f28d35d-FRA
accept-ranges
bytes
content-length
10918
server
cloudflare
icons8-phone-60.webp
offer-k.getvi-shift.com/images/kinetic/ 		472 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/kinetic/icons8-phone-60.webp
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49c41172386524a83cbb75d748e7c84c324ef4f0c12c67286c60812f55c252f8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3d-1d8"
age
1955
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Tvhg4h2Ea3%2Fsm8tLEqQgz8Ye8N4xZq3IfQC8%2F1LdCNYBWm3SUINF5czTbXQRLYOFAGHk0tB4mdNzXHJ8EBWFvWpj5ytsjZlkFt5CgfTxzcA48hHt%2BGgy7msQgh8b%2BnrnPrY5xWm79qiEg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=107&recv=58&lost=25&retrans=25&sent_bytes=98734&recv_bytes=14581&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=891&x=1", cfExtPri, cfHdrFlush;dur=7547
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:01 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7562f29d35d-FRA
accept-ranges
bytes
content-length
472
server
cloudflare
s1-ic1.webp
offer-k.getvi-shift.com/upload/300/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/upload/300/s1-ic1.webp
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02e3471681541b3cbe5901d27762b68a8b0697f80959db8ac9c8ac2b2516a838

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3f-4e6"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oMK5WjUvmMQTzFnDrzBshuhkLbEO3q6Mh9mGiQ4aE9XQ9va6aUJSnPZff8Hf4pf4kRGui%2FLkLKcZ6NBHak4IbchD49Q6WbG2GIrjcQ0LJTIlUtg%2Bs%2B9p9i8yq7oYUq0UqSkW5VEWDpDzgw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=107&recv=58&lost=25&retrans=25&sent_bytes=98734&recv_bytes=14581&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=891&x=1", cfExtPri, cfHdrFlush;dur=7547
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:03 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7562f2cd35d-FRA
accept-ranges
bytes
content-length
1254
server
cloudflare
s1-ic2.webp
offer-k.getvi-shift.com/upload/300/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/upload/300/s1-ic2.webp
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cfee50475bcc85591aaca463ddc34e66fcdef9355d654eecb695f056c66e3b5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3f-658"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ItPYzxy%2BU9GGIqea1zbCA5jMj6lHVrCUcnRPlSDbTQEvo1yGCCfZucFmww6bzrDOb6FuVDm9jc9ehzd2jjLDp3kEAbH%2BcEgWR2s%2FJO1ZMko%2FT8Q3SP7Ljlehdbu4aU467GNATyKDVWXtCg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=108&recv=58&lost=26&retrans=26&sent_bytes=99934&recv_bytes=14581&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=895&x=1", cfExtPri, cfHdrFlush;dur=7543
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:03 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7562f2ed35d-FRA
accept-ranges
bytes
content-length
1624
server
cloudflare
s1-ic3.webp
offer-k.getvi-shift.com/upload/300/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/upload/300/s1-ic3.webp
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c46e230a35ad8847f5d3021c9818af4e0fd226733d167392eb58b5be6999106a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3f-684"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F96qANEATgWE7a3EBcTaAvA7AvN60KSymw6N9Kf9338GQaHtBkq4ecacwKUmSMVmlg4ONyE%2FVW0hRSfiHf%2FVR5XcFL5%2BAZtZw4MQHYDJ8lws%2FWp%2BfdS8386qlX0A12t5Ce8NonZ8EubbLA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=178786&sent=107&recv=58&lost=25&retrans=25&sent_bytes=98734&recv_bytes=14581&delivery_rate=33292&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=895&x=1", cfExtPri, cfHdrFlush;dur=7608
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:03 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7562f33d35d-FRA
accept-ranges
bytes
content-length
1668
server
cloudflare
s1-ic4.webp
offer-k.getvi-shift.com/upload/300/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/upload/300/s1-ic4.webp
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
66e948957905f1a80510b8aa8f5d7a5335b32f18a42b20b1b8542b6713ee7a43

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3f-7e6"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yGAF7w3J%2BsQ9FSMnQRhpI5htf4bNl8RxWo0VcdVHN0Nvc%2BAa%2BBk1HyLRxA5QmUNNbhdCSLhTSC4TRWr%2BzNITIJBMTKU2s3P%2BRi7cxuJk%2FaXsp6xKK42JLajmYRhszsdftmIaGycaYdET7A%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=152830&sent=116&recv=62&lost=26&retrans=26&sent_bytes=106957&recv_bytes=15218&delivery_rate=26189&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=1042&x=1", cfExtPri, cfHdrFlush;dur=7461
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:03 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f75719cbd35d-FRA
accept-ranges
bytes
content-length
2022
server
cloudflare
star02.png
offer-k.getvi-shift.com/images/kinetic/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/kinetic/star02.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
92158235a68fa09845a49da16f828f7bb93478bc6f9e92e561397b1ab91a1a22

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3d-6b1"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6J1wubBaJdv0hhKQEfqJpVp906tXIN%2B%2BfbNQK9rKpCPt9GFwedn6T60sWe4%2BZdR%2BJI6hME2ODgA1dpVQ2Kn9KRuT%2BC9NKYVMU%2Fu6L44WhHHxNQDJU4NbXvomgrfxeTt%2BjHedFiRNGEnO8w%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=162571&sent=126&recv=64&lost=26&retrans=26&sent_bytes=115181&recv_bytes=16226&delivery_rate=68096&cwnd=8197&unsent_bytes=0&cid=e05695eb41a94b91&ts=1158&x=1", cfExtPri, cfHdrFlush;dur=7408
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/png
last-modified
Thu, 04 Jul 2024 11:45:01 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f757cb90d35d-FRA
accept-ranges
bytes
content-length
1713
server
cloudflare
star.png
offer-k.getvi-shift.com/images/ 		385 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/star.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52c5e554ea9eedd0970340d2987c2c6fc2897a13343b1afcdcc68281fc98f3f4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3c-181"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GytQOuKYy7ivCUfEZO9ZH4sFbDfUnBZ1or9mg9eFDfxYfe7BRTiUfKNxdXnU0FDftvUp0hWKk1ozNQQeqPbf4Oow19upZGyMlIgwEwiZ25izG2zhTgdLFhqY4lTx3daEePEti%2Fv1kPeWHw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=162571&sent=126&recv=64&lost=26&retrans=26&sent_bytes=115181&recv_bytes=16226&delivery_rate=68096&cwnd=8197&unsent_bytes=0&cid=e05695eb41a94b91&ts=1151&x=1", cfExtPri, cfHdrFlush;dur=7415
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/png
last-modified
Thu, 04 Jul 2024 11:45:00 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f757cb92d35d-FRA
accept-ranges
bytes
content-length
385
server
cloudflare
xclose.png
offer-k.getvi-shift.com/images/blissy/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/blissy/xclose.png
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfd6dfbf348462f8e35aac00960d50d182a964d6a35e6cce108530179b913bba

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3d-9c2"
age
4984
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yIYVlRv%2FqohG8z3eztX5BrVuuWyHFNGbRWrt3stDQv2k2JXkgLlTC9xCKzB%2BmjWG0odo08RcFBiAWXvi0I2JUj4g9PIsiRSTMbuFALR4jujoY6hb0KF4EDcVPi2kRrQhdtym5wJeTQUd%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=135497&sent=95&recv=48&lost=24&retrans=24&sent_bytes=88867&recv_bytes=9736&delivery_rate=42990&cwnd=6997&unsent_bytes=0&cid=e05695eb41a94b91&ts=773&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
image/png
last-modified
Thu, 04 Jul 2024 11:45:01 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7556d30d35d-FRA
accept-ranges
bytes
content-length
2498
server
cloudflare
klaviyo.js
static.klaviyo.com/onsite/js/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.klaviyo.com/onsite/js/klaviyo.js?company_id=VLDxrn
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
552818556edf7f78c0073dcf8a32d5aef256a4a43d8933e20e00224916096deb
Security Headers
Name Value
Content-Security-Policy object-src 'none'; script-src 'report-sample' 'strict-dynamic' 'unsafe-eval'; frame-ancestors 'self' login.bigcommerce.com *.mybigcommerce.com admin.shopify.com klaviyo.file.force.com klaviyo.lightning.force.com klaviyo.my.salesforce.com; base-uri 'none'; report-uri /csp/

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

access-control-max-age
86400
content-encoding
br
etag
"669906c3e6aa1ceaecdd7d551d3ecfc4"
age
65960
access-control-allow-methods
GET
x-cache
HIT, HIT
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
application/javascript
x-served-by
cache-lga21984-LGA, cache-fra-etou8220117-FRA
x-cache-hits
44, 0
access-control-allow-headers
vary
Accept-Encoding
content-security-policy
object-src 'none'; script-src 'report-sample' 'strict-dynamic' 'unsafe-eval'; frame-ancestors 'self' login.bigcommerce.com *.mybigcommerce.com admin.shopify.com klaviyo.file.force.com klaviyo.lightning.force.com klaviyo.my.salesforce.com; base-uri 'none'; report-uri /csp/
cache-control
max-age=1, stale-while-revalidate=10800, stale-if-error=86400
x-timer
S1732027343.139361,VS0,VE2
access-control-allow-credentials
true
allow
GET, OPTIONS
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
1985
content-language
en-us
server
nginx
js
www.googletagmanager.com/gtag/ 		404 KB
130 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-FKE1ZCRLHG&l=dataLayer&cx=c&gtm=45He4be0v9180508217za200
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NZC3P9WD
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
a00163b105356559691d0b832db802127304542eceb1426256b28fc38aab877c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Tue, 19 Nov 2024 14:42:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
133518
x-xss-protection
0
server
Google Tag Manager
6gzzp74dle
www.clarity.ms/tag/ 		616 B
872 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/tag/6gzzp74dle
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
65b437cab2be521149fe7240f5eace41b29a6a6acdc9d0ebe76a35268fa9970e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store
request-context
appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78
expires
-1
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
616
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
application/x-javascript
x-azure-ref
20241119T144223Z-15cf779cf56xcgbmhC1DUSt6r0000000027g00000000e75p
js
www.googletagmanager.com/gtag/ 		281 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-16721746388
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NZC3P9WD
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
4a8406e7b3011440826068cf40c64437925c9081ceda162772f70d6f3eb41c0e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Tue, 19 Nov 2024 14:42:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:19 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Tue, 19 Nov 2024 12:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
99461
x-xss-protection
0
server
Google Tag Manager
collect
www.google.com/ccm/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Foffer-k.getvi-shift.com%2Foffer%2F1%2Fcheckout-now-v3%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=2136800616.1732027340&auid=2132076263.1732027340&npa=1&gtm=45He4be0v9180508217za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&tft=1732027339513&tfd=2065&apve=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NZC3P9WD
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f4.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers
sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame 07AC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Foffer-k.getvi-shift.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NZC3P9WD
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f8.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
4988
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
br
content-length
1476
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy
cross-origin
date
Tue, 19 Nov 2024 13:19:15 GMT
expires
Wed, 19 Nov 2025 13:19:15 GMT
last-modified
Mon, 21 Oct 2024 16:58:00 GMT
report-to
{"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server
sffe
service-worker-allowed
/static/service_worker
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
clarity.js
www.clarity.ms/s/0.7.56/ 		66 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/s/0.7.56/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/6gzzp74dle
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
dc1da692990307185621fd661b7305e29d3a0a5ba0f0d998e5a1463a17c57044

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

x-azure-ref
20241119T144223Z-15cf779cf56xcgbmhC1DUSt6r0000000027g00000000e769
cache-control
public, max-age=86400
x-ms-version
2018-03-28
content-encoding
br
etag
W/"0x8DD041B2B98F09E"
x-fd-int-roxy-purgeid
79034942
x-ms-request-id
f97bab10-501e-0016-4b11-3ad80c000000
access-control-allow-origin
*
x-cache
TCP_HIT
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
last-modified
Wed, 13 Nov 2024 19:41:29 GMT
fender_analytics.04ab38f130b37e59f5d2.js
static-tracking.klaviyo.com/onsite/js/ 		35 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static-tracking.klaviyo.com/onsite/js/fender_analytics.04ab38f130b37e59f5d2.js?cb=1
Requested by
Host: static.klaviyo.com
URL: https://static.klaviyo.com/onsite/js/klaviyo.js?company_id=VLDxrn
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0e913234e3123ba8a5d535706253505bf4e1c5260f4a28ea8c31fbcfcb6b8aaa

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
etag
"c00d53f438ea65f2db1f84c264cf714c"
x-amz-version-id
yzchsteEWmJB1oIUQ2WGXYi9VgiVet_U
age
65962
x-cache
HIT, HIT
date
Tue, 19 Nov 2024 14:42:23 GMT
x-amz-meta-surrogate-control
max-age=31536000
last-modified
Thu, 07 Nov 2024 17:02:38 GMT
content-type
application/javascript
x-served-by
cache-lga21925-LGA, cache-fra-etou8220107-FRA
x-cache-hits
3, 13050
x-amz-id-2
rb0zTsZTl5gTXbNvDZL7prz7pcUmFGLgbfSy+Tp81J20+VWkJDUZPOpbYfumFsq/BQ8LkGkP9VVOS8BqbNXNchozjR3hASMC
vary
Accept-Encoding
cache-control
max-age=2592000,stale-while-revalidate=10800
x-amz-meta-entrypoints-hash
aaa4b6085cbd632503eaf0997667570ce306da01
x-amz-request-id
B9FVX2T845KAFC4H
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
x-amz-meta-surrogate-key
fender-asset
content-length
12403
server
AmazonS3
x-amz-server-side-encryption
AES256
static.8d136cd44b74e8189276.js
static-tracking.klaviyo.com/onsite/js/ 		495 B
866 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static-tracking.klaviyo.com/onsite/js/static.8d136cd44b74e8189276.js?cb=1
Requested by
Host: static.klaviyo.com
URL: https://static.klaviyo.com/onsite/js/klaviyo.js?company_id=VLDxrn
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6eaa7d84867f4a3f58d1cff2d44b4d4adfcc58072a48d761fe092b7e6172b253

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
etag
"264b8a3f80d7760ba761881fd76641fb"
x-amz-version-id
6zlTE8Co7OjOY9GYezYqIio1d6NroU4.
age
65962
x-cache
HIT, HIT
date
Tue, 19 Nov 2024 14:42:23 GMT
x-amz-meta-surrogate-control
max-age=31536000
last-modified
Sun, 27 Oct 2024 19:37:22 GMT
content-type
application/javascript
x-served-by
cache-lga21975-LGA, cache-fra-etou8220107-FRA
x-cache-hits
6, 13050
x-amz-id-2
14Qf/sarMCfZ/KOrGLmbQwQ6hufraCUQXzA+i7KyoiQIPxYOSg3RFAB2pGFJ3/z8hDtOLE9UsAACMOB/LHX2SA==
vary
Accept-Encoding
cache-control
max-age=2592000,stale-while-revalidate=10800
x-amz-meta-entrypoints-hash
2b402f8568bcce13fb51a14008ebe3527f498a90
x-amz-request-id
FSBWPMGA65HMDDGR
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
x-amz-meta-surrogate-key
fender-asset
content-length
280
server
AmazonS3
x-amz-server-side-encryption
AES256
runtime.1656648f257697861a7f.js
static.klaviyo.com/onsite/js/ 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.klaviyo.com/onsite/js/runtime.1656648f257697861a7f.js?cb=1
Requested by
Host: static.klaviyo.com
URL: https://static.klaviyo.com/onsite/js/klaviyo.js?company_id=VLDxrn
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e8b9df96e9f32cd479c40b7edebcb81f2916f73dd28aeef9e787ca3392954c48

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
etag
"97025bd026c58b792448f2513559c238"
x-amz-version-id
g7GQeEWG5YIzach7k9Ow8Lz1ZG.wRt4G
age
65962
x-cache
HIT, HIT
date
Tue, 19 Nov 2024 14:42:23 GMT
x-amz-meta-surrogate-control
max-age=31536000
last-modified
Mon, 18 Nov 2024 14:25:39 GMT
content-type
application/javascript
x-served-by
cache-lga21947-LGA, cache-fra-etou8220089-FRA
x-cache-hits
9, 14804
x-amz-id-2
+mxiToFU4O/rUUdFCnO/2kzAOqqFNPjsitoFx5uOcSCQgjTF/cvXsi9Qd1kcj/VYj0AD/z4SfL7WuCIdVxYUHQ==
vary
Accept-Encoding
cache-control
max-age=2592000,stale-while-revalidate=10800
x-amz-meta-entrypoints-hash
27dc79982088623505416d516a77eb0928f158f7
x-amz-request-id
VQ76QJADM6J6PDAK
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
x-amz-meta-surrogate-key
fender-asset
content-length
7829
server
AmazonS3
x-amz-server-side-encryption
AES256
sharedUtils.5c9dd35782316441d37b.js
static.klaviyo.com/onsite/js/ 		49 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.klaviyo.com/onsite/js/sharedUtils.5c9dd35782316441d37b.js?cb=1
Requested by
Host: static.klaviyo.com
URL: https://static.klaviyo.com/onsite/js/klaviyo.js?company_id=VLDxrn
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c62f3218c0b289ec5709c615aa14974fa3d88cbe64534ac0cca52cca51c3ac32

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://offer-k.getvi-shift.com
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
etag
"547aeff69454f5cf9c3bb7e0a8021dfe"
x-amz-version-id
D0_fAy6ataiLh1WPb8vjPZl8RAeHpW7I
age
65962
x-cache
HIT, HIT
date
Tue, 19 Nov 2024 14:42:23 GMT
x-amz-meta-surrogate-control
max-age=31536000
last-modified
Thu, 07 Nov 2024 21:33:49 GMT
content-type
application/javascript
x-served-by
cache-lga21963-LGA, cache-fra-etou8220089-FRA
x-cache-hits
29, 13654
x-amz-id-2
ulpB4hYk1v1rsi54r5P1wzN2+GgyTkwBkn1QwbZ2AP2RgHq96LA5bfPc89Uf15YJ96d9jQu3Z23THy9vseNVZQ==
vary
Accept-Encoding
cache-control
max-age=2592000,stale-while-revalidate=10800
x-amz-meta-entrypoints-hash
9c9d4648388573789d56c980b867a7f28da8a438
x-amz-request-id
X8ZDS83GN9PBMS96
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
x-amz-meta-surrogate-key
fender-asset
content-length
18359
server
AmazonS3
x-amz-server-side-encryption
AES256
destination
www.googletagmanager.com/gtag/ 		420 KB
132 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/destination?id=G-BFXEWPXKBT&l=dataLayer&cx=c&gtm=45je4be0v9180508556za200zb9180508217
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FKE1ZCRLHG&l=dataLayer&cx=c&gtm=45He4be0v9180508217za200
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
52357f9feebcc48422ca5f1b5a2bb918d1241e90ac495fa6aba1ee00c1fc2a06
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires
Tue, 19 Nov 2024 14:42:23 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
134957
x-xss-protection
0
server
Google Tag Manager
collect
gtm-khd4rlt-owq2o.uc.r.appspot.com/g/ 		2 KB
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://gtm-khd4rlt-owq2o.uc.r.appspot.com/g/collect?v=2&tid=G-FKE1ZCRLHG&gtm=45je4be0v9180508556z89180508217za200zb9180508217&_p=1732027338336&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cid=451776835.1732027343&ecid=180548745&ul=de-de&sr=1600x1200&_fplc=0&ur=DE-NI&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&sst.etld=google.de&sst.gcsub=region1&sst.tft=1732027338336&sst.ude=0&_s=1&sid=1732027343&sct=1&seg=0&dl=https%3A%2F%2Foffer-k.getvi-shift.com%2Foffer%2F1%2Fcheckout-now-v3%2F%3FC1%3D1301%26C2%3D%26uid%3D12770%26oid%3D1301%26affid%3D1223%26AFFID%3D1223%26utm_campaign%3DCPA_1223%26utm_source%3D1223%26source_id%3DAutoResponder%26sub1%3D%26sub2%3D7b6eb633b3ea43379c2c0c810452a39e%26discount%3D%26banner%3Dn&dt=Vi-Shift&uid=&en=page_view&_fv=1&_nsi=1&_ss=1&ep.page_type=Checkout%20Page&ep.offer=Vi-Shift&ep.gtm_version=GTM-NZC3P9WD%3B%2012%3B%20&tfd=5854&richsstsse
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FKE1ZCRLHG&l=dataLayer&cx=c&gtm=45He4be0v9180508217za200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
48404bab25594e17eef17448f4bbfb2ba0f4edf65daccfa574a8a8b7f4adb0dc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache
content-encoding
gzip
access-control-allow-credentials
true
x-content-type-options
nosniff
via
1.1 google
access-control-allow-origin
https://offer-k.getvi-shift.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
text/plain
vary
Accept-Encoding
visa-mstr-disc.webp
offer-k.getvi-shift.com/images/kinetic/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/images/kinetic/visa-mstr-disc.webp
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dd3f038a64b2e46316379946bb9557f7336238d53abf780470492b0d7350ee3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3d-f7a"
age
4987
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QrZ20PAk48XEYhVXeMkdPJ6RQoMBPt4NvCG34a5miB2%2FpX1nrTWuDMaAvcCMRmpHFHILiuuYKA8%2BDvf0wYq2Z9lWY2zPDwNg%2B92s2D%2B2wydR9hgWel8SkTg7wNGGMLU1sjfOFhZdUmRJeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=162571&sent=132&recv=66&lost=26&retrans=31&sent_bytes=121207&recv_bytes=17436&delivery_rate=68096&cwnd=8197&unsent_bytes=0&cid=e05695eb41a94b91&ts=5166&x=1", cfExtPri, cfHdrFlush;dur=3400
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:01 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f770ee51d35d-FRA
accept-ranges
bytes
content-length
3962
server
cloudflare
product1a.webp
offer-k.getvi-shift.com/upload/300/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer-k.getvi-shift.com/upload/300/product1a.webp
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a06ad17002beeb927fa743733c38d105e230bd5f67303c321cc171e1d70fea93

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3f-1c82"
age
4987
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LkntvABtKTSWDxta5VEbV7ncHHIC7zFG%2F0aQLuAQENBc3rBx9nr7yPP4zfHEBwwzHD5rnyEIBm1LxtcOpS%2BdiuVZ6KETQi29if4Od0VfMGvhTyQNaiTJfr8irWcpT3eUGcqehkvvEeCwyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=162571&sent=132&recv=66&lost=26&retrans=31&sent_bytes=121207&recv_bytes=17436&delivery_rate=68096&cwnd=8197&unsent_bytes=0&cid=e05695eb41a94b91&ts=5165&x=1", cfExtPri, cfHdrFlush;dur=3482
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:03 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f770ee54d35d-FRA
accept-ranges
bytes
content-length
7298
server
cloudflare
collect
region1.analytics.google.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-BFXEWPXKBT&gtm=45je4be0v881947278z89180508217za200zb9180508556&_p=1732027338336&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cid=451776835.1732027343&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1732027343&sct=1&seg=0&dl=https%3A%2F%2Foffer-k.getvi-shift.com%2Foffer%2F1%2Fcheckout-now-v3%2F%3FC1%3D1301%26C2%3D%26uid%3D12770%26oid%3D1301%26affid%3D1223%26AFFID%3D1223%26utm_campaign%3DCPA_1223%26utm_source%3D1223%26source_id%3DAutoResponder%26sub1%3D%26sub2%3D7b6eb633b3ea43379c2c0c810452a39e%26discount%3D%26banner%3Dn&dt=Vi-Shift&en=screen_view&_fv=1&_ss=1&ep.gtm_event=pageView&ep.page_type=Checkout%20Page&ep.page_isReload=false&ep.page_isExclude=false&ep.offer=Vi-Shift&ep.gtm_uniqueId=1732027338262.1&ep.gtm_version=GTM-NZC3P9WD%3B%2012%3B%20&ep.gtm_template_v=28&ep.gtm_tag_name=GA4%20Event%20-%20screen_view&tfd=6315
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-BFXEWPXKBT&l=dataLayer&cx=c&gtm=45je4be0v9180508556za200zb9180508217
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://offer-k.getvi-shift.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
text/plain
server
Golfe2
collect
stats.g.doubleclick.net/g/ 		0
559 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-BFXEWPXKBT&cid=451776835.1732027343&gtm=45je4be0v881947278z89180508217za200zb9180508556&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-BFXEWPXKBT&l=dataLayer&cx=c&gtm=45je4be0v9180508556za200zb9180508217
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://offer-k.getvi-shift.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
text/plain
server
Golfe2
ga-audiences
www.google.de/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-BFXEWPXKBT&cid=451776835.1732027343&gtm=45je4be0v881947278z89180508217za200zb9180508556&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855&tag_exp=101925629~102067555~102067808~102077855&z=1060443461
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lhr35s10-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Tue, 19 Nov 2024 14:42:23 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
collect
gtm-khd4rlt-owq2o.uc.r.appspot.com/g/ 		701 B
615 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://gtm-khd4rlt-owq2o.uc.r.appspot.com/g/collect?v=2&tid=G-FKE1ZCRLHG&gtm=45je4be0v9180508556z89180508217za200zb9180508217&_p=1732027338336&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cid=451776835.1732027343&ecid=180548745&ul=de-de&sr=1600x1200&_fplc=0&ur=DE-NI&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&sst.etld=google.de&sst.gcsub=region1&sst.tft=1732027338336&sst.ude=0&_s=2&sid=1732027343&sct=1&seg=0&dl=https%3A%2F%2Foffer-k.getvi-shift.com%2Foffer%2F1%2Fcheckout-now-v3%2F%3FC1%3D1301%26C2%3D%26uid%3D12770%26oid%3D1301%26affid%3D1223%26AFFID%3D1223%26utm_campaign%3DCPA_1223%26utm_source%3D1223%26source_id%3DAutoResponder%26sub1%3D%26sub2%3D7b6eb633b3ea43379c2c0c810452a39e%26discount%3D%26banner%3Dn&dt=Vi-Shift&uid=&en=All%20Events&ep.page_type=Checkout%20Page&ep.offer=Vi-Shift&ep.gtm_version=GTM-NZC3P9WD%3B%2012%3B%20&_et=3&tfd=6450&richsstsse
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FKE1ZCRLHG&l=dataLayer&cx=c&gtm=45He4be0v9180508217za200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
7b5d71106c1685d97f3c0a36fc7d7901b37074250b5556ab23a7607a776d2e57
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache
content-encoding
gzip
access-control-allow-credentials
true
x-content-type-options
nosniff
via
1.1 google
access-control-allow-origin
https://offer-k.getvi-shift.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:24 GMT
content-type
text/plain
vary
Accept-Encoding
collect
region1.analytics.google.com/g/s/ 		0
259 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&gtm=45j91e4be0v9180508556z89180508217z9858053261za200zb9180508217&tag_exp=101925629~102067555~102067808~102077855&_gsid=BFXEWPXKBThLj1uVe75ns24k2VU_zwoQ
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:194:0"}],}
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:194:0
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
text/plain
server
Golfe2
_set_cookie
gtm-khd4rlt-owq2o.uc.r.appspot.com/ 		48 B
48 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gtm-khd4rlt-owq2o.uc.r.appspot.com/_set_cookie?val=heiblRDS%2BU%2FpNaPIxmvI73B%2BF7C2BbU6HqzJJKlHN8ZXMNGSSTSA6V1AOhuqFgPZ9y4ZhN0007OsZkbnn%2Brwq%2FCOA5QV4GYj3XbKpJl6N6feDRxNT4VasLYCWup%2Fubl2vfaf7qj9Y2W1Jhq4bYT7KyQRX9IEITOYStqLJjXOABtazMiWT%2BpamygrkV5oJd5z6ZuMLB9ta7LpFBRExycPS6ocf5iQ8uKcv%2FaDQ9WugKbfuNY%3D
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:24 GMT
content-type
image/gif
collect
region1.analytics.google.com/g/s/ 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&gtm=45j91e4be0v9180508556z89180508217z9858053261za200zb9180508217&tag_exp=101925629~102067555~102067808~102077855&_gsid=BFXEWPXKBTgHd5LHsGIBvYCgikeSSgaw
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:194:0"}],}
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:194:0
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:24 GMT
content-type
text/plain
server
Golfe2
ga-audiences
www.google.de/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-BFXEWPXKBT&cid=451776835.1732027343&gtm=45j91e4be0v9180508556z89180508217z9858053261za200zb9180508217&tag_exp=101925629~102067555~102067808~102077855&aip=1&z=1436595737
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lhr35s10-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Tue, 19 Nov 2024 14:42:23 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
collect
stats.g.doubleclick.net/g/ 		0
49 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-BFXEWPXKBT&cid=451776835.1732027343&gtm=45j91e4be0v9180508556z89180508217z9858053261za200zb9180508217&tag_exp=101925629~102067555~102067808~102077855&aip=1
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:23 GMT
content-type
text/plain
server
Golfe2
collect
p.clarity.ms/ 		34 B
393 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://p.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.56/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.122.63.128 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
43378b030a7ae4837077c15e4ffef90699bc25b1d125935c8fa9c5dfb735c5a6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://offer-k.getvi-shift.com/

Response headers

Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Credentials
true
Request-Context
appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
Access-Control-Allow-Origin
https://offer-k.getvi-shift.com
Date
Tue, 19 Nov 2024 14:42:24 GMT
Content-Type
text/plain; charset=utf-8
Vary
Origin
Server
nginx
collect
region1.analytics.google.com/g/s/ 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&gtm=45j91e4be0v9180508556z89180508217z9858053261za200zb9180508217&tag_exp=101925629~102067555~102067808~102077855&_gsid=BFXEWPXKBTMtwB1WmqsiErte4nG6JG7g
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:194:0"}],}
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:194:0
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:24 GMT
content-type
text/plain
server
Golfe2
ga-audiences
www.google.de/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-BFXEWPXKBT&cid=451776835.1732027343&gtm=45j91e4be0v9180508556z89180508217z9858053261za200zb9180508217&tag_exp=101925629~102067555~102067808~102077855&aip=1&z=964326227
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lhr35s10-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Tue, 19 Nov 2024 14:42:24 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
collect
p.clarity.ms/ 		0
287 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://p.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.56/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.122.63.128 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://offer-k.getvi-shift.com/

Response headers

Request-Context
appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
Access-Control-Allow-Origin
https://offer-k.getvi-shift.com
Date
Tue, 19 Nov 2024 14:42:25 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
token
offer-k.getvi-shift.com/ 		355 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/token?affId=1223&c1=1301
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/js/main.min.js?b7eef3fb04d47b928ec96100cb63f14d
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52f4f46c0aba8b7b88e009ed8abf5f60ca3e67e6b5146274dd3bebf7556e0249

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s4a6nWcAY2NdZzwQzwf1jYz8JgwWkXGOfYABGD%2B%2BBrCKkPKwF6g3EzP7PpI%2FPwcV6FNg2Dp1VJgkCR9lQgUpXSlui9yXCpGAC8kyzzjZ9Fe7wzurMfYb6y1fMmr0gNJBb2xZmlDvQYXUmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7997cc3d35d-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=56633&sent=613&recv=138&lost=40&retrans=48&sent_bytes=657532&recv_bytes=21955&delivery_rate=17398&cwnd=32137&unsent_bytes=0&cid=e05695eb41a94b91&ts=11823&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:30 GMT
content-type
application/json
vary
Origin, Cookie
server
cloudflare
priority
u=1,i
click
www.mxj5trk.com/sdk/ 		90 B
435 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.mxj5trk.com/sdk/click?effp=a1513d2d440efb504c0b9b8e861053d9&sec_ch_ua_platform=&sec_ch_ua_platform_version=&sec_ch_ua_model=&_ef_transaction_id=&oid=1301&affid=1223&__cc=&async=json&uid=12770&sub2=7b6eb633b3ea43379c2c0c810452a39e&source_id=AutoResponder&__qp=C1%7CC2%7Cuid%7Coid%7Caffid%7CAFFID%7Cutm_campaign%7Cutm_source%7Csource_id%7Csub1%7Csub2%7Cdiscount%7Cbanner&__rf=&__efckuq=8
Requested by
Host: www.mxj5trk.com
URL: https://www.mxj5trk.com/scripts/sdk/everflow.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.205.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
107.205.117.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
b13b18d1c59d36598d5b8805c5c0f92e88d395870a5b8965ad30d1d75bdbcf1f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

accept-ch
Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
access-control-allow-credentials
true
via
1.1 google
x-eflow-request-id
0dce30db-8430-429d-bb50-b399db855c7e
access-control-allow-origin
https://offer-k.getvi-shift.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
90
date
Tue, 19 Nov 2024 14:42:29 GMT
content-type
application/json; charset=utf-8
vary
Origin
server
nginx
/
randomuser.me/api/ 		21 KB
7 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://randomuser.me/api/?results=20&nat=ca
Requested by
Host: offer-k.getvi-shift.com
URL: https://offer-k.getvi-shift.com/js/checkout.min.js?aef169cae5014f691b993c8032bff52a
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
efcbc283b654aa37c1fb7b1c50748a348ac735279f82bcd66cdd184284e8f6d1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
DYNAMIC
etag
W/"5470-tqaL8aXVdocWwZ8oqCVsQJhxBlc"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C2yyN5Mlt9QEbo8L4V17TApFbItshMHlyE2sFSrslMJUiGSq5u5LL%2FFv0J81AIaY61q0t0hDA4Lgj%2FVySpxbnCVVIrUSjMdH2pcqADje0Tb0qZLQqTyyv2GoBxT5HLeT"}],"group":"cf-nel","max_age":604800}
cf-ray
8e50f79a794d0076-CDG
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=60270&sent=10&recv=10&lost=0&retrans=0&sent_bytes=4106&recv_bytes=4431&delivery_rate=259&cwnd=12000&unsent_bytes=0&cid=46262fc74b5f1eec&ts=411&x=1", cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:30 GMT
content-type
application/json; charset=utf-8
x-powered-by
Express
vary
Accept-Encoding
server
cloudflare
black-trans2.jpg
offer.buyvi-shift.com/offer/1/app/desktop/images/checkout-now-v3/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offer.buyvi-shift.com/offer/1/app/desktop/images/checkout-now-v3/black-trans2.jpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11102ceca91e549e163b0f4ddd174edf9bf5ff876765e11b05bf8adee92addd1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cf-cache-status
HIT
etag
"6720a419-4493"
age
1647584
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pRJse6UvNppehLtMuBbOWOJ0rt3kDocisgXv0Q5gzL9kZqxXQRnc7qtoBXkeEs3SQGE70Bo9YJRkzap%2BwT7wLeCReNAviUqVXYw2ABjDS8r1jhIDVh0TU5Cq4EWU4PZfmQgkN2DWmvA%3D"}],"group":"cf-nel","max_age":604800}
expires
Sat, 30 Nov 2024 13:02:46 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=54212&sent=13&recv=7&lost=0&retrans=0&sent_bytes=4215&recv_bytes=3148&delivery_rate=39089&cwnd=12000&unsent_bytes=0&cid=f6e566649e87932f&ts=616&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:30 GMT
content-type
image/jpeg
last-modified
Tue, 29 Oct 2024 09:00:09 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
public, max-age=2592000, must-revalidate, proxy-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
public
cf-ray
8e50f79ccffed26a-FRA
accept-ranges
bytes
content-length
17555
server
cloudflare
js
maps.googleapis.com/maps/api/ 		385 KB
121 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/js?key=AIzaSyBOs7NwOdJpQdi_aHBsLHJq5gAKNY91t58&libraries=places&callback=Function.prototype&_=1732027343173
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
d56a46d6b2768fdfa4db9c7ecf2e175e8e6a1131ef96bf626ee17238b48a9f09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
public, max-age=1800, stale-while-revalidate=3600
timing-allow-origin
*
content-encoding
gzip
etag
db187831
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
123621
date
Tue, 19 Nov 2024 14:42:30 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
vary
Accept-Language, Origin, X-Origin, Referer
server
scaffolding on HTTPServer2
x-frame-options
SAMEORIGIN
truncated
/ 		181 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
34ed2e2f3b2f4d741cf4e5ed2da19a51293f6a7f5fecc8574822f1d635faa198

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
conversion
www.mxj5trk.com/sdk/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.mxj5trk.com/sdk/conversion?effp=a1513d2d440efb504c0b9b8e861053d9&sec_ch_ua_platform=&sec_ch_ua_platform_version=&sec_ch_ua_model=&transaction_id=03d3f880f15f4c8cacb8f4601193a83d&aid=503&adv_event_id=1&event_source_url=offer-k.getvi-shift.com
Requested by
Host: www.mxj5trk.com
URL: https://www.mxj5trk.com/scripts/sdk/everflow.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.117.205.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
107.205.117.34.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/json
Referer
https://offer-k.getvi-shift.com/

Response headers

accept-ch
Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
access-control-allow-credentials
true
via
1.1 google
x-eflow-request-id
3b46c372-bc0e-4d66-bb05-4f417472dc99
access-control-allow-origin
https://offer-k.getvi-shift.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:30 GMT
vary
Origin
server
nginx
favicon-2.webp
offer-k.getvi-shift.com/upload/300/ 		1 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://offer-k.getvi-shift.com/upload/300/favicon-2.webp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aab14041ba73efdfe3ba991d09bfdbc7e6db96187cdcaf751d9c41a2fd8fbf89

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n

Response headers

cf-cache-status
HIT
etag
"66868b3f-484"
age
4994
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xt4QyAfeXyVeFyBcxdO5R26OHiQ2KSW7o6lT3xwSOnRMw3Aj8gQVVPEKEy2kMWOPxQzACaumHSj94KvwCugfLOCk3BaTsjfpX%2FT7FI1LEVjpRcbue9FAsDSqb8EmlacO1ObOpnl%2FVvB9RQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 31 Dec 2037 23:55:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=52743&sent=611&recv=137&lost=40&retrans=48&sent_bytes=655602&recv_bytes=21910&delivery_rate=394963&cwnd=32137&unsent_bytes=0&cid=e05695eb41a94b91&ts=11673&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 14:42:30 GMT
content-type
image/webp
last-modified
Thu, 04 Jul 2024 11:45:03 GMT
vary
Accept-Encoding
priority
u=1,i
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 google
cf-ray
8e50f7998d0fd35d-FRA
accept-ranges
bytes
content-length
1156
server
cloudflare
collect
p.clarity.ms/ 		0
287 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://p.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.56/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.122.63.128 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://offer-k.getvi-shift.com/

Response headers

Request-Context
appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
Access-Control-Allow-Origin
https://offer-k.getvi-shift.com
Date
Tue, 19 Nov 2024 14:42:30 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
gen_204
maps.googleapis.com/maps/api/mapsjs/ 		3 B
44 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyBOs7NwOdJpQdi_aHBsLHJq5gAKNY91t58&libraries=places&callback=Function.prototype&_=1732027343173
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.23.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f10.1e100.net
Software
scaffolding on HTTPServer2 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
content-encoding
gzip
x-content-type-options
nosniff
access-control-allow-origin
https://offer-k.getvi-shift.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23
date
Tue, 19 Nov 2024 14:42:31 GMT
x-xss-protection
0
content-type
application/json; charset=UTF-8
vary
Origin, X-Origin, Referer
server
scaffolding on HTTPServer2
x-frame-options
SAMEORIGIN
common.js
maps.googleapis.com/maps-api-v3/api/js/58/11a/intl/de_ALL/ 		267 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/58/11a/intl/de_ALL/common.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyBOs7NwOdJpQdi_aHBsLHJq5gAKNY91t58&libraries=places&callback=Function.prototype&_=1732027343173
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
415683bd714195a6f4c3c6d729c1e8f5061a26b5edf54cc5ac1317ad3309d7e2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
age
13288
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options
nosniff
expires
Wed, 19 Nov 2025 11:01:03 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 11:01:03 GMT
last-modified
Tue, 29 Oct 2024 22:44:00 GMT
content-type
text/javascript
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges
bytes
content-length
56957
x-xss-protection
0
server
sffe
util.js
maps.googleapis.com/maps-api-v3/api/js/58/11a/intl/de_ALL/ 		191 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/58/11a/intl/de_ALL/util.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyBOs7NwOdJpQdi_aHBsLHJq5gAKNY91t58&libraries=places&callback=Function.prototype&_=1732027343173
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f997e0f2a67fae6c99b9466b56e583964feecb57b1635eaf35b4c8fbcc510919
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
age
79376
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options
nosniff
expires
Tue, 18 Nov 2025 16:39:35 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 18 Nov 2024 16:39:35 GMT
last-modified
Tue, 29 Oct 2024 22:44:00 GMT
content-type
text/javascript
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges
bytes
content-length
59598
x-xss-protection
0
server
sffe
controls.js
maps.googleapis.com/maps-api-v3/api/js/58/11a/intl/de_ALL/ 		99 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/58/11a/intl/de_ALL/controls.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyBOs7NwOdJpQdi_aHBsLHJq5gAKNY91t58&libraries=places&callback=Function.prototype&_=1732027343173
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c65a4e113463e270a4ee54aa3b0a7f3396f438474af4e78c29dbeaca6da295e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
age
525122
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options
nosniff
expires
Thu, 13 Nov 2025 12:50:29 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 13 Nov 2024 12:50:29 GMT
last-modified
Tue, 29 Oct 2024 22:44:00 GMT
content-type
text/javascript
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges
bytes
content-length
26659
x-xss-protection
0
server
sffe
places_impl.js
maps.googleapis.com/maps-api-v3/api/js/58/11a/intl/de_ALL/ 		45 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/58/11a/intl/de_ALL/places_impl.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyBOs7NwOdJpQdi_aHBsLHJq5gAKNY91t58&libraries=places&callback=Function.prototype&_=1732027343173
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c23d1728cfd67f7ebd8e289c2f7ea84648c77bf3bac25de63c60aa8e85db151f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

content-encoding
br
age
74763
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options
nosniff
expires
Tue, 18 Nov 2025 17:56:28 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 18 Nov 2024 17:56:28 GMT
last-modified
Tue, 29 Oct 2024 22:44:00 GMT
content-type
text/javascript
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges
bytes
content-length
14122
x-xss-protection
0
server
sffe
powered-by-google-on-white3.png
maps.gstatic.com/mapfiles/api-3/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://maps.gstatic.com/mapfiles/api-3/images/powered-by-google-on-white3.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cd80d0dcb2a44bd30c11fcdf13d4c280f336dad9442ee7da79146f2bb77381a4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

report-to
{"group":"geo-tactile","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/geo-tactile"}]}
x-content-type-options
nosniff
expires
Tue, 19 Nov 2024 14:42:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:31 GMT
content-type
image/png
last-modified
Tue, 18 May 2021 19:15:00 GMT
cache-control
private, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/geo-tactile
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="geo-tactile"
content-length
1616
x-xss-protection
0
server
sffe
autocomplete-icons.png
maps.gstatic.com/mapfiles/api-3/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://maps.gstatic.com/mapfiles/api-3/images/autocomplete-icons.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
db209390b90b70f4b1ef3540cb581e4ec8edbba21980971b68e4aef5c5d352fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

report-to
{"group":"geo-tactile","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/geo-tactile"}]}
x-content-type-options
nosniff
expires
Tue, 19 Nov 2024 14:42:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:31 GMT
content-type
image/png
last-modified
Tue, 18 May 2021 19:15:00 GMT
cache-control
private, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/geo-tactile
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="geo-tactile"
content-length
3351
x-xss-protection
0
server
sffe
collect
region1.analytics.google.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-BFXEWPXKBT&gtm=45je4be0v881947278z89180508217za200zb9180508556&_p=1732027338336&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cid=451776835.1732027343&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1732027343&sct=1&seg=0&dl=https%3A%2F%2Foffer-k.getvi-shift.com%2Foffer%2F1%2Fcheckout-now-v3%2F%3FC1%3D1301%26C2%3D%26uid%3D12770%26oid%3D1301%26affid%3D1223%26AFFID%3D1223%26utm_campaign%3DCPA_1223%26utm_source%3D1223%26source_id%3DAutoResponder%26sub1%3D%26sub2%3D7b6eb633b3ea43379c2c0c810452a39e%26discount%3D%26banner%3Dn&dt=Vi-Shift&en=javascript_error&epn.error_line=109&ep.error_message=Uncaught%20TypeError%3A%20Cannot%20set%20properties%20of%20null%20(setting%20%27checked%27)&ep.error_url=https%3A%2F%2Foffer-k.getvi-shift.com%2Foffer%2F1%2Fcheckout-now-v3%2F%3FC1%3D1301%26C2%3D%26uid%3D12770%26oid%3D1301%26affid%3D1223%26AFFID%3D1223%26utm_campaign%3DCPA_1223%26utm_source%3D1223%26source_id%3DAutoResponder%26sub1%3D%26sub2%3D7b6eb633b3ea43379c2c0c810452a39e%26discount%3D%26banner%3Dn&ep.gtm_template_v=28&ep.offer=Vi-Shift&ep.page_type=Checkout%20Page&ep.gtm_version=GTM-NZC3P9WD%3B%2012%3B%20&ep.gtm_tag_name=GA4%20Event%20-%20JS%20Errors&_et=6069&tfd=17403
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-BFXEWPXKBT&l=dataLayer&cx=c&gtm=45je4be0v9180508556za200zb9180508217
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://offer-k.getvi-shift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://offer-k.getvi-shift.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 14:42:34 GMT
content-type
text/plain
server
Golfe2

Verdicts & Comments Add Verdict or Comment

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 string| offerId string| nextPage string| productName string| pageName string| pageType object| queryParams object| dataLayer object| intShipping object| warranty object| recurring_campaigns object| sizes object| pixelForm object| blocedUsers object| countries function| gtag object| turnstile object| google_tag_manager object| google_tag_data object| lazySizes object| _learnq function| clarity object| EF function| $ function| jQuery function| scrollToE function| scrollToE2 function| scrollToE3 function| stickycall function| _typeof function| ownKeys function| _objectSpread function| _defineProperty function| _toPropertyKey function| _toPrimitive object| KLAVIYO_JS_REGEX function| logFailedKlaviyoJsLoad string| __klKey function| onYouTubeIframeAPIReady object| gaGlobal object| webpackChunk_klaviyo_onsite_modules object| _klOnsite object| klaviyo object| google object| litHtmlVersions object| module$exports$mapsapi$geometry$spherical object| litElementVersions object| reactiveElementVersions object| module$contents$mapsapi$overlay$overlayView_OverlayView object| _gtm_xhr object| __e3_

13 Cookies

Domain/Path Name / Value
mw03trk.com/ Name: uniqueClick_2JKMHWN
Value: e12e8fb6-ae67-491c-8e2e-a42c9466d94e:1732027337
mw03trk.com/ Name: transaction_id
Value: 7b6eb633b3ea43379c2c0c810452a39e
.getvi-shift.com/ Name: _gcl_au
Value: 1.1.2132076263.1732027340
.getvi-shift.com/ Name: _ga
Value: GA1.1.451776835.1732027343
.getvi-shift.com/ Name: _ga_FKE1ZCRLHG
Value: GS1.1.1732027343.1.0.1732027343.0.0.180548745
www.mxj5trk.com/ Name: uniqueClick
Value: 5d4a63fe-f6d1-4f48-9104-151fd99e9b11:1732027349
www.mxj5trk.com/ Name: transaction_id
Value: 03d3f880f15f4c8cacb8f4601193a83d
.getvi-shift.com/ Name: _ga_BFXEWPXKBT
Value: GS1.1.1732027343.1.0.1732027349.54.0.0
offer-k.getvi-shift.com/ Name: ef_witness
Value: 1
offer-k.getvi-shift.com/ Name: ef_affid
Value: 1223
offer-k.getvi-shift.com/ Name: ef_tid_c_o_1301
Value: 03d3f880f15f4c8cacb8f4601193a83d
offer-k.getvi-shift.com/ Name: ef_tid_c_a_503
Value: 03d3f880f15f4c8cacb8f4601193a83d
offer-k.getvi-shift.com/ Name: csrf_
Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmdW5uZWxJZCI6MzAwLCJvZmZlcklkIjoxNDI4LCJleHAiOjE3MzIxMTM3NTAsImlzU2NydWIiOmZhbHNlLCJhZmZpZCI6IjEyMjMiLCJDMSI6IjEzMDEiLCJpcCI6IjgwLjI1NS43LjEwMiIsImhvc3QiOiJvZmZlci1rLmdldHZpLXNoaWZ0LmNvbSIsInBsYXRmb3JtIjoic3RpY2t5IiwiY291bnRyeSI6IkRFIiwiY3VycmVuY3kiOiJVU0QifQ.SlEVqUxefv7pmmr7qvUP4l6GZKFuPO42yMJh9hoasa4

5 Console Messages

Source Level URL
Text
rendering warning URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0B0C202F41D0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering warning URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0E01C00F41D0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering warning URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A010C302F41D0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering warning URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A080C202F41D0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
javascript warning URL: https://offer-k.getvi-shift.com/offer/1/checkout-now-v3/?C1=1301&C2=&uid=12770&oid=1301&affid=1223&AFFID=1223&utm_campaign=CPA_1223&utm_source=1223&source_id=AutoResponder&sub1=&sub2=7b6eb633b3ea43379c2c0c810452a39e&discount=&banner=n
Message:
The resource https://offer.getrivalsmartwatch.com/offer/1/app/desktop/images/checkout-now-v2/black-trans2.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
challenges.cloudflare.com
code.jquery.com
fonts.gstatic.com
gtm-khd4rlt-owq2o.uc.r.appspot.com
holidayofferbadges.s3.amazonaws.com
images.dmca.com
maps.googleapis.com
maps.gstatic.com
mw03trk.com
offer-k.getvi-shift.com
offer.buyvi-shift.com
offer.getbiobandwatch.com
offer.getrivalsmartwatch.com
p.clarity.ms
randomuser.me
region1.analytics.google.com
static-tracking.klaviyo.com
static.klaviyo.com
stats.g.doubleclick.net
www.clarity.ms
www.google.com
www.google.de
www.googletagmanager.com
www.mxj5trk.com
104.17.24.14
104.18.94.41
142.250.185.200
142.250.186.100
151.101.194.133
151.101.66.133
172.217.18.3
172.217.23.106
172.67.220.100
188.114.97.3
20.122.63.128
2001:4860:4802:32::36
216.239.32.36
216.58.206.35
2400:52e0:1e00::1079:1
2606:4700::6811:190e
2606:4700::6812:5f29
2620:1ec:bdf::45
2a00:1450:4001:806::2014
2a00:1450:4001:828::2003
2a00:1450:4001:829::200a
2a00:1450:400c:c04::9a
2a04:4e42:600::649
2a06:98c1:3120::3
2a06:98c1:3121::3
3.5.28.200
34.117.205.107
35.241.35.107
02e3471681541b3cbe5901d27762b68a8b0697f80959db8ac9c8ac2b2516a838
044d376e1a48dfd95023145c6ad3c2c829b257ef495ce3fa4ccc137971273b8e
0689dabda813659e82ce24a8cf8163085dde5bcb93d2a1f723444fa654a7e6f9
0b408a2eec9bf39d8510a4787dd5459738d1ee43e54f8982684bbe63ba387684
0c5ed985fdbddc027124d4e6879ce1a1860832cda85e2b517c18d8fbd2fffc06
0e913234e3123ba8a5d535706253505bf4e1c5260f4a28ea8c31fbcfcb6b8aaa
11102ceca91e549e163b0f4ddd174edf9bf5ff876765e11b05bf8adee92addd1
1282871d2cfb4ee07dd96583248c7acfbc9143620042d6d4ec78b24473838f0c
135e1609cea84f4ea3fa70e166f5466cdecb288abc2f96212f586dbfa206f34b
1e528b84ff29b9f80f3ed6f6e1c52c3d106c6140bf9593881f70105e83a2d17f
2cf7833ee174c4af5765d79030bd45b759e7c1d47799e4062b8ad64cf7b3d581
314b074d0362794037beb8b4d12d2493de3cf35848391a80bfe5ff55ee8b0844
34ed2e2f3b2f4d741cf4e5ed2da19a51293f6a7f5fecc8574822f1d635faa198
3799f765df5a2e9762262f0c98f9275ef5861cf426b0091b082372fe4af554dd
3b98b0dc3bed9d40f43e64adba5de47c76895338a96f0a5a314676cd6287eca9
3d5aaceac1817ecaf4402f1f68c31ffc8eafe08a277cf8d79ae715afb300bfbf
3d9120fa621da6d613c1698b7014ec6bdf4620366e8f2b7b547059f4b6f6272b
3dd3f038a64b2e46316379946bb9557f7336238d53abf780470492b0d7350ee3
415683bd714195a6f4c3c6d729c1e8f5061a26b5edf54cc5ac1317ad3309d7e2
43378b030a7ae4837077c15e4ffef90699bc25b1d125935c8fa9c5dfb735c5a6
478f0dd54ca86db9b05426d5246f559f21baa33f02d72047f3cf9722a925afd6
482994b911cc3e869aa8ace6d9932d67b68de83ea2885207ce165ff04c38d7bc
48404bab25594e17eef17448f4bbfb2ba0f4edf65daccfa574a8a8b7f4adb0dc
49c41172386524a83cbb75d748e7c84c324ef4f0c12c67286c60812f55c252f8
4a8406e7b3011440826068cf40c64437925c9081ceda162772f70d6f3eb41c0e
50ba099b396a9f8d48f9642be89c1f59200fb4008ed78974b1aa66b71e43bdaa
5100f5ee3b88b4929df84d101feb7d43ea2f1230546865d0647a6c6f21848ed7
52357f9feebcc48422ca5f1b5a2bb918d1241e90ac495fa6aba1ee00c1fc2a06
52c5e554ea9eedd0970340d2987c2c6fc2897a13343b1afcdcc68281fc98f3f4
52f4f46c0aba8b7b88e009ed8abf5f60ca3e67e6b5146274dd3bebf7556e0249
552818556edf7f78c0073dcf8a32d5aef256a4a43d8933e20e00224916096deb
575b2b383474606bcd11802527835c93cc1de6cb326b895bfe4ce75e0d11cfb7
57a18f291f8730968d03c67ac7952dc209649f6aea4b78ff1b2c652aa6f02d19
5e2975080484cbd155df2640cf883b661d04c8d800b73d763d493445640326cb
65b437cab2be521149fe7240f5eace41b29a6a6acdc9d0ebe76a35268fa9970e
66e948957905f1a80510b8aa8f5d7a5335b32f18a42b20b1b8542b6713ee7a43
6cfee50475bcc85591aaca463ddc34e66fcdef9355d654eecb695f056c66e3b5
6eaa7d84867f4a3f58d1cff2d44b4d4adfcc58072a48d761fe092b7e6172b253
7220b7706d036813ef75226d14dc2a5886a60ff453864af7eb230ac906334a97
7b5d71106c1685d97f3c0a36fc7d7901b37074250b5556ab23a7607a776d2e57
8888c8ae4780d3cf032e8fa768148b09a5cdc32fbdd666850b0344001a35634b
8ed13e360c27fe4bc9d1f0e54d6ff228ae27a3c091d64d99dc1dea57bf496bd2
92158235a68fa09845a49da16f828f7bb93478bc6f9e92e561397b1ab91a1a22
9805fc9909ab10d7945503b34a461d4f9c95276e32b9898a42e919d156b82f2e
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e
9cee4d46d01279944e2f6e2ca0279922d6aaaa148aaa986d67cfa820875f7f6d
a00163b105356559691d0b832db802127304542eceb1426256b28fc38aab877c
a06ad17002beeb927fa743733c38d105e230bd5f67303c321cc171e1d70fea93
a0ecd2276289f78980151b3a4e7e9e81e44255add441c9c2976853d264f7c73b
aab14041ba73efdfe3ba991d09bfdbc7e6db96187cdcaf751d9c41a2fd8fbf89
b0206eade0adcf1138aae421f0b9d912f3f34a7754852b55e962a010c7b68275
b13b18d1c59d36598d5b8805c5c0f92e88d395870a5b8965ad30d1d75bdbcf1f
b7595c3d2e94df7416308fa2ccf5ae8832137c76d2e9a8b02e6ed2cb2d92e2f7
c23d1728cfd67f7ebd8e289c2f7ea84648c77bf3bac25de63c60aa8e85db151f
c46e230a35ad8847f5d3021c9818af4e0fd226733d167392eb58b5be6999106a
c62f3218c0b289ec5709c615aa14974fa3d88cbe64534ac0cca52cca51c3ac32
c65a4e113463e270a4ee54aa3b0a7f3396f438474af4e78c29dbeaca6da295e5
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cd7cb5b0082f01431a155460632b954dd952166e4136c156dfea87015511cf7b
cd80d0dcb2a44bd30c11fcdf13d4c280f336dad9442ee7da79146f2bb77381a4
d56a46d6b2768fdfa4db9c7ecf2e175e8e6a1131ef96bf626ee17238b48a9f09
d9e6077900d21940206069ce5b05bae5e2ef6f100187cfe49dda6c41a10863e7
db209390b90b70f4b1ef3540cb581e4ec8edbba21980971b68e4aef5c5d352fb
dc1da692990307185621fd661b7305e29d3a0a5ba0f0d998e5a1463a17c57044
dfd6dfbf348462f8e35aac00960d50d182a964d6a35e6cce108530179b913bba
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8021f1a9dad409f7e699457ac334653bf800464df69900237c4de1c29e275d0
e8b9df96e9f32cd479c40b7edebcb81f2916f73dd28aeef9e787ca3392954c48
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efcbc283b654aa37c1fb7b1c50748a348ac735279f82bcd66cdd184284e8f6d1
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f997e0f2a67fae6c99b9466b56e583964feecb57b1635eaf35b4c8fbcc510919
fd20e0e4cc9d566f505ddbd503877a2f657418e8fa7d86ecaf2c1009b79e3de4