www.savingssubsidybenefitscard.com Open in urlscan Pro
2606:4700:3037::ac43:c214  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.savingssubsidybenefitscard.com/	18 KB 7 KB	397ms 312ms	Document text/html	2606:4700:3037::ac43:c214 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.savingssubsidybenefitscard.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:c214 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f6123cb805e256c19f11777f9dbb272e58effffc88ae24cc38d494b3822eda25 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Length alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8605344759853735-FRA content-encoding br content-type text/html; charset=UTF-8 date Wed, 06 Mar 2024 20:48:01 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=68wPJpK8wfMeC8UVdluVVJp7bbtfgyZ41vLsGneEAsV06e99ItIdDOMBxvoggUZYM4y3BzWXHOmXLO9V%2FBBc7I22eHwLYvCeaz1r7eSfcoPz6eJPjoa4ZlPeZWTxP7vgjjiACkdnDfuMIioos50BH%2FMe%2BZ2dDz5knf8SM8LWvmUz"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding x-content-type-options nosniff
GET H2	200	/ Show response worker-polished-shadow-8999.jordan-64e.workers.dev/	7 KB 2 KB	381ms 295ms	Script text/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://worker-polished-shadow-8999.jordan-64e.workers.dev/?api_key=c1bc8978475345ca28577df846adc9b9&pub_id=&pid=2&vid=1&tags=%5B%7B%22type%22%3A%22User%22%2C%22s1%22%3A%22%22%7D%2C%7B%22type%22%3A%22User%22%2C%22kkclid%22%3A1219411392%7D%5D&sl=https%3A%2F%2Fwww.savingssubsidybenefitscard.com%2Fee7aee3149c71ece4d6c4ba9c.php%3Fclid%3D1219411392%26l%3D195799%26v%3D%26e%3D53071%26d%3D0%26o%3D26950%26lid%3D0&referer=https%3A%2F%2Fsavingssubsidybenefitscard.com%2F&cid= Requested by Host: www.savingssubsidybenefitscard.com URL: https://www.savingssubsidybenefitscard.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf1f1a47bada2730755f41e94cae2418780540a3b6a5b0507fa63a4bf96a2f95 Request headers accept-language de-DE,de;q=0.9 Referer https://www.savingssubsidybenefitscard.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 06 Mar 2024 20:48:01 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WkffXMcfG3uBBRMgH2boedau21Qt6Z1vofXCEN0Z7rcuY7Wf5ze7aLXrKwgc%2B9vFh%2FgJ%2BS4vb15%2FR0MTGtKvY9RZRPHDP5AKQfwDwSki6BNcnivWfWSF04hZAqTAUzjsJlup4veKaFtMi7GXqkaBahBJy%2F3Hgz19To7PjXwV4eKsScUEpdHgqAv%2Bnum5tJ1RXQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript cf-ray 86053449dcecbb44-FRA alt-svc h3=":443"; ma=86400
GET H2	200	style.css www.savingssubsidybenefitscard.com/v2_130-13/css/	7 KB 2 KB	414ms 413ms	Stylesheet text/css	2606:4700:3037::ac43:c214 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.savingssubsidybenefitscard.com/v2_130-13/css/style.css Requested by Host: www.savingssubsidybenefitscard.com URL: https://www.savingssubsidybenefitscard.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:c214 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 570462fd4e53dc53985272cad5e2e18d025ea7f3f69efed2d87eb60df9c1af94 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.savingssubsidybenefitscard.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 06 Mar 2024 20:48:01 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br alt-svc h3=":443"; ma=86400 last-modified Tue, 27 Feb 2024 13:52:06 GMT server cloudflare etag W/"65dde906-1bf1" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T7mcdqS1zjqlaMH1S6Wun%2Bp13usfpt2YkQVLIVe3TAeVE1PMC8JC6W9bo68gXNp%2FLtgT0xBVy8VQ2bCqXfMbqgLGyVBzabUe0vjXbJr07aJ7RsvcAWlIniWrPlZYj%2Bx1Z9Ww%2FWKE%2BCtSrlX%2BPmsgMBBbIDnVZffSDAf5v1jpcdj2"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * access-control-expose-headers Content-Length cache-control max-age=315360000 cf-ray 860534494c693735-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 88 KB	66ms 20ms	Script text/javascript	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: www.savingssubsidybenefitscard.com URL: https://www.savingssubsidybenefitscard.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.savingssubsidybenefitscard.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 06 Mar 2024 00:15:14 GMT x-content-type-options nosniff age 73967 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 89501 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 06 Mar 2025 00:15:14 GMT
GET H2	200	sleepy-joe.webp i.ibb.co/7VypHcN/	34 KB 34 KB	252ms 32ms	Image image/webp	162.19.58.158 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/7VypHcN/sleepy-joe.webp Requested by Host: www.savingssubsidybenefitscard.com URL: https://www.savingssubsidybenefitscard.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.58.158 , France, ASN16276 (OVH, FR), Reverse DNS ns3096590.ip-162-19-58.eu Software nginx / Resource Hash e12748500844b87e758a6d32e565946e3b4957593956c1668315e9b45c5e8acd Request headers accept-language de-DE,de;q=0.9 Referer https://www.savingssubsidybenefitscard.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 06 Mar 2024 20:48:01 GMT last-modified Mon, 05 Feb 2024 03:32:21 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/webp access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 34438 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	mixpanel-2-latest.min.js Show response cdn.mxpnl.com/libs/	54 KB 19 KB	62ms 20ms	Script text/javascript	2600:1901:0:bc29:: GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js Requested by Host: www.savingssubsidybenefitscard.com URL: https://www.savingssubsidybenefitscard.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:bc29:: Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash 7c690a6ebb2eef51e8ccc66161b02197c22f388f1fc23c89e0f5c7b70e1eac50 Request headers accept-language de-DE,de;q=0.9 Referer https://www.savingssubsidybenefitscard.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 06 Mar 2024 20:43:48 GMT content-encoding gzip age 253 x-guploader-uploadid ABPtcPp7cpw03gnnKc3ahtcodXnoKblcFd12gTK8Pbv1eLcdrSDE-tOVq6d2sFZ6u2VPyuxuTyA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 2 x-goog-stored-content-encoding gzip alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 18490 last-modified Tue, 06 Feb 2024 00:09:36 GMT server UploadServer etag "eb0675a8749ea5d76345796217db928f" vary Accept-Encoding x-goog-generation 1707178176338436 x-goog-hash crc32c=fWmQwA==, md5=6wZ1qHSepddjRXliF9uSjw== access-control-allow-origin * content-type text/javascript cache-control public,max-age=600 x-goog-stored-content-length 18490 accept-ranges bytes expires Wed, 06 Mar 2024 20:53:48 GMT

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| goToClickWall object| appWorkerUtils object| appWorkerSettings object| appWorkerGeolocation function| _getPubId object| mixpanel function| $ function| jQuery function| waitingInfo string| timer2 number| interval object| _rgba_tags

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.savingssubsidybenefitscard.com/	1970-01-21 03:41:34	Name: mp_2c6bcfbbb40cb7fae2628bb918050781_mixpanel Value: %7B%22distinct_id%22%3A%20%22%24device%3A18e1585ebb1379-0ad85f7f01d721-673d5551-1d4c00-18e1585ebb1379%22%2C%22%24device_id%22%3A%20%2218e1585ebb1379-0ad85f7f01d721-673d5551-1d4c00-18e1585ebb1379%22%2C%22baseUrl%22%3A%20%22https%3A%2F%2Fwww.savingssubsidybenefitscard.com%2F%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%2C%22__mps%22%3A%20%7B%7D%2C%22__mpso%22%3A%20%7B%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D%2C%22__mpus%22%3A%20%7B%7D%2C%22__mpa%22%3A%20%7B%7D%2C%22__mpu%22%3A%20%7B%7D%2C%22__mpr%22%3A%20%5B%5D%2C%22__mpap%22%3A%20%5B%5D%7D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.mxpnl.com
i.ibb.co
worker-polished-shadow-8999.jordan-64e.workers.dev
www.savingssubsidybenefitscard.com
162.19.58.158
2600:1901:0:bc29::
2606:4700:3037::ac43:c214
2a00:1450:4001:810::200a
2a06:98c1:3121::3
570462fd4e53dc53985272cad5e2e18d025ea7f3f69efed2d87eb60df9c1af94
7c690a6ebb2eef51e8ccc66161b02197c22f388f1fc23c89e0f5c7b70e1eac50
cf1f1a47bada2730755f41e94cae2418780540a3b6a5b0507fa63a4bf96a2f95
e12748500844b87e758a6d32e565946e3b4957593956c1668315e9b45c5e8acd
f6123cb805e256c19f11777f9dbb272e58effffc88ae24cc38d494b3822eda25
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e