www.elfcosmetics.com Open in urlscan Pro
165.254.198.116 Public Scan

URL: https://st.dynamicyield.com/

URL: https://rcom.dynamicyield.com/

URL: https://policies.google.com/privacy
Title: Privacy Policy

URL: https://policies.google.com/terms
Title: Terms of Service

URL: https://www.tiktok.com/@elfyeah/

URL: https://www.instagram.com/elfcosmetics/

URL: https://www.pinterest.com/elfcosmetics/

URL: https://www.facebook.com/elfcosmetics/

URL: https://www.youtube.com/user/eyeslipsfacedotcom

URL: https://twitter.com/elfcosmetics

URL: https://www.snapchat.com/add/elfcosmetics

URL: https://www.linkedin.com/company/e-l-f-beauty

URL: https://www.elfbeauty.com/careers/
Title: Careers

URL: https://www.elfbeauty.com/
Title: Investor Relations

URL: https://preferences.elfcosmetics.com/privacy
Title: Privacy Rights Request Form

URL: https://www.onetrust.com/products/cookie-consent/

1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cosmeticscriminal.ca/ HTTP 307
https://cosmeticscriminal.ca/ HTTP 301
https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/en_CA/ HTTP 301
https://www.elfcosmetics.com/en_CA

Request Chain 15

https://cdn.media.amplience.net/v/elfcosmetics/PWT_STORY_CRIMESCENE_VID/mp4_720p HTTP 302
https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_crimescene_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/8dfa5d11-77b7-4333-9d42-c08b194a927c.mp4

Request Chain 18

https://cdn.media.amplience.net/v/elfcosmetics/PWT_STORY_COSMETIC_CRIMINALS_VID/mp4_720p HTTP 302
https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_cosmetic_criminals_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/c5334fb2-6c51-41eb-8d3b-28107083bcd2.mp4

Request Chain 34

https://www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/authorize?redirect_uri=https%3A%2F%2Fwww.elfcosmetics.com%2Fcallback&response_type=code&client_id=f9f7052a-f742-4c38-bdf5-1da004e7fb3b&hint=guest&channel_id=elf-us&code_challenge=_PkMDJAzUBE1xuROgEkOvDW7rSCk3JNvpgf8gPUvqIk HTTP 303
https://www.elfcosmetics.com/callback?usid=c0a2c34a-f689-4e35-bc1d-55576260ac47&code=d9RRAcPuDpCR3I7X220ivKPfQ7hPQrmdAaZsGlJxa9U

Request Chain 57

https://pixel.pointmediatracker.com/kpi?c=elfcosmetics&kpi=visit&tag_id=244&fpc=ca19f132-4cb3-4176-a484-88b805f2d972&user_id=undefined&utm_source=undefined&utm_medium=undefined&utm_campaign=undefined&new=undefined&gtmcb=1415535648 HTTP 302
https://cdn.blisspointmedia.com/assets/img/pixel.gif

Request Chain 58

https://secure.adnxs.com/px?id=160890&%20seg=6104893&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D160890%26%2520seg%3D6104893%26t%3D2

Request Chain 59

https://insight.adsrvr.org/track/pxl/?adv=3ftfnh3&ct=0:8m23e30&fmt=3 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZjFlZTQ2MGEtOWE2Yy00N2Y5LWE2MzEtNWU5NTVjOGJiMzRm&gdpr=0&gdpr_consent=&ttd_tdid=f1ee460a-9a6c-47f9-a631-5e955c8bb34f HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm=&google_sc=&google_hm=ZjFlZTQ2MGEtOWE2Yy00N2Y5LWE2MzEtNWU5NTVjOGJiMzRm&gdpr=0&gdpr_consent=&ttd_tdid=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&google_tc= HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&google_gid=CAESEEkvFPiwY07Cdy_sUrmQWpw&google_cver=1 HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=f1ee460a-9a6c-47f9-a631-5e955c8bb34f HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=9156917649463128279&ttd_tdid=f1ee460a-9a6c-47f9-a631-5e955c8bb34f HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&expiration=1737787175&gdpr=0&gdpr_consent= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&expiration=1737787175&gdpr=0&gdpr_consent=&C=1

Request Chain 159

https://www.googleadservices.com/pagead/conversion/698270988/?random=1498154844&fst=1735195175905&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4c50h1v9125640115z8896608294z99175401888za200zb896608294&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1830084713.1735195174&bttype=purchase&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5l1&uip=167.114.209.0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&tag_exp=101925629~102067555~102067808~102081485~102198178&s3p=1 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/698270988/?random=873472652&fst=1735195175905&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4c50h1v9125640115z8896608294z99175401888za200zb896608294&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1830084713.1735195174&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5l1&uip=167.114.209.0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&tag_exp=101925629~102067555~102067808~102081485~102198178&s3p=1&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAkoVZXZlbnQtc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&eitems=ChEIgPeuuwYQzcLm9YekgpWZARIdAIw1fRXliand5B7AR1QQyG0FfkFgDRW3nxqOEik&pscrd=IhMIjpLs4OnEigMVaw2ICR2WuRUkMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOh1odHRwczovL3d3dy5lbGZjb3NtZXRpY3MuY29tL0JWQ2hBSWdQZXV1d1lRamZ2QWg1RHBzZHRpRWl3QTByNnVPS3hTT2thWUthY3pmTk1VVnRXaXhaUnBXeU1GTlpKTXdoUUpxamxpaVhNd2NSOXpLekdHMFE HTTP 302
https://www.google.com/pagead/1p-conversion/698270988/?random=873472652&fst=1735195175905&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4c50h1v9125640115z8896608294z99175401888za200zb896608294&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1830084713.1735195174&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5l1&uip=167.114.209.0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&tag_exp=101925629~102067555~102067808~102081485~102198178&s3p=1&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAkoVZXZlbnQtc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&pscrd=IhMIjpLs4OnEigMVaw2ICR2WuRUkMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOh1odHRwczovL3d3dy5lbGZjb3NtZXRpY3MuY29tL0JWQ2hBSWdQZXV1d1lRamZ2QWg1RHBzZHRpRWl3QTByNnVPS3hTT2thWUthY3pmTk1VVnRXaXhaUnBXeU1GTlpKTXdoUUpxamxpaVhNd2NSOXpLekdHMFE&is_vtc=1&cid=CAQSKQCa7L7dudpbNhuQhODsyF5MZM4wkKDjgHRlc6Svu0_fGjDjRpnY2KpZ&eitems=ChEIgPeuuwYQzcLm9YekgpWZARIdAIw1fRU2dO_0F-SglMVOXhTSChECbrnfUg9ek0I&random=702289343 HTTP 302
https://www.google.ca/pagead/1p-conversion/698270988/?random=873472652&fst=1735195175905&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4c50h1v9125640115z8896608294z99175401888za200zb896608294&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1830084713.1735195174&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5l1&uip=167.114.209.0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&tag_exp=101925629~102067555~102067808~102081485~102198178&s3p=1&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAkoVZXZlbnQtc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&pscrd=IhMIjpLs4OnEigMVaw2ICR2WuRUkMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOh1odHRwczovL3d3dy5lbGZjb3NtZXRpY3MuY29tL0JWQ2hBSWdQZXV1d1lRamZ2QWg1RHBzZHRpRWl3QTByNnVPS3hTT2thWUthY3pmTk1VVnRXaXhaUnBXeU1GTlpKTXdoUUpxamxpaVhNd2NSOXpLekdHMFE&is_vtc=1&cid=CAQSKQCa7L7dudpbNhuQhODsyF5MZM4wkKDjgHRlc6Svu0_fGjDjRpnY2KpZ&eitems=ChEIgPeuuwYQzcLm9YekgpWZARIdAIw1fRU2dO_0F-SglMVOXhTSChECbrnfUg9ek0I&random=702289343&ipr=y

Request Chain 221

https://idsync.rlcdn.com/458359.gif?partner_uid=6f57d388-d6ca-4d1b-8a14-1d4b6bff8a69 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CPf8GxIwCiwIARCd5gEaJDZmNTdkMzg4LWQ2Y2EtNGQxYi04YTE0LTFkNGI2YmZmOGE2ORAAGg0Iq_SzuwYSBQjoBxAAQgBKAA HTTP 307
https://tags.rd.linksynergy.com/cs?ns=lr&uid3=06b875baf8bdbc45451cfc381a795848f20ad85fef5641fcc0630ce7f471418f6ac34734d8e453ee

238 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request elf-cosmetic-criminals Show response
www.elfcosmetics.com/en_CA/
Redirect Chain

http://cosmeticscriminal.ca/
https://cosmeticscriminal.ca/
https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

1006 KB
250 KB

630ms
479ms

Document
text/html

165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

c3771d189a69d038146fe817c1c28e0e47f0b39f2f1a74ccc3f70625259a6bb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

access-control-allow-origin: *
age: 6 6
alt-svc: h3=":443"; ma=86400
cache-control: public, must-revalidate, s-maxage=900
content-encoding: gzip
content-length: 254891
content-type: text/html; charset=utf-8
date: Thu, 26 Dec 2024 06:39:30 GMT
etag: W/"de811-PI2xLgR8K+ipaNcLpWXXv53udyg"
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
via: 1.1 1918cab433d8a05c792c3cff85897f3c.cloudfront.net (CloudFront)
x-amz-apigw-id: DYwEQEcMiYcELgw=
x-amz-cf-id: wkKeQlQQPH09mUS75BA5dcQACb4bhuztFuc7GiugFIeYqzjCJoDsvQ==
x-amz-cf-pop: DFW57-P1
x-amzn-remapped-connection: close
x-amzn-remapped-content-length: 911377
x-amzn-remapped-date: Thu, 26 Dec 2024 06:39:23 GMT
x-amzn-requestid: 6e791282-5fba-446c-a765-7d5eeebfdcdc
x-amzn-trace-id: Root=1-676cfa1a-27eb8a407363730c377a5ca5;Parent=46240e0a3ee09157;Sampled=0;Lineage=1:2b75b0e9:0
x-cache: Hit from cloudfront
x-yottaa-metrics: 3221a5fec613/[234,51,-] 32D1a5fec674/[-,358.840]
x-yottaa-optimizations: ob/1000000100001000 si/32D1a5fec674-1734717345-8434348101 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-os: 200

Redirect headers

age: 0
content-length: 1198
content-type: text/html; charset=utf-8
date: Thu, 26 Dec 2024 06:39:30 GMT
location: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
vary: User-Agent
x-yottaa-fw: fb/100000 tid/658f1dead931403bb4ae3e88 rid/658f270fd931403bb4ae60d5 stid/5ad7b08e2bb0ac0c5ba3d38c
x-yottaa-metrics: 25D1cc0285ed/[-,0.123]
x-yottaa-optimizations: ob/0 si/25D1cc0285ed-1734717344-3378797465 tts/1735195170200 ti/0 ai/658f1dead931403bb4ae3e88

GET /
cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/en_CA/ 0
0

GET
H2

200

en_CA
www.elfcosmetics.com/
Redirect Chain

https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/en_CA/
https://www.elfcosmetics.com/en_CA

1 MB
1 MB

935ms
518ms

Image
text/html

165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.elfcosmetics.com/en_CA

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-amzn-remapped-content-length: 976415
content-encoding: gzip
x-amzn-remapped-connection: close
etag: W/"ee61f-ITAUOiULFaVdzgrTDFDzrew+bNs"
age: 843, 843
x-amzn-requestid: 74b57138-0f10-49bc-9c18-4f085a0f007a
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: kgamYH7hECVfXQoIbDXj_fxVKeSt0JwtS8in3SDH3SmPBsC6GrXjow==
date: Thu, 26 Dec 2024 06:39:31 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
x-yottaa-optimizations: ob/1000000100001000 si/32D1a5fec674-1734717345-8434348115 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
strict-transport-security: max-age=15552000; includeSubDomains
x-yottaa-os: 200
cache-control: public, must-revalidate, s-maxage=900
x-amz-apigw-id: DYuBqFTxiYcEhig=
x-amzn-remapped-date: Thu, 26 Dec 2024 06:25:27 GMT
x-amzn-trace-id: Root=1-676cf6d7-5be5b00b1583430b4b76a87a;Parent=25a10ff5cf0dc3ae;Sampled=0;Lineage=1:2b75b0e9:0
via: 1.1 cbe94ab27088fc4bb73abf8e3179b3d2.cloudfront.net (CloudFront)
x-yottaa-metrics: 3221a5fec6f0/[257,52,-] 32D1a5fec674/[-,398.437]
access-control-allow-origin: *
content-length: 267865
x-amz-cf-pop: DFW57-P1

Redirect headers

x-amzn-remapped-content-length: 0
x-amzn-remapped-connection: close
age: 3308
x-amzn-requestid: cf140a66-8f16-4098-bad0-fb6ee9a7ac7b
x-cache: Miss from cloudfront, HIT
x-amz-cf-id: wtKYs4xrUpRh8RTCAqqUPfQcQgfjfzPEuXSkMQFW53UTyCOFLY6Zxw==
date: Thu, 26 Dec 2024 06:39:31 GMT
content-type: application/json
x-served-by: cache-yul1970082-YUL
x-cache-hits: 1
x-yottaa-optimizations: ob/1000 si/3211a5fec642-1730389938-1188481477 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
strict-transport-security: max-age=15552000; includeSubDomains
location: https://www.elfcosmetics.com/en_CA
x-amz-apigw-id: DYoAmF6KiYcEs1g=
x-amzn-remapped-date: Thu, 26 Dec 2024 05:44:22 GMT
x-timer: S1735195171.070757,VS0,VE1
x-amzn-trace-id: Root=1-676ced36-5e651f5116797fb94aca1fd0;Parent=1752c2cacc14c8a3;Sampled=0;Lineage=1:2b75b0e9:0
via: 1.1 e9bcf307d6ed54e3e501e39bc538dcfc.cloudfront.net (CloudFront), 1.1 varnish
x-yottaa-metrics: 3221cc02d1b1/[313,306,-] 3211a5fec642/[-,315.119]
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-amz-cf-pop: DFW57-P1
server: CloudFront

GET /
cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/en_CA/ 0
0

GET
H/1.1 200
OK 985935623
player.vimeo.com/video/ Frame 6442 0
0 277ms
216ms Document
text/html 162.159.138.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://player.vimeo.com/video/985935623?h=0fd60177fc&badge=0&autopause=0&player_id=0&app_id=58479

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.159.138.60 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' https://.vimeocdn.com 'unsafe-eval' resource: https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://browser-intake-datadoghq.com https://src.litix.io https://www.gstatic.com https://cdn.kollective.app/ https://wirewax.s3.eu-west-1.amazonaws.com https://edge-assets.wirewax.com https://embedder-sdk.wirewax.com https://embedder-sdk.wirewax.tv; style-src 'self' 'unsafe-inline' https://.vimeocdn.com https://fonts.googleapis.com https://edge-assets.wirewax.com https://edge-player5.wirewax.com; connect-src 'self' ws: wss: https://vimeo.com https://api.vimeo.com https://csi.gstatic.com https://.akamaized.net https://.akamaized-staging.net https://.vimeocdn.com https://drm.vhx.com/v2/fairplay/cert https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://storage.googleapis.com https://bam.nr-data.net https://browser-intake-datadoghq.com https://live-api.cloud.vimeo.com https://.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://.kollective.app https://.kollective.app:31015 https://.kollectivecd.com https://.hivestreaming.com https://vimeo.magisto.com https://stage-proxy.vimeo.magisto.com https://.wirewax.com https://.wirewax.tv https://wirewax.s3.eu-west-1.amazonaws.com https://sqs.us-east-1.amazonaws.com https://sqs.eu-west-1.amazonaws.com https://s3-eu-west-1.amazonaws.com https://cognito-identity.us-east-1.amazonaws.com https://cognito-identity.eu-west-1.amazonaws.com https://player-telemetry.vimeo.com https://lensflare.vimeo.com https://arclight.vimeo.com; font-src data: https://edge-assets.wirewax.com https://branding.cdn.magisto.com https://fonts.gstatic.com https://player.vimeo.com; img-src 'self' data: https://player.vimeo.com https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://i.vimeocdn.com https://duysrfiajusdh.cloudfront.net https://d263mgllkjh2k2.cloudfront.net https://wirewax.s3.eu-west-1.amazonaws.com https://studio-media.wirewax.com https://edge-assets.wirewax.com https://maps.googleapis.com android-webview-video-poster:; object-src 'self' https://.vimeocdn.com https://.akamaized.net https://.akamaized-staging.net; media-src 'self' blob: https://.vimeocdn.com https://.akamaized.net https://.akamaized-staging.net https://.gvt1.com https://live-api.cloud.vimeo.com; frame-src 'self' https://*; worker-src blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

CF-Cache-Status: DYNAMIC
CF-Ray: 8f7f12fb9997ac25-YYZ
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 26 Dec 2024 06:39:31 GMT
Expires: Fri, 15 Dec 1985 19:30:00 GMT
Link: <https://fresnel.vimeocdn.com>; rel=preconnect; crossorigin, <https://i.vimeocdn.com>; rel=preconnect; crossorigin, <https://f.vimeocdn.com>; rel=preconnect; crossorigin
Server: cloudflare
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
Vary: Origin, Referer, Accept-Encoding
Via: 1.1 varnish
content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' https://*.vimeocdn.com 'unsafe-eval' resource: https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://browser-intake-datadoghq.com https://src.litix.io https://www.gstatic.com https://cdn.kollective.app/ https://wirewax.s3.eu-west-1.amazonaws.com https://edge-assets.wirewax.com https://embedder-sdk.wirewax.com https://embedder-sdk.wirewax.tv; style-src 'self' 'unsafe-inline' https://*.vimeocdn.com https://fonts.googleapis.com https://edge-assets.wirewax.com https://edge-player5.wirewax.com; connect-src 'self' ws: wss: https://vimeo.com https://api.vimeo.com https://csi.gstatic.com https://*.akamaized.net https://*.akamaized-staging.net https://*.vimeocdn.com https://drm.vhx.com/v2/fairplay/cert https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://storage.googleapis.com https://bam.nr-data.net https://browser-intake-datadoghq.com https://live-api.cloud.vimeo.com https://*.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://*.kollective.app https://*.kollective.app:31015 https://*.kollectivecd.com https://*.hivestreaming.com https://vimeo.magisto.com https://stage-proxy.vimeo.magisto.com https://*.wirewax.com https://*.wirewax.tv https://wirewax.s3.eu-west-1.amazonaws.com https://sqs.us-east-1.amazonaws.com https://sqs.eu-west-1.amazonaws.com https://s3-eu-west-1.amazonaws.com https://cognito-identity.us-east-1.amazonaws.com https://cognito-identity.eu-west-1.amazonaws.com https://player-telemetry.vimeo.com https://lensflare.vimeo.com https://arclight.vimeo.com; font-src data: https://edge-assets.wirewax.com https://branding.cdn.magisto.com https://fonts.gstatic.com https://player.vimeo.com; img-src 'self' data: https://player.vimeo.com https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://*.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://i.vimeocdn.com https://duysrfiajusdh.cloudfront.net https://d263mgllkjh2k2.cloudfront.net https://wirewax.s3.eu-west-1.amazonaws.com https://studio-media.wirewax.com https://edge-assets.wirewax.com https://maps.googleapis.com android-webview-video-poster:; object-src 'self' https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net; media-src 'self' blob: https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.gvt1.com https://live-api.cloud.vimeo.com; frame-src 'self' https://*; worker-src blob:
x-backend-server: player-backend-edge-entry
x-bapp-server: player-backend-cc96c996c-x82k5
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-host: player-backend-cc96c996c-x82k5
x-player-backend: g
x-served-by: cache-yyz4548-YYZ
x-timer: S1735195171.151238,VS0,VE168
x-xss-protection: 1; mode=block

GET
H2 200 rZPCKoUReO0
www.youtube.com/embed/ Frame FAC7 0
0 167ms
97ms Document
text/html 2607:f8b0:4004:c06::be
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/rZPCKoUReO0?enablejsapi=1

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::be Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-security-policy: require-trusted-types-for 'script'
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Thu, 26 Dec 2024 06:39:31 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Icon-BeautySquad-Logo-png
elfcosmetics.a.bigcontent.io/v1/static/ 7 KB
7 KB 99ms
61ms Image
image/png 172.64.145.183
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://elfcosmetics.a.bigcontent.io/v1/static/Icon-BeautySquad-Logo-png?%24Desktop%24=&fmt=auto
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.145.183 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 359722b660d0b4a5afb34561728a3918b96bdccf3a3cddc4291ee4cd15f65c3f

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
x-amz-version-id: null
age: 64711
access-control-allow-methods: POST, GET, OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 26 Dec 2024 06:39:31 GMT
edge-control: max-age=86400
content-type: image/png
last-modified: Wed, 25 Dec 2024 09:09:56 GMT
vary: Accept-Encoding
priority: u=3,i
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cache-control: s-maxage=86400, max-age=1800
x-amp-cf-worker: true
cf-ray: 8f7f12fb6d15a226-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6783
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 icon-noun-gift-1165617
elfcosmetics.a.bigcontent.io/v1/static/ 2 KB
1 KB 83ms
45ms Image
image/svg+xml 172.64.145.183
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://elfcosmetics.a.bigcontent.io/v1/static/icon-noun-gift-1165617?%24Desktop%24=&fmt=auto
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.145.183 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4aa855b8d34657ab4df5ca73fe7d7f67735ee1e39e8de83856ddc473d4713fbb

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: null
age: 11624
access-control-allow-methods: POST, GET, OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 26 Dec 2024 06:39:31 GMT
edge-control: max-age=86400
content-type: image/svg+xml
last-modified: Wed, 25 Dec 2024 13:15:14 GMT
vary: Accept-Encoding
priority: u=3,i
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cache-control: s-maxage=86400, max-age=1800
x-amp-cf-worker: true
cf-ray: 8f7f12fb6d14a226-YYZ
access-control-allow-origin: *
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 PWT_STORY_HEADER_DESKTOP_BG-min
cdn.media.amplience.net/i/elfcosmetics/ 630 KB
630 KB 128ms
76ms Image
image/jpeg 2606:4700:4400::6812:20dd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_HEADER_DESKTOP_BG-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:20dd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b89cd71669a53e8801ea9e9d4fb8a40bb5dbbb393a1b6c4a249349b42086da7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
x-amp-source-width: 3199
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:31 GMT
edge-control: max-age=86400
content-type: image/jpeg
last-modified: Wed, 25 Dec 2024 18:23:42 GMT
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: WnnDsAa7X,l4p5bDg2e,2orsu9Nt2,k4NPUWi7z
cache-control: s-maxage=86400, max-age=1800
x-req-id: _fBkKbZfUE
x-amp-source-height: 1249
x-amp-cf-worker: true
cf-ray: 8f7f12fb7cc8a320-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 644728
x-amp-published: Wed, 20 Dec 2023 20:47:39 GMT
x-amp-srv: CF
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 PWT_STORY_HEADER_DESKTOP_CC-min
cdn.media.amplience.net/i/elfcosmetics/ 205 KB
205 KB 107ms
55ms Image
image/png 2606:4700:4400::6812:20dd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_HEADER_DESKTOP_CC-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:20dd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ab1474b1928d39f768075dfef56e53b01fff6c85a44b07d150c4abf7299c3b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
x-amp-source-width: 800
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:31 GMT
edge-control: max-age=86400
content-type: image/png
last-modified: Wed, 25 Dec 2024 18:23:43 GMT
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: 110n0_Q9x,l4p5bDg2e,HwG53bbZp,UyB2-aY-L
cache-control: s-maxage=86400, max-age=1800
x-req-id: xpDdge-AAA
x-amp-source-height: 340
x-amp-cf-worker: true
cf-ray: 8f7f12fb7cc9a320-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 209440
x-amp-published: Wed, 20 Dec 2023 20:47:39 GMT
x-amp-srv: CF
x-xss-protection: 1; mode=block
server: cloudflare

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H2 200 PWT_STORY_SOCIALLISTENING_DESKTOP_5-blurred-min
cdn.media.amplience.net/i/elfcosmetics/ 2 MB
2 MB 130ms
78ms Image
image/png 2606:4700:4400::6812:20dd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_SOCIALLISTENING_DESKTOP_5-blurred-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:20dd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdbeef0b146607f5137f8f5434eeab8625ee0801da2af33e045528d191e512d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
x-amp-source-width: 3080
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:31 GMT
edge-control: max-age=86400
content-type: image/png
last-modified: Wed, 25 Dec 2024 18:23:43 GMT
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: 06AYkBm0p,l4p5bDg2e,hUXp-ygcH,UyB2-aY-L
cache-control: s-maxage=86400, max-age=1800
x-req-id: -O4Fx-lq47
x-amp-source-height: 1484
x-amp-cf-worker: true
cf-ray: 8f7f12fb7ccaa320-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2085695
x-amp-published: Wed, 03 Jan 2024 21:02:28 GMT
x-amp-srv: CF
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 PWT_STORY_DETECTIVES_DESKTOP_6-min
cdn.media.amplience.net/i/elfcosmetics/ 330 KB
331 KB 168ms
117ms Image
image/jpeg 2606:4700:4400::6812:20dd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_DETECTIVES_DESKTOP_6-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:20dd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cb2ac35adc7dee4b051d05a7ffc844c9f61eb67b3ce350a16a552f98ffc4172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
x-amp-source-width: 2806
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:31 GMT
edge-control: max-age=86400
content-type: image/jpeg
last-modified: Wed, 25 Dec 2024 18:23:43 GMT
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: pToRCMyrF,l4p5bDg2e,q-jdDBY1E,k4NPUWi7z
cache-control: s-maxage=86400, max-age=1800
x-req-id: OrwrrMpp-c
x-amp-source-height: 1062
x-amp-cf-worker: true
cf-ray: 8f7f12fb7ccba320-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 338113
x-amp-published: Wed, 27 Dec 2023 17:21:33 GMT
x-amp-srv: CF
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 PWT_STORY_ON_THE_CASE_DESKTOP_BTS-min
cdn.media.amplience.net/i/elfcosmetics/ 180 KB
180 KB 148ms
96ms Image
image/jpeg 2606:4700:4400::6812:20dd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_ON_THE_CASE_DESKTOP_BTS-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:20dd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a0204422805f76d793709204fd52e753cb059e5dd5099e41781499c8072e726

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
x-amp-source-width: 1952
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:31 GMT
edge-control: max-age=86400
content-type: image/jpeg
last-modified: Wed, 25 Dec 2024 18:23:43 GMT
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: pVmNrJ7uK,l4p5bDg2e,O8QiTHpoz,k4NPUWi7z
cache-control: s-maxage=86400, max-age=1800
x-req-id: i2LRYp7iYG
x-amp-source-height: 1108
x-amp-cf-worker: true
cf-ray: 8f7f12fb7ccca320-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 184181
x-amp-published: Fri, 29 Dec 2023 07:51:47 GMT
x-amp-srv: CF
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 PWT_STORY_CRIME_TAPE_DESKTOP_7-min
cdn.media.amplience.net/i/elfcosmetics/ 614 KB
614 KB 130ms
79ms Image
image/png 2606:4700:4400::6812:20dd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/PWT_STORY_CRIME_TAPE_DESKTOP_7-min

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:20dd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37d207a7297589d062c2af128ee513190a9297959cb24c68078f68d64b899c98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
x-amp-source-width: 3200
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:31 GMT
edge-control: max-age=86400
content-type: image/png
last-modified: Thu, 26 Dec 2024 06:39:24 GMT
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: YFs8LtPvK,l4p5bDg2e,N2xhcEEJW,UyB2-aY-L
cache-control: s-maxage=86400, max-age=1800
x-req-id: RQNX0Kgr3p
x-amp-source-height: 525
x-amp-cf-worker: true
cf-ray: 8f7f12fb7ccda320-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 628288
x-amp-published: Thu, 28 Dec 2023 16:15:28 GMT
x-amp-srv: CF
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2

206

8dfa5d11-77b7-4333-9d42-c08b194a927c.mp4
cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_crimescene_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/
Redirect Chain

https://cdn.media.amplience.net/v/elfcosmetics/PWT_STORY_CRIMESCENE_VID/mp4_720p
https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_crimescene_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/8dfa5d11-77b7-4333-9d42-c08b194a927c.mp4

1 MB
1 MB

132ms
49ms

Media
video/mp4

2600:1408:ac00::17de:102b
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_crimescene_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/8dfa5d11-77b7-4333-9d42-c08b194a927c.mp4
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Server: 2600:1408:ac00::17de:102b Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: b3efc48717edad187198d0a608a3b3a8195f0e5b6b6b41f27b78824796cbd61e

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

access-control-max-age: 3000
x-amp-route: ak-s1
etag: "dd3676819bd88a250c875a11e38c307d"
Content-Range: bytes 0-1060947/1060948
access-control-allow-methods: GET, HEAD
accept-ranges: bytes
access-control-allow-origin: *
Content-Length: 1060948
date: Thu, 26 Dec 2024 06:39:31 GMT
x-amp-srv: A
last-modified: Fri, 22 Dec 2023 15:50:27 GMT
content-type: video/mp4
x-amz-server-side-encryption: AES256

Redirect headers

cf-cache-status: HIT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:31 GMT
edge-control: max-age=86400
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: _3BmQX9Yi,l4p5bDg2e,bgWw7nQ29
cache-control: s-maxage=86400, max-age=1800
location: https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_crimescene_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/8dfa5d11-77b7-4333-9d42-c08b194a927c.mp4
x-amp-cf-worker: true
cf-ray: 8f7f12fbbce6a320-YUL
access-control-allow-origin: *
content-length: 0
x-xss-protection: 1; mode=block
x-amp-srv: CF
server: cloudflare

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 89ad311944927ce3cfae733238f317bf1a9a65c082e1c49a9d3c2ab590421e8d

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Origin: https://www.elfcosmetics.com
Referer

Response headers

Content-Type: application/font-woff2;charset=utf-8

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93d3607ab3b6aacff8c4500a18bf501c85271bfc14950eb923f9a65ee456a7ac

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Origin: https://www.elfcosmetics.com
Referer

Response headers

Content-Type: application/font-woff2;charset=utf-8

GET
H2

206

c5334fb2-6c51-41eb-8d3b-28107083bcd2.mp4
cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_cosmetic_criminals_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/
Redirect Chain

https://cdn.media.amplience.net/v/elfcosmetics/PWT_STORY_COSMETIC_CRIMINALS_VID/mp4_720p
https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_cosmetic_criminals_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/c5334fb2-6c51-41eb-8d3b-28107083bcd2.mp4

1 MB
1 MB

507ms
355ms

Media
video/mp4

2600:1408:ac00::17de:102b
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_cosmetic_criminals_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/c5334fb2-6c51-41eb-8d3b-28107083bcd2.mp4
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Server: 2600:1408:ac00::17de:102b Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 4ae7d857dd8d096a5198b1e8280de9f929ca88d690e445731b6ffdffbf2b8383

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

access-control-max-age: 3000
x-amp-route: ak-s1
etag: "91a2cbc7ca143aac79d0312d84bb77fb"
Content-Range: bytes 0-1262366/1262367
access-control-allow-methods: GET, HEAD
accept-ranges: bytes
access-control-allow-origin: *
Content-Length: 1262367
date: Thu, 26 Dec 2024 06:39:31 GMT
x-amp-srv: A
last-modified: Fri, 22 Dec 2023 17:43:50 GMT
content-type: video/mp4
x-amz-server-side-encryption: AES256

Redirect headers

cf-cache-status: HIT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:31 GMT
edge-control: max-age=86400
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: WrvkTt2Po,l4p5bDg2e,fH6Lo3_5e
cache-control: s-maxage=86400, max-age=1800
location: https://cdn.static.amplience.net/elfcosmetics/_vid/pwt_story_cosmetic_criminals_vid/0171df9d-95f8-4fdc-8266-8ebb30d7ebca/video/c5334fb2-6c51-41eb-8d3b-28107083bcd2.mp4
x-amp-cf-worker: true
cf-ray: 8f7f12fbace0a320-YUL
access-control-allow-origin: *
content-length: 0
x-xss-protection: 1; mode=block
x-amp-srv: CF
server: cloudflare

GET
H2 200 jquery-3.7.1.slim.min.js Show response
code.jquery.com/ 69 KB
24 KB 69ms
20ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.7.1.slim.min.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9261efb3407e3a9096e4654750d8eff6b3a663422f48845c7fbcc65034c340cf

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
etag: W/"28feccc0-11278"
age: 5178692
x-cache: HIT, HIT
date: Thu, 26 Dec 2024 06:39:31 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 14381, 10496
x-served-by: cache-lga21987-LGA, cache-yul1970067-YUL
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1735195171.190165,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24036
server: nginx

GET
H/1.1 200
OK player.js Show response
player.vimeo.com/api/ 37 KB
12 KB 100ms
40ms Script
application/javascript 162.159.138.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://player.vimeo.com/api/player.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.159.138.60 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

498a41eab15456686643b139ae2c289c961bb02da852aaad698540831d0e9bb5

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Age: 8
x-backend-server: player-backend-edge-entry
expires: Thu, 26 Dec 2024 02:09:23 GMT
x-player-backend: g
x-cache: HIT
Date: Thu, 26 Dec 2024 06:39:31 GMT
Content-Type: application/javascript;charset=utf-8
x-bapp-server
x-served-by: cache-yyz4559-YYZ
x-cache-hits: 1
vary: Origin, Referer, Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'
Cache-Control: max-age=1800
x-timer: S1735195171.220475,VS0,VE1
Connection: keep-alive
via: 1.1 varnish
CF-RAY: 8f7f12fc1c45ac46-YYZ
accept-ranges: bytes
access-control-allow-origin: *
Content-Length: 11437
Server: cloudflare

GET
H2 200 player_api Show response
www.youtube.com/ 993 B
2 KB 129ms
57ms Script
text/javascript 2607:f8b0:4004:c09::be
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/player_api

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::be Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1daeb8f2b20e643498e588a0f3bc753699fe28c787205ece9b0fc5cd5a7b06be

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: br
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
x-content-type-options: nosniff
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
expires: Thu, 26 Dec 2024 06:39:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
date: Thu, 26 Dec 2024 06:39:31 GMT
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: require-trusted-types-for 'script'
cache-control: private, max-age=0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
x-xss-protection: 0
server: ESF

GET
H2 200 vendor.js Show response
cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/ 2 MB
643 KB 68ms
28ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 495b6c4a195f2e48f175b6e86696578e7716c3053ef82277f81290025eb7d5b1

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-amz-meta-deploy: 964016
content-encoding: gzip
age: 143387
x-cache: Hit from cloudfront, HIT
x-amz-cf-id: gG1kKB4vwlr4PbXnq7yvz00n1jNMeSks_KrLIjXRQAYf8SloZq-yag==
date: Thu, 26 Dec 2024 06:39:31 GMT
content-type: application/javascript; charset=utf8
x-served-by: cache-yul1970038-YUL
x-cache-hits: 1
x-yottaa-optimizations: ob/1100 si/2511cc02853d-1730386260-823477444 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
vary: Accept-Encoding
x-yottaa-forcecache: true, true
cache-control: public, max-age=31104000
x-timer: S1735195171.193499,VS0,VE1
via: 1.1 fd35f1fff2f9fd0955b7c73222980a2c.cloudfront.net (CloudFront), 1.1 varnish
x-amz-meta-bundle: 12898
x-yottaa-metrics: 2521cc028528/[14,-,1735051783047] 2511cc02853d/[-,163.652]
accept-ranges: bytes
access-control-allow-origin: *
content-length: 657956
x-amz-cf-pop: SFO53-P2
server: AmazonS3

GET
H2 200 main.js Show response
cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/ 2 MB
582 KB 65ms
25ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/main.js?yocs=Z_14_1K_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c9dc8b4206fa8a943926774e6d6b9da08c2ee10e23ea04ba2715769104859eee

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-amz-meta-deploy: 964016
content-encoding: gzip
age: 143387
x-cache: Hit from cloudfront, HIT
x-amz-cf-id: hI-W-I4wYXArV9U2aPMgxWaYYvwS2BWM8gSyw_ljajH00FJUHYB9ug==
date: Thu, 26 Dec 2024 06:39:31 GMT
content-type: application/javascript; charset=utf8
x-served-by: cache-yul1970038-YUL
x-cache-hits: 1
x-yottaa-optimizations: ob/1100 si/2511cc02853e-1730386261-1449860740 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
vary: Accept-Encoding
x-yottaa-forcecache: true, true
cache-control: public, max-age=31104000
x-timer: S1735195171.193647,VS0,VE1
via: 1.1 68a8bf1c51ac47222204adb56c4024ac.cloudfront.net (CloudFront), 1.1 varnish
x-amz-meta-bundle: 12898
x-yottaa-metrics: 2521cc028a77/[13,-,1735051783024] 2511cc02853e/[-,120.572]
accept-ranges: bytes
access-control-allow-origin: *
content-length: 595099
x-amz-cf-pop: SFO53-P2
server: AmazonS3

GET
H2 200 pages-product-list-product-list-page.js Show response
cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/ 50 KB
15 KB 61ms
21ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/pages-product-list-product-list-page.js?yocs=Z_14_1K_
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a80b10ec0c44ff82a283f3d78f81623e15d8381656a111ad9211878700f89c2

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-amz-meta-deploy: 964016
content-encoding: gzip
age: 142909
x-cache: Miss from cloudfront, HIT
x-amz-cf-id: nL6JAqSTJAUmAZLsLTRnbR6vUHx7GfydgmH-NZMvsqgzjxpw4uVX8Q==
date: Thu, 26 Dec 2024 06:39:31 GMT
content-type: application/javascript; charset=utf8
x-served-by: cache-yul1970038-YUL
x-cache-hits: 31
x-yottaa-optimizations: ob/1100 si/36118cae0e1f-1733882031-1117850057 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
vary: Accept-Encoding
x-yottaa-forcecache: true, true
cache-control: public, max-age=31104000
x-timer: S1735195171.193751,VS0,VE0
via: 1.1 0d78cc90106520d13c1b5c5b16dd8246.cloudfront.net (CloudFront), 1.1 varnish
x-amz-meta-bundle: 12898
x-yottaa-metrics: 36218cae0e31/[2,-,1735051793773] 36118cae0e1f/[-,5.814]
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14522
x-amz-cf-pop: FRA56-P7
server: AmazonS3

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 76ms
30ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/main.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50d93a2c186cbd1032ed973e133713a6dfbbd5f7fba4fb89069350f228ce4d81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: UzmBk0Ra4K9he+CwjGKb/g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD1DE4B7A34202
x-ms-lease-status: unlocked
age: 72584
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Mon, 23 Dec 2024 10:29:45 GMT
date: Thu, 26 Dec 2024 06:39:32 GMT
content-type: application/javascript
last-modified: Mon, 16 Dec 2024 15:17:12 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 1138e44e-a01e-0067-6135-50202d000000
cf-ray: 8f7f13056dc5a27b-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7211
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 api_dynamic.js Show response
cdn.dynamicyield.com/api/8772046/ 577 KB
63 KB 196ms
109ms Script
application/javascript 2600:9000:28a9:ee00:a:b89d:a6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.dynamicyield.com/api/8772046/api_dynamic.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:28a9:ee00:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: DYCDN /
Resource Hash: 317dbf63b324173465b73d3a60f73635e80ce3ed8d476a0bd01bbb14cdeaa66e

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

vary: accept-encoding
link: <//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
cache-control: max-age=30
content-encoding: gzip
etag: W/"d72a6b573c29c257c5f14eb22fad8973"
age: 3
via: 1.1 f9d8b248b09e5c0a77a4319a8bfbc9d0.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: rFwBL6fZRNjTwCCnf3X6uuLFKUr_UneRY419VDpyznSwBlwliVrGCA==
date: Thu, 26 Dec 2024 06:39:30 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 24 Dec 2024 21:31:10 GMT
server: DYCDN
x-amz-cf-pop: IAD89-P3
x-amz-server-side-encryption: AES256

GET
H2 200 api_static.js Show response
cdn.dynamicyield.com/api/8772046/ 395 KB
116 KB 126ms
39ms Script
application/javascript 2600:9000:28a9:ee00:a:b89d:a6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.dynamicyield.com/api/8772046/api_static.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:28a9:ee00:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: DYCDN /
Resource Hash: 5dc0d7bd68b30ae8330274f08b4f3424d474fa1f10bc1abfcceaa89901bb3c08

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

vary: accept-encoding
link: <//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
cache-control: max-age=28800
content-encoding: gzip
etag: W/"34a902f7bd976cb13d0c3785dde3a9a4"
age: 5064
via: 1.1 f9d8b248b09e5c0a77a4319a8bfbc9d0.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: lbVOolgtSHFIukiPiqTQ_UrhMoaCcLyhoXPCsOCLF39tfjSQA4ukBA==
date: Thu, 26 Dec 2024 05:15:09 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 24 Dec 2024 21:31:10 GMT
server: DYCDN
x-amz-cf-pop: IAD89-P3
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 562 KB
146 KB 124ms
41ms Script
application/javascript 2607:f8b0:400d:c09::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WL3STMX

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4d08e48f124b3a77127dd31d8f40a1fdaf51113218521a1195840738e260be49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Thu, 26 Dec 2024 06:39:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 26 Dec 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 148758
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 / Show response
api.ipify.org/ 24 B
318 B 106ms
46ms XHR
application/json 104.26.12.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d42963d04775f09b1f7834b7fc62019aca171c718b81f5b895ccafa44b20fcda

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8f7f1305c8833a06-YYZ
access-control-allow-origin: *
server-timing: cfL4;desc="?proto=TCP&rtt=25234&min_rtt=24937&rtt_var=5708&sent=7&recv=10&lost=0&retrans=0&sent_bytes=4045&recv_bytes=2219&delivery_rate=152843&cwnd=252&unsent_bytes=0&cid=41c8f6b26497c8ce&ts=54&x=0"
content-length: 24
date: Thu, 26 Dec 2024 06:39:32 GMT
content-type: application/json
vary: Origin
server: cloudflare

GET
H2 200 / Show response
api.ipify.org/ 24 B
229 B 157ms
50ms XHR
application/json 104.26.12.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d42963d04775f09b1f7834b7fc62019aca171c718b81f5b895ccafa44b20fcda

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8f7f130618df3a06-YYZ
access-control-allow-origin: *
server-timing: cfL4;desc="?proto=TCP&rtt=27822&min_rtt=24933&rtt_var=8459&sent=11&recv=13&lost=0&retrans=0&sent_bytes=4429&recv_bytes=2311&delivery_rate=152843&cwnd=257&unsent_bytes=0&cid=41c8f6b26497c8ce&ts=105&x=0"
content-length: 24
date: Thu, 26 Dec 2024 06:39:32 GMT
content-type: application/json
vary: Origin
server: cloudflare

GET
H2 200 searchsession Show response
www.elfcosmetics.com/api/en-ca/v2.0/ 105 B
676 B 285ms
285ms Fetch
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/api/en-ca/v2.0/searchsession?locale=en-ca&profile_id=&session_id=

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/main.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

/ Express

Resource Hash

174aa1201610a00cb23e9895c186fb9d78be70ee4722c6fab47c78f399f94786

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

content-encoding: gzip
x-amzn-remapped-connection: keep-alive
etag: W/"69-JtYV9zrWQ9DcXrFDaZOyN9RzpZo"
age: 0
x-content-type-options: nosniff
x-amzn-requestid: 574b9420-d094-4cf2-b551-ffc5876219ea
date: Thu, 26 Dec 2024 06:39:32 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348116 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-os: 200
x-amz-apigw-id: DYwFzGsEvHcEfTg=
x-amzn-remapped-date: Thu, 26 Dec 2024 06:39:32 GMT
x-amzn-trace-id: Root=1-676cfa24-4bfc27091ad73dc773ec4f0e
x-yottaa-metrics: 3221a5fec6f2/[224,220,-] 32D1a5fec674/[-,226.471]
access-control-allow-origin: *
content-length: 110
x-powered-by: Express

GET
H2 200 7f85a56ba4.css
use.fontawesome.com/ 1 KB
1 KB 99ms
28ms Stylesheet
text/css 2606:4700:3036::6815:1b98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/7f85a56ba4.css
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e92913c2b11fc1e9e7c4f84628362d1c9660e7f7e88904d124c9ebbbef9d4e48

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: HIT
etag: W/"8360eb270b919a1fb4776bc448d9ed14"
age: 5945
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ln%2F69IeTBle5yAm6VX0OT0MgXznsx18CR2YlksiJaN%2BYAHzYb0Zjrn9fp0adGdmCRpsqBXb8qECKZEqiJeWXPBpPeSXkBYMvYi2xRYIJMRGr0vKMqRa78EhNuUFwMq1tfoi5zV6AegXCFCCLXQeYOHiq"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f7f1305feaa7133-YUL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=18575&min_rtt=18470&rtt_var=4067&sent=7&recv=10&lost=0&retrans=0&sent_bytes=4033&recv_bytes=2212&delivery_rate=206189&cwnd=252&unsent_bytes=0&cid=3f63abe695030611&ts=34&x=0"
date: Thu, 26 Dec 2024 06:39:32 GMT
content-type: text/css
last-modified: Fri, 22 Sep 2023 00:57:51 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 font-awesome-css.min.css
use.fontawesome.com/releases/v4.7.0/css/ 30 KB
7 KB 28ms
28ms Stylesheet
text/css 2606:4700:3036::6815:1b98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v4.7.0/css/font-awesome-css.min.css
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/7f85a56ba4.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://use.fontawesome.com/7f85a56ba4.css

Response headers

cache-control: max-age=31556926
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: HIT
etag: W/"36082410df2ef7f83932219089dc1443"
age: 172725
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9vFaFMjp5hg7JsnIJ6SAJuTwu0x7QGGUOAdydtE65NEdJiSk%2BxfHagbTfQXnnBmf%2FSo03Huw3SwSgRbOrM6QLslGtrFhacgBmCT3H7QWRmV2lk1%2BUnfbgErZnOyYNyi38ryR%2BZtyB7hCO0sAmwjuUS1B"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f7f13066ef57133-YUL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=23386&min_rtt=18470&rtt_var=11295&sent=12&recv=14&lost=0&retrans=0&sent_bytes=5150&recv_bytes=2355&delivery_rate=206189&cwnd=257&unsent_bytes=0&cid=3f63abe695030611&ts=99&x=0"
date: Thu, 26 Dec 2024 06:39:32 GMT
content-type: text/css
last-modified: Fri, 22 Sep 2023 01:44:05 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2

200

callback
www.elfcosmetics.com/
Redirect Chain

https://www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/authorize?redirect_uri=https%3A%2F%2Fwww.elfcosmetics.com%2Fcallback&response_type=code&client_id=...
https://www.elfcosmetics.com/callback?usid=c0a2c34a-f689-4e35-bc1d-55576260ac47&code=d9RRAcPuDpCR3I7X220ivKPfQ7hPQrmdAaZsGlJxa9U

0
0

303ms
303ms

Fetch
application/json

165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/callback?usid=c0a2c34a-f689-4e35-bc1d-55576260ac47&code=d9RRAcPuDpCR3I7X220ivKPfQ7hPQrmdAaZsGlJxa9U

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

x-amzn-remapped-content-length: 0
x-amzn-remapped-connection: close
age: 0
x-amzn-requestid: 3dd4040b-ae3c-41aa-a677-359240d72509
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: VTmcLdHfI34UJ5bYQDmzioeBRo2GsfYmss_3sa-EfiL3QddSKSUXHg==
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/json
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348119 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
strict-transport-security: max-age=15552000; includeSubDomains
x-yottaa-os: 200
x-yottaa-forcecache: true
cache-control: public, max-age=604800
x-amz-apigw-id: DYwF8FFniYcEdiw=
x-amzn-remapped-date: Thu, 26 Dec 2024 06:39:33 GMT
x-amzn-trace-id: Root=1-676cfa25-6b07b3cf6c33d1db1a628b34;Parent=16e974923722b846;Sampled=0;Lineage=1:2b75b0e9:0
via: 1.1 7d27498ef63e76e5a81975299a76fae4.cloudfront.net (CloudFront)
x-yottaa-metrics: 3221a5fec6f6/[242,229,-] 32D1a5fec674/[-,245.105]
access-control-allow-origin: *
content-length: 0
x-amz-cf-pop: DFW57-P1

Redirect headers

x-correlation-id: 8f7f1307ca26cf33
cf-cache-status: DYNAMIC
age: 0
x-ratelimit-1m-limit: 24000, 2000000
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: v32N_qqrbErwTm1fjN7fBGZmQ33NI_H3GHpNW4hMnpFk5NqiAuVGCg==
date: Thu, 26 Dec 2024 06:39:33 GMT
vary: Accept-Encoding
x-yottaa-optimizations: ob/0 si/32D1a5fec674-1734717345-8434348118 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
strict-transport-security: max-age=31536000; includeSubDomains
x-yottaa-os: 303
cache-control: no-store
location: https://www.elfcosmetics.com/callback?usid=c0a2c34a-f689-4e35-bc1d-55576260ac47&code=d9RRAcPuDpCR3I7X220ivKPfQ7hPQrmdAaZsGlJxa9U
pragma: no-cache
via: 1.1 ae39d1ac6bb931d0ff3d636fc3e249de.cloudfront.net (CloudFront)
cf-ray: 8f7f1307ca26cf33-CMH
x-yottaa-metrics: 3221a5fec6f4/[169,163,-] 32D1a5fec674/[-,254.206]
access-control-allow-origin: *
x-ratelimit-1m-remaining: 23723, 1960373
content-length: 0
x-proxy-request-url: https://6p9dgqhn.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/authorize?redirect_uri=https%3A%2F%2Fwww.elfcosmetics.com%2Fcallback&response_type=code&client_id=f9f7052a-f742-4c38-bdf5-1da004e7fb3b&hint=guest&channel_id=elf-us&code_challenge=_PkMDJAzUBE1xuROgEkOvDW7rSCk3JNvpgf8gPUvqIk
x-amz-cf-pop: DFW57-P1
x-ratelimit-1m-reset: 26831, 26830

POST
H2 201 / Show response
sdk.iad-05.braze.com/api/v3/data/ 736 B
715 B 226ms
224ms XHR
application/json 104.18.38.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/data/

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.38.107 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

780b63ab12a6d6c8d02e06a3b73b29f1b2f7505c4bb754ce564b30aafca8746f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.elfcosmetics.com/
X-Braze-TriggersRequest: true
X-Braze-Last-Req-Ms-Ago: 7200000
X-Braze-DataRequest: true
X-Braze-Req-Attempt: 1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-type: application/json
X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57

Response headers

access-control-max-age: 7200
x-request-id: a945b73c-5c43-4a93-afd5-72fd5a0b6426
access-control-expose-headers
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"780b63ab12a6d6c8d02e06a3b73b29f1"
access-control-allow-methods: POST, GET
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/json
vary: Origin,Accept-Encoding
x-runtime: 0.160566
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=0, private, must-revalidate
x-ratelimit-reset: 1735195176
cf-ray: 8f7f1307be9853ef-YYZ
x-ratelimit-remaining: 499.0
access-control-allow-origin: *
x-ratelimit-limit: 500.0
server: cloudflare

OPTIONS
H2 200 /
sdk.iad-05.braze.com/api/v3/data/ Frame 0
0 120ms
62ms Preflight 104.18.38.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.38.107 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-last-req-ms-ago,x-braze-req-attempt,x-braze-triggersrequest,x-requested-with
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

access-control-allow-headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-last-req-ms-ago,x-braze-req-attempt,x-braze-triggersrequest,x-requested-with
access-control-allow-methods: POST, GET
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
cf-cache-status: DYNAMIC
cf-ray: 8f7f13075e4453ef-YYZ
content-encoding: gzip
date: Thu, 26 Dec 2024 06:39:33 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
H2 200 6ee1574c-d59b-4e80-9930-2e1c3c7db4ff.json Show response
cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/ 6 KB
2 KB 81ms
41ms XHR
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf500a4c158d24ba238d521a5fa775e693d03c507fa3f882bffbbeaf9fedeb64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: aY7kJA0jlzEL9QWHODNZDw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCA5D566A7B63C
age: 71195
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Fri, 27 Dec 2024 06:39:33 GMT
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 20:25:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: dad0151f-501e-0097-0a7f-47f043000000
cf-ray: 8f7f1307ee30713c-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1832
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 st Show response
st.dynamicyield.com/ 161 KB
13 KB 230ms
53ms Script
text/javascript 2600:9000:27c2:bc00:15:ad21:c740:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.dynamicyield.com/st?sec=8772046&inHead=true&id=0&jsession=ew6z3fbbsovnbv2idotsdd1oyftgggjm&ref=&scriptVersion=2.45.0&isSesNew=true&dyid_server=&ctx=%7B%22type%22%3A%22OTHER%22%2C%22lng%22%3A%22en-CA%22%2C%22data%22%3A%5B%5D%7D
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27c2:bc00:15:ad21:c740:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 95878a8bf366ce2b81463625efa7b742466f3f72a3c6c1bd0395b46036f759dc

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache
content-encoding: gzip
via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
expires: Thu, 26 Dec 2024 06:39:32 GMT
access-control-allow-origin: *
x-cache: Miss from cloudfront
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-amz-cf-id: 9WGRedKgITBCo0YhROJFU9peSZWNlOM3C94g3IJGrvgvKQx2KrfceQ==
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-amz-cf-pop: IAD61-P4

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
295 B 88ms
42ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db0da7efe3ac5fc9e598f71e291326f137ea7bbbf97fed4fee0e86b717b0d9a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
accept: application/json
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8f7f130a9bf3a273-YUL
access-control-allow-origin: *
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

OPTIONS
H2 200 sync
sdk.iad-05.braze.com/api/v3/content_cards/ Frame 0
0 59ms
59ms Preflight 104.18.38.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.38.107 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: braze-sync-retry-count,content-type,x-braze-api-key,x-braze-contentcardsrequest,x-braze-datarequest,x-braze-last-req-ms-ago,x-braze-req-attempt,x-braze-req-tokens-remaining,x-requested-with
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

access-control-allow-headers: braze-sync-retry-count,content-type,x-braze-api-key,x-braze-contentcardsrequest,x-braze-datarequest,x-braze-last-req-ms-ago,x-braze-req-attempt,x-braze-req-tokens-remaining,x-requested-with
access-control-allow-methods: POST, GET
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
cf-cache-status: DYNAMIC
cf-ray: 8f7f130a990853ef-YYZ
content-encoding: gzip
date: Thu, 26 Dec 2024 06:39:33 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

OPTIONS
H2 200 sync
sdk.iad-05.braze.com/api/v3/feature_flags/ Frame 0
0 62ms
61ms Preflight 104.18.38.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/feature_flags/sync

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.38.107 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-featureflagsrequest,x-braze-last-req-ms-ago,x-braze-req-attempt,x-braze-req-tokens-remaining,x-requested-with
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

access-control-allow-headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-featureflagsrequest,x-braze-last-req-ms-ago,x-braze-req-attempt,x-braze-req-tokens-remaining,x-requested-with
access-control-allow-methods: POST, GET
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
cf-cache-status: DYNAMIC
cf-ray: 8f7f130aa90d53ef-YYZ
content-encoding: gzip
date: Thu, 26 Dec 2024 06:39:33 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

POST
H2 201 sync Show response
sdk.iad-05.braze.com/api/v3/content_cards/ 85 B
227 B 112ms
110ms XHR
application/json 104.18.38.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.38.107 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67a82049ee5d8cc5dc58710083aaa237f63ebb13e09bc363759a4925020acaab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.elfcosmetics.com/
BRAZE-SYNC-RETRY-COUNT: 0
X-Braze-DataRequest: true
X-Braze-Last-Req-Ms-Ago: 7200000
X-Braze-ContentCardsRequest: true
X-Braze-Req-Attempt: 1
X-Braze-Req-Tokens-Remaining: 29
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-type: application/json
X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57

Response headers

access-control-max-age: 7200
x-request-id: cf17893d-a1e5-440e-b14b-13e908b638f2
access-control-expose-headers
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"67a82049ee5d8cc5dc58710083aaa237"
access-control-allow-methods: POST, GET
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/json
vary: Origin,Accept-Encoding
x-runtime: 0.049153
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=0, private, must-revalidate
x-ratelimit-reset: 1735195176
cf-ray: 8f7f130af98253ef-YYZ
x-ratelimit-remaining: 495.0
access-control-allow-origin: *
x-ratelimit-limit: 500.0
server: cloudflare

POST
H2 201 sync Show response
sdk.iad-05.braze.com/api/v3/feature_flags/ 20 B
180 B 101ms
100ms XHR
application/json 104.18.38.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/feature_flags/sync

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.38.107 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e92f434a50c76d6e52d0d3cc91cdf1854c7fd39fecd5ae65800568aef7c03029

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.elfcosmetics.com/
X-Braze-Last-Req-Ms-Ago: 7200000
X-Braze-DataRequest: true
X-Braze-Req-Attempt: 1
X-Braze-Req-Tokens-Remaining: 28
X-Braze-FeatureFlagsRequest: true
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-type: application/json
X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57

Response headers

access-control-max-age: 7200
x-request-id: c610d0fd-73d1-45d4-8ba0-c37e93d5b0cd
access-control-expose-headers
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"e92f434a50c76d6e52d0d3cc91cdf185"
access-control-allow-methods: POST, GET
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/json
vary: Origin,Accept-Encoding
x-runtime: 0.040430
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=0, private, must-revalidate
x-ratelimit-reset: 1735195176
cf-ray: 8f7f130b098753ef-YYZ
x-ratelimit-remaining: 496.0
access-control-allow-origin: *
x-ratelimit-limit: 500.0
server: cloudflare

POST
H3 200 collect
www.google.com/ccm/ 0
0 170ms
81ms Ping
text/plain 173.194.66.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&scrsrc=www.googletagmanager.com&frm=0&rnd=700349826.1735195174&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&auid=1830084713.1735195174&navt=n&npa=0&gtm=45He4cc1v896608294za200&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1735195173569&tfd=3631&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL3STMX
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 173.194.66.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: qo-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4cc0/ Frame EEB4 0
0 117ms
40ms Document
text/html 2607:f8b0:400d:c09::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fwww.elfcosmetics.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL3STMX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

accept-ranges: bytes
age: 176549
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Tue, 24 Dec 2024 05:37:04 GMT
expires: Wed, 24 Dec 2025 05:37:04 GMT
last-modified: Thu, 12 Dec 2024 10:18:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202406.1.0/ 451 KB
110 KB 30ms
30ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202406.1.0/otBannerSdk.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

47407e3845cb067265a07cb279ccc7a38b927b0c2dc034b627f089115ac0d306

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: 7I5y/rp4ODu7ul89ty+epQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5E56F667161
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 64553
x-content-type-options: nosniff
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/javascript
last-modified: Tue, 16 Jul 2024 22:20:01 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 81606c97-401e-00c7-0bac-43ef4b000000
cf-ray: 8f7f130b196ea27b-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 112027
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/01909eed-3bdc-7682-b7c3-733dc31fe301/ 227 KB
39 KB 36ms
36ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/6ee1574c-d59b-4e80-9930-2e1c3c7db4ff/01909eed-3bdc-7682-b7c3-733dc31fe301/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202406.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eef52bd0c8a7abdd22a88a94381a05bc58c34d48c1c4155ff816ba21c38cca28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: 8kCXQkwViL618LYUH092ww==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCA5D56AD873B6
age: 65604
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Fri, 27 Dec 2024 06:39:33 GMT
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 20:25:21 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: bd10f3a4-801e-0095-474c-26f2b9000000
cf-ray: 8f7f130b9802713c-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39839
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 dy-coll-min.js Show response
cdn.dynamicyield.com/scripts/2.45.0/ 196 KB
65 KB 36ms
35ms Script
text/javascript 2600:9000:28a9:ee00:a:b89d:a6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:28a9:ee00:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: DYCDN /
Resource Hash: e35ebb7e01dda1bdb1fbb86be8bb4163c3b3a0b1353a0b90d573d1ebb913eddd

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

vary: accept-encoding
link: <//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
cache-control: max-age=31536000
content-encoding: gzip
etag: W/"2cc11e085e968b149aa3743056780ffc"
age: 4484097
via: 1.1 f9d8b248b09e5c0a77a4319a8bfbc9d0.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: HDBint9FTIETC8hWbYkIj-8YWePGz2L0VUcWJQAVoLLlowS70psaow==
date: Mon, 04 Nov 2024 09:04:37 GMT
content-type: text/javascript
last-modified: Mon, 28 Oct 2024 08:59:27 GMT
server: DYCDN
x-amz-cf-pop: IAD89-P3
x-amz-server-side-encryption: AES256

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202406.1.0/assets/ 13 KB
3 KB 30ms
29ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202406.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202406.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: sHJXWIgDpMKY35PyRRy4zQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5E56B3084E2
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 63479
x-content-type-options: nosniff
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 22:19:54 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: e5ee5aa5-201e-0039-2d2a-31d32e000000
cf-ray: 8f7f130c685b713c-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3003
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202406.1.0/assets/v2/ 62 KB
13 KB 31ms
30ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202406.1.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202406.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7dbc72c3f0511495fdf45d42283a246613db44b0906199cef195a773068d822f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: LtDYZmcfPNW39lMw/Yu0RQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5E56C7CC8BB
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 85787
x-content-type-options: nosniff
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 22:19:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 125efa87-d01e-00e0-3577-d87502000000
cf-ray: 8f7f130c685c713c-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12723
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/202406.1.0/assets/ 5 KB
2 KB 35ms
34ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202406.1.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202406.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: QnaHNt7KvNcyo6Q1ZDZObg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5E56C38B888
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 63479
x-content-type-options: nosniff
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 22:19:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 21a48b36-f01e-0091-3444-26073b000000
cf-ray: 8f7f130c685e713c-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1738
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202406.1.0/assets/ 24 KB
4 KB 36ms
36ms Fetch
text/css 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202406.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202406.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c496fcbe60fec78dc1b86a9136644d9a97cae20df32be3e9a4a62ce7bd0e6a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: HyPJ72TNHxdfOI82cqKVqA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-lease-status: unlocked
cf-bgj: minify
cf-cache-status: HIT
x-ms-version: 2009-09-19
age: 67075
content-encoding: gzip
x-content-type-options: nosniff
cf-polished: origSize=24745
date: Thu, 26 Dec 2024 06:39:33 GMT
content-type: text/css
last-modified: Tue, 16 Jul 2024 22:20:07 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: c2721718-001e-00c0-0f77-d819ce000000
cf-ray: 8f7f130c6861713c-YUL
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

POST
H2 200 token Show response
www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/ 2 KB
2 KB 208ms
208ms Fetch
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/api/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/token

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

b79192cfcd3e3a1a21a294dea5e8069ecce4bdaf0cd19c0b2bffd0051a4216e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Authorization
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
c_x-pwa-request: true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-correlation-id: 8f7f130ced10cf4e
age: 0
x-ratelimit-1m-limit: 24000, 2000000
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS,PATCH
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: nXjY9008biQqW3qbTT7tVunH4aA5Eomeu4sF7TEPIBwK1ZASmggQ-Q==
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json
vary: Accept-Encoding
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348120 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
strict-transport-security: max-age=31536000; includeSubDomains
x-yottaa-os: 200
cache-control: no-store
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 e9bcf307d6ed54e3e501e39bc538dcfc.cloudfront.net (CloudFront)
cf-ray: 8f7f130ced10cf4e-CMH
x-yottaa-metrics: 3221a5fec6f7/[148,145,-] 32D1a5fec674/[-,150.418]
access-control-allow-origin: *
x-ratelimit-1m-remaining: 23714, 1959504
x-proxy-request-url: https://6p9dgqhn.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/f_ecom_bbxc_prd/oauth2/token
x-amz-cf-pop: DFW57-P1
x-ratelimit-1m-reset: 26059, 26058

POST
H2 200 8772046 Show response
rcom.dynamicyield.com/v3/recommend/ 12 KB
2 KB 295ms
89ms XHR
application/json 2600:9000:2305:8c00:1c:df99:ffc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rcom.dynamicyield.com/v3/recommend/8772046
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2305:8c00:1c:df99:ffc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: a972e945e0ac66df1546837f38dfaf886fc78beaaedeca3029213b71b2f150df

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

timing-allow-origin: *
content-encoding: gzip
access-control-allow-methods: GET, POST
via: 1.1 dfbe3a6f5b354f9a5f95a5a6814ce14e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 1764
x-amz-cf-id: fjmFZZPtnEb3mamhXJZJLL89uZsvOT4fQSlTVfejwNDTsbZm8IRJLA==
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-pop: IAD89-P2
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token

POST
H2 200 uia Show response
async-px.dynamicyield.com/ 0
383 B 211ms
39ms XHR
text/plain 18.165.83.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/uia?cnst=1&_=1735195173914
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-78.iad55.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: POST, GET, OPTIONS
via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: ODBfnRNozXAV0HUsZqlvUbT4b59ie_aqmGdCLfwAhJ1Ry2ex8WyHJw==
date: Thu, 26 Dec 2024 06:39:34 GMT
x-amz-cf-pop: IAD55-P3
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With

GET
H2 200 cnxtag-min.js Show response
js.cnnx.link/roi/ 2 KB
1 KB 218ms
34ms Script
text/javascript 2600:9000:2479:5000:11:85b0:d600:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.cnnx.link/roi/cnxtag-min.js?id=316282
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL3STMX
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2479:5000:11:85b0:d600:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d5267085b5489f178aae1444e1367dbca2debc7c061d5ddd803a16711a19c93b

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: max-age=600
content-encoding: gzip
age: 248
via: 1.1 google, 1.1 4f8e8c9677a68ac8935c32689f962b7a.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 7P26mtrllxvWj4mPmSO4_Gb9STjxMvxWg-VurqohohgAYs-aV35SRw==
date: Thu, 26 Dec 2024 06:35:25 GMT
content-type: text/javascript;charset=UTF-8
vary: Accept-Encoding
x-amz-cf-pop: IAD61-P3

GET
H2

200

pixel.gif
cdn.blisspointmedia.com/assets/img/
Redirect Chain

https://pixel.pointmediatracker.com/kpi?c=elfcosmetics&kpi=visit&tag_id=244&fpc=ca19f132-4cb3-4176-a484-88b805f2d972&user_id=undefined&utm_source=undefined&utm_medium=undefined&utm_campaign=undefin...
https://cdn.blisspointmedia.com/assets/img/pixel.gif

807 B
1 KB

152ms
32ms

Image
image/gif

18.160.18.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.blisspointmedia.com/assets/img/pixel.gif
Protocol: H2
Server: 18.160.18.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-18-23.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-amz-version-id: null
etag: "18b3e43abad26bdac6f4cea944777b62"
age: 77389
via: 1.1 7a5e7fb63610c502e6d20ae459e78942.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 807
x-amz-cf-id: lqu7GxIHE9SzuK2Lb1SzAGhepN8W000CD7EvVIV-lhsMUlhK3ZaLGg==
date: Wed, 25 Dec 2024 09:09:46 GMT
content-type: image/gif
last-modified: Mon, 08 Apr 2019 16:24:44 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P4

Redirect headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
location: https://cdn.blisspointmedia.com/assets/img/pixel.gif
x-amz-apigw-id: DYwGBHySIAMEZ2Q=
x-amzn-trace-id: Root=1-676cfa26-3b4e10d676687da071ff21ad;Parent=713a97e8846ab7f7;Sampled=0;Lineage=1:07bbc27a:0
x-amzn-requestid: 1c1946ed-2a10-46a5-bc62-f28cf97fdd9a
access-control-allow-origin: *
content-length: 2
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=160890&%20seg=6104893&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D160890%26%2520seg%3D6104893%26t%3D2

43 B
1 KB

34ms
32ms

Image
image/gif

68.67.181.231
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D160890%26%2520seg%3D6104893%26t%3D2

Protocol

Server

68.67.181.231 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 167.114.209.103; 167.114.209.103; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 1cf1aa32-1e12-4286-a81f-09710318199b
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 26 Dec 2024 06:39:34 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D160890%26%2520seg%3D6104893%26t%3D2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 167.114.209.103; 167.114.209.103; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: c0c9db0f-6b37-495f-b7d4-0aebd594b76f
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 26 Dec 2024 06:39:34 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=3ftfnh3&ct=0:8m23e30&fmt=3
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZjFlZTQ2MGEtOWE2Yy00N2Y5LWE2MzEtNWU5NTVjOGJiMzRm&gdpr=0&gdpr_consent=&ttd_tdid=f1ee460a-9a6c-47f9-a631-5e955...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm=&google_sc=&google_hm=ZjFlZTQ2MGEtOWE2Yy00N2Y5LWE2MzEtNWU5NTVjOGJiMzRm&gdpr=0&gdpr_consent=&ttd_tdid=f1ee460a-9a6c-47f9-a631-5e9...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&google_gid=CAESEEkvFPiwY07Cdy_sUrmQWpw&google_cver=1
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=f1ee460a-9a6c-47f9-a631-5e955c8bb34f
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=9156917649463128279&ttd_tdid=f1ee460a-9a6c-47f9-a631-5e955c8bb34f
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&expiration=1737787175&gdpr=0&gdpr_consent=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&expiration=1737787175&gdpr=0&gdpr_consent=&C=1

43 B
766 B

65ms
64ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&expiration=1737787175&gdpr=0&gdpr_consent=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2dAcmIerYBJ%2BSUuOQD%2BZQJLzE3p1mouJvwf1ev7jqWt0EONU53GEfSTRIDNlS3nS43FTAh%2FjwQa1WZZduB8m03bAnVn7iBAB4vV%2BqPv6xhqYPPtAArXv2FCoBpdB4JMr1KRK9ojlMqxujA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8f7f13164e0839f3-YYZ
content-length: 43
server: cloudflare

Redirect headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mChWWVd0Mi2pot6SrRowHl9UVK7Uqe7C3csaga6lXChSaHTOks3Tpg0x6Enllq3wkoyvv%2FCIiu0XB55%2BLnhfqihwxpATMAeUCwU%2Fyu6n0xrxOi1LqW4PwGfkomzKmTBbJ%2FnDAUnsh7a1hQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 26 Dec 2024 06:39:35 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
location: /rum?cm_dsp_id=39&external_user_id=f1ee460a-9a6c-47f9-a631-5e955c8bb34f&expiration=1737787175&gdpr=0&gdpr_consent=&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8f7f1314acfe39f3-YYZ
content-length: 0
server: cloudflare

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
624 B 30ms
29ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 80448
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: image/svg+xml
last-modified: Mon, 16 Dec 2024 15:17:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 00507193-401e-0022-4d23-50fdbc000000
cf-ray: 8f7f130daadea27b-YUL
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
539 B 29ms
29ms Fetch
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202406.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 28853
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: image/svg+xml
last-modified: Mon, 16 Dec 2024 15:17:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: eec5be36-001e-00a6-7f44-50ab94000000
cf-ray: 8f7f130db8ef713c-YUL
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_company_logo.png
cdn.cookielaw.org/logos/static/ 4 KB
4 KB 29ms
28ms Image
image/png 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_company_logo.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: E8+sk/ECzKgTUVtDLikiIA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DD1DE4B914BC78
age: 72298
cf-cache-status: HIT
x-content-type-options: nosniff
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: image/png
last-modified: Mon, 16 Dec 2024 15:17:15 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 8c798c0b-c01e-001a-4a47-50bce5000000
cf-ray: 8f7f130ddaffa27b-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4036
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 31ms
31ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 80447
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: image/svg+xml
last-modified: Mon, 16 Dec 2024 15:17:15 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d85d13eb-c01e-005e-3595-556089000000
cf-ray: 8f7f130ddb00a27b-YUL
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 75ms
38ms Fetch 18.165.83.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=877&uid=-8277615877148575195&sec=8772046&t=ri&e=1261284&p=1&ve=11209913&va=%5B27119924%5D&ses=6c5fcc624125fe912fc201ac5d54e5fe&expSes=69870&aud=884367.884385.884387.1167402.1324059.1846919.2356145.998337.1004416.1092373.1426804.1443347.1182144.799436.799440&expVisitId=536459328656866872&cgtgDecisionId=536459327773149356&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1735195174047&rri=789105
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-78.iad55.r.cloudfront.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: POST, GET, OPTIONS
via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: lvnfjMwvXvMhdG389vzUCCs4BWiEcb8b-nkoTSHWp-sjbL_6QmXhqQ==
date: Thu, 26 Dec 2024 06:39:34 GMT
x-amz-cf-pop: IAD55-P3
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 78ms
42ms Fetch 18.165.83.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=189160&uid=-8277615877148575195&sec=8772046&t=ri&e=1574966&p=1&ve=12698518&va=%5B28347247%5D&ses=6c5fcc624125fe912fc201ac5d54e5fe&expSes=69870&aud=884367.884385.884387.1167402.1324059.1846919.2356145.998337.1004416.1092373.1426804.1443347.1182144.799436.799440&expVisitId=536459327367418655&cgtgDecisionId=536459328424638642&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1735195174048&rri=8504243
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-78.iad55.r.cloudfront.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: POST, GET, OPTIONS
via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: c1Wra8MayBAaJU1WQ0xd5UxTm4LlT_oKpvgEb2SnJ3eXDztg-KaeAw==
date: Thu, 26 Dec 2024 06:39:34 GMT
x-amz-cf-pop: IAD55-P3
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 78ms
42ms Fetch 18.165.83.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=457200&uid=-8277615877148575195&sec=8772046&t=ri&e=1609852&p=1&ve=12669413&va=%5B28321879%5D&ses=6c5fcc624125fe912fc201ac5d54e5fe&expSes=69870&aud=884367.884385.884387.1167402.1324059.1846919.2356145.998337.1004416.1092373.1426804.1443347.1182144.799436.799440&expVisitId=536459329072265215&cgtgDecisionId=536459329247348868&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1735195174049&rri=9134305
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-78.iad55.r.cloudfront.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: POST, GET, OPTIONS
via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: KSNSF1HnoWeqD5pgJUbHzpx7QZz0ugm-hYoVtF5x2jPDFuPka7CxXg==
date: Thu, 26 Dec 2024 06:39:34 GMT
x-amz-cf-pop: IAD55-P3
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 77ms
43ms Fetch 18.165.83.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=296186&uid=-8277615877148575195&sec=8772046&t=ri&e=1956448&p=1&ve=13877322&va=%5B29454385%5D&ses=6c5fcc624125fe912fc201ac5d54e5fe&expSes=69870&aud=884367.884385.884387.1167402.1324059.1846919.2356145.998337.1004416.1092373.1426804.1443347.1182144.799436.799440&expVisitId=536459329062024670&cgtgDecisionId=536459326436315617&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1735195174050&rri=4347409
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-78.iad55.r.cloudfront.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: POST, GET, OPTIONS
via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: NO-2WbTNDbZKkWY-rFpxSbDXZG_WPH7I39vW-LXjVPDtw7ofZL6TFg==
date: Thu, 26 Dec 2024 06:39:34 GMT
x-amz-cf-pop: IAD55-P3
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With

GET
H2 200 favicon.ico
www.elfcosmetics.com/ 34 KB
35 KB 163ms
162ms Other
image/x-icon 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/favicon.ico
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: 1331786f628c441b99665436eb8815381e066e17d5c3bb56f5ce2e045d8da17a

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

x-amzn-remapped-content-length: 34494
x-amzn-remapped-connection: close
etag: W/"86be-19400db65b0"
age: 118
x-amzn-requestid: 95abfdba-8060-4beb-9ceb-8787c01f6ecc
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: cK2YWa0A4gB4-Xc3EgKvp478a5gaTZyo41azhiUB1WQML7Wp6clnAQ==
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: image/x-icon
last-modified: Thu, 26 Dec 2024 02:46:06 GMT
vary: Accept-Encoding
x-yottaa-optimizations: ob/0 si/32D1a5fec674-1734717345-8434348122 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-os: 200
x-yottaa-forcecache: true
cache-control: max-age=600, s-maxage=600
x-amz-apigw-id: DYOCfHoNCYcEQLA=
x-amzn-remapped-date: Thu, 26 Dec 2024 02:47:05 GMT
x-amzn-trace-id: Root=1-676cc3a9-677d96db7bca7ee25ea2fb47;Parent=39a177e21deb6902;Sampled=0;Lineage=1:2b75b0e9:0
via: 1.1 f9c7cdbfd821ee3522abb640c0e0a228.cloudfront.net (CloudFront)
x-yottaa-metrics: 3221a5fec6f9/[48,43,-] 32D1a5fec674/[-,51.365]
access-control-allow-origin: *
x-amz-cf-pop: DFW57-P1

POST
H2 200 batch
async-px.dynamicyield.com/ 0
384 B 105ms
38ms Ping
text/plain 18.165.83.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/batch?cnst=1&_=1735195174065_824571
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-78.iad55.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: POST, GET, OPTIONS
via: 1.1 a97f872e6a14f227f3c3ea78467c0330.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: MyDvDLsnOT0MFxn7T2TOov03rqXZ1puFOvUEJP6XiDPi26NawxaR8A==
date: Thu, 26 Dec 2024 06:39:34 GMT
x-amz-cf-pop: IAD55-P3
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With

POST
H2 200 event
qoe-1.yottaa.net/log-nt/ 3 B
191 B 139ms
35ms Ping
text/json 99.83.184.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://qoe-1.yottaa.net/log-nt/event
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.184.193 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0540a066b92ce4ca.awsglobalaccelerator.com
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

access-control-allow-origin: *
access-control-expose-headers: X-Results-Data-Source
timing-allow-origin: *
cache-control: no-cache
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: text/json
access-control-allow-credentials: true

GET
H2 200 var
async-px.dynamicyield.com/ 0
0 49ms
39ms Fetch 18.165.83.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/var?cnst=1&_=350987&uid=-8277615877148575195&sec=8772046&t=ri&e=1575901&p=1&ve=12991774&va=%5B28646951%5D&ses=6c5fcc624125fe912fc201ac5d54e5fe&expSes=69870&aud=884367.884385.884387.1167402.1324059.1846919.2356145.998337.1004416.1092373.1426804.1443347.1182144.799436.799440&expVisitId=536459328425935059&cgtgDecisionId=536459325903981287&mech=1&smech=null&eri=1&tsrc=Direct&reqts=1735195174073&rri=6839854
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-78.iad55.r.cloudfront.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: POST, GET, OPTIONS
via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: ubBAvAuypnOLzxqIoOlg9NQTJnw7fnbeXVftUKWieDZhiOg9K5dJ_w==
date: Thu, 26 Dec 2024 06:39:34 GMT
x-amz-cf-pop: IAD55-P3
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With

POST
H2 204 sessions Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/ 0
1 KB 195ms
193ms XHR
text/plain 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/sessions
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmN2YwN2I5ZC03MWUxLTQ2YTYtOGM3Yi02Y2UzYmQ4NjU1MzQiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmMwYTJjMzRhLWY2ODktNGUzNS1iYzFkLTU1NTc2MjYwYWM0NyIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MzUxOTUxNDMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmFjd1hhRmtLa1hsZWNSeEh3Mm1xWVl4cmtaOjpjaGlkOmVsZi11cyIsImV4cCI6MTczNTE5Njk3MywiaWF0IjoxNzM1MTk1MTczLCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDMxMzg2OTk1MDcwNTc0MTIzNyJ9.XA9lk1NsAjgienfZh-M_p_0MSOgqgITDo_ITDeBNpSuKGREwqE2cADvSoQcSPl_Dhtbu7hehGdzLJB66qB2tOg
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

access-control-expose-headers: etag,location,x-dw-version-status,x-dw-resource-state,authorization,x-dw-request-base-id
x-dw-request-base-id: h0plrSb6bGcBAAB_
x-dw-version-status: obsolete
age: 0
cf-cache-status: DYNAMIC
expires: Thu, 01 Dec 1994 16:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: b0yY0FRkpIJqg_etwXcaobq6QuwfC3e9vRrBPz3TLxSgLpxVe9sMeg==
date: Thu, 26 Dec 2024 06:39:34 GMT
x-yottaa-optimizations: ob/0 si/32D1a5fec674-1734717345-8434348123 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-os: 204
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
allow: OPTIONS,POST
cf-ray: 8f7f130e6a770606-IAD
x-yottaa-metrics: 3221a5fec6fa/[104,101,-] 32D1a5fec674/[-,106.450]
via: 1.1 c7697b9c4955dc41900ab918dddd33e0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/sessions
x-amz-cf-pop: DFW57-P1

POST
H2 200 shoppercontext Show response
www.elfcosmetics.com/api/v1/ 154 B
916 B 608ms
602ms Fetch
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/api/v1/shoppercontext?siteId=elf-us

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/main.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

e1b06c1da9362f1483327932d5e98b16da8c014e7353e237b2b0a5290b56c53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmN2YwN2I5ZC03MWUxLTQ2YTYtOGM3Yi02Y2UzYmQ4NjU1MzQiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmMwYTJjMzRhLWY2ODktNGUzNS1iYzFkLTU1NTc2MjYwYWM0NyIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MzUxOTUxNDMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmFjd1hhRmtLa1hsZWNSeEh3Mm1xWVl4cmtaOjpjaGlkOmVsZi11cyIsImV4cCI6MTczNTE5Njk3MywiaWF0IjoxNzM1MTk1MTczLCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDMxMzg2OTk1MDcwNTc0MTIzNyJ9.XA9lk1NsAjgienfZh-M_p_0MSOgqgITDo_ITDeBNpSuKGREwqE2cADvSoQcSPl_Dhtbu7hehGdzLJB66qB2tOg
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: application/json

Response headers

x-amzn-remapped-content-length: 154
content-encoding: gzip
x-amzn-remapped-connection: close
etag: W/"9a-TeJiArtVRfVL73NQ8YH+ETiJDcE"
age: 0
x-amzn-requestid: 815c9ea2-0191-4029-a1b1-a5c5532833f1
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: rTYngcBore-Kk7JeLbIK8ar8xS-w4Y2E7SLVQeAacL9MvSJV31i9iA==
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json; charset=utf-8
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348124 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
strict-transport-security: max-age=15552000; includeSubDomains
x-yottaa-os: 200
x-amz-apigw-id: DYwGBFZeiYcEP4g=
x-amzn-remapped-date: Thu, 26 Dec 2024 06:39:34 GMT
x-amzn-trace-id: Root=1-676cfa26-5bdc049906e140de74b78912;Parent=4992683597e42f55;Sampled=0;Lineage=1:2b75b0e9:0
via: 1.1 a9c93b7820e04954dd3278b106daa8da.cloudfront.net (CloudFront)
x-yottaa-metrics: 3221cc02d142/[543,540,-] 32D1a5fec674/[-,546.017]
access-control-allow-origin: *
content-length: 127
x-amz-cf-pop: DFW57-P1

POST
H2 201 sync Show response
sdk.iad-05.braze.com/api/v3/content_cards/ 85 B
251 B 117ms
112ms XHR
application/json 104.18.38.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.38.107 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2026d6a973b4569173ed6c33fa9b4d985e9409de1b93510293c34a4def8cfce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.elfcosmetics.com/
BRAZE-SYNC-RETRY-COUNT: 0
X-Braze-DataRequest: true
X-Braze-Last-Req-Ms-Ago: 552
X-Braze-ContentCardsRequest: true
X-Braze-Req-Attempt: 1
X-Braze-Req-Tokens-Remaining: 27
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-type: application/json
X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57

Response headers

access-control-max-age: 7200
x-request-id: e4c8a4a4-6325-43af-a564-de8bf0c52537
access-control-expose-headers
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"a2026d6a973b4569173ed6c33fa9b4d9"
access-control-allow-methods: POST, GET
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json
vary: Origin,Accept-Encoding
x-runtime: 0.050785
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=0, private, must-revalidate
x-ratelimit-reset: 1735195176
cf-ray: 8f7f130e1c0f53ef-YYZ
x-ratelimit-remaining: 494.0
access-control-allow-origin: *
x-ratelimit-limit: 500.0
server: cloudflare

POST
H2 200 shoppercontext Show response
www.elfcosmetics.com/api/v1/ 154 B
919 B 746ms
742ms Fetch
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/api/v1/shoppercontext?siteId=elf-us

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/main.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

e1b06c1da9362f1483327932d5e98b16da8c014e7353e237b2b0a5290b56c53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmN2YwN2I5ZC03MWUxLTQ2YTYtOGM3Yi02Y2UzYmQ4NjU1MzQiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmMwYTJjMzRhLWY2ODktNGUzNS1iYzFkLTU1NTc2MjYwYWM0NyIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MzUxOTUxNDMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmFjd1hhRmtLa1hsZWNSeEh3Mm1xWVl4cmtaOjpjaGlkOmVsZi11cyIsImV4cCI6MTczNTE5Njk3MywiaWF0IjoxNzM1MTk1MTczLCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDMxMzg2OTk1MDcwNTc0MTIzNyJ9.XA9lk1NsAjgienfZh-M_p_0MSOgqgITDo_ITDeBNpSuKGREwqE2cADvSoQcSPl_Dhtbu7hehGdzLJB66qB2tOg
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: application/json

Response headers

x-amzn-remapped-content-length: 154
content-encoding: gzip
x-amzn-remapped-connection: close
etag: W/"9a-TeJiArtVRfVL73NQ8YH+ETiJDcE"
age: 0
x-amzn-requestid: fac241b5-c189-4d46-9ae9-4ca4e71a80d9
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: lxrwCaAriVTUrgc9SAKJnkkvZFfECYUPaQNA1MOfLb5bxgyR4sxyMQ==
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json; charset=utf-8
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348125 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
strict-transport-security: max-age=15552000; includeSubDomains
x-yottaa-os: 200
x-amz-apigw-id: DYwGBGIviYcEdIw=
x-amzn-remapped-date: Thu, 26 Dec 2024 06:39:34 GMT
x-amzn-trace-id: Root=1-676cfa26-1540434a2a80877b2f0ea416;Parent=06e629eef4999e02;Sampled=0;Lineage=1:2b75b0e9:0
via: 1.1 a78d8f4a6ccd81221651cd6112d5330a.cloudfront.net (CloudFront)
x-yottaa-metrics: 3221cc02d147/[682,679,-] 32D1a5fec674/[-,684.425]
access-control-allow-origin: *
content-length: 127
x-amz-cf-pop: DFW57-P1

POST
H2 201 sync Show response
sdk.iad-05.braze.com/api/v3/content_cards/ 85 B
200 B 124ms
120ms XHR
application/json 104.18.38.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.iad-05.braze.com/api/v3/content_cards/sync

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.38.107 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2026d6a973b4569173ed6c33fa9b4d985e9409de1b93510293c34a4def8cfce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.elfcosmetics.com/
BRAZE-SYNC-RETRY-COUNT: 0
X-Braze-DataRequest: true
X-Braze-Last-Req-Ms-Ago: 1
X-Braze-ContentCardsRequest: true
X-Braze-Req-Attempt: 1
X-Braze-Req-Tokens-Remaining: 26
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-type: application/json
X-Braze-Api-Key: 609afcb2-1dc3-41ef-a771-0a9aaf10bf57

Response headers

access-control-max-age: 7200
x-request-id: 9666109c-935e-4039-ad12-d997fcf4a540
access-control-expose-headers
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"a2026d6a973b4569173ed6c33fa9b4d9"
access-control-allow-methods: POST, GET
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json
vary: Origin,Accept-Encoding
x-runtime: 0.056462
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=0, private, must-revalidate
x-ratelimit-reset: 1735195176
cf-ray: 8f7f130e1c1153ef-YYZ
x-ratelimit-remaining: 493.0
access-control-allow-origin: *
x-ratelimit-limit: 500.0
server: cloudflare

GET
H2 200 geo-ip Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/ 189 B
926 B 307ms
305ms XHR
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=167.114.209.103

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

1a69edfa8b18d3fdf995628faed84a7660dd3144fe7f4e5639e945861ba7815a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
c_x-pwa-request: true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
content-type: application/json

Response headers

content-encoding: gzip
x-dw-request-base-id: lUq6pyb6bGcBAAB_
x-dw-version-status: obsolete
age: 0
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: xx6EJXGSTKgP5nBXlvbBpYT4tUvze55LWBbGO2m0JFWtdANCWbpxlw==
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json;charset=UTF-8
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348126 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
sfdc_customization: HOOK
x-yottaa-os: 200
cache-control: max-age=0,no-cache,no-store,must-revalidate
allow: GET,HEAD,OPTIONS
cf-ray: 8f7f130e787fcf4f-CMH
x-yottaa-metrics: 3221cc02d143/[245,242,-] 32D1a5fec674/[-,247.445]
via: 1.1 e9bcf307d6ed54e3e501e39bc538dcfc.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=167.114.209.103
x-amz-cf-pop: DFW57-P1

GET
H2 200 geo-ip Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/ 189 B
925 B 468ms
159ms XHR
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=167.114.209.103

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

1a69edfa8b18d3fdf995628faed84a7660dd3144fe7f4e5639e945861ba7815a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
c_x-pwa-request: true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
content-type: application/json

Response headers

content-encoding: gzip
x-dw-request-base-id: lUrXpyb6bGcBAAB_
x-dw-version-status: obsolete
age: 0
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: Xb83-Hzb84pf62MxwIfbtALcmTfZpG7p0jVZmpvGt1U8eLq0Ql5gDQ==
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json;charset=UTF-8
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348131 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
sfdc_customization: HOOK
x-yottaa-os: 200
cache-control: max-age=0,no-cache,no-store,must-revalidate
allow: GET,HEAD,OPTIONS
cf-ray: 8f7f131058e6cf74-CMH
x-yottaa-metrics: 3221cc02d14b/[101,97,-] 32D1a5fec674/[-,103.293]
via: 1.1 895116b5366f3f5264f7b6361d3fd564.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/custom_objects/CustomApi/geo-ip?c_ip=167.114.209.103
x-amz-cf-pop: DFW57-P1

POST
H2 200 event Show response
www.elfcosmetics.com/api/en-ca/v2.0/ 105 B
676 B 252ms
250ms Fetch
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/api/en-ca/v2.0/event?locale=en-CA

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/main.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

/ Express

Resource Hash

174aa1201610a00cb23e9895c186fb9d78be70ee4722c6fab47c78f399f94786

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: application/json
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

content-encoding: gzip
x-amzn-remapped-connection: keep-alive
etag: W/"69-JtYV9zrWQ9DcXrFDaZOyN9RzpZo"
age: 0
x-content-type-options: nosniff
x-amzn-requestid: 453d515b-34d1-451a-9b8a-8ac1ca6f887b
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348127 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-os: 200
x-amz-apigw-id: DYwGCEUhPHcEsLg=
x-amzn-remapped-date: Thu, 26 Dec 2024 06:39:34 GMT
x-amzn-trace-id: Root=1-676cfa26-7c9cc4670009063d584cfc3a
x-yottaa-metrics: 3221cc02d14a/[192,189,-] 32D1a5fec674/[-,194.583]
access-control-allow-origin: *
content-length: 110
x-powered-by: Express

GET
H2 200 baskets Show response
www.elfcosmetics.com/mobify/proxy/api/customer/shopper-customers/v1/organizations/f_ecom_bbxc_prd/customers/acwXaFkKkXlecRxHw2mqYYxrkZ/ 11 B
984 B 196ms
195ms Fetch
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/api/customer/shopper-customers/v1/organizations/f_ecom_bbxc_prd/customers/acwXaFkKkXlecRxHw2mqYYxrkZ/baskets?siteId=elf-us

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

31f48ed33afe7e437efa2c30cbf97fbd62c2de5c0732504077377846fe64973f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmN2YwN2I5ZC03MWUxLTQ2YTYtOGM3Yi02Y2UzYmQ4NjU1MzQiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmMwYTJjMzRhLWY2ODktNGUzNS1iYzFkLTU1NTc2MjYwYWM0NyIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MzUxOTUxNDMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmFjd1hhRmtLa1hsZWNSeEh3Mm1xWVl4cmtaOjpjaGlkOmVsZi11cyIsImV4cCI6MTczNTE5Njk3MywiaWF0IjoxNzM1MTk1MTczLCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDMxMzg2OTk1MDcwNTc0MTIzNyJ9.XA9lk1NsAjgienfZh-M_p_0MSOgqgITDo_ITDeBNpSuKGREwqE2cADvSoQcSPl_Dhtbu7hehGdzLJB66qB2tOg
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
c_x-pwa-request: true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

x-yottaa-metrics: 3221a5fec61f/[135,130,-] 32D1a5fec674/[-,137.228]
x-correlation-id: 8f7f130fbd8b13ad
cf-cache-status: DYNAMIC
content-encoding: gzip
age: 0
x-content-type-options: nosniff
expires: Thu, 01 Dec 1994 16:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: qwen5sDc4Q3HGWrYAVf9botESTaJlCPIasiHeI6MjHFxLCODbAohbg==
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json;charset=UTF-8
vary: Accept-Encoding
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348129 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
strict-transport-security: max-age=31536000; includeSubDomains
sfdc_customization: HOOK
x-yottaa-os: 200
cache-control: no-cache, no-store
pragma: no-cache
via: 1.1 a65725dd05dc27eea7ae75a2e122228e.cloudfront.net (CloudFront)
sfdc_cache_status: MISS [0/1]
cf-ray: 8f7f130fbd8b13ad-CMH
accept-ranges: bytes
access-control-allow-origin: *
sfdc_load: 1
content-length: 37
dnt: 0
x-ratelimit-limit: 99999
x-ratelimit-remaining: 999
x-proxy-request-url: https://6p9dgqhn.api.commercecloud.salesforce.com/customer/shopper-customers/v1/organizations/f_ecom_bbxc_prd/customers/acwXaFkKkXlecRxHw2mqYYxrkZ/baskets?siteId=elf-us
x-amz-cf-pop: DFW57-P1

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/03dbdfab/www-widgetapi.vflset/ 30 KB
10 KB 41ms
31ms Script
text/javascript 2607:f8b0:4004:c09::be
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/03dbdfab/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::be Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14939503c8a97bef459ce94218f0e65933ab569f7b1d726bcb0b3c1031ebccf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: br
age: 834
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
x-content-type-options: nosniff
expires: Fri, 26 Dec 2025 06:25:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:25:40 GMT
last-modified: Mon, 16 Dec 2024 05:14:15 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
content-length: 10165
x-xss-protection: 0
server: sffe

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
989 B 58ms
54ms Script
text/javascript 173.194.66.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=onloadcallback&render=explicit

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.66.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qo-in-f147.1e100.net

Software

ESF /

Resource Hash

0c34a0cc5c5e472589a32746a26ff106919c30e1978fdac19e19889fdb4f5a07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: private, max-age=300
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options: nosniff
expires: Thu, 26 Dec 2024 06:39:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date: Thu, 26 Dec 2024 06:39:34 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 110221.ct.js Show response
tag.rmp.rakuten.com/ 47 KB
15 KB 204ms
39ms Script
text/javascript 34.102.147.248
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.rmp.rakuten.com/110221.ct.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.102.147.248 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

248.147.102.34.bc.googleusercontent.com

Software

Resource Hash

3b0f317806d1ce70f504afd76f39bd17a3467778641af122dc06e95e73a03613

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=86400
content-encoding: gzip
x-samesite: secure
via: 1.1 google
x-dyn: 0
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-cache: hit
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: text/javascript
last-modified: Thu, 26 Dec 2024 06:39:34 GMT

GET
H2 200 js Show response
www.paypal.com/sdk/ 425 KB
120 KB 81ms
24ms Script
application/javascript 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/sdk/js?client-id=AQ-EQFYFdmKNxtZRBoRdv2chvQI-_ZPvL1jVN9SFYCTseKT4OHPKrnT2yJlx8kWKnFI7JXEJM_cTSdbf&intent=authorize&currency=CAD&vault=true&components=buttons,messages

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

911894783ee4fd2bdbea04f4cf5c1ccfa3cab4be816e5ebed6c5d2c2cb6d38a3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; script-src 'nonce-FnIlmon31eJuMEpNXKwcd/FYrGD/E5yaDPRJQTEQeCsVJHCo' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'nonce-FnIlmon31eJuMEpNXKwcd/FYrGD/E5yaDPRJQTEQeCsVJHCo' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

access-control-expose-headers: Server-Timing
paypal-debug-id: f4612405fd613
content-encoding: gzip
etag: W/"1d899-LHR6v85diFVZ7uoSF/xh1vUcO3g"
age: 2906
origin-trial: AmF3SS0NWoXo3HaojgmIVVXavukRnZH597u+xZNXRCiKWzSKzfNPHw9NC32GmblY12+HXpkCEYeYGyvRBNkkJg0AAABbeyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlRwY2QiLCJleHBpcnkiOjE3MzUzNDM5OTksImlzU3ViZG9tYWluIjp0cnVlfQ==
x-content-type-options: nosniff
disable-set-cookie: true
traceparent: 00-0000000000000000000f4612405fd613-771dc5dbaaba51ec-01
server-timing: "traceparent;desc="00-0000000000000000000f4612405fd613-89ae448b9d0881e0-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
p3p: true
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-bur-kbur8200163-BUR, cache-yul1970055-YUL, cache-yul1970055-YUL
x-cache-hits: 684, 2, 0
x-frame-options: SAMEORIGIN
x-cache: HIT, HIT, MISS
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-FnIlmon31eJuMEpNXKwcd/FYrGD/E5yaDPRJQTEQeCsVJHCo' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-FnIlmon31eJuMEpNXKwcd/FYrGD/E5yaDPRJQTEQeCsVJHCo' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
cache-control: public, max-age=3600, s-maxage=10800
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
x-timer: S1735195174.389704,VS0,VE2
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
access-control-allow-origin: *
content-length: 120985
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK main.js Show response
static.ordergroove.com/1e72a9589c4f11e9a62ebc764e10b970/ 150 KB
52 KB 255ms
37ms Script
application/javascript 23.9.177.190
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.ordergroove.com/1e72a9589c4f11e9a62ebc764e10b970/main.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.9.177.190 , United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-9-177-190.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

c2ac7532466beef2ea338502b864a697286dfb2a61cefb19fcebe0cccc40f068

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=15768000
Vary: Accept-Encoding
Cache-Control: must-revalidate, max-age=900
Content-Encoding: gzip
Connection: keep-alive
Expires: Thu, 26 Dec 2024 06:54:34 GMT
Access-Control-Allow-Origin: *
Content-Length: 53150
Date: Thu, 26 Dec 2024 06:39:34 GMT
Content-Type: application/javascript;charset=UTF-8
X-Powered-By: Express
Server: nginx
X-Frame-Options: SAMEORIGIN

POST
H2 200 batch
async-px.dynamicyield.com/ 0
384 B 46ms
38ms Ping
text/plain 18.165.83.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/batch?cnst=1&_=1735195174321_646978
Requested by: Host: cdn.dynamicyield.com
URL: https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-78.iad55.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: POST, GET, OPTIONS
via: 1.1 a97f872e6a14f227f3c3ea78467c0330.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: Y7s3_lg3GD5wUSHuNEqBXzziVPWEzluu3hVYVnMgT__XxfCgoVQOrg==
date: Thu, 26 Dec 2024 06:39:34 GMT
x-amz-cf-pop: IAD55-P3
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 317 KB
106 KB 116ms
109ms Script
application/javascript 2607:f8b0:400d:c09::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-5D80LRC85N&l=dataLayer&cx=c&gtm=45He4cc1v896608294za200

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ae0018bbcc48a57326fdd1200e7fe62ee90a3ebfeff2500f40f429f0aeedb7c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 26 Dec 2024 06:39:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 108531
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 412 KB
132 KB 57ms
51ms Script
application/javascript 2607:f8b0:400d:c09::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c&gtm=45He4cc1v896608294za200

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b3423e758c8785cf5979d56229ee4fe3d34c0f1fd8726e6c95b1e61ff51017ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 26 Dec 2024 06:39:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 134994
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
588 B 66ms
60ms Script
text/javascript 2607:f8b0:4004:c09::be
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::be Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1daeb8f2b20e643498e588a0f3bc753699fe28c787205ece9b0fc5cd5a7b06be

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: br
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
x-content-type-options: nosniff
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
expires: Thu, 26 Dec 2024 06:39:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: require-trusted-types-for 'script'
cache-control: private, max-age=0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
x-xss-protection: 0
server: ESF

GET
H3 200 include.js Show response
cdn8.eu.inside.chat/gtm/IN-1011171-EC/ 40 KB
11 KB 89ms
41ms Script
application/javascript 104.18.8.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn8.eu.inside.chat/gtm/IN-1011171-EC/include.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.8.17 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fbf274307b0005c6c7e28165828d62def90546a6395cc49c4bf08aa9a7fd2a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"066bf777448db1:0"
age: 383
expires: Thu, 26 Dec 2024 07:39:34 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript
last-modified: Sat, 07 Dec 2024 06:51:40 GMT
vary: Accept-Encoding
priority: u=3,i=?0
strict-transport-security: max-age=31536000; includeSubdomains
cache-control: public, max-age=3600
cf-ray: 8f7f130feb8136bf-YYZ
accept-ranges: bytes
content-length: 10553
server: cloudflare

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 231 KB
83 KB 48ms
43ms Script
application/javascript 2607:f8b0:400d:c09::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-9231397&l=dataLayer&cx=c&gtm=45He4cc1v896608294za200

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b13195e89e92e2c65ca449c901c5e66cb8bde57c5572fd6fd266d268c739c5a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Thu, 26 Dec 2024 06:39:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 26 Dec 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 84563
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 236 KB
84 KB 97ms
92ms Script
application/javascript 2607:f8b0:400d:c09::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-10742279&l=dataLayer&cx=c&gtm=45He4cc1v896608294za200

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a1cd045ea5065178260b96ea8c9fc618ffce5368157bfdfc1cc5b4425cc18ffc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Thu, 26 Dec 2024 06:39:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 26 Dec 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 85861
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 core.js Show response
s.pinimg.com/ct/ 5 KB
2 KB 74ms
21ms Script
application/javascript 2a04:4e42::84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 46811578437caf8eac61ac10112c43b46ede17063b29ac96b866c7027b6fd1d2

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

access-control-max-age: 86400
access-control-expose-headers: X-CDN
cache-control: max-age=7200
content-encoding: br
etag: "11c76370dfab0397b8a31fe800363638"
x-cdn: fastly
access-control-allow-methods: GET
alt-svc: h3=":443";ma=600
access-control-allow-origin: *
content-length: 1863
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript
vary: Accept-Encoding, Origin
x-amz-server-side-encryption: AES256

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 239 KB
61 KB 80ms
34ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

24751cbae618f6fbeb532498fd1ceeda5350f30085086cd5426961a2695e3d9f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-dMtOcuDl' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-dMtOcuDl' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=31, rtx=0, c=23, mss=1232, tbw=4528, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: HQiGRIR1T2vjzPFX8PC1rQfO7uamkg7zEGImsszbOtnzMdOta7Z7u4wcS8NOfs0A3WG/nplzuv1EL4qGdRMnWg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62282
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 43 KB
13 KB 117ms
19ms Script
application/javascript 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: public, max-age=60
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding: gzip
etag: "1a001f3a066bff47a766099b87253911"
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
content-length: 12220
date: Thu, 26 Dec 2024 06:39:34 GMT
last-modified: Mon, 18 Nov 2024 21:16:35 GMT
content-type: application/javascript
vary: Accept-Encoding,Origin
server: snooserv
x-amz-server-side-encryption: AES256

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 142ms
50ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 84948E09F2BE472A94B1B58CDEC14512 Ref B: YMQ01EDGE0606 Ref C: 2024-12-26T06:39:34Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H2 200 events.js Show response
analytics.tiktok.com/i18n/pixel/ 9 KB
3 KB 181ms
68ms Script
application/javascript 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=BRR4GA0I9JJBU29G8GF0&lib=ttq
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 4ce223c978f8e674deda50ed77f1b2ed384ef851459157bbc17749a25bc41afc

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
x-cache-remote: TCP_MISS from a104-78-78-6.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
expires: Thu, 26 Dec 2024 06:39:34 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=19, origin; dur=8, inner; dur=4
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-akamai-request-id: 592f1cea.861dbfc2
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239ee9eb7a18cc5bfc687ebd96a21cd2e4d7c84f1a238ae77d5e66b09844ea5c9a972f8843f56594f88a9d9ef54062b446cacb140a7e794084b4f7a19689b9fb86a061302cefa6d9dc2b9fc4f04567480990
x-origin-response-time: 8,104.78.78.6
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-241226063934FC9760CAE5CBBB33AA47-5221A08875997F6A-00
content-length: 2490
x-parent-response-time: 26,23.220.104.143
x-tt-logid: 20241226063934FC9760CAE5CBBB33AA47
server: nginx

GET
H2 200 events.js Show response
analytics.tiktok.com/i18n/pixel/ 8 KB
3 KB 157ms
52ms Script
application/javascript 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1EFEJPT0U322RQPGHFG&lib=ttq
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 4d7a2f20627724c304780f3d00177e32e2c64fc3952bd7b07dcd07e67a2bc63d

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
x-cache-remote: TCP_MISS from a23-220-104-203.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
expires: Thu, 26 Dec 2024 06:39:34 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=4, origin; dur=7, inner; dur=4
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-akamai-request-id: 38203f8.861dbfc1
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239e8f9b090f72d6d82c03ffee34299eb02e52452420228f89f803279f48f09898cf79b9bd893de5bf7614446892c8dc27db6bd96f0dd76e1ed89ed82d5bb11ba54204252d42cdc73446fdc34c273921496b
x-origin-response-time: 7,23.220.104.203
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-2412260639347DAE4D9592DFF335004B-72C92C9938B3C64B-00
x-parent-response-time: 11,23.220.104.143
x-tt-logid: 202412260639347DAE4D9592DFF335004B
server: nginx

GET
H2 200 widget.js Show response
js.jebbit.com/companion/v1/ 44 KB
45 KB 216ms
39ms Script
text/javascript 2600:9000:27c2:b000:a:7914:b00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.jebbit.com/companion/v1/widget.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27c2:b000:a:7914:b00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 226049a96ceaa190e0dd45980c8fba9367127b7c2b19b635ee30bb7f4fa17e52

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-amz-version-id: M.fQKrXkVHcvymDK9D8bU4BvoS660wdj
etag: "9ee6264c1a592ca4976fb94c91ef8c87"
age: 30058
via: 1.1 fa1e2e434547c02a4b589a4e0e41d4dc.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 45384
x-amz-cf-id: -WDpoCvb4nAcrwgVPXnXnV3qubFzf-07GVXUpA9bx5ZOZZ-tpX1eiA==
date: Wed, 25 Dec 2024 22:18:37 GMT
content-type: text/javascript
last-modified: Mon, 07 Oct 2024 17:19:22 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P4
x-amz-server-side-encryption: AES256

GET
H2 200 i.js Show response
tag.wknd.ai/6664/ 17 KB
6 KB 196ms
21ms Script
text/plain 34.120.253.250
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.wknd.ai/6664/i.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.253.250 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 250.253.120.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: 76beaaff8ada2fa4f616aa893f30677a484968931518a570d5e581e00d4f1894

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
etag: 125093d95c11c3
age: 8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:26 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
link: <https://assets.bounceexchange.com>; rel=dns-prefetch, <https://events.bouncex.net>; rel=dns-prefetch, <https://data.cdnbasket.net>; rel=dns-prefetch, <https://page.cdnbasket.net>; rel=dns-prefetch, <https://view.cdnbasket.net>; rel=dns-prefetch, <https://ids.cdnwidget.com>; rel=dns-prefetch, <https://u.cdnwidget.com>; rel=dns-prefetch, <https://api.bounceexchange.com>; rel=preconnect, <https://pd.cdnwidget.com>; rel=preconnect
cache-control: public,max-age=60
timing-allow-origin: *
x-envoy-upstream-service-time: 0
x-envoy-decorator-operation: tag-router.tag-router.svc.cluster.local:80/*
via: 1.1 google
access-control-allow-origin: *
content-length: 5687
server: istio-envoy
x-region: us-central1

GET
H3 200 activity;register_conversion=1;src=9231397;type=retarget;cat=globa0;ord=5666547940880;npa=1;auiddc=1830084713.1735195174;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=undefine...
ad.doubleclick.net/ 0
23 B 130ms
46ms Image
image/png 173.194.207.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=9231397;type=retarget;cat=globa0;ord=5666547940880;npa=1;auiddc=1830084713.1735195174;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;ps=1;pcor=1780073240;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4cc1v9181619921z8896608294za201zb896608294;gcs=G111;gcd=13v3v3v3u5l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102198178;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.207.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qk-in-f149.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 26 Dec 2024 06:39:34 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"6099993761818560125"}],"aggregatable_trigger_data":[{"filters":[{"14":["8259474"]}],"key_piece":"0x5c2f5392a9cec3d5","source_keys":["12","13","14","15","16","17","18","19","20","21","27161852","27161853","27161854","27161855","628473576","628473577","628473578","628473579","628795380","628795381","628795382","628795383","628812176","628812177","628812178","628812179","641998712","641998713","641998714","641998715","643969340","643969341","643969342","643969343"]},{"key_piece":"0x7cfd780652385e34","not_filters":{"14":["8259474"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","27161852","27161853","27161854","27161855","628473576","628473577","628473578","628473579","628795380","628795381","628795382","628795383","628812176","628812177","628812178","628812179","641998712","641998713","641998714","641998715","643969340","643969341","643969342","643969343"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"27161852":32,"27161853":32,"27161854":32,"27161855":3177,"628473576":32,"628473577":32,"628473578":32,"628473579":3177,"628795380":32,"628795381":32,"628795382":32,"628795383":3177,"628812176":32,"628812177":32,"628812178":32,"628812179":3177,"641998712":32,"641998713":32,"641998714":32,"641998715":3177,"643969340":32,"643969341":32,"643969342":32,"643969343":3177},"aggregation_coordinator_origin":"https://publickeyservice.msmt.gcp.privacysandboxservices.com","debug_key":"2055359347624463367","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"6099993761818560125","filters":[{"14":["8259474"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"6099993761818560125","filters":[{"14":["8259474"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"6099993761818560125","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"6099993761818560125","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["9231397"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

GET
H2 200 main.7d8116bd.js Show response
s.pinimg.com/ct/lib/ 81 KB
23 KB 21ms
20ms Script
application/javascript 2a04:4e42::84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.7d8116bd.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: fb322d9e801b20f445402380d99d144e674abdc4821c6b5d30936c0ecfe381ab

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

access-control-max-age: 86400
access-control-expose-headers: X-CDN
cache-control: max-age=1209600
content-encoding: br
etag: "b7968e6e7735284fd26091b6f049515c"
x-cdn: fastly
access-control-allow-methods: GET
alt-svc: h3=":443";ma=600
access-control-allow-origin: *
content-length: 23467
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript
vary: Accept-Encoding, Origin
x-amz-server-side-encryption: AES256

GET
H3 200 ig.js Show response
cdn8.eu.inside.chat/ 167 KB
59 KB 40ms
39ms Script
text/javascript 104.18.8.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn8.eu.inside.chat/ig.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.8.17 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf055e03c860dd88d9d4017203050548dc930d6b78749b07320c9b08f3625071

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: 75fd15fd6fcf6083994b9a43ad8e8323
age: 371
expires: Thu, 26 Dec 2024 07:39:34 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
priority: u=3,i=?0
strict-transport-security: max-age=31536000; includeSubdomains
cache-control: public, max-age=3600
cf-ray: 8f7f1310cbe936bf-YYZ
accept-ranges: bytes
content-length: 59762
server: cloudflare

POST
H2 204 collect
analytics.google.com/g/ 0
0 102ms
43ms Fetch
text/plain 2001:4860:4802:36::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZLYXLXNDL8&gtm=45je4cc1v879088318z8896608294za200zb896608294&_gaz=1&gcs=G111&gcd=13v3v3v3u5l1&npa=1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=606766695.1735195175&ul=en-ca&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&sid=1735195174&sct=1&seg=0&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&en=page_view&_fv=1&_nsi=1&_ss=2&ep.page_type=content&ep.page_environment=production&ep.page_country=CA&ep.page_language=EN&up.custom_user_id=&up.client_id=&up.user_has_transacted=false&up.user_logged_in=false&up.user_country=CA&up.user_loyalty_status=false&tfd=4633
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c&gtm=45He4cc1v896608294za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.elfcosmetics.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
548 B 131ms
42ms Ping
text/plain 2607:f8b0:400d:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-ZLYXLXNDL8&cid=606766695.1735195175&gtm=45je4cc1v879088318z8896608294za200zb896608294&aip=1&dma=0&gcs=G111&gcd=13v3v3v3u5l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c&gtm=45He4cc1v896608294za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c09::9a Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.elfcosmetics.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 460ms
414ms Image
image/gif 74.125.192.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-ZLYXLXNDL8&cid=606766695.1735195175&gtm=45je4cc1v879088318z8896608294za200zb896608294&aip=1&dma=0&gcs=G111&gcd=13v3v3v3u5l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tag_exp=101925629~102067555~102067808~102081485~102198178&z=3351506

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.192.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 26 Dec 2024 06:39:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 local
www.paypal.com/credit-presentment/experiments/ Frame 2D03 0
0 64ms
26ms Document
text/html 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/credit-presentment/experiments/local?uid=uid_numhnacfzmymuvpacsidplhppphjzs&disableSetCookie=true&features=%5Bobject%20Object%5D%2Cnative-modal&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEtRVFGWUZkbUtOeHRaUkJvUmR2MmNodlFJLV9aUHZMMWpWTjlTRllDVHNlS1Q0T0hQS3JuVDJ5Smx4OGtXS25GSTdKWEVKTV9jVFNkYmYmaW50ZW50PWF1dGhvcml6ZSZjdXJyZW5jeT1DQUQmdmF1bHQ9dHJ1ZSZjb21wb25lbnRzPWJ1dHRvbnMsbWVzc2FnZXMiLCJhdHRycyI6eyJkYXRhLXNkay1pbnRlZ3JhdGlvbi1zb3VyY2UiOiJyZWFjdC1wYXlwYWwtanMiLCJkYXRhLXVpZCI6InVpZF9udW1obmFjZnpteW11dnBhY3NpZHBsaHBwcGhqenMifX0&env=production&scriptUID=uid_numhnacfzmymuvpacsidplhppphjzs&version=1.65.2&integrationType=SDK

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AQ-EQFYFdmKNxtZRBoRdv2chvQI-_ZPvL1jVN9SFYCTseKT4OHPKrnT2yJlx8kWKnFI7JXEJM_cTSdbf&intent=authorize&currency=CAD&vault=true&components=buttons,messages

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'sha256-RmYTC9iPUTyoPfOBR9rEZcPmA3A8NGQgxJOYYBUb740=' 'sha256-MkvCXwEdBhR/QU6eqGX5THWCtkqlaanwiNzVKNI9Vb8=' 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com https:; frame-src 'self' https://.paypalobjects.com https://.paypal.com https://.qualtrics.com; connect-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges: bytes
access-control-expose-headers: Server-Timing
age: 127396
cache-control: s-maxage=86400, max-age=0
content-encoding: gzip
content-length: 1526
content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'sha256-RmYTC9iPUTyoPfOBR9rEZcPmA3A8NGQgxJOYYBUb740=' 'sha256-MkvCXwEdBhR/QU6eqGX5THWCtkqlaanwiNzVKNI9Vb8=' 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com https:; frame-src 'self' https://*.paypalobjects.com https://*.paypal.com https://*.qualtrics.com; connect-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com
content-type: text/html; charset=utf-8
correlation-id: f297073f2214c
date: Thu, 26 Dec 2024 06:39:34 GMT
dc: ccg11-origin-www-1.paypal.com
edge-cache-tag: up-treatments-zoid
etag: W/"1479-yj0UbgDPfYS32foLFCUx3ljARmY"
origin-trial: AmF3SS0NWoXo3HaojgmIVVXavukRnZH597u+xZNXRCiKWzSKzfNPHw9NC32GmblY12+HXpkCEYeYGyvRBNkkJg0AAABbeyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlRwY2QiLCJleHBpcnkiOjE3MzUzNDM5OTksImlzU3ViZG9tYWluIjp0cnVlfQ==
paypal-debug-id: f297073f2214c
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
server-timing: "traceparent;desc="00-0000000000000000000f297073f2214c-e272aa939955c476-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
traceparent: 00-0000000000000000000f297073f2214c-cfeea88515da8693-01
vary: Accept-Encoding
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT, MISS
x-cache-hits: 11920, 3864, 0
x-served-by: cache-bur-kbur8200087-BUR, cache-yul1970057-YUL, cache-yul1970057-YUL
x-timer: S1735195175.723378,VS0,VE6
x-xss-protection: 1; mode=block

GET
H2 200 pptm.js Show response
www.paypal.com/tagmanager/ 14 KB
6 KB 25ms
24ms Script
application/x-javascript 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/tagmanager/pptm.js?id=www.elfcosmetics.com&t=xo&v=5.0.465&source=payments_sdk&client_id=AQ-EQFYFdmKNxtZRBoRdv2chvQI-_ZPvL1jVN9SFYCTseKT4OHPKrnT2yJlx8kWKnFI7JXEJM_cTSdbf&comp=buttons,messages&disableSetCookie=true&vault=true

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

196824cac414f654e7063d0da949b17fb3bbdf95caf34ecfab7d0ad7a30fd5e4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'nonce-My6BN1GPoNOkqTM7NqkPhi+Hn96f/tjRpov2uhK2oMgsKvCX' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; img-src * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.google-analytics.com 'unsafe-inline' https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

paypal-debug-id: f727526a61347
content-encoding: gzip
etag: W/"368c-Wnmcqh3VYNgy3NQjfgP/01pg9SI"
age: 136468
origin-trial: AmF3SS0NWoXo3HaojgmIVVXavukRnZH597u+xZNXRCiKWzSKzfNPHw9NC32GmblY12+HXpkCEYeYGyvRBNkkJg0AAABbeyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlRwY2QiLCJleHBpcnkiOjE3MzUzNDM5OTksImlzU3ViZG9tYWluIjp0cnVlfQ==
x-content-type-options: nosniff
traceparent: 00-0000000000000000000f727526a61347-1d0da8b0cd9e9671-01
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT, HIT, MISS
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/x-javascript; charset=utf-8
x-served-by: cache-bur-kbur8200077-BUR, cache-yul1970055-YUL, cache-yul1970055-YUL
x-cache-hits: 1178, 42, 0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-My6BN1GPoNOkqTM7NqkPhi+Hn96f/tjRpov2uhK2oMgsKvCX' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; img-src * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.google-analytics.com 'unsafe-inline' https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
cache-control: public, max-age=3600
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
x-timer: S1735195175.685055,VS0,VE4
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
content-length: 4803
x-xss-protection: 1; mode=block

GET
H3 200 1638306756445368 Show response
connect.facebook.net/signals/config/ 81 KB
16 KB 35ms
35ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1638306756445368?v=2.9.179&r=stable&domain=www.elfcosmetics.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

410435b46620aaadc41bb3931524f941316bfe78b96906325b7f6a2268d38953

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-3wsT8Ts0' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-3wsT8Ts0' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=32, rtx=0, c=77, mss=1232, tbw=70592, tp=66, tpl=0, uplat=3, ullat=-1
pragma: public
x-fb-debug: YzwRN1VgwBb4kI3o4PUQoaGdj5pAlvFqwZOAV305eCts5EE5Ndbs2zIyND1qF5IAQJWs7zcRZY6GPpldvW1BnA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
content-length: 16484
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 config Show response
pixel-config.reddit.com/pixels/t2_16331p/ 3 B
124 B 110ms
35ms XHR
application/json 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-config.reddit.com/pixels/t2_16331p/config
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: max-age=14400
content-encoding: gzip
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json

GET
H2 200 t2_16331p_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
700 B 66ms
26ms XHR
application/json 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_16331p_telemetry
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: max-age=300
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding: gzip
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 98
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/json
vary: Accept-Encoding,Origin
server: snooserv

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 110ms
36ms Image
image/gif 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1735195174711&id=t2_16331p&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=7ee6ea2700bb381c0e33e8532d15f18a707b7207a0d4e63e67c0f1f0d1e72223&uuid=e38a593a-91ad-4ab8-a8c7-9584a439eccf&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_b192616d&dpm=&dpcc=&dprc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
retry-after: 0
cross-origin-resource-policy: cross-origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish
accept-ranges: bytes
content-length: 42
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: image/gif
server: Varnish

GET
H3 200 activity;register_conversion=1;src=10742279;type=elf8j0;cat=glo_flap;ord=2770224537076;npa=1;auiddc=1830084713.1735195174;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;ps=1...
ad.doubleclick.net/ 0
24 B 44ms
43ms Image
image/png 173.194.207.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=10742279;type=elf8j0;cat=glo_flap;ord=2770224537076;npa=1;auiddc=1830084713.1735195174;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;ps=1;pcor=1177806118;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4cc1v9181663336z8896608294za201zb896608294;gcs=G111;gcd=13v3v3v3u5l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102198178;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.207.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qk-in-f149.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 26 Dec 2024 06:39:34 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"11931247742733387941"}],"aggregatable_trigger_data":[{"filters":[{"14":["12119809"]}],"key_piece":"0x43b36fb4c2f6416c","source_keys":["12","13","14","15","16","17","18","19","20","21","24748276","24748277","24748278","24748279","27138660","27138661","27138662","27138663","30226404","30226405","30226406","30226407","31055692","31055693","31055694","31055695","628477676","628477677","628477678","628477679","628627208","628627209","628627210","628627211","642003348","642003349","642003350","642003351","642887056","642887057","642887058","642887059","644875020","644875021","644875022","644875023","644922660","644922661","644922662","644922663"]},{"key_piece":"0x694fb9e28c873d6","not_filters":{"14":["12119809"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","24748276","24748277","24748278","24748279","27138660","27138661","27138662","27138663","30226404","30226405","30226406","30226407","31055692","31055693","31055694","31055695","628477676","628477677","628477678","628477679","628627208","628627209","628627210","628627211","642003348","642003349","642003350","642003351","642887056","642887057","642887058","642887059","644875020","644875021","644875022","644875023","644922660","644922661","644922662","644922663"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"24748276":32,"24748277":32,"24748278":32,"24748279":3177,"27138660":34,"27138661":34,"27138662":34,"27138663":3345,"30226404":34,"30226405":34,"30226406":34,"30226407":3345,"31055692":32,"31055693":32,"31055694":32,"31055695":3177,"628477676":32,"628477677":32,"628477678":32,"628477679":3177,"628627208":32,"628627209":32,"628627210":32,"628627211":3177,"642003348":32,"642003349":32,"642003350":32,"642003351":3177,"642887056":65,"642887057":65,"642887058":65,"642887059":6356,"644875020":46,"644875021":46,"644875022":46,"644875023":4540,"644922660":40,"644922661":40,"644922662":40,"644922663":3973},"aggregation_coordinator_origin":"https://publickeyservice.msmt.gcp.privacysandboxservices.com","debug_key":"11551565204635715486","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"11931247742733387941","filters":[{"14":["12119809"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"11931247742733387941","filters":[{"14":["12119809"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"11931247742733387941","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"11931247742733387941","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["10742279"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

GET
H2 200 collect Show response
sgtm.elfcosmetics.com/g/ 1 KB
2 KB 152ms
87ms Fetch
text/plain 34.49.124.132
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.elfcosmetics.com/g/collect?v=2&tid=G-5D80LRC85N&gtm=45je4cc1v9125640115z8896608294za200zb896608294&gcs=G111&gcd=13v3v3v3u5l1&npa=1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=606766695.1735195175&ecid=1206783689&ul=en-ca&sr=1600x1200&_fplc=0&ir=1&ur=CA-QC&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&sst.rnd=700349826.1735195174&sst.etld=google.ca&sst.adr=1&sst.ude=0&_s=1&sid=1735195174&sct=1&seg=0&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&en=page_view&_fv=1&_ss=1&tfd=4863&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5D80LRC85N&l=dataLayer&cx=c&gtm=45He4cc1v896608294za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.49.124.132 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

9248549a7f8a792ca8139b8450f080fe1276af370592c8f48569ecd79fa87658

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache
x-accel-buffering: no
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
access-control-allow-origin: https://www.elfcosmetics.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: text/plain
server: Google Frontend

GET
H2 200 collect Show response
sgtm.elfcosmetics.com/g/ 65 B
472 B 352ms
304ms Fetch
text/plain 34.49.124.132
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.elfcosmetics.com/g/collect?v=2&tid=G-5D80LRC85N&gtm=45je4cc1v9125640115z8896608294za200zb896608294&gcs=G111&gcd=13v3v3v3u5l1&npa=1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=606766695.1735195175&ecid=1206783689&ul=en-ca&sr=1600x1200&_fplc=0&ir=1&ur=CA-QC&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&sst.rnd=700349826.1735195174&sst.etld=google.ca&sst.adr=1&sst.ude=0&_s=2&sid=1735195174&sct=1&seg=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&en=page_view&ep.vendor_id=facebook&ep.event_id=1735195712406_173519613233420&ep.facebook_pixel_id=1638306756445368&_et=6&tfd=4880&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5D80LRC85N&l=dataLayer&cx=c&gtm=45He4cc1v896608294za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.49.124.132 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

ec2-34-197-51-182.compute-1.amazonaws.com

Software

Google Frontend /

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache
x-accel-buffering: no
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
access-control-allow-origin: https://www.elfcosmetics.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: text/plain
server: Google Frontend

GET
H2 200 activityi;src=9231397;type=retarget;cat=globa0;ord=5666547940880;npa=1;auiddc=1830084713.1735195174;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;ps=1;pcor=178007324...
9231397.fls.doubleclick.net/ Frame BF2B 0
0 179ms
50ms Document
text/html 142.251.179.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9231397.fls.doubleclick.net/activityi;src=9231397;type=retarget;cat=globa0;ord=5666547940880;npa=1;auiddc=1830084713.1735195174;u6=%2Fen_CA%2Felf-cosmetic-criminals;u10=undefined;u12=undefined;u8=undefined;ps=1;pcor=1780073240;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4cc1v9181619921z8896608294za201zb896608294;gcs=G111;gcd=13v3v3v3u5l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102198178;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.179.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f149.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 434
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Dec 2024 06:39:35 GMT
expires: Thu, 26 Dec 2024 06:39:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 1a8bfa042c9c5.js Show response
t.contentsquare.net/uxa/ 382 KB
90 KB 167ms
38ms Script
application/javascript 3.167.88.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.contentsquare.net/uxa/1a8bfa042c9c5.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.88.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-88-75.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fb298350052d73bf05c430b61a0464dfb1f16711dea168f38987df5a0990e267

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: br
etag: "0ddd937a36a8125e23eeff645a7055e5"
age: 0
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: ZBT8hUeL_2bBhyd2DwHgPmK2TI-Iqx0j59QAfdBagpVRPux_n8LedQ==
date: Mon, 23 Dec 2024 18:11:21 GMT
content-type: application/javascript;charset=utf-8
last-modified: Wed, 18 Dec 2024 13:15:12 GMT
vary: Origin
cache-control: max-age=900
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
via: 1.1 f8513f043bb0905bbc74a0542f2b9082.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 91883
x-amz-cf-pop: IAD55-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

OPTIONS
H2 204 logger
www.paypal.com/xoplatform/logger/api/ Frame 0
0 190ms
150ms Preflight 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/xoplatform/logger/api/logger?disableSetCookie=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://www.elfcosmetics.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
date: Thu, 26 Dec 2024 06:39:35 GMT
dc: ccg11-origin-www-1.paypal.com
origin-trial: AmF3SS0NWoXo3HaojgmIVVXavukRnZH597u+xZNXRCiKWzSKzfNPHw9NC32GmblY12+HXpkCEYeYGyvRBNkkJg0AAABbeyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlRwY2QiLCJleHBpcnkiOjE3MzUzNDM5OTksImlzU3ViZG9tYWluIjp0cnVlfQ==
paypal-debug-id: f590557c1b9b2
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
traceparent: 00-0000000000000000000f590557c1b9b2-ede50ebc528f6056-01
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS, MISS
x-cache-hits: 0, 0, 0
x-content-type-options: nosniff
x-served-by: cache-bur-kbur8200118-BUR, cache-yul1970042-YUL, cache-yul1970042-YUL
x-timer: S1735195175.981392,VS0,VE131

POST
H2 200 logger Show response
www.paypal.com/xoplatform/logger/api/ 985 B
902 B 156ms
154ms XHR
application/json 151.101.193.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/xoplatform/logger/api/logger?disableSetCookie=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

af4a45e102f58c1c29ae6772f2e06e20f0ba35e409b4e9acc6e66e21c77b485f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
accept: application/json
content-type: application/json

Response headers

paypal-debug-id: f5905576e3a84
content-encoding: br
etag: W/"3d9-ukVvjnuOEkwYIBl8dXYH0rKEcRc"
origin-trial: AmF3SS0NWoXo3HaojgmIVVXavukRnZH597u+xZNXRCiKWzSKzfNPHw9NC32GmblY12+HXpkCEYeYGyvRBNkkJg0AAABbeyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlRwY2QiLCJleHBpcnkiOjE3MzUzNDM5OTksImlzU3ViZG9tYWluIjp0cnVlfQ==
x-content-type-options: nosniff
traceparent: 00-0000000000000000000f5905576e3a84-d58a49907024bcdd-01
server-timing: content-encoding;desc="br",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-cache: MISS, MISS, MISS
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: application/json; charset=utf-8
x-served-by: cache-bur-kbur8200038-BUR, cache-yul1970042-YUL, cache-yul1970042-YUL
x-cache-hits: 0, 0, 0
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
x-timer: S1735195175.133866,VS0,VE134
access-control-allow-credentials: true
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: none
access-control-allow-origin: https://www.elfcosmetics.com

GET
H2 200 activityi;src=10742279;type=elf8j0;cat=glo_flap;ord=2770224537076;npa=1;auiddc=1830084713.1735195174;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;ps=1;pcor=1177806118;uaa=...
10742279.fls.doubleclick.net/ Frame 1D22 0
0 151ms
48ms Document
text/html 142.251.16.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10742279.fls.doubleclick.net/activityi;src=10742279;type=elf8j0;cat=glo_flap;ord=2770224537076;npa=1;auiddc=1830084713.1735195174;u1=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals;ps=1;pcor=1177806118;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4cc1v9181663336z8896608294za201zb896608294;gcs=G111;gcd=13v3v3v3u5l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102198178;epver=2;~oref=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals?

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 371
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Dec 2024 06:39:35 GMT
expires: Thu, 26 Dec 2024 06:39:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/ 547 KB
216 KB 102ms
34ms Script
text/javascript 2607:f8b0:4004:c1f::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b261530f05e272e18b5b5c86d860c4979c82b5b6c538e1643b3c94fc9ba76dd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Origin: https://www.elfcosmetics.com
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
age: 66901
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options: nosniff
expires: Thu, 25 Dec 2025 12:04:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 25 Dec 2024 12:04:34 GMT
last-modified: Tue, 10 Dec 2024 23:05:10 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges: bytes
access-control-allow-origin: *
content-length: 220882
x-xss-protection: 0
server: sffe

GET
H2 200 / Show response
ct.pinterest.com/user/ 321 B
680 B 93ms
35ms XHR
application/json 151.101.128.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/user/?tid=2615235625530&pd=%7B%22np%22%3A%22gtm%22%7D&cb=1735195174980&dep=2%2CPAGE_LOAD
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.7d8116bd.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.128.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 27074e6240ca22f6d5a7cc51ee8cd8a0f091080ca80e6a1bea1c624e1cb40341

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

access-control-expose-headers: Epik,Pin-Unauth
content-encoding: gzip
x-pinterest-rid-128bit: 3caf16b996ef4fcaf62dfc23a783eb52
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443";ma=604800
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: application/json; charset=utf-8
cache-control: no-cache,no-store,must-revalidate,max-age=0
pragma: no-cache
x-envoy-upstream-service-time: 0
x-cdn: fastly
access-control-allow-credentials: true
referrer-policy: origin
pin-unauth: dWlkPVkySXlPRGN6WkRjdE1EbGlOUzAwWXpObUxUa3dOR1l0Wm1SbU1HTXhZakJqTlRnNA
pinterest-version: 3d92257897107be8ea2c6613dcfb8dbea319fa46
access-control-allow-origin: https://www.elfcosmetics.com
content-length: 186
x-pinterest-rid: 1773911173734674

GET
H2 200 / Show response
ct.pinterest.com/user/ 321 B
327 B 93ms
37ms XHR
application/json 151.101.128.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/user/?event=pagevisit&ed=%7B%22event_id%22%3A%221735195712406_173519613233420%22%2C%22np%22%3A%22gtm%22%7D&tid=2615235625530&cb=1735195174982&dep=5%2CEVENT_TAGS_ABSENT
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.7d8116bd.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.128.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 27074e6240ca22f6d5a7cc51ee8cd8a0f091080ca80e6a1bea1c624e1cb40341

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

access-control-expose-headers: Epik,Pin-Unauth
content-encoding: gzip
x-pinterest-rid-128bit: 0a5592eb592c57667f562a43cfaa2d90
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443";ma=604800
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: application/json; charset=utf-8
cache-control: no-cache,no-store,must-revalidate,max-age=0
pragma: no-cache
x-envoy-upstream-service-time: 0
x-cdn: fastly
access-control-allow-credentials: true
referrer-policy: origin
pin-unauth: dWlkPU9XRTRaVGhtWW1NdFpXUTBaUzAwT1dVM0xXRmxNR1V0TkRnek56TXpOREUxTjJWbQ
pinterest-version: 3d92257897107be8ea2c6613dcfb8dbea319fa46
access-control-allow-origin: https://www.elfcosmetics.com
content-length: 186
x-pinterest-rid: 9175567761549176

GET
H2 200 main.MWE1OTI4NzI4MQ.js Show response
analytics.tiktok.com/i18n/pixel/static/ 352 KB
97 KB 37ms
37ms Script
application/javascript 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MQ.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: ba3710ffb62361879a717271253bcda8d3a4d1c61f22abc95e00181ca2fea228

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-cache: TCP_MEM_HIT from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
vary: Accept-Encoding
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server-timing: cdn-cache; desc=HIT, edge; dur=0, origin; dur=0, inner; dur=4
x-tt-trace-id: 00-241219142316EEDF1887C0434EE35BDF-12EB65031B6D5207-00
content-length: 98977
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: application/javascript; charset=UTF-8
x-tt-logid: 20241219142316EEDF1887C0434EE35BDF
server: nginx
x-akamai-request-id: 861dc655
x-tt-trace-host: 01d66584a6d7563c883fb006039214d5c715d7145f7192a34f33fc875af004cadaf7d3e2fcbb23fb56bc6339e21b4b65c3e9a679fd9d92d1d50bd0b53d97cf7c2b8602134095bf94affbc96a8a10e08813f4190cce363642516985d4bff6fb74a4

GET
H2 200 main.MWE1OTI4NzI4MA.js Show response
analytics.tiktok.com/i18n/pixel/static/ 347 KB
96 KB 97ms
96ms Script
application/javascript 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MA.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: ecf6e5354373fa78e0539f812ecc35f949250f81c4146c419b6208a4166c0005

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-cache: TCP_MEM_HIT from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
vary: Accept-Encoding
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server-timing: cdn-cache; desc=HIT, edge; dur=1, origin; dur=0, inner; dur=15
x-tt-trace-id: 00-24121914135204BE9F9E7BD5C6D3226A-774211B0366B625F-00
content-length: 97497
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: application/javascript; charset=UTF-8
x-tt-logid: 2024121914135204BE9F9E7BD5C6D3226A
server: nginx
x-akamai-request-id: 861dc66b
x-tt-trace-host: 0111cf6be0bc44902a3cb6bb042cc71704dbc44ea5486130d58131134df36473a74aa658f0e97a3fca425ea6ab64e03a81de9f3d4a64aa3d0e8dda61b396a33f5e9f2dc30cb8eba479de2d04738a255c4bfe37d499b3b2bf005b398bee778c490e

GET
H2 200 5013978.js Show response
bat.bing.com/p/action/ 363 B
424 B 52ms
49ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5013978.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

4922a8859b315c354c23ad278e35483c6cf29aebf1c509c2c928c1f41634fe43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B9A899EDEF5C43B588F747ADAE3AFBF5 Ref B: YMQ01EDGE0606 Ref C: 2024-12-26T06:39:35Z
x-cache: CONFIG_NOCACHE
date: Thu, 26 Dec 2024 06:39:34 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ts
t.paypal.com/ 42 B
518 B 216ms
118ms Image
image/gif 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?pgrp=muse%3Athird-party%3Aanalytics-xo%3A%3A7PFGPLHGYKX72-1&page=muse%3Athird-party%3Aanalytics-xo%3A%3A7PFGPLHGYKX72-1%3A%3A%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=3a9b41b4-1a0b-4488-939e-bc9b13368cc5&fltp=analytics&mrid=7PFGPLHGYKX72&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&flag_consume=yes&pt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1735195175038&g=480&completeurl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&disableSetCookie=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (dcd/7D44) /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
timing-allow-origin: *
paypal-debug-id: 9b67054cee5a6
pragma: no-cache
correlation-id: 9b67054cee5a6
expires: Thu, 26 Dec 2024 06:39:35 GMT
server-timing: traceparent;desc="00-00000000000000000009b67054cee5a6-b41f2f6922e977f5-01", content-encoding;desc="", x-cdn;desc="edgecast"
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
traceparent: 00-00000000000000000009b67054cee5a6-27d81eca923b902c-01
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: image/gif
vary: Accept-Encoding
server: ECAcc (dcd/7D44)

GET
H2 200 widget.css
js.jebbit.com/companion/v1/ 15 KB
16 KB 40ms
38ms Stylesheet
text/css 2600:9000:27c2:b000:a:7914:b00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.jebbit.com/companion/v1/widget.css
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27c2:b000:a:7914:b00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 69beb39687e8656561a843b13137c292498648b7f1ae665214eb292527cd436b

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-amz-version-id: fgLtE0C.phC7FjS26Fxc9wt33wvWl9V5
etag: "c2b625a2843069c776e8a618c90b952a"
age: 41506
via: 1.1 fa1e2e434547c02a4b589a4e0e41d4dc.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 15522
x-amz-cf-id: JqirhvJLE53G9VbLP_2ck-arzvkWsYOe11JzkkJDUygv1QIlYuo46w==
date: Wed, 25 Dec 2024 19:07:50 GMT
content-type: text/css
last-modified: Mon, 07 Oct 2024 17:19:22 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P4
x-amz-server-side-encryption: AES256

GET
H2 200 launcher_configs Show response
external-api.jebbit.com/moments/v2/ 2 B
448 B 343ms
38ms XHR
application/json 34.197.51.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://external-api.jebbit.com/moments/v2/launcher_configs?key=542695a9-9318-492b-9638-2018989f6dc4&url=aHR0cHMlM0ElMkYlMkZ3d3cuZWxmY29zbWV0aWNzLmNvbSUyRmVuX0NBJTJGZWxmLWNvc21ldGljLWNyaW1pbmFscw==&completedLightboxCampaigns=W10=&jebbitCookies=

Requested by

Host: js.jebbit.com
URL: https://js.jebbit.com/companion/v1/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.197.51.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

surrogate-control: no-store
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
x-content-type-options: nosniff
expires: 0
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-dns-prefetch-control: off
pragma: no-cache
access-control-allow-credentials: true
x-download-options: noopen
access-control-allow-origin: https://www.elfcosmetics.com
content-length: 2
x-xss-protection: 1; mode=block

POST
H2 200 baskets Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/ 3 KB
3 KB 290ms
287ms XHR
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/baskets

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

71653716110005990d98223aa0664888af88ae40d06269268b1434d0367b15d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmN2YwN2I5ZC03MWUxLTQ2YTYtOGM3Yi02Y2UzYmQ4NjU1MzQiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmMwYTJjMzRhLWY2ODktNGUzNS1iYzFkLTU1NTc2MjYwYWM0NyIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MzUxOTUxNDMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmFjd1hhRmtLa1hsZWNSeEh3Mm1xWVl4cmtaOjpjaGlkOmVsZi11cyIsImV4cCI6MTczNTE5Njk3MywiaWF0IjoxNzM1MTk1MTczLCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDMxMzg2OTk1MDcwNTc0MTIzNyJ9.XA9lk1NsAjgienfZh-M_p_0MSOgqgITDo_ITDeBNpSuKGREwqE2cADvSoQcSPl_Dhtbu7hehGdzLJB66qB2tOg
x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
c_x-pwa-request: true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
content-type: application/json

Response headers

x-dw-resource-state: b5eb246d9971b7cfbc5dfa88704c190628fbe1db262be11125fdb67df3623260
access-control-expose-headers: etag,location,x-dw-version-status,x-dw-resource-state,authorization,x-dw-request-base-id
content-encoding: gzip
x-dw-version-status: obsolete
etag: b5eb246d9971b7cfbc5dfa88704c190628fbe1db262be11125fdb67df3623260
age: 0
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=DRL99bSgIAEwzC620upO84T8H5.6QTNU06I4huveVTw-1735195175-1.0.1.1-EwsTvCd4mKFbPQ6NkJQanLH10Te3.gMpJCtZ..TZ2m5.vz2xGojBCpsxmJjcbFf8caih8Mn7PGkyGDDfs5fNc.Icom1WJ10Wz54nRe4xIVviR.wq9ojCOHgZzZO.DumyV.jM40zwHyplzItWczRURliQChQoBkSjdA9z3jXC6vY"}],"group":"cf-csp-endpoint","max_age":86400}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: n5Xyn9akxZ0WRN2vuUcr508lDbrzhdrYp0LfR0dpgS9eAUBZH-kuYg==
content-type: application/json;charset=UTF-8
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348136 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
sfdc_customization: HOOK
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
allow: OPTIONS,POST
accept-ranges: bytes
content-length: 1106
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/baskets
x-dw-request-base-id: lUoEqCf6bGcBAAB_
expires: Thu, 01 Dec 1994 16:00:00 GMT
date: Thu, 26 Dec 2024 06:39:35 GMT
x-yottaa-os: 200
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=DRL99bSgIAEwzC620upO84T8H5.6QTNU06I4huveVTw-1735195175-1.0.1.1-EwsTvCd4mKFbPQ6NkJQanLH10Te3.gMpJCtZ..TZ2m5.vz2xGojBCpsxmJjcbFf8caih8Mn7PGkyGDDfs5fNc.Icom1WJ10Wz54nRe4xIVviR.wq9ojCOHgZzZO.DumyV.jM40zwHyplzItWczRURliQChQoBkSjdA9z3jXC6vY; report-to cf-csp-endpoint
via: 1.1 b3ac893abff0a2c3dda216fe4cd9157a.cloudfront.net (CloudFront)
cf-ray: 8f7f13150ef41741-IAD
x-yottaa-metrics: 3221cc02d141/[226,223,-] 32D1a5fec674/[-,228.892]
access-control-allow-origin: *
x-amz-cf-pop: DFW57-P1

GET
H3 200 / Show response
ct.pinterest.com/v3/ 35 B
449 B 37ms
37ms Fetch
image/gif 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/v3/?tid=2615235625530&pd=%7B%22np%22%3A%22gtm%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%227d8116bd%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1735195175403
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.7d8116bd.js
Protocol: H3
Security: QUIC, , AES_256_GCM
Server: 151.101.0.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache,no-store,must-revalidate,max-age=0
pragma: no-cache
x-envoy-upstream-service-time: 2
x-pinterest-rid-128bit: a821c9a6c98c06ce9ef308ed74716ff5
x-cdn: fastly
access-control-allow-credentials: true
referrer-policy: origin
expires: Sat, 01 Jan 2000 00:00:00 GMT
pinterest-version: 3d92257897107be8ea2c6613dcfb8dbea319fa46
access-control-allow-origin: https://www.elfcosmetics.com
alt-svc: h3=":443";ma=604800
content-length: 35
date: Thu, 26 Dec 2024 06:39:35 GMT
x-pinterest-rid: 1145350809328716
content-type: image/gif

GET
H3 200 config Show response
www8.eu.inside.chat/ 231 B
723 B 215ms
135ms XHR
application/json 104.18.8.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.eu.inside.chat/config?acc=IN-1011171&pid=&c1=OK&dev=2&url=https%3A%2F%2Fwww.elfcosmetics.com&sid=14&j=1

Requested by

Host: cdn8.eu.inside.chat
URL: https://cdn8.eu.inside.chat/ig.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.8.17 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

315acb465670b7566eace723f0ee35b9470d09f042e6ebaaf9e8e1c12d786bf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: CP="insert_p3p_privacy_policy_here"
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: application/json; charset=UTF-8
last-modified: Sat, 01 Jan 2000 00:00:00 GMT
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubdomains
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8f7f1316eedc37d0-YYZ
access-control-allow-origin: https://www.elfcosmetics.com
server: cloudflare

GET
H3 200 /
www.facebook.com/tr/ 0
16 B 68ms
32ms Image
text/plain 31.13.66.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1638306756445368&ev=PageView&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&rl=&if=false&ts=1735195175644&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1735195175057.884215667284265022&ic=fbpixel&ler=empty&cdl=API_unavailable&it=1735195174698&coo=false&eid=1735195712406_173519613233420&tm=1&chmd=&chpv=&chfv=undefined&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=30, rtx=0, c=23, mss=1232, tbw=4544, tp=10, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
199 B 124ms
88ms Image
image/png 31.13.66.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1638306756445368&ev=PageView&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&rl=&if=false&ts=1735195175644&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1735195175057.884215667284265022&ic=fbpixel&ler=empty&cdl=API_unavailable&it=1735195174698&coo=false&eid=1735195712406_173519613233420&tm=1&chmd=&chpv=&chfv=undefined&rqm=FGET

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xa230b3a6a6e8856b","source_keys":["1"]}],"aggregatable_values":{"1":10922},"aggregatable_source_registration_time":"exclude","filters":{"3":["1521466687872304"]},"debug_reporting":true,"debug_key":"1984566642478420621"}
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: image/png
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-debug: 3m09VTYE8rok0yptN33jA24+gk628Mi9ePbv1rGc5UxZoML0UGoyYb8C5zuy8jmJ1nROsZrUH8IVVWUSRz1odw==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=30, rtx=0, c=23, mss=1232, tbw=4864, tp=12, tpl=0, uplat=51, ullat=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 204 collect
analytics.google.com/g/s/ 0
268 B 145ms
143ms Image
text/plain 2001:4860:4802:36::181
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://analytics.google.com/g/s/collect?dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5l1&gtm=45j91e4c50h1v9125640115z8896608294z99175401888za200zb896608294&tag_exp=101925629~102067555~102067808~102081485~102198178&_gsid=5D80LRC85N2AKCLJtKUSp_NlKP4rkwWg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:194:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:194:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 414ms
412ms Image
image/gif 74.125.192.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5l1&tid=G-5D80LRC85N&cid=zTHN0a%2BnjFn3SDdbEvTyEYd%2F3M2wxXGeGE674yNPDHs%3D.1735195175&gtm=45j91e4c50h1v9125640115z8896608294z99175401888za200zb896608294&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=1534097385

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.192.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 26 Dec 2024 06:39:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 collect
stats.g.doubleclick.net/g/ 0
49 B 44ms
42ms Image
text/plain 2607:f8b0:400d:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5l1&tid=G-5D80LRC85N&cid=zTHN0a%2BnjFn3SDdbEvTyEYd%2F3M2wxXGeGE674yNPDHs%3D.1735195175&gtm=45j91e4c50h1v9125640115z8896608294z99175401888za200zb896608294&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c09::9a Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: text/plain
server: Golfe2

POST
H2 200 collect Show response
sgtm.elfcosmetics.com/g/ 915 B
1 KB 136ms
134ms Fetch
text/plain 34.49.124.132
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.elfcosmetics.com/g/collect?v=2&tid=G-5D80LRC85N&gtm=45je4cc1v9125640115z8896608294za200zb896608294&gcs=G111&gcd=13v3v3v3u5l1&npa=1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=606766695.1735195175&ecid=1206783689&ul=en-ca&sr=1600x1200&_fplc=0&ir=1&ur=CA-QC&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&sst.rnd=700349826.1735195174&sst.etld=google.ca&sst.adr=1&sst.ude=0&sid=1735195174&sct=1&seg=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&_s=3&tfd=5866&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5D80LRC85N&l=dataLayer&cx=c&gtm=45He4cc1v896608294za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.49.124.132 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

3.67.98.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

c1bdc1c359f76d19e88fdd012520ad5add79fa31a60ba61c95ea8f2e500a369d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache
x-accel-buffering: no
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
access-control-allow-origin: https://www.elfcosmetics.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: text/plain
server: Google Frontend

GET
H2 200 jsp Show response
ut.rd.linksynergy.com/ 148 B
405 B 84ms
35ms Script
text/plain 34.98.67.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ut.rd.linksynergy.com/jsp?cn=rmuid&ro=0&cb=___rmuid

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.98.67.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

7d0c55dcca18c4acda3e5245128c5b0520921d1161d38aff613bea8a97a5f837

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

via: 1.1 google
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 148
date: Thu, 26 Dec 2024 06:39:35 GMT
x-samesite: secure
content-type: text/plain; charset=utf-8

GET
H2 200 runtime_c81e76ee00d795b1eebf8d27949f8dc5.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 908 B
1 KB 227ms
21ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/runtime_c81e76ee00d795b1eebf8d27949f8dc5.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 546e554a3c51ce180d022de9ff5506f14603b38d40ece9f2be43c88328358a52

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: etag, Content-Type
content-encoding: br
x-goog-hash: crc32c=zwy9lg==, md5=HCxXU9+1dkCoulTxEZNLMA==
etag: "1c2c5753dfb57640a8ba54f111934b30"
age: 266493
ad-auction-allowed: true
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 509
date: Mon, 23 Dec 2024 04:38:03 GMT
last-modified: Thu, 19 Dec 2024 20:55:33 GMT
content-type: text/javascript
x-guploader-uploadid: AFiumC7FCed2sK4qHOIK2GhXIi105nN68oNgW_P3MWCxctXFWsUsMaACC1bqRgPgSmURek57
cache-control: public,max-age=31536000
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1734641733605837
content-length: 509
server: UploadServer

GET
H2 200 muse.js Show response
www.paypalobjects.com/muse/ 57 KB
16 KB 101ms
29ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/muse/muse.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D10C) /

Resource Hash

79da320c6fb87e096c737f174d81eeda39902923945c8b7a90bdc4b7d934734f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

paypal-debug-id: 2463a19d21afa
content-encoding: br
etag: "6761d5cf-e2ea"
x-content-type-options: nosniff
expires: Thu, 26 Dec 2024 07:39:35 GMT
traceparent: 00-00000000000000000002463a19d21afa-a969a3ad5577153c-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Thu, 26 Dec 2024 06:39:35 GMT
content-type: application/javascript
last-modified: Tue, 17 Dec 2024 19:49:35 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
content-length: 16026
server: ECAcc (nyd/D10C)

GET
H3 200 / Show response
ct.pinterest.com/v3/ 35 B
695 B 52ms
51ms Fetch
image/gif 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/v3/?event=pagevisit&ed=%7B%22event_id%22%3A%221735195712406_173519613233420%22%2C%22np%22%3A%22gtm%22%7D&tid=2615235625530&cb=1735195175814&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22pin_unauth%22%3A%22dWlkPVkySXlPRGN6WkRjdE1EbGlOUzAwWXpObUxUa3dOR1l0Wm1SbU1HTXhZakJqTlRnNA%22%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%227d8116bd%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Atrue%7D
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.7d8116bd.js
Protocol: H3
Security: QUIC, , AES_256_GCM
Server: 151.101.0.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache,no-store,must-revalidate,max-age=0
pragma: no-cache
x-envoy-upstream-service-time: 15
x-pinterest-rid-128bit: 9b2b63b38843f610e84289b13792882a
x-cdn: fastly
access-control-allow-credentials: true
referrer-policy: origin
expires: Sat, 01 Jan 2000 00:00:00 GMT
pinterest-version: 3d92257897107be8ea2c6613dcfb8dbea319fa46
access-control-allow-origin: https://www.elfcosmetics.com
alt-svc: h3=":443";ma=604800
content-length: 35
date: Thu, 26 Dec 2024 06:39:35 GMT
x-pinterest-rid: 1673609055949675
content-type: image/gif

GET
H2 200 products Show response
www.elfcosmetics.com/api/en-ca/v2.0/ 1 MB
95 KB 719ms
719ms Fetch
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/api/en-ca/v2.0/products?ids=300211%2C300166%2C300242%2C59560UP%2C300168%2C57150%2C300240%2C300224%2C300237%2C23212%2C81765%2C57418&phash=17ad4db65da0f7c8&siteId=elf-us&locale=en-CA&currency=CAD

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/main.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

/ Express

Resource Hash

77cecc38ae2d9089c5b5edc4219a6cda50e467f54aa35fe8f2c6297d3ee2b946

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmN2YwN2I5ZC03MWUxLTQ2YTYtOGM3Yi02Y2UzYmQ4NjU1MzQiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmMwYTJjMzRhLWY2ODktNGUzNS1iYzFkLTU1NTc2MjYwYWM0NyIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MzUxOTUxNDMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmFjd1hhRmtLa1hsZWNSeEh3Mm1xWVl4cmtaOjpjaGlkOmVsZi11cyIsImV4cCI6MTczNTE5Njk3MywiaWF0IjoxNzM1MTk1MTczLCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDMxMzg2OTk1MDcwNTc0MTIzNyJ9.XA9lk1NsAjgienfZh-M_p_0MSOgqgITDo_ITDeBNpSuKGREwqE2cADvSoQcSPl_Dhtbu7hehGdzLJB66qB2tOg
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
c_x-pwa-request: true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
clientid: 982499-0-40048abc

Response headers

content-encoding: gzip
x-amzn-remapped-connection: keep-alive
etag: W/"15a448-URJ5vL1o8KaNaCqkTw3BRcsUwtg"
age: 0
x-content-type-options: nosniff
x-amzn-requestid: 22f6b608-0975-4b8f-8bd2-9a2df1212607
date: Thu, 26 Dec 2024 06:39:36 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348142 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-os: 200
x-amz-apigw-id: DYwGUFcWvHcElfw=
x-amzn-remapped-date: Thu, 26 Dec 2024 06:39:36 GMT
x-amzn-trace-id: Root=1-676cfa28-684825841c7a19087bfcf26c
x-yottaa-metrics: 3221a5fec69a/[655,650,-] 32D1a5fec674/[-,658.137]
access-control-allow-origin: *
x-powered-by: Express

GET
H2 204 0
bat.bing.com/action/ 0
361 B 50ms
49ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5013978&tm=gtm002&Ver=2&mid=bee24189-a5be-4c2a-9c45-5a0d1c8df5b4&bo=1&sid=2c4c3740c35411ef92cb735b1959f63a&vid=2c4c5290c35411efa5b23f0911a34459&vids=1&msclkid=N&pi=918639831&lg=en-CA&sw=1600&sh=1200&sc=24&tl=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&p=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&r=&lt=4002&evt=pageLoad&sv=1&cdb=AQET&rn=920343

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B64D63A237914C61A65A645A86E918FA Ref B: YMQ01EDGE0606 Ref C: 2024-12-26T06:39:35Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 26 Dec 2024 06:39:35 GMT

GET
H2 200 identify_45dd5971.js Show response
analytics.tiktok.com/i18n/pixel/static/ 146 KB
39 KB 103ms
103ms Script
application/javascript 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/identify_45dd5971.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 2adcf9fd70c1c834f4b13d732b66f4900cec9a6bbdc587b85dbc68cdd9a34be4

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-cache: TCP_MEM_HIT from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
vary: Accept-Encoding
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server-timing: cdn-cache; desc=HIT, edge; dur=0, origin; dur=0, inner; dur=2
x-tt-trace-id: 00-2411150502397366B6D33FC20AF00152-4482C89C78A0B499-00
content-length: 39240
date: Thu, 26 Dec 2024 06:39:36 GMT
content-type: application/javascript; charset=UTF-8
x-tt-logid: 202411150502397366B6D33FC20AF00152
server: nginx
x-akamai-request-id: 861dd503
x-tt-trace-host: 010e9fd4bb5c089565c4ad7ecc18c02e64d6eb0f37673373e4d6c987350ed1c448fe05300c228c9a484f6aa32801a8e06740ea973a2884a3cecef42349714eb3d62c423892703eaab9e2ddef870416c82979dcddbbf536ff0e11fb4ed7916fe48e

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 0288 0
0 137ms
60ms Document
text/html 173.194.66.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcA2G4UAAAAAK-fHuRDYBsNQoJlqlDqQvrjGwQu&co=aHR0cHM6Ly93d3cuZWxmY29zbWV0aWNzLmNvbTo0NDM.&hl=en&type=image&v=zIriijn3uj5Vpknvt_LnfNbF&theme=light&size=invisible&badge=bottomright&cb=lxr2prz86l19

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.66.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qo-in-f103.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-p5moNeMMePU3y3I_xncS0g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-p5moNeMMePU3y3I_xncS0g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 26 Dec 2024 06:39:36 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 cf Show response
www8.eu.inside.chat/page/ 175 B
455 B 168ms
168ms XHR
application/json 104.18.8.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.eu.inside.chat/page/cf?_=1735195175810.4407

Requested by

Host: cdn8.eu.inside.chat
URL: https://cdn8.eu.inside.chat/ig.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.8.17 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4cbd36265ac7ead5bfaacfa627dda7380c6907e449419be3cf5e04e8cc8313c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 26 Dec 2024 06:39:36 GMT
content-type: application/json
last-modified: Sat, 01 Jan 2000 00:00:00 GMT
vary: Accept-Encoding
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubdomains
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8f7f131bc9c937d0-YYZ
access-control-allow-origin: https://www.elfcosmetics.com
server: cloudflare

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
876 B 88ms
87ms Ping
text/plain 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MQ.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

x-cache-remote: TCP_MISS from a23-48-100-179.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Thu, 26 Dec 2024 06:39:36 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=8, origin; dur=23, inner; dur=16
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:36 GMT
x-akamai-request-id: 79ca8895.861dda02
access-control-allow-headers: Authorization,*
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239e9d51bd04f8e13c54599e968dfeca1012223ac08c9cf4b578a1e67b330ab911b94c46eb014710a0e2d92cf3e34ad3bbe97e5cad3cfd08b3ea653c2568dd157512ca39299b573c03a2030072f8e3d1006d
x-origin-response-time: 23,23.48.100.179
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-241226063936F6315189F73EC79F81D0-0BD212784CC18118-00
content-length: 0
x-parent-response-time: 25,23.220.104.143
x-tt-logid: 20241226063936F6315189F73EC79F81D0
server: nginx

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
724 B 271ms
269ms Ping
text/plain 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MQ.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Thu, 26 Dec 2024 06:39:36 GMT
server-timing: inner; dur=189, cdn-cache; desc=MISS, edge; dur=8, origin; dur=192
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:36 GMT
x-akamai-request-id: 861dda03
access-control-allow-headers: Authorization,*
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239e4261788fe7eb8276f6e53a6eb0979a6c8ac90a95fc248437d0f4eb5d13d14f1fe3f5038acf19cf7f870935b0e052e2ab0b3cf9d2970df955f52adedbb9c2cf08
x-origin-response-time: 192,23.220.104.143
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-24122606393699673DC3BF9B94C24DAF-0F3D46ED10BF83F6-00
content-length: 0
x-tt-logid: 2024122606393699673DC3BF9B94C24DAF
server: nginx

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
881 B 157ms
156ms Ping
text/plain 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MQ.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

x-cache-remote: TCP_MISS from a104-78-78-45.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Thu, 26 Dec 2024 06:39:36 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=62, origin; dur=23, inner; dur=18
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:36 GMT
x-akamai-request-id: 372788b9.861dda04
access-control-allow-headers: Authorization,*
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239ed4eb2e8bc8ad1998eb1c9842832a3ed8eddd0f17940fc872d8e41619c156369ec8dff84a184d74b8396ecb7671fd76e5248dc4f19235001cdc188442294d685c25a79b174b573f8dd2962eb91865734b
x-origin-response-time: 23,104.78.78.45
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-241226063936129941BBCBD6559F4E05-78155BC04B47F69B-00
content-length: 0
x-parent-response-time: 74,23.220.104.143
x-tt-logid: 20241226063936129941BBCBD6559F4E05
server: nginx

POST
H2 200 act
analytics.tiktok.com/api/v2/pixel/ 0
879 B 124ms
123ms Ping
text/plain 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel/act
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MQ.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

x-cache-remote: TCP_MISS from a23-48-100-103.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Thu, 26 Dec 2024 06:39:36 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=10, origin; dur=31, inner; dur=28
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:36 GMT
x-akamai-request-id: 7cff7e82.861dda05
access-control-allow-headers: Authorization,*
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239e9f5fde64b90c4b89c27e49885e23540f2a23c0470d4ebd28233ef720d439c6dbb08fc39d59e3fac165ba21dd2ed4077a468e830973bf11a9de6eda45e1eae6e20b4503d39a15855168dfa7824bce3c98
x-origin-response-time: 31,23.48.100.103
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-24122606393630136B40939DF5388151-20A7D44F7670810A-00
content-length: 0
x-parent-response-time: 33,23.220.104.143
x-tt-logid: 2024122606393630136B40939DF5388151
server: nginx

POST
H2 200 act
analytics.tiktok.com/api/v2/pixel/ 0
881 B 186ms
186ms Ping
text/plain 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel/act
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MQ.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

x-cache-remote: TCP_MISS from a104-78-78-103.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Thu, 26 Dec 2024 06:39:36 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=64, origin; dur=41, inner; dur=26
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:36 GMT
x-akamai-request-id: 31c85529.861dda46
access-control-allow-headers: Authorization,*
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239eeb08e74586238cc1f27cd489ae9c63515dc57f6eb2ae1b766d989ab67c0509e5bce9f24291b4864733625e441cbd01d2dd1e0a93ae8d6971bd4a3f90f121c8c486e1aa350699750ae46b7c1d9b1dfa97
x-origin-response-time: 42,104.78.78.103
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-241226063936AB7B4EE4F11690BF89E7-2E28CF8112238C96-00
content-length: 0
x-parent-response-time: 91,23.220.104.143
x-tt-logid: 20241226063936AB7B4EE4F11690BF89E7
server: nginx

POST
H2 200 act
analytics.tiktok.com/api/v2/pixel/ 0
878 B 124ms
124ms Ping
text/plain 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel/act
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MQ.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

x-cache-remote: TCP_MISS from a23-220-104-203.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Thu, 26 Dec 2024 06:39:36 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=10, origin; dur=20, inner; dur=16
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:36 GMT
x-akamai-request-id: 3822c16.861dda48
access-control-allow-headers: Authorization,*
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239e8f9b090f72d6d82c03ffee34299eb02e15b1fcde621b9cb483cd1c32e6d24be8163a234f7f444200d2606d1d2abe9c10661ce9703ac84fb525ccfe635ec232261f23bb22087b4fe8d28efaeaa3f97bc4
x-origin-response-time: 20,23.220.104.203
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-241226063936B30F4B9D516E89266B2C-0C9429EF39473DAE-00
content-length: 0
x-parent-response-time: 22,23.220.104.143
x-tt-logid: 20241226063936B30F4B9D516E89266B2C
server: nginx

POST
H2 200 act
analytics.tiktok.com/api/v2/pixel/ 0
883 B 124ms
123ms Ping
text/plain 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel/act
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MQ.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

x-cache-remote: TCP_MISS from a23-48-100-169.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Thu, 26 Dec 2024 06:39:36 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=15, origin; dur=29, inner; dur=24
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:36 GMT
x-akamai-request-id: 4b5f5b34.861dda49
access-control-allow-headers: Authorization,*
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239ebfe5cb34aa5dcbcf7519080d08f456ba30b43c20f9b89b11ccd4d4d87c1b9760d38744e4d7006cabdcaf13f8b1272471b55033815928647a8fddc7043e919298d5c5a4bda533b172fb7c0fa19afdc35a
x-origin-response-time: 29,23.48.100.169
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-24122606393636E60E0B18DDD688D97B-51D17CD4563A5DA0-00
content-length: 0
x-parent-response-time: 35,23.220.104.143
x-tt-logid: 2024122606393636E60E0B18DDD688D97B
server: nginx

POST
H2 200 act
analytics.tiktok.com/api/v2/pixel/ 0
721 B 294ms
293ms Ping
text/plain 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel/act
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MQ.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Thu, 26 Dec 2024 06:39:36 GMT
server-timing: inner; dur=214, cdn-cache; desc=MISS, edge; dur=9, origin; dur=218
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:36 GMT
x-akamai-request-id: 861dda4a
access-control-allow-headers: Authorization,*
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239e7372a6f6222919f206a3327afed27285de8628dafb9c3177e9ea186a3938ea0aadbbd142c523ac62226705965b9c9806451a6bdbc8e71dfec10cfd2ac75084ad
x-origin-response-time: 218,23.220.104.143
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-2412260639360624B99A9F450271A6C0-53FDB2D227E1D85B-00
content-length: 0
x-tt-logid: 202412260639360624B99A9F450271A6C0
server: nginx

GET
H3 200 token_create.js Show response
ct.pinterest.com/static/ct/ 4 KB
4 KB 20ms
19ms Script
application/javascript 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/static/ct/token_create.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_256_GCM
Server: 151.101.0.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 85ab852bfb2016bce3933a1c7107b1bce807179f46364db291ab1f86b89addbb

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: max-age=7200
timing-allow-origin: https://ct.pinterest.com
etag: "6d0ca67bea866259c359c2d1e93bf622"
age: 5202
x-cdn: fastly
alt-svc: h3=":443";ma=604800
content-length: 4054
date: Thu, 26 Dec 2024 06:39:36 GMT
content-type: application/javascript
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 ct.html
ct.pinterest.com/ Frame 7DB5 0
0 71ms
34ms Document
text/html 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/ct.html
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.0.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

alt-svc: h3=":443";ma=604800
cache-control: max-age=86400
content-encoding: gzip
content-length: 323
content-type: text/html; charset=utf-8
date: Thu, 26 Dec 2024 06:39:36 GMT
pinterest-version: 3d92257897107be8ea2c6613dcfb8dbea319fa46
referrer-policy: origin
x-cdn: fastly
x-envoy-upstream-service-time: 0
x-pinterest-rid: 1340805540746649
x-pinterest-rid-128bit: a5fab994561cbe2d129b7f891114603e

GET
H2 200 index.html
www.paypalobjects.com/muse/analytics/ Frame F945 0
0 112ms
28ms Document
text/html 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/muse/analytics/index.html

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D191) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

accept-ranges: bytes
cache-control: s-maxage=31536000, public,max-age=3600
content-encoding: br
content-length: 16466
content-type: text/html
date: Thu, 26 Dec 2024 06:39:36 GMT
dc: ccg11-origin-www-1.paypal.com
etag: "6761d5cf-e4f0"
expires: Thu, 26 Dec 2024 07:39:36 GMT
last-modified: Tue, 17 Dec 2024 19:49:35 GMT
paypal-debug-id: 51caf36b1edc2
server: ECAcc (nyd/D191)
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-000000000000000000051caf36b1edc2-3cd826791d531508-01
vary: Accept-Encoding
x-cache: HIT
x-content-type-options: nosniff

GET
H3

200

/
www.google.ca/pagead/1p-conversion/698270988/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/698270988/?random=1498154844&fst=1735195175905&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4c50h1v9125640...
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/698270988/?random=873472652&fst=1735195175905&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4...
https://www.google.com/pagead/1p-conversion/698270988/?random=873472652&fst=1735195175905&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4c50h1v9125640115z8896...
https://www.google.ca/pagead/1p-conversion/698270988/?random=873472652&fst=1735195175905&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4c50h1v9125640115z88966...

42 B
64 B

57ms
56ms

Image
image/gif

74.125.192.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/698270988/?random=873472652&fst=1735195175905&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4c50h1v9125640115z8896608294z99175401888za200zb896608294&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1830084713.1735195174&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5l1&uip=167.114.209.0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&tag_exp=101925629~102067555~102067808~102081485~102198178&s3p=1&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAkoVZXZlbnQtc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&pscrd=IhMIjpLs4OnEigMVaw2ICR2WuRUkMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOh1odHRwczovL3d3dy5lbGZjb3NtZXRpY3MuY29tL0JWQ2hBSWdQZXV1d1lRamZ2QWg1RHBzZHRpRWl3QTByNnVPS3hTT2thWUthY3pmTk1VVnRXaXhaUnBXeU1GTlpKTXdoUUpxamxpaVhNd2NSOXpLekdHMFE&is_vtc=1&cid=CAQSKQCa7L7dudpbNhuQhODsyF5MZM4wkKDjgHRlc6Svu0_fGjDjRpnY2KpZ&eitems=ChEIgPeuuwYQzcLm9YekgpWZARIdAIw1fRU2dO_0F-SglMVOXhTSChECbrnfUg9ek0I&random=702289343&ipr=y

Protocol

Server

74.125.192.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-3-162-103-107.iad61.r.cloudfront.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 26 Dec 2024 06:39:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.ca/pagead/1p-conversion/698270988/?random=873472652&fst=1735195175905&cv=10&fmt=3&label=87uyCIuRktcBEIyK-8wC&bg=ffffff&guid=ON&u_w=1600&u_h=1200&gtm=45j91e4c50h1v9125640115z8896608294z99175401888za200zb896608294&value=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tiba=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&data=event%3Dpageview%3Bvendor_id%3Dgoogle_ads%3Bgoogle_ads_conversion_id%3D698270988%3Bgoogle_ads_conversion_label%3D87uyCIuRktcBEIyK-8wC%3Bgoogle_ads_tag_type%3Dconversion&auid=1830084713.1735195174&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5l1&uip=167.114.209.0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&tag_exp=101925629~102067555~102067808~102081485~102198178&s3p=1&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAkoVZXZlbnQtc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&pscrd=IhMIjpLs4OnEigMVaw2ICR2WuRUkMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOh1odHRwczovL3d3dy5lbGZjb3NtZXRpY3MuY29tL0JWQ2hBSWdQZXV1d1lRamZ2QWg1RHBzZHRpRWl3QTByNnVPS3hTT2thWUthY3pmTk1VVnRXaXhaUnBXeU1GTlpKTXdoUUpxamxpaVhNd2NSOXpLekdHMFE&is_vtc=1&cid=CAQSKQCa7L7dudpbNhuQhODsyF5MZM4wkKDjgHRlc6Svu0_fGjDjRpnY2KpZ&eitems=ChEIgPeuuwYQzcLm9YekgpWZARIdAIw1fRU2dO_0F-SglMVOXhTSChECbrnfUg9ek0I&random=702289343&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 26 Dec 2024 06:39:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 main-v2_ebe451a946893ac92b8458b147333165.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 528 KB
115 KB 23ms
20ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main-v2_ebe451a946893ac92b8458b147333165.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 4c225989448788e7394a256c85ac33a9b701e5a69cb7d0a9a0b2ec158b4382e1

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: etag, Content-Type
content-encoding: br
x-goog-hash: crc32c=ujPWoQ==, md5=RPwsRHVobfECm1Ueff9vSA==
etag: "44fc2c4475686df1029b551e7dff6f48"
age: 15369
ad-auction-allowed: true
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 117007
date: Thu, 26 Dec 2024 02:23:27 GMT
last-modified: Mon, 23 Dec 2024 18:18:30 GMT
content-type: text/javascript
x-guploader-uploadid: AFiumC4ollDrCdx5kBi936GpV9QC-zzoJ82TlQoyz-P9BX95LB2FkPUCNYgo9OulmuXZIjLN
cache-control: public,max-age=31536000
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1734977910879279
content-length: 117007
server: UploadServer

GET
H2 200 cjs_min_6ef1802500d8367a80105e664862d0d7.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 49 KB
16 KB 40ms
39ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_6ef1802500d8367a80105e664862d0d7.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 56aea4e78cf1538541603e3c8f14b15dfc9bfee27cadb946f8b3017ebe8abe3b

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: etag, Content-Type
content-encoding: gzip
x-goog-hash: crc32c=6P9MLA==, md5=6BERCLAZEJG3E4hTDg5sSQ==
etag: "e8111108b0191091b71388530e0e6c49"
age: 156073
ad-auction-allowed: true
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 15758
date: Tue, 24 Dec 2024 11:18:23 GMT
last-modified: Wed, 06 Nov 2024 14:57:41 GMT
content-type: text/javascript; charset=utf-8
x-guploader-uploadid: AFiumC6oZx1Bgcc7hsP9qNJm9hcK9qGqcEyeKjPSvAv5em0-u20SMl3PGsZpv--xMjddU54u10Kbr10
cache-control: public,max-age=31536000,no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1730905061873049
content-length: 15758
server: UploadServer

GET b9263c6f-45c5-469f-acef-3bae1c010e2e
https://www.elfcosmetics.com/ Frame 0
0

GET
H2 200 PWA-UpdateSession Show response
www.elfcosmetics.com/mobify/proxy/controllers/on/demandware.store/Sites-elf-us-Site/en_CA/ 56 B
1 KB 468ms
467ms XHR
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.elfcosmetics.com/mobify/proxy/controllers/on/demandware.store/Sites-elf-us-Site/en_CA/PWA-UpdateSession
Requested by: Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: 772f15316085ec36cb19f9af3a622cf12d847e0f187c3f907ee6daf975b7f7ce

Request headers

c_x-pwa-request: true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

content-encoding: gzip
x-dw-request-base-id: lUo_qCj6bGcBAAB_
cf-cache-status: DYNAMIC
age: 0
expires: Thu, 01 Dec 1994 16:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: 9mpUFIQFti4UELa6zFAKtNrIfCc3fcel7TKWES557-3lv33aNr2-5g==
date: Thu, 26 Dec 2024 06:39:36 GMT
content-type: application/json
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348147 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-os: 200
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 22067fb5d7eb764108747a104222f50a.cloudfront.net (CloudFront)
cf-ray: 8f7f131cdba9cf66-CMH
x-yottaa-metrics: 3221a5fec665/[373,370,-] 32D1a5fec674/[-,375.615]
access-control-allow-origin: *
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/on/demandware.store/Sites-elf-us-Site/en_CA/PWA-UpdateSession
x-amz-cf-pop: DFW57-P1

GET
H/1.1 200
OK / Show response
data.cdnbasket.net/ 14 B
338 B 188ms
53ms XHR
application/json 34.120.191.180
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_6ef1802500d8367a80105e664862d0d7.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.191.180 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 180.191.120.34.bc.googleusercontent.com
Software: /
Resource Hash: 853651a449f827a0ef43b6f6bd1576f619256e7e9d60020c3ec0f8f12a19e1d5

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Expires: 0
Access-Control-Allow-Origin: *
Date: Thu, 26 Dec 2024 06:39:36 GMT
Content-Type: application/json
Access-Control-Allow-Headers: Origin, Content-Type, Accept

GET
H/1.1 200
OK / Show response
page.cdnbasket.net/ 14 B
338 B 191ms
53ms XHR
application/json 34.120.255.12
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://page.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_6ef1802500d8367a80105e664862d0d7.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.255.12 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 12.255.120.34.bc.googleusercontent.com
Software: /
Resource Hash: fe35c77c017b2b82e8607d672febc8c25fab2dda1b73f1ead6fb655ace3a8607

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Expires: 0
Access-Control-Allow-Origin: *
Date: Thu, 26 Dec 2024 06:39:36 GMT
Content-Type: application/json
Access-Control-Allow-Headers: Origin, Content-Type, Accept

GET
H/1.1 200
OK / Show response
view.cdnbasket.net/ 14 B
338 B 191ms
53ms XHR
application/json 34.117.175.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://view.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_6ef1802500d8367a80105e664862d0d7.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.175.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.175.117.34.bc.googleusercontent.com
Software: /
Resource Hash: a88b04c6028922191091e1e99b45742294f56636bfd0324263f123b2c8bc30c0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Expires: 0
Access-Control-Allow-Origin: *
Date: Thu, 26 Dec 2024 06:39:36 GMT
Content-Type: application/json
Access-Control-Allow-Headers: Origin, Content-Type, Accept

GET
H3 200 inbox-v2_75060a85c1a4aebcc6f779b9e84db722.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 19 KB
5 KB 20ms
20ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/inbox-v2_75060a85c1a4aebcc6f779b9e84db722.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 183ae143a7f66c133f3948bdf61a0a9f97eb326be7de5947c1f19b93f3b9db24

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: etag, Content-Type
content-encoding: br
x-goog-hash: crc32c=df/Fww==, md5=CihY9k4bsokmzU8kBOwKQw==
etag: "0a2858f64e1bb28926cd4f2404ec0a43"
age: 235366
ad-auction-allowed: true
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 5475
date: Mon, 23 Dec 2024 13:16:50 GMT
last-modified: Thu, 19 Dec 2024 20:55:14 GMT
content-type: text/javascript
x-guploader-uploadid: AFiumC40j9OnNhYKwWjZhNM1Ud36MXsfsFxOnAjOQHo1EF2IgofZsgn8Y0JLDa9XerU5FC4tRT8Xb6s
cache-control: public,max-age=31536000
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1734641714494708
content-length: 5475
server: UploadServer

GET
H3 200 onsite-v2_abbdf7a49be9b52b097917b7b527b262.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 16 KB
5 KB 21ms
21ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/onsite-v2_abbdf7a49be9b52b097917b7b527b262.br.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: a8b68b46f44aac34f59d2926e8db6bdae4bc3b7fe3aad60948e97f428b087531

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: etag, Content-Type
content-encoding: br
x-goog-hash: crc32c=YWhgXQ==, md5=E+t6bCqMhb3KnLqECwDbLA==
etag: "13eb7a6c2a8c85bdca9cba840b00db2c"
age: 129290
ad-auction-allowed: true
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 5039
date: Tue, 24 Dec 2024 18:44:46 GMT
last-modified: Mon, 23 Dec 2024 18:18:36 GMT
content-type: text/javascript
x-guploader-uploadid: AFiumC4zs9mR3DmGayWGzZWvuoLKlQa_RtpWhSOEY3k2jkpBs0HAnRCU0eTLrSzZFtiszubZ
cache-control: public,max-age=31536000
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1734977916309988
content-length: 5039
server: UploadServer

GET
H3 200 frontend-framework.js.bundle Show response
cdn8.eu.inside.chat//js/ 310 KB
60 KB 38ms
38ms Script
text/javascript 104.18.8.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn8.eu.inside.chat//js/frontend-framework.js.bundle?v=a741df0-5

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.8.17 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c56b64061c466dd911d957066c0e2fa6b9b5e15e3b887f38d7a2bff6bf1348ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "b3dc4c62828cfc4d4eb3792ee171d025"
age: 1266
expires: Fri, 03 Jan 2025 06:39:36 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 26 Dec 2024 06:39:36 GMT
content-type: text/javascript
vary: Accept-Encoding
priority: u=3,i=?0
strict-transport-security: max-age=31536000; includeSubdomains
cache-control: public, max-age=691200
cf-ray: 8f7f131d0c9336bf-YYZ
accept-ranges: bytes
content-length: 61640
server: cloudflare

GET
H2 200 ts
t.paypal.com/ 42 B
251 B 119ms
119ms Image
image/gif 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?pgrp=muse%3Aoffer%3A%3A%3A7PFGPLHGYKX72-1&page=muse%3Aoffer%3A%3A%3A7PFGPLHGYKX72-1%3A%3AvisitorInfoFlowStarted%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=3a9b41b4-1a0b-4488-939e-bc9b13368cc5&es=visitorInfoFlowStarted&mrid=7PFGPLHGYKX72&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&pt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1735195176514&g=480&completeurl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&disableSetCookie=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (dcd/7D67) /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
timing-allow-origin: *
paypal-debug-id: 7ac02e1205e25
pragma: no-cache
correlation-id: 7ac02e1205e25
expires: Thu, 26 Dec 2024 06:39:36 GMT
server-timing: traceparent;desc="00-00000000000000000007ac02e1205e25-1308dbaa3dfad6f3-01", content-encoding;desc="", x-cdn;desc="edgecast"
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
traceparent: 00-00000000000000000007ac02e1205e25-277c870fb3131d72-01
date: Thu, 26 Dec 2024 06:39:36 GMT
content-type: image/gif
vary: Accept-Encoding
server: ECAcc (dcd/7D67)

GET
H3 200 jquery-3.7.1.min.js Show response
assets.bounceexchange.com/assets/bounce/ 85 KB
30 KB 22ms
22ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/jquery-3.7.1.min.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: etag, Content-Type
x-goog-hash: crc32c=fsBEgw==, md5=LIctvmD0unD7hTVhE9izXg==
content-encoding: br
etag: W/"2c872dbe60f4ba70fb85356113d8b35e"
age: 70128
ad-auction-allowed: true
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 87533
date: Wed, 25 Dec 2024 11:10:48 GMT
last-modified: Mon, 23 Dec 2024 18:18:08 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
x-guploader-uploadid: AFiumC4CuHNDzzXTahzawQOMtmr9zKjiaHW7Ym4z5O4hfYnhU1gBR9QZpbr7zQwg-w2pj6yU_zw4sis
cache-control: public,max-age=31536000
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: none
access-control-allow-origin: *
x-goog-generation: 1734977888533613
content-length: 31013
server: UploadServer

GET
H3 200 negotiate Show response
www8.eu.inside.chat/signalr/ 391 B
577 B 161ms
132ms XHR
application/json 104.18.8.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.eu.inside.chat/signalr/negotiate?clientProtocol=2.1&k=IN-1011171%3A26525992-c3424497bc85442f587e1b74d7330d09686b0f0e2ff7b5f764544ea6ef212cda-5-5%3A142948733%3A1082574&c=cc7df85d7c0f2da7d98ca11ffe645510&nc=0&connectionData=%5B%7B%22name%22%3A%22insidesocialhub%22%7D%5D&_=1735195174990

Requested by

Host: cdn8.eu.inside.chat
URL: https://cdn8.eu.inside.chat/ig.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.8.17 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5910ed4f63adc538567e241d58c9ff4e9114f6e906bd5218330adf856554ab09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Accept: text/plain, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
expires: -1
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 26 Dec 2024 06:39:36 GMT
content-type: application/json; charset=UTF-8
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubdomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8f7f131dce8eab75-YYZ
access-control-allow-origin: https://www.elfcosmetics.com
server: cloudflare

GET
H3 200 ig.css
cdn8.eu.inside.chat// 13 KB
4 KB 38ms
38ms Stylesheet
text/css 104.18.8.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn8.eu.inside.chat//ig.css?dev=2&_a741df0-5

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.8.17 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

097ece141436f930315dd1ef80c15e89a1a1bc2eaaf634e96d4d53c1b0d07cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "467ac5f0ff9ddafc490fa480f5fdb10b"
age: 2935
expires: Fri, 03 Jan 2025 06:39:36 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 26 Dec 2024 06:39:36 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=31536000; includeSubdomains
cache-control: public, max-age=691200
cf-ray: 8f7f131d9ce536bf-YYZ
accept-ranges: bytes
content-length: 3743
server: cloudflare

POST
H2 200 act
analytics.tiktok.com/api/v2/pixel/ 0
880 B 83ms
80ms Ping
text/plain 23.212.248.145
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel/act
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWE1OTI4NzI4MQ.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.248.145 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-212-248-145.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

x-cache-remote: TCP_MISS from a104-78-78-85.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Thu, 26 Dec 2024 06:39:36 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=17, origin; dur=29, inner; dur=25
x-cache: TCP_MISS from a23-220-104-143.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
date: Thu, 26 Dec 2024 06:39:36 GMT
x-akamai-request-id: 44886b5f.861dde70
access-control-allow-headers: Authorization,*
x-tt-trace-host: 01c6924f8812bfc1a214d7532ab5d94386519f0ba61c3416836a525e653c0d239e932e903aeb72dde4e499c21e9dd84f9778e215fa5c9750c63400397c7787a93ce068d3c4441a1bc4307b74420dc42ee825a08a4a6813cec7acb3771195c745b7916ddfa5af03cd6f71505bf1f5c73c1e
x-origin-response-time: 29,104.78.78.85
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-2412260639360677872499DB8EBF1935-25F2DB503EC1ACA4-00
content-length: 0
x-parent-response-time: 37,23.220.104.143
x-tt-logid: 202412260639360677872499DB8EBF1935
server: nginx

GET
H2 200 local_storage_frame17.min.html
assets.bounceexchange.com/assets/bounce/ Frame DF43 0
0 57ms
20ms Document
text/html 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/local_storage_frame17.min.html
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

accept-ranges: none
access-control-allow-origin: *
access-control-expose-headers: etag Content-Type
ad-auction-allowed: true
age: 144424
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=31536000
content-encoding: br
content-length: 938
content-type: text/html; charset=UTF-8
date: Tue, 24 Dec 2024 14:32:32 GMT
etag: W/"fc893948c3efc689b5b19d8a77958e23"
last-modified: Mon, 23 Dec 2024 18:18:07 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-generation: 1734977887138096
x-goog-hash: crc32c=kX4cqg== md5=/Ik5SMPvxom1sZ2Kd5WOIw==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 2408
x-guploader-uploadid: AFiumC5dpgjK-4MFK3IBHz_dQ0OyzBLhvqfDbSrqlM3wdVy0tl613XxiLue_5O_aITCeJ55xfh7F9CA

GET
H2 200 lookup Show response
pd.cdnwidget.com/ 74 B
288 B 119ms
55ms XHR
application/json 34.149.130.207
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://pd.cdnwidget.com/lookup?deviceID=undefined&bxwid=6664&bxdid=4611971811262855021&visitID=1735195176727101&enableUID2=false
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main-v2_ebe451a946893ac92b8458b147333165.br.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.130.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 207.130.149.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: f309b4b6297e8c886d8d6b1ff31decc2d09f6eecf7804e3325bf5a2d3a5eac55

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-envoy-upstream-service-time: 4
x-envoy-decorator-operation: id-resolution.id-resolution.svc.cluster.local:9000/*
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74
date: Thu, 26 Dec 2024 06:39:36 GMT
content-type: application/json
server: istio-envoy

GET
H3 200 bframe
www.google.com/recaptcha/api2/ Frame ABE0 0
0 53ms
52ms Document
text/html 173.194.66.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&k=6LcA2G4UAAAAAK-fHuRDYBsNQoJlqlDqQvrjGwQu

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.66.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qo-in-f103.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dU5c0YTyjNxjRdXL3zzOLA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-dU5c0YTyjNxjRdXL3zzOLA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 26 Dec 2024 06:39:36 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 heap_config.js Show response
cdn.us.heap-api.com/config/1042782804/ 1 KB
1 KB 131ms
33ms Script
application/javascript 3.162.103.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.us.heap-api.com/config/1042782804/heap_config.js

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.162.103.107 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

145b6536261490a3596321cd3c1018019dfa2bf0b2ea1cf93102d62c6bcdfaaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

content-encoding: gzip
etag: W/"4b9-qBnRNqbCCHyoP3Fnv6+2CqKIT1s"
age: 120
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: W8czwg8rVeqTbYi3-yyqYPFwZfqNxwuwfDIkqlCMk0Dn3eUGyBboKQ==
date: Thu, 26 Dec 2024 06:37:41 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=120
cross-origin-resource-policy: cross-origin
via: 1.1 eb9a7c491927f70f3921f0803caae61c.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD61-P1
x-powered-by: Express
server: nginx

GET
H2 200 init1.js Show response
api.bounceexchange.com/bounce/ 77 KB
15 KB 213ms
56ms Script
text/javascript 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.bounceexchange.com/bounce/init1.js?wklzs=941&wklz=C4ewVgigvAZgrgOwMbAJYgQMhQZygRgHYBmAVnwE5zCA2ADls2AC8QoAWOgBkwHcBTAEY5UwfgH1UAEyg057TACd+OEABs4aDARpcuAD3wAmPUv4x+i5YqjYAhmrWoEAc3FxFaqAAtgwAA44AKTEAIJBRgBiEZG8cQB0-GowSCA4ALb8aEg48anpMfwI4gDC4VFJMAC0qRlZqEg1iqjpzg44mABuqCLA4qkgANao-FBBhABCEUZq-tMh5Ua+AcFGpGERpFGbUXG8icm1mdm5+TuRRaXlWxfJNWnHDU0tbWqrRhEl04rzG0Yf-3GABFsCAhiMxpNpjheJ1fqEYO1+J9plJpPDpuwaPhKIR8HQcUYaEY6KRSFwjPh5kYvv9ulJ4UQyJRqDRCEY8VwqTTpnDARsof81CAXC5+FJJAh4Yi3sief9+J1LOJhaLxZLpUiUf8kHZFH0AI7AACe8K42qMODgglafnVGF6co+YRlODltJmIrFEuckikRTQMBGDP5CK18qMuv1mtlFqjfU6DjgToWruRhCBFv8UkiqEUOGAABkQHYQ87QsBFMmLVIXBjBUYegAFZTdEBwHAlDugTI-UNpi09ADK1pwSGagksMbdg5wABV+PpgCPhOPUJO++WBxHdUhvBJgO8FkzyFQiPRaMDgV09TgANqq72SgC6sCRN-zd8Vysf6ucr7TD973jcQjWNV8eETT8rRtUQxAlB1RH4AD3yg+9fx9YppADVAg3FFDZSAu94wIt0iJAxMNGQt9CLQu9-DsMVxBNfxqMAzp-RgB8vT-LD-QQQNg1I-guk44i9QTJM2PfAZhgPMEVT1MUaLIwR-CgHgsnUu8ACJ4x0gAaPS7DEFwQEUY1DL0-ckEGdtgCs7wQEyKz-EUEApDgFArLdPU9x059MH8Q9bHyfwnDsZAJBgNRGNsTpvDsKAgA
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: da42d3f53e2ab3e6a6fbe2eb97e532fdef907dcefa9bf9d3120487a428a57aad

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
content-encoding: gzip
pragma: no-cache
x-envoy-upstream-service-time: 19
x-envoy-decorator-operation: legacy-api-tier1.legacy-api.svc.cluster.local:80/*
via: 1.1 google
expires: 0
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 26 Dec 2024 06:39:37 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H3 204 collect
analytics.google.com/g/ 0
0 44ms
42ms Fetch
text/plain 173.194.205.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZLYXLXNDL8&gtm=45je4cc1v879088318z8896608294za200zb896608294&gcs=G111&gcd=13v3v3v3u5l1&npa=1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=606766695.1735195175&ul=en-ca&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=MA&_s=2&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&sid=1735195174&sct=1&seg=0&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&tfd=7366
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZLYXLXNDL8&l=dataLayer&cx=c&gtm=45He4cc1v896608294za200
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 173.194.205.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: qm-in-f138.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.elfcosmetics.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: text/plain
server: Golfe2

POST
H2 200 event Show response
www.elfcosmetics.com/api/en-ca/v2.0/ 105 B
675 B 264ms
262ms Fetch
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/api/en-ca/v2.0/event?locale=en-CA

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/main.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

/ Express

Resource Hash

174aa1201610a00cb23e9895c186fb9d78be70ee4722c6fab47c78f399f94786

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: application/json
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

content-encoding: gzip
x-amzn-remapped-connection: keep-alive
etag: W/"69-JtYV9zrWQ9DcXrFDaZOyN9RzpZo"
age: 0
x-content-type-options: nosniff
x-amzn-requestid: a7611b17-5196-4100-a475-d7a503401a17
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348150 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-os: 200
x-amz-apigw-id: DYwGhFwaPHcEcgg=
x-amzn-remapped-date: Thu, 26 Dec 2024 06:39:37 GMT
x-amzn-trace-id: Root=1-676cfa29-62e9080732dc07051b0b2882
x-yottaa-metrics: 3221a5fec663/[198,196,-] 32D1a5fec674/[-,200.726]
access-control-allow-origin: *
content-length: 110
x-powered-by: Express

GET
H2 200 BestofBeauty_2023
cdn.media.amplience.net/i/elfcosmetics/ 3 KB
3 KB 48ms
46ms Image
image/avif 2606:4700:4400::6812:20dd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/BestofBeauty_2023?%24Desktop%24=&fmt=auto&w=70

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:20dd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b8754d5335c7e31fcbee1892acc922277ff94159ad636a1ae461dc194a3b562

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
age: 51347
x-amp-source-width: 421
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:37 GMT
edge-control: max-age=86400
content-type: image/avif
last-modified: Tue, 24 Dec 2024 16:50:17 GMT
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: uSvzJWS7G,l4p5bDg2e,mF-g78ke7,Pkjy1BsHj,WepA0szpz
cache-control: s-maxage=86400, max-age=1800
x-req-id: m54JOF7cl-
x-amp-source-height: 422
x-amp-cf-worker: true
cf-ray: 8f7f13229da8a320-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2927
x-amp-published: Tue, 19 Sep 2023 21:22:09 GMT
x-amp-srv: CF
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 badge-gone-viral
cdn.media.amplience.net/i/elfcosmetics/ 2 KB
2 KB 39ms
39ms Image
image/avif 2606:4700:4400::6812:20dd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/badge-gone-viral?%24Desktop%24=&fmt=auto&w=70

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:20dd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

921bb8f806f6d01af44b3ddd672999e5ff531a0036bdc5f5cac08e905031ea72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
age: 30628
x-amp-source-width: 1404
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:37 GMT
edge-control: max-age=86400
content-type: image/avif
last-modified: Wed, 25 Dec 2024 13:18:13 GMT
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: qFWsiGBc3,l4p5bDg2e,mF-g78ke7,3i2hWg6BQ,WepA0szpz
cache-control: s-maxage=86400, max-age=1800
x-req-id: aO6T6Co34v
x-amp-source-height: 1404
x-amp-cf-worker: true
cf-ray: 8f7f13229da9a320-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1929
x-amp-published: Thu, 30 May 2024 19:09:02 GMT
x-amp-srv: CF
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 new-9FAEE5
cdn.media.amplience.net/i/elfcosmetics/ 722 B
1 KB 39ms
38ms Image
image/avif 2606:4700:4400::6812:20dd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/new-9FAEE5?%24Desktop%24=&fmt=auto&w=22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:20dd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8df9e9875419d2c0d1bc8af23e63949a7e20b1ff5cd2f57c7958fc65a7be8b56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
age: 46235
x-amp-source-width: 112
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:37 GMT
edge-control: max-age=86400
content-type: image/avif
last-modified: Wed, 25 Dec 2024 10:02:42 GMT
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: oKdLC1Xh7,l4p5bDg2e,mF-g78ke7,tJjh4FgGa,WepA0szpz
cache-control: s-maxage=86400, max-age=1800
x-req-id: v9vJMyEqlX
x-amp-source-height: 96
x-amp-cf-worker: true
cf-ray: 8f7f13229daba320-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 722
x-amp-published: Thu, 30 May 2024 19:09:02 GMT
x-amp-srv: CF
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 staffPicks-white
cdn.media.amplience.net/i/elfcosmetics/ 656 B
833 B 42ms
42ms Image
image/avif 2606:4700:4400::6812:20dd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.media.amplience.net/i/elfcosmetics/staffPicks-white?%24Desktop%24=&fmt=auto&w=22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:20dd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b02a020f88f0cd42fad80078f958d9a87a2f83cee756d5fb426a40bc9823da92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cf-cache-status: HIT
age: 21769
x-amp-source-width: 112
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 26 Dec 2024 06:39:37 GMT
edge-control: max-age=86400
content-type: image/avif
last-modified: Wed, 25 Dec 2024 12:36:14 GMT
vary: Accept-Encoding
x-frame-options: DENY
edge-cache-tag: QuKXbP_B9,l4p5bDg2e,mF-g78ke7,4MizThq0Q,WepA0szpz
cache-control: s-maxage=86400, max-age=1800
x-req-id: dDg560Qbif
x-amp-source-height: 96
x-amp-cf-worker: true
cf-ray: 8f7f13229daca320-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 656
x-amp-published: Thu, 09 Nov 2023 14:42:35 GMT
x-amp-srv: CF
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 83567_OpenA_R.jpg
www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dw84c47c19/2023/HaloGlowLiquidFilterSHADEEXT/ 5 KB
6 KB 71ms
68ms Image
image/jpeg 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dw84c47c19/2023/HaloGlowLiquidFilterSHADEEXT/83567_OpenA_R.jpg?sfrm=png&sw=252
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: be1fd6510a54a2f5c0add06d69866193c1989bef789913b5166e5435ff5a5b2e

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 4115654
x-amz-storage-class: INTELLIGENT_TIERING
x-cache: Miss from cloudfront
x-amz-cf-id: p3rrH7wf4iJn2Cecf36L0xfCsE9jBXAL3JZ7xhR11D_6GsHDzVkPSg==
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/jpeg
x-amz-meta-cleanquerystring: sfrm=png&sw=252
x-amz-expiration: expiry-date="Sun, 20 Apr 2025 00:00:00 GMT", rule-id="transform_cache_ttl"
x-yottaa-optimizations: ob/101 si/32D1a5fec674-1730834775-4322718826 tts/1731079396337 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-forcecache: true
cache-control: public, max-age=31104000
via: 1.1 68914922a694954838e87fc9b0aa10fe.cloudfront.net (CloudFront)
cf-ray: 8df691478ef6e54e-DFW
x-yottaa-metrics: 3221a5fec61f/[7,-,1731079440587] 32D1a5fec674/[hit]
access-control-allow-origin: *
content-length: 5156
x-amz-cf-pop: SFO53-C1
x-amz-server-side-encryption: AES256

GET
H2 200 84823_Open_A_R.jpg
www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dw8bd27906/2020/ 3 KB
3 KB 75ms
72ms Image
image/jpeg 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dw8bd27906/2020/84823_Open_A_R.jpg?sfrm=png&sw=252
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: 98c0276c0d23a127810147d4166a65d77423be1425e3ab89b52e841cc47dde92

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 4114800
x-cache: Miss from cloudfront
x-amz-cf-id: 99SYJGIwQ39Z_-OCnjkRmFGhziihPPIcdaCFEedwOdQuVBE-EFtfWA==
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/jpeg
x-amz-meta-cleanquerystring: sfrm=png&sw=252
x-amz-expiration: expiry-date="Mon, 16 Dec 2024 00:00:00 GMT", rule-id="transform_cache_ttl"
x-yottaa-optimizations: ob/101 si/32D1a5fec674-1730834775-4322727216 tts/1731079396337 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-forcecache: true
cache-control: public, max-age=31104000
via: 1.1 dac715481713fd87ba1460d2185ab6e2.cloudfront.net (CloudFront)
cf-ray: 8df690f8efa42e24-DFW
x-yottaa-metrics: 3221a5fec620/[5,-,1731079428019] 32D1a5fec674/[hit]
access-control-allow-origin: *
content-length: 2865
x-amz-cf-pop: DFW57-P9
x-amz-server-side-encryption: AES256

GET
H2 200 83048_OPEN-A_v4_R.jpg
www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dw073dd3db/2024/GlowReviverGLIMMERS/candycoded/ 4 KB
4 KB 123ms
120ms Image
image/jpeg 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dw073dd3db/2024/GlowReviverGLIMMERS/candycoded/83048_OPEN-A_v4_R.jpg?sfrm=png&sw=252
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: 42a11e5e4cf5cfddc24c7fadff68da57e01a48be90df1ff5bd18813b83c763bc

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 2919221
x-amz-storage-class: INTELLIGENT_TIERING
x-cache: Miss from cloudfront
x-amz-cf-id: -QeuqKNQ5NRhvH_iXYrmLztTCd0uxqMD0N9-pYju9JKBPPeSoO8Gnw==
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/jpeg
x-amz-meta-cleanquerystring: sfrm=png&sw=252
x-amz-expiration: expiry-date="Mon, 22 Dec 2025 00:00:00 GMT", rule-id="transform_cache_ttl"
x-yottaa-optimizations: ob/101 si/32D1a5fec674-1732227525-7160364239 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-forcecache: true
cache-control: public, max-age=31104000
via: 1.1 a1ee2f3d4ad7afa58c3219e56c8cd250.cloudfront.net (CloudFront)
cf-ray: 8e68464af9f447fd-DFW
x-yottaa-metrics: 3221a5fec661/[6,-,1732271745769] 32D1a5fec674/[hit]
access-control-allow-origin: *
content-length: 3894
x-amz-cf-pop: DFW57-P9
x-amz-server-side-encryption: AES256

GET
H2 200 84562_LPSTK_OpenA_R.jpg
www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dwc22087ab/2020/ 3 KB
4 KB 123ms
121ms Image
image/jpeg 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dwc22087ab/2020/84562_LPSTK_OpenA_R.jpg?sfrm=png&sw=252
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: 13fd9cfcb9f0d659ae31b8d72c4248fd3adb0bef631db1685f08aa170ba182f8

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 4114408
x-cache: Miss from cloudfront
x-amz-cf-id: wpmn5hBseF0zZH9Es_G32FcUiNnPB3Zn51vzh6IIDYB3WivhwsMkeg==
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/jpeg
x-amz-meta-cleanquerystring: sfrm=png&sw=252
x-amz-expiration: expiry-date="Mon, 23 Dec 2024 00:00:00 GMT", rule-id="transform_cache_ttl"
x-yottaa-optimizations: ob/101 si/32D1a5fec674-1730834775-4322731238 tts/1731079396337 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-forcecache: true
cache-control: public, max-age=31104000
via: 1.1 bd414f5f75d6893558dff609c5ff1fe6.cloudfront.net (CloudFront)
cf-ray: 8df693d04b73e867-DFW
x-yottaa-metrics: 3221a5fec65e/[5,-,1731079544458] 32D1a5fec674/[hit]
access-control-allow-origin: *
content-length: 3207
x-amz-cf-pop: SFO53-C1
x-amz-server-side-encryption: AES256

GET
H2 200 57150_SCSET_InPack_R.jpg
www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dw8f3b9a0b/2022/HolyHydration!NewPackaging/ 9 KB
9 KB 127ms
124ms Image
image/jpeg 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dw8f3b9a0b/2022/HolyHydration!NewPackaging/57150_SCSET_InPack_R.jpg?sfrm=png&sw=252
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: b890e9a79e66ed421d732490a8b8dfdafbc1a820455ab3947b3c506b777d69d6

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 4115167
x-cache: Miss from cloudfront
x-amz-cf-id: TS6d0ccNsBJo05j1DxPo4JG38gBTn3Qv9wBgZBToRIlp6CGGHlrBSA==
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/jpeg
x-amz-meta-cleanquerystring: sfrm=png&sw=252
x-amz-expiration: expiry-date="Mon, 09 Dec 2024 00:00:00 GMT", rule-id="transform_cache_ttl"
x-yottaa-optimizations: ob/101 si/32D1a5fec674-1730834775-4322724303 tts/1731079396337 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-forcecache: true
cache-control: public, max-age=31104000
via: 1.1 0f4013a0af68dcba176ca4372e470df4.cloudfront.net (CloudFront)
cf-ray: 8df693859ef447a6-DFW
x-yottaa-metrics: 3221cc02d142/[6,-,1731079532488] 32D1a5fec674/[hit]
access-control-allow-origin: *
content-length: 8751
x-amz-cf-pop: SFO53-C1
x-amz-server-side-encryption: AES256

GET
H2 200 57521_Closed_V2_R.jpg
www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dw7e1843f5/2024/BronzingDrops/ 3 KB
4 KB 136ms
134ms Image
image/jpeg 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.elfcosmetics.com/dw/image/v2/BBXC_PRD/on/demandware.static/-/Sites-elf-master/default/dw7e1843f5/2024/BronzingDrops/57521_Closed_V2_R.jpg?sfrm=png&sw=252
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),
Reverse DNS
Software: /
Resource Hash: d7d82c12abcf865ac1e4e07441925991141d54c9d6454702553e17b91f119065

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 4115482
x-amz-storage-class: INTELLIGENT_TIERING
x-cache: Hit from cloudfront
x-amz-cf-id: wXHECGT-bJw_cb9ZbuSRKPwhU9Drfw_cdlws8LEuIGTU1Yn1V-Tvrw==
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/jpeg
x-amz-meta-cleanquerystring: sfrm=png&sw=252
x-amz-expiration: expiry-date="Mon, 12 May 2025 00:00:00 GMT", rule-id="transform_cache_ttl"
x-yottaa-optimizations: ob/101 si/32D1a5fec674-1730834775-4322720782 tts/1731079396337 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
x-yottaa-forcecache: true
cache-control: public, max-age=31104000
via: 1.1 83145dec40eefa09519caf823858554e.cloudfront.net (CloudFront)
cf-ray: 8df694ce890b6bec-DFW
x-yottaa-metrics: 3221a5fec621/[6,-,1731079585073] 32D1a5fec674/[hit]
access-control-allow-origin: *
content-length: 3519
x-amz-cf-pop: DFW57-P9
x-amz-server-side-encryption: AES256

GET
H2 200 ts
t.paypal.com/ 42 B
252 B 121ms
120ms Image
image/gif 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?pgrp=muse%3Aoffer%3A%3A%3A7PFGPLHGYKX72-1&page=muse%3Aoffer%3A%3A%3A7PFGPLHGYKX72-1%3A%3AvisitorInfo%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=3a9b41b4-1a0b-4488-939e-bc9b13368cc5&es=visitorInfo&cust=9TG8HQ6LLAJMU&mrid=7PFGPLHGYKX72&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&pt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&unsc=6&identifier_used=DFP&e=im&t=1735195177376&g=480&completeurl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&disableSetCookie=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (dcd/7D85) /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
timing-allow-origin: *
paypal-debug-id: b3dcc0272e7c5
pragma: no-cache
correlation-id: b3dcc0272e7c5
expires: Thu, 26 Dec 2024 06:39:37 GMT
server-timing: traceparent;desc="00-0000000000000000000b3dcc0272e7c5-085d2e6f8355964f-01", content-encoding;desc="", x-cdn;desc="edgecast"
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
traceparent: 00-0000000000000000000b3dcc0272e7c5-2d784fc73ce97c5e-01
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/gif
vary: Accept-Encoding
server: ECAcc (dcd/7D85)

GET
H2 200 c Show response
ids.cdnwidget.com/ 442 B
781 B 212ms
61ms XHR
application/json 2600:1901:0:56e0::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ids.cdnwidget.com/c?cookieID=&deviceID=&iv=&v=&GCH1=&SCH1=&GCS1=106252081&GCS2=MTcyLjE3LjAuNiwxMC4xLjE3LjI1MCxmZGJmOjFkMzc6YmJlMDo6MTc6MTo6ZmEsZmRiZjoxZDM3OmJiZTA6OjE3OjE6OmZh&pe=false&wsid=6664&varID=&varData=undefined&log=%7B%22config%22%3A%7B%22gmEN%22%3Atrue%2C%22pixEN%22%3Afalse%7D%2C%22apikey%22%3A%222%5EHIykD%22%2C%22cjsversion%22%3A%221.5.9%22%2C%22wsid%22%3A6664%2C%22loadID%22%3A%223DqlDnqVsNCU7RR%22%2C%22timing%22%3A%7B%22sessionStorageLoad%22%3A10%2C%22IDStageStart%22%3A11%2C%22netComplete%22%3A150%2C%22obsReqdata%22%3A207%2C%22obsReqpage%22%3A207%2C%22obsReqview%22%3A208%2C%22IDStagePrefire%22%3A208%7D%2C%22matches%22%3A%7B%22cookie%22%3Afalse%2C%22LS%22%3Afalse%7D%2C%22info%22%3A%7B%22isSpoofed%22%3Atrue%2C%22PM%22%3Afalse%2C%22DNT%22%3Afalse%2C%22deviceTimezone%22%3A-8%2C%22extensionID%22%3Anull%2C%22externalID%22%3Anull%2C%22agent%22%3A%7B%22device%22%3Anull%7D%2C%22firstLoad%22%3Atrue%7D%2C%22deviceid%22%3A%224611971811262855021%22%2C%22visitid%22%3A%221735195176727101%22%7D
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_6ef1802500d8367a80105e664862d0d7.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:56e0:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software: /
Resource Hash: dbe2d652a2921bd02c6e26b5a2daf2902ff911dd1bc862c18eab4fa4ac251a96

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.elfcosmetics.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 442
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: application/json
vary: Origin

GET
H2 200 heap.js Show response
cdn.us.heap-api.com/v5/heapjs-static/5.2.5/core/ 307 KB
77 KB 38ms
37ms Script
application/javascript 3.162.103.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.us.heap-api.com/v5/heapjs-static/5.2.5/core/heap.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.103.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-103-107.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 83ad7afbc0337725d1ebd2d6dc111178686ca59eac905d4f173d08e3e3c561f7

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-amz-cf-pop: IAD61-P1
content-encoding: gzip
etag: W/"15e5efdde56dc76b8a2976b750f8ef64"
age: 1789
cross-origin-resource-policy: cross-origin
via: 1.1 eb9a7c491927f70f3921f0803caae61c.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: gOdwzhwA1gkBRluOWWEmZ8IwuvfrD-kcAlZPYu0Vp7Xq1Bct-8140A==
date: Thu, 26 Dec 2024 06:09:49 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
server: AmazonS3
last-modified: Mon, 16 Dec 2024 19:15:27 GMT
x-amz-server-side-encryption: AES256

GET
H3 200 creatives-base-styles.a53944a2.min.css
assets.bounceexchange.com/tag/css/ 37 KB
6 KB 22ms
20ms Stylesheet
text/css 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/tag/css/creatives-base-styles.a53944a2.min.css
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 286a9eb90b3236f3c77e9cd147b524d542d53ba83973de175c45be3eb1147805

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: etag, Content-Type
content-encoding: gzip
x-goog-hash: crc32c=lLRhfg==, md5=VPYb3L+2+BQnyKaAP0iwLw==
etag: "54f61bdcbfb6f81427c8a6803f48b02f"
age: 239224
ad-auction-allowed: true
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 6053
date: Mon, 23 Dec 2024 12:12:33 GMT
last-modified: Tue, 13 Dec 2022 17:12:22 GMT
content-type: text/css
vary: Accept-Encoding
x-guploader-uploadid: AFiumC4VLtQKOs80CHUundmLIwIWOMe7X1dpXgb5_BoO42HyE8eYz5ArUQYl0XNlXlnj9qxHLSvLw_w
cache-control: public,max-age=31536000
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670951542233151
content-length: 6053
server: UploadServer

GET
H2 200 visit
events.bouncex.net/track.gif/ 42 B
96 B 143ms
39ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/visit?wklz=G4SwziAuBcCuYFMBOBDA5ggdpAvAWQHsAvEAG1JQFIAmAMQFYA6ABhuYAoAZETWAD0oBmAEJsAgpgAmSAiElsAjKxFsA0gEpxABy2kEAdQQAjVVBoNBAdkaCAbG3aqAEgBU8nGgGE2pEAGsENgBxBABjPwJNamZPAAsZAFtAugVqAA4WRltbBUFGNLS2QiMyZOYAZRQAMxQkEHN6KxtbADJQCBgkBCrkLqQcNvAoaAopHjQtdARYJFIcWMhILTAaRrFVug3aAHddxgRSKtCCMCTIEFCwRmOErawAfU916no6A6qAWmPThHPQr7qCR4KFIYEGHWgXTABFIsHOBEwfBwClszGY4OGUJhcJACIAnsjouj2sNQvBIAQEsBaiAUEY9GAcJRLKJqNRSAQ0BhJPceDRqEJntQaqDkgLqN42QhgMh7hyuQgeXy2YL+SLEPyvPzQrVIPcAI6QPGawRC1gqiX8sCwIxAxaK+4Ijpi1Vs9Uuy1s+Xc3mYXmSLDnKogRUmoXuzWe6g6pCQMNqkEai2S6O6+7U2Eu00J0WRlOTDD3I1aLPhxMuywAEQxMGOBD8IaZLKt22AYYjUckcnjbIALDkFABOSwKNIKVK2dL0ejMagKPP80DyFWmhSWQT0IebyyWZi2HeWXtatltlfrZtV4-ULSSWggJBgSCcAgoZcC02QJCwZIpyRoePNmy4AAApdKABDwJ45KUsg7blle4DlDaYChHURiwWeHYpuALgIHwkBIUYKFoRh75iFh2ooKEsQIEWKxnmuG5bmuthpJY9iXlGVTAHGDHrpug7bpYV4oAQYbmimpBaD21ALEs9FrFsWy7Ns+yHN8ZwXFcNx3H6Tx3IcXwnJp-yoSAQKYImC5sig9FkRJi5aKeZHzp2MnScm-JIDJ1nRjxYaMQJQlXhAb6Ch8rkpmgqFhoI4oprcZ4OV6-l8UxglrsJUY6gkkwgGgmB2aqgFsux1CDr2hRnsyrLUMAzmCsl7KpS5-HMTuzKVle1Dsb2ghsQBtX1eJV6kC1gqBe1wmXjN1bwMgUzYNARgyNsiD9HEiQIC082oBgS0yg+uKYISGTMFkOR5AUO3rYtMC6CgkBVAQSAJDgEjSLIkg3Qt+0wAGoChL8eIljgWixAi21ko+MFINAsS2ccmCHZAio4OiGAENAxywNgSB4scAY4E8LSY9jEF4wTBABoIxNiAAcqTCBYzjlOWUkxMoJZkgoEzWNdGgx04AAip4fOQgggsIuzCAi9+6GhOLoRQAShB4wgILi1oJyQCChOy04prixQ5yQLARO9kw9DGwigtm0THzrlkSsIucmCBvrOD02ILRdByr6eCguUoPlhUAGrUOjLQJNTsvotsxjOnIODZLYvY1snk0ZTue4HunAMXAgyf9uOw6juO1CTmk06zgoLQFtKIbbJnLSIPq36YEDyfoqEviBucSSPkHWjIm12frmkrS9yG2AoFoICHRACI4LraCCC0BdA2DLSQLE948pMsZ4vcMN7bRXZgHSeiSDg7o70QBA4JV6LQjMW8J0YLR3Tgu1AA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
x-envoy-upstream-service-time: 0
x-envoy-decorator-operation: event-collector.event-collector.svc.cluster.local:80/*
via: 1.1 google
expires: Tue, 01 Jan 2001 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/gif

GET
H2 200 pageview
events.bouncex.net/track.gif/ 42 B
96 B 143ms
39ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/pageview?wklz=A4Qw5gpgbglhDuAuArgJwDYF4AWAXXwAzgKQDMAgsQEwBi1N8jAdBOgGYDGA9oQLYS4YHQk2696EAHYB9AMKVarNgFpufAUNWoYvGJJDpCAMlCRYCRB2SFcXXlBDaQAI3QRCmYgHYAQtSroXGCQACbSev5kClRsBoQQkVSy-tAQqNKBwRBhEVRUUf6xhgl51Ml5HI640gCOuACekRT+AAyJ5VSEyM66+NnSXJKEMLgl+c15RfHt-pmh4TIwIVKCbHAhTdFTY2X+lai4m4VxO0l7VdIO6Mg7EzEnM3mmENINwLdbD6VeACIm4NA4EhuFwANZwYYALwgmAAbABGFr-MxAywgSSDIQGHD4IgFWj0RjwFjsNT8QTCUR2CQyeQSdiqHjkzQcbS6fSGZGAiwg8EvWxcDKOSCYbZc8zArhguCvervTCkYCc54SyxSvnSKEwqgAVj1RjEwEsvGAmCRhsQuA4bDNBrsRuspvN9sQYGATqMqFYXBAIVkIBNIBgYCGADUqLbeFxlrb4BBnMNRks4bDYQAWIywRPJ+FeUg6+EATgLXi8LVhpa8GeWsA4EGTaYRRa88IAHPD4VRYVRW3qWlR4eKgTmjPEajdJHWRxx0HBJPgdO5cAHTbn80WS3nW62DbOViBgDAoGlhoNMMuwKQjDWhDDgEZcNgYKgwqADvVNbZUADpCEYIQXDcEJRROB9IS4TA01bJFCC4NA60wONnCMAF50waw0iAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
x-envoy-upstream-service-time: 0
x-envoy-decorator-operation: event-collector.event-collector.svc.cluster.local:80/*
via: 1.1 google
expires: Tue, 01 Jan 2001 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/gif

GET
H3 200 start Show response
www8.eu.inside.chat/signalr/ 25 B
276 B 132ms
132ms XHR
application/json 104.18.8.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.eu.inside.chat/signalr/start?transport=webSockets&clientProtocol=2.1&k=IN-1011171%3A26525992-c3424497bc85442f587e1b74d7330d09686b0f0e2ff7b5f764544ea6ef212cda-5-5%3A142948733%3A1082574&c=cc7df85d7c0f2da7d98ca11ffe645510&nc=0&connectionToken=9jUdcpWdhQckAel8CSCYKASCFRDBOkYaSfRfiIdisCZF0R9ik0%2Fa%2Flc3iYzMgXMtw5%2Bb1X%2FeffrTP5XxPgQ9Upmxfz42PkaA0ENdgtbzr4Axv2n%2BgaT9bAs5umQvhfNy&connectionData=%5B%7B%22name%22%3A%22insidesocialhub%22%7D%5D&_=1735195174991

Requested by

Host: cdn8.eu.inside.chat
URL: https://cdn8.eu.inside.chat/ig.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.8.17 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c50a0366bab0d95bd0dfbbf67ed889b5fd383ee7464a77660088c32e4ef91c20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.elfcosmetics.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Accept: text/plain, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
expires: -1
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: application/json; charset=UTF-8
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubdomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8f7f1322c9cbab75-YYZ
access-control-allow-origin: https://www.elfcosmetics.com
server: cloudflare

PATCH
H2 200 be43e8b7546102ce7129234d14 Show response
www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/baskets/ 3 KB
2 KB 239ms
237ms XHR
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/mobify/proxy/ocapi/s/elf-us/dw/shop/v21_3/baskets/be43e8b7546102ce7129234d14

Requested by

Host: cdn-fsly.yottaa.net
URL: https://cdn-fsly.yottaa.net/5a0c9b7632f01c35d4210220/www.elfcosmetics.com/v~4b.aa/mobify/bundle/12898/vendor.js?yocs=Z_14_1K_

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

4359cf2b6cd5d9c87a0aab3e1da91b271cc9e1321f34994dc112ade313b07b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmN2YwN2I5ZC03MWUxLTQ2YTYtOGM3Yi02Y2UzYmQ4NjU1MzQiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmMwYTJjMzRhLWY2ODktNGUzNS1iYzFkLTU1NTc2MjYwYWM0NyIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MzUxOTUxNDMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmFjd1hhRmtLa1hsZWNSeEh3Mm1xWVl4cmtaOjpjaGlkOmVsZi11cyIsImV4cCI6MTczNTE5Njk3MywiaWF0IjoxNzM1MTk1MTczLCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDMxMzg2OTk1MDcwNTc0MTIzNyJ9.XA9lk1NsAjgienfZh-M_p_0MSOgqgITDo_ITDeBNpSuKGREwqE2cADvSoQcSPl_Dhtbu7hehGdzLJB66qB2tOg
x-dw-client-id: f9f7052a-f742-4c38-bdf5-1da004e7fb3b
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
c_x-pwa-request: true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
content-type: application/json

Response headers

x-dw-resource-state: 5a76e1bf224c3493c62356ea75f89e4d485b9e3ebaa1bec2ffb3bdcb9765ea89
access-control-expose-headers: etag,location,x-dw-version-status,x-dw-resource-state,authorization,x-dw-request-base-id
content-encoding: gzip
x-dw-request-base-id: lUp1qCn6bGcBAAB_
etag: 5a76e1bf224c3493c62356ea75f89e4d485b9e3ebaa1bec2ffb3bdcb9765ea89
age: 0
x-dw-version-status: obsolete
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
x-yottaa-profileid: 5a0c9b7632f01c35d4210220
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: KMAYeRjoG-wZDs78uGk4xbYDmjFPLfOLKF51GF1itFNnOJakzsXLqA==
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: application/json;charset=UTF-8
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348159 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
sfdc_customization: HOOK
x-yottaa-os: 200
access-control-allow-credentials: true
allow: DELETE,GET,HEAD,OPTIONS,PATCH
cf-ray: 8f7f13236cda6a4c-CMH
x-yottaa-metrics: 3221a5fec65e/[150,144,-] 32D1a5fec674/[-,153.788]
via: 1.1 535c2b5354e6ba6798fd64420ee97a2c.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 995
x-proxy-request-url: https://cc-elf-us-prd.elfcosmetics.com/s/elf-us/dw/shop/v21_3/baskets/be43e8b7546102ce7129234d14
x-amz-cf-pop: DFW57-P1

GET
H3 200 0860ab24f45bc22b8f13cc8d6647caaa.jpg
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 84 KB
84 KB 22ms
21ms Image
image/jpeg 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/0860ab24f45bc22b8f13cc8d6647caaa.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: cef923d56729944b2ae70b4e78b864efbb81a1db323d25882483aa8d935f9528

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: etag, Content-Type
x-goog-hash: crc32c=MTqQwQ==, md5=CGCrJPRbwiuPE8yNZkfKqg==
etag: "0860ab24f45bc22b8f13cc8d6647caaa"
age: 301674
ad-auction-allowed: true
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 86329
date: Sun, 22 Dec 2024 18:51:43 GMT
last-modified: Fri, 01 Nov 2024 19:19:11 GMT
content-type: image/jpeg
x-guploader-uploadid: AFiumC6ZNhr7Oysbm73qO8z9QAPVkKnS6NutcqI6kiVYKltURbUu7OU2FoeZnPmBvDHF9ZF0
cache-control: public,max-age=31536000
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1730488751388465
content-length: 86329
server: UploadServer

GET
H3 200 59a941c096f98029341d8c56b7b89113.png
assets.bounceexchange.com/assets/uploads/clients/4142/creatives/ 18 KB
18 KB 26ms
25ms Image
image/png 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/4142/creatives/59a941c096f98029341d8c56b7b89113.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 2f9c91dd6030ee0311497f63531e9e27cb31cb8468a74c0b8482075bdbaa80b5

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: etag, Content-Type
x-goog-hash: crc32c=8aFhaA==, md5=WalBwJb5gCk0HYxWt7iREw==
etag: "59a941c096f98029341d8c56b7b89113"
age: 239314
ad-auction-allowed: true
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 18352
date: Mon, 23 Dec 2024 12:11:03 GMT
last-modified: Tue, 25 Aug 2020 15:57:40 GMT
content-type: image/png
x-guploader-uploadid: AFiumC6rpIc5NyOZITrJurRk6iunMh7KcYFPy9hXWZ_7BFYHFadshbW_1bXKjQTf9CU59Twc
cache-control: public,max-age=31536000
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1598371060392963
content-length: 18352
server: UploadServer

GET
H3 200 16f45df19355361dc1c101036c0035b0.png
assets.bounceexchange.com/assets/uploads/clients/3258/creatives/ 2 KB
2 KB 25ms
24ms Image
image/png 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bounceexchange.com/assets/uploads/clients/3258/creatives/16f45df19355361dc1c101036c0035b0.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 915046d9ebab575f9b2f8ba9a35e030b2be55b1439edce6e72f7a19b4a55bd45

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: etag, Content-Type
x-goog-hash: crc32c=pklVBw==, md5=FvRd8ZNVNh3BwQEDbAA1sA==
etag: "16f45df19355361dc1c101036c0035b0"
age: 23149
ad-auction-allowed: true
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 2419
date: Thu, 26 Dec 2024 00:13:48 GMT
last-modified: Thu, 01 Apr 2021 03:01:32 GMT
content-type: image/png
x-guploader-uploadid: AFiumC73Vtm4GE8nf-cfP_ySaauuxDdDYWT0EMB48ijnEJlkKtrCSO-PCza1BcIIbG_F6NNqq1RYUMs
cache-control: public,max-age=31536000
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1617246092060079
content-length: 2419
server: UploadServer

GET
H2 200 eligible
events.bouncex.net/track.gif/ 42 B
96 B 77ms
38ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/eligible?wklz=E4UwNg9ghgJgwlAtgBygSwOYDsDOA1AJgF4AGAMhgwC40cBlAVwCMcBjYNJkYIgMyjA4QFarQAKoAG5oIDHHDkAXCIm58BQkVVZRWACxAAVOkQCMAdgDMAVlMBOW+YBsADmdkGARzNkhGVViKAPpoMDhEZDoo6NihRATOACyWbr6ywKwgREyyWJkAHmRQGCCBRABWOGSIEDBZ5ADuICxoiiBxTp2JZNI4rXEWNvaO5iRO5hPdddKZcYlOpvbmpi6LBE4ELtbWJASmZKgl0iANA74gngylszDxkWBopYqKaKo4ikjIZla2DhbmiWsLnuj0CUGQaEk3D6ECwRA+GEsFBAMyyyDIij0aGAMCCqGAigAnkF3hBgMUQEEYLQoEwwCBbvxBMJFAAvCBERIuEhAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
x-envoy-upstream-service-time: 0
x-envoy-decorator-operation: event-collector.event-collector.svc.cluster.local:80/*
via: 1.1 google
expires: Tue, 01 Jan 2001 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/gif

GET
H2 200 eligible
events.bouncex.net/track.gif/ 42 B
99 B 66ms
43ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/eligible?wklz=E4UwNg9ghgJgwlAtgBygSwOYDsDOA1AJgF4AGAMhgwC40cBlAVwCMcBjYNJkYIgMyjA4QFarQAKoAG5oIDHHDkAXCIm58BQkVVZRWACxAAVOkQCMAdgDMAVlMBOW+YBsADmdkGARzNkhGVViKAPpoMDhEZDoo6NihRATOBHYALC6+ssCsIERMslhZAB5kUBgggUQAVjhkiBAw2eQA7iAsaIogcU5dyWTSOG1xFjb2juYkTuaTPfXSWXHJTqb25qYuSwROBC7W1iQEpmSopdIgjYO+IJ4MZXMwRJaRYGhliopoqjiKSMhmVrYOFnMCwOrCeLygyDQkm4-QgWCIXwwDxmaCyRGQZEUejQwBgQVQwEUAE8gp8IMASiAgjBaFAmGAQHd+IJhIoAF4QIipEhAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
x-envoy-upstream-service-time: 1
x-envoy-decorator-operation: event-collector.event-collector.svc.cluster.local:80/*
via: 1.1 google
expires: Tue, 01 Jan 2001 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/gif

GET
H2 200 pop
events.bouncex.net/track.gif/ 42 B
206 B 59ms
37ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/pop?wklz=A4e2C4EMGMBcEsBukEgHYF4EFsCmAnAMn1wBsRIATAYUm2EngHM0BnANQCYMAGQp3CHDQQAVzSx8ATxGVcGagEF+g8CSbx0GAIrUVQkRPhpcE2fIByy0QEcMARkLQ6DZmniUMnAOwA2TgCcACwAHISsYvjQ8gBGYmjRAB6EkAISGABWrITYIHK8hADuuDGs8LC4Hhi+NUGEiPBlCJ723gDMAKz2AV3e3jy+fd51cg3RVUG+9t3e9iHTnP4hHR08nI4MAg24hVWOrLg2oqbjnnXQpPCmsDi4rLAuDu1dPa3Dvm1Ol9eQwEgEZS0DyYn1G8GiGGAhFgAAt4PhKAB9Bj4WBSRH3ED4VK4RGURqQGKkXCeABmkFIB2hAC8QBhQjwgA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
x-envoy-upstream-service-time: 0
x-envoy-decorator-operation: event-collector.event-collector.svc.cluster.local:80/*
via: 1.1 google
expires: Tue, 01 Jan 2001 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: image/gif

GET
H2 204 pageview
c.contentsquare.net/ 0
272 B 154ms
34ms Image
text/plain 18.205.99.155
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/pageview?ex=&dt=214&pvt=n&cvars=%7B%223%22%3A%5B%22Page%20Type%22%2C%22content%22%5D%7D&cvarp=%7B%223%22%3A%5B%22Page%20Type%22%2C%22content%22%5D%7D&la=en-CA&uc=0&url=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dr=&dw=1600&dh=6759&ww=1600&wh=1200&sw=1600&sh=1200&uu=4cf7fd5f-31c8-a030-db29-98f59e0ad942&sn=1&hd=1735195177&v=15.43.0&pid=1926&pn=1&happid=1042782804&hsid=1100305967513676&huu=2898171355238391&r=258348
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.205.99.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-99-155.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 24 Oct 1982 23:00:00 GMT
access-control-allow-origin: *
date: Thu, 26 Dec 2024 06:39:37 GMT
content-disposition: inline
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With

POST
H2 200 add_user_properties Show response
c.us.heap-api.com/api/capture/v2/ 2 B
286 B 36ms
35ms Fetch
text/plain 54.162.176.102
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c.us.heap-api.com/api/capture/v2/add_user_properties

Requested by

Host: cdn.us.heap-api.com
URL: https://cdn.us.heap-api.com/v5/heapjs-static/5.2.5/core/heap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.162.176.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: application/octet-stream
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
access-control-allow-methods: POST, PUT, GET
access-control-allow-origin: *
content-length: 2
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: text/plain; charset=utf-8
server: nginx
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H2 200 track Show response
c.us.heap-api.com/api/capture/v2/ 2 B
286 B 38ms
36ms Fetch
text/plain 54.162.176.102
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c.us.heap-api.com/api/capture/v2/track

Requested by

Host: cdn.us.heap-api.com
URL: https://cdn.us.heap-api.com/v5/heapjs-static/5.2.5/core/heap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.162.176.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: application/octet-stream
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
access-control-allow-methods: POST, PUT, GET
access-control-allow-origin: *
content-length: 2
date: Thu, 26 Dec 2024 06:39:37 GMT
content-type: text/plain; charset=utf-8
server: nginx
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

OPTIONS
H2 200 add_user_properties
c.us.heap-api.com/api/capture/v2/ Frame 0
0 131ms
33ms Preflight
text/html 54.162.176.102
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c.us.heap-api.com/api/capture/v2/add_user_properties

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.162.176.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: POST, PUT, GET
access-control-allow-origin: *
allow: POST
content-length: 4
content-type: text/html; charset=utf-8
date: Thu, 26 Dec 2024 06:39:37 GMT
etag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

OPTIONS
H2 200 track
c.us.heap-api.com/api/capture/v2/ Frame 0
0 131ms
34ms Preflight
text/html 54.162.176.102
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c.us.heap-api.com/api/capture/v2/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.162.176.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.elfcosmetics.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: POST, PUT, GET
access-control-allow-origin: *
allow: POST
content-length: 4
content-type: text/html; charset=utf-8
date: Thu, 26 Dec 2024 06:39:37 GMT
etag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 204 dvar
c.contentsquare.net/ 0
19 B 89ms
34ms Image
text/plain 18.205.99.155
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/dvar?v=15.43.0&pid=1926&pn=1&sn=1&uu=4cf7fd5f-31c8-a030-db29-98f59e0ad942&happid=1042782804&hsid=1100305967513676&huu=2898171355238391&dv=H4sIAAAAAAAAA43PwWqDQBAG4FcZhN4aUYOKvRkNIZCG0oRCTrLdHZMNm13REStt370jhBaaHnraYZj%2F25l3L19U5aFaGfcqDBTOUusM7LEj78H7owsfUI5WXLS8i4KDRqP4Xb412Gq0Ejvv%2Fio%2BoxylQZgB%2BsavfShEix08OtVzN8hmURDN%2BY%2BfLISMb3FgcNB0cj1xpe0Z5VRIp%2FAbvy6204SQq3Pf0QUtdbfci2i1IO0sC%2BHv%2BN41sBDWYgu7k24abY9Q9OTq%2Br9QrhQrjBynw5jkq6ctNm6AtSXeiaNPrukNx2mccttqlVeFYZnWJY8mQZImSZLFfpjO4zCLwzT2Pr8AkSptHpgBAAA%3D&ct=2&r=476674
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.205.99.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-99-155.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 24 Oct 1982 23:00:00 GMT
access-control-allow-origin: *
date: Thu, 26 Dec 2024 06:39:37 GMT
content-disposition: inline
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With

GET
H2 200 telemetry
c.us.heap-api.com/api/ 32 B
234 B 101ms
34ms Image
image/gif 54.162.176.102
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.us.heap-api.com/api/telemetry?a=1042782804&te=type&te=data&te=cm&te=eventPropertiesTelemetry%20-%20added%20new%20properties&te=val&te=1&st=1735195177745&hv=5.2.5&ld=cdn.us.heap-api.com

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.162.176.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

3.67.98.34.bc.googleusercontent.com

Software

Resource Hash

853b983923a033223e4f391790e6e86619b31d542b40e7e1e8221fb0d6957ab1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 32
date: Thu, 26 Dec 2024 06:39:37 GMT
pragma: no-cache
content-type: image/gif

POST
H2 200 shoppercontext Show response
www.elfcosmetics.com/api/v1/ 154 B
919 B 573ms
571ms Fetch
application/json 165.254.198.116
YOTTAA-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.elfcosmetics.com/api/v1/shoppercontext?siteId=elf-us&method=PATCH

Requested by

Host: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/1a8bfa042c9c5.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.254.198.116 , United States, ASN393259 (YOTTAA-AS-1, US),

Reverse DNS

Software

Resource Hash

e1b06c1da9362f1483327932d5e98b16da8c014e7353e237b2b0a5290b56c53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

authorization: Bearer eyJ2ZXIiOiIxLjAiLCJqa3UiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJraWQiOiJmN2YwN2I5ZC03MWUxLTQ2YTYtOGM3Yi02Y2UzYmQ4NjU1MzQiLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4zLjQiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5zaG9wcGVyLW15YWNjb3VudC5iYXNrZXRzIHNmY2Muc2hvcHBlci1teWFjY291bnQuYWRkcmVzc2VzIHNmY2Muc2hvcHBlci1wcm9kdWN0cyBzZmNjLnNob3BwZXItbXlhY2NvdW50LnJ3IHNmY2Muc2hvcHBlci1teWFjY291bnQucGF5bWVudGluc3RydW1lbnRzIHNmY2Muc2hvcHBlci1jdXN0b21lcnMubG9naW4gc2ZjYy5zaG9wcGVyLWNvbnRleHQucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5vcmRlcnMgc2ZjYy5zaG9wcGVyLWN1c3RvbWVycy5yZWdpc3RlciBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5hZGRyZXNzZXMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wcm9kdWN0bGlzdHMucncgc2ZjYy5zaG9wcGVyLXByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItcHJvbW90aW9ucyBzZmNjLnNob3BwZXItYmFza2V0cy1vcmRlcnMucncgc2ZjYy5zaG9wcGVyLW15YWNjb3VudC5wYXltZW50aW5zdHJ1bWVudHMucncgc2ZjYy5zaG9wcGVyLWdpZnQtY2VydGlmaWNhdGVzIHNmY2Muc2hvcHBlci1wcm9kdWN0LXNlYXJjaCBzZmNjLnNob3BwZXItbXlhY2NvdW50LnByb2R1Y3RsaXN0cyBzZmNjLnNob3BwZXItY2F0ZWdvcmllcyBzZmNjLnNob3BwZXItbXlhY2NvdW50Iiwic3ViIjoiY2Mtc2xhczo6YmJ4Y19wcmQ6OnNjaWQ6ZjlmNzA1MmEtZjc0Mi00YzM4LWJkZjUtMWRhMDA0ZTdmYjNiOjp1c2lkOmMwYTJjMzRhLWY2ODktNGUzNS1iYzFkLTU1NTc2MjYwYWM0NyIsImN0eCI6InNsYXMiLCJpc3MiOiJzbGFzL3Byb2QvYmJ4Y19wcmQiLCJpc3QiOjEsImRudCI6IjAiLCJhdWQiOiJjb21tZXJjZWNsb3VkL3Byb2QvYmJ4Y19wcmQiLCJuYmYiOjE3MzUxOTUxNDMsInN0eSI6IlVzZXIiLCJpc2IiOiJ1aWRvOnNsYXM6OnVwbjpHdWVzdDo6dWlkbjpHdWVzdCBVc2VyOjpnY2lkOmFjd1hhRmtLa1hsZWNSeEh3Mm1xWVl4cmtaOjpjaGlkOmVsZi11cyIsImV4cCI6MTczNTE5Njk3MywiaWF0IjoxNzM1MTk1MTczLCJqdGkiOiJDMkMxOTUxNjYxMTg2MC00MjQ2Mzc5MDMxMzg2OTk1MDcwNTc0MTIzNyJ9.XA9lk1NsAjgienfZh-M_p_0MSOgqgITDo_ITDeBNpSuKGREwqE2cADvSoQcSPl_Dhtbu7hehGdzLJB66qB2tOg
Referer: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: application/json

Response headers

x-amzn-remapped-content-length: 154
content-encoding: gzip
x-amzn-remapped-connection: close
etag: W/"9a-TeJiArtVRfVL73NQ8YH+ETiJDcE"
age: 0
x-amzn-requestid: 603aed58-f893-4f1e-9497-41120e4654f0
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: 023AgGdxXSI_QBDGLZDgXs9nWhgWcszEOUH3RmZ7Lor3ReX9fkJrDA==
date: Thu, 26 Dec 2024 06:39:38 GMT
content-type: application/json; charset=utf-8
x-yottaa-optimizations: ob/1000 si/32D1a5fec674-1734717345-8434348163 tts/1731597410018 ti/5a0c9b7632f01c35d4210286 ai/5a0c9b7632f01c35d4210220 tm/0
strict-transport-security: max-age=15552000; includeSubDomains
x-yottaa-os: 200
x-amz-apigw-id: DYwGoHFICYcEh2g=
x-amzn-remapped-date: Thu, 26 Dec 2024 06:39:38 GMT
x-amzn-trace-id: Root=1-676cfa2a-4451c3b35dff61fd452305ac;Parent=69b6318014aacc77;Sampled=0;Lineage=1:2b75b0e9:0
via: 1.1 535c2b5354e6ba6798fd64420ee97a2c.cloudfront.net (CloudFront)
x-yottaa-metrics: 3221a5fec63e/[511,509,-] 32D1a5fec674/[-,514.280]
access-control-allow-origin: *
content-length: 127
x-amz-cf-pop: DFW57-P1

GET
H2 202 graph
idr.cdnwidget.com/ 0
194 B 142ms
54ms Image
text/plain 34.149.130.207
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idr.cdnwidget.com/graph?cookieID=2qk8O4Z7v0jXnLjoSgSXJunH5HG&deviceID=2qk8OA95DdPT0cUHQge6YzVpcdK&bxdid=4611971811262855021&bxvid=1735195177067774&bxwid=6664&gm=true&apikey=2^HIykD&loadID=3DqlDnqVsNCU7RR
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.130.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 207.130.149.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

x-envoy-upstream-service-time: 1
x-envoy-decorator-operation: id-resolution.id-resolution.svc.cluster.local:9000/*
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 26 Dec 2024 06:39:38 GMT
server: istio-envoy

GET
H2 200 script-tag.js Show response
cdn-scripts.signifyd.com/api/ 10 KB
4 KB 99ms
32ms Script
application/javascript 108.138.64.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-scripts.signifyd.com/api/script-tag.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-38.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d7a363f752524fb545c3b2eb48a56d163cb659bc427d5215800ee7781d92c2ca

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

vary: accept-encoding
cache-control: max-age=1800
content-encoding: gzip
etag: W/"73ca6f23f3e08738233832c7a7a0c30c"
age: 455
via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 4-AB8MIOU_oY_sUVbw_TrYKMa5yE_GYKqJq5FxONWX1sW3bI8-hvyA==
date: Thu, 26 Dec 2024 06:32:04 GMT
content-type: application/javascript
last-modified: Tue, 23 Apr 2024 14:51:40 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P1
x-amz-server-side-encryption: AES256

GET
H2 204 dvar
c.contentsquare.net/ 0
42 B 32ms
32ms Image
text/plain 18.205.99.155
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/dvar?v=15.43.0&pid=1926&pn=1&sn=1&uu=4cf7fd5f-31c8-a030-db29-98f59e0ad942&happid=1042782804&hsid=1100305967513676&huu=2898171355238391&dv=H4sIAAAAAAAAA6tWcvSL93B1DIh3LChQ8HRRslIyNDAxMrcwsjAwUaoFAAixYhsfAAAA&ct=2&r=529746
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.205.99.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-99-155.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 24 Oct 1982 23:00:00 GMT
access-control-allow-origin: *
date: Thu, 26 Dec 2024 06:39:38 GMT
content-disposition: inline
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With

GET
H2 200 company_toolkit.js Show response
cdn-scripts.signifyd.com/api/ 4 KB
2 KB 33ms
32ms Script
application/javascript 108.138.64.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-scripts.signifyd.com/api/company_toolkit.js
Requested by: Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-38.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6082597f3871c77c9b31aa1383577f8c0e54cb5ff09275dc817bc70d96e6217d

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

vary: accept-encoding
cache-control: max-age=1800
content-encoding: gzip
etag: W/"2c3950f122b3977df61b0e077aaa92c8"
age: 796
via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: k27lWVb7Qhh9v0A324b-V8rnVbf_wRbxo8-PZwsQBQudDD1N3IpKBw==
date: Thu, 26 Dec 2024 06:26:23 GMT
content-type: application/javascript
last-modified: Tue, 30 May 2023 10:18:44 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P1
x-amz-server-side-encryption: AES256

POST
H2 200 exist Show response
srm.ba.contentsquare.net/ 2 B
94 B 339ms
109ms Fetch
application/json 34.246.148.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://srm.ba.contentsquare.net/exist?v=15.43.0&pid=1926&pn=1&sn=1&uu=4cf7fd5f-31c8-a030-db29-98f59e0ad942&happid=1042782804&hsid=1100305967513676&huu=2898171355238391
Requested by: Host: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/1a8bfa042c9c5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.148.34 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-148-34.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

access-control-allow-origin: *
content-length: 2
date: Thu, 26 Dec 2024 06:39:39 GMT
content-type: application/json

GET
H/1.1 200
OK i1s6g9t5t3himegn.js Show response
imgs.signifyd.com/ 98 KB
14 KB 292ms
99ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/i1s6g9t5t3himegn.js?5e4w58gnwu66usvw=w2txo5aa&fzlpyeqmrovv1nk4=L2VuX0NBL2JlNDNlOGI3NTQ2MTAyY2U3MTI5MjM0ZDE0

Requested by

Host: www.elfcosmetics.com
URL: https://www.elfcosmetics.com/en_CA/elf-cosmetic-criminals

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

6d01b46bf6994f3c8ed578d35b48472c72bd6136f913ff60f71d267f2c2fee6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

X-Robots-Tag: noindex, nofollow
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP=IVAa PSAa
Keep-Alive: timeout=2, max=100
Date: Thu, 26 Dec 2024 06:39:39 GMT
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Server: Apache

GET
H2 200 id_sync
events.bouncex.net/track.gif/ 42 B
96 B 39ms
37ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/id_sync?id_sync:id_type=sid&id_sync:id_source=graph&soft_id=2qk8OA95DdPT0cUHQge6YzVpcdK&source=web&agent=cjs&deviceid=4611971811262855021&visitid=1735195177067774&websiteid=6664&pageviewid=1&sequenceid=4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
x-envoy-upstream-service-time: 0
x-envoy-decorator-operation: event-collector.event-collector.svc.cluster.local:80/*
via: 1.1 google
expires: Tue, 01 Jan 2001 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Thu, 26 Dec 2024 06:39:39 GMT
content-type: image/gif

GET
H2

200

cs
tags.rd.linksynergy.com/
Redirect Chain

https://idsync.rlcdn.com/458359.gif?partner_uid=6f57d388-d6ca-4d1b-8a14-1d4b6bff8a69
https://idsync.rlcdn.com/1000.gif?memo=CPf8GxIwCiwIARCd5gEaJDZmNTdkMzg4LWQ2Y2EtNGQxYi04YTE0LTFkNGI2YmZmOGE2ORAAGg0Iq_SzuwYSBQjoBxAAQgBKAA
https://tags.rd.linksynergy.com/cs?ns=lr&uid3=06b875baf8bdbc45451cfc381a795848f20ad85fef5641fcc0630ce7f471418f6ac34734d8e453ee

37 B
294 B

41ms
36ms

Image
image/gif

34.98.67.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tags.rd.linksynergy.com/cs?ns=lr&uid3=06b875baf8bdbc45451cfc381a795848f20ad85fef5641fcc0630ce7f471418f6ac34734d8e453ee

Protocol

Server

34.98.67.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

via: 1.1 google
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 26 Dec 2024 06:39:39 GMT
x-samesite: secure
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://tags.rd.linksynergy.com/cs?ns=lr&uid3=06b875baf8bdbc45451cfc381a795848f20ad85fef5641fcc0630ce7f471418f6ac34734d8e453ee
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 26 Dec 2024 06:39:39 GMT

GET
H2 200 rcomEvent
async-px.dynamicyield.com/ 0
0 38ms
38ms Fetch 18.165.83.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://async-px.dynamicyield.com/rcomEvent?cnst=1&_=40263&uid=-8277615877148575195&sec=8772046&aud=884367.884385.884387.1167402.1324059.1846919.2356145.998337.1004416.1092373.1426804.1443347.1182144.799436.799440&expSes=69870&p=1&cl=d.an.c.ws.fst.&ses=6c5fcc624125fe912fc201ac5d54e5fe&data=%7B%22ctx%22%3A%7B%22type%22%3A%22OTHER%22%2C%22lng%22%3A%22en-CA%22%2C%22data%22%3A%5B%5D%7D%2C%22widgets%22%3A%7B%22199244%22%3A%7B%22fId%22%3A16887%2C%22fallbackData%22%3Atrue%2C%22expData%22%3A%7B%22expId%22%3Anull%2C%22varId%22%3Anull%7D%2C%22events%22%3A%5B%7B%22type%22%3A%22PIMP%22%2C%22pId%22%3A%5B%22300211%22%2C%22300166%22%2C%22300242%22%2C%22300168%22%2C%2257150%22%2C%22300240%22%2C%22300224%22%2C%22300237%22%2C%2223212%22%2C%2281765%22%2C%2257418%22%5D%2C%22strId%22%3A9%2C%22md%22%3A%7B%7D%7D%2C%7B%22type%22%3A%22WIMP%22%2C%22strId%22%3A9%7D%2C%7B%22type%22%3A%22WRIMP%22%2C%22strId%22%3A9%7D%2C%7B%22type%22%3A%22PRIMP%22%2C%22pId%22%3A%5B%22300237%22%2C%22300224%22%2C%22300240%22%2C%2257150%22%2C%22300168%22%2C%22300242%22%2C%22300166%22%2C%22300211%22%5D%2C%22strId%22%3A9%2C%22md%22%3A%7B%7D%7D%5D%7D%7D%7D&reqts=1735195179045&rri=559325
Requested by: Host: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/1a8bfa042c9c5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-78.iad55.r.cloudfront.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: POST, GET, OPTIONS
via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: mPhXbdVHMMozn7CoIQB2gbhbKGB-VlmWURL1A8pvJrpDVhoi4KGEVw==
date: Thu, 26 Dec 2024 06:39:39 GMT
x-amz-cf-pop: IAD55-P3
access-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With

GET
H/1.1 200
OK pHNdqEDra13C1zpv Show response
imgs.signifyd.com/ Frame 0B05 319 KB
54 KB 108ms
108ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/pHNdqEDra13C1zpv?c1421c6aaed1d29e=CKN5ShrLTPm1AlcAxFJ5SXeQX6JuSLQL1zn22cUwe4KZvBJ7Q5rwpv6T-dqK5DKrfqsRe_JhPn470UoMYIi7k8KMcGendyn-Cp8HvqGNbxukWO7Gsr9VN9r58xZp6FZy7FDrmJvcMqJ5pnTQbjpTjUyRaKMRiV1ks0I4gbZNwYeztBUjkKz_xkjOZdqs97kTj_KfNwOupl9o5txXGAMCS_t-uys&jb=3d35242662736577354e63667f782c62796d35436464726d6164253a3833302462736a7535496072656d65266271603d4b68786d65672f3a3a313830

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/i1s6g9t5t3himegn.js?5e4w58gnwu66usvw=w2txo5aa&fzlpyeqmrovv1nk4=L2VuX0NBL2JlNDNlOGI3NTQ2MTAyY2U3MTI5MjM0ZDE0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

5a482bb57572cdedb347fd99182206d9dd65137a8ff5dba2e3903f3a76a943c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

X-Robots-Tag: noindex, nofollow
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=99
Date: Thu, 26 Dec 2024 06:39:39 GMT
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
tmx-nonce: 0af366a4828f254f
X-XSS-Protection: 1; mode=block
Server: Apache

GET
H/1.1 200
OK Ux18xlrW1-HPFbcn
imgs.signifyd.com/ Frame 0B05 81 B
475 B 274ms
92ms Image
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/Ux18xlrW1-HPFbcn?bbd3192149dfbda4=ErX8BPc5z7VVFlfQyiHNTM-Pwv737typ-KOAcAVh-Sq51V0COx_L2C09XNxv7nwRALglATjZ6DDdlR1rf0x7LGd7keNYU-CPw-Ksar03qjkd_bPzl1q29ID-gJ43EUh_YtGc-jpWBL3UeDhkDkDble66eGVl3_W3USjI8BBmZsDfPOLNMg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 81
Keep-Alive: timeout=2, max=100
Date: Thu, 26 Dec 2024 06:39:39 GMT
X-XSS-Protection: 1; mode=block
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK Ug2GTYV9gJaCIh5T
imgs.signifyd.com/ Frame 0B05 81 B
475 B 276ms
92ms Image
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/Ug2GTYV9gJaCIh5T?ba78e198d5718a19=CjXi-XsHHRqDbO_Hq2I-jQAK48hkicyEs_g0ncqtw1IkYX_dc52nhxUwcaJnItnLQYCnGu27JKU6x7GwgWsNncG_oOhYucHK6dOgmXh7jQYDZdL9d22wncqmalstnLVfyNXV4Ki24FUo5SQZ8UOcbNgfRohzGaQJSHv5AMqKEvtawxXPmg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 81
Keep-Alive: timeout=2, max=100
Date: Thu, 26 Dec 2024 06:39:39 GMT
X-XSS-Protection: 1; mode=block
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK clear.png Show response
imgs.signifyd.com/fp/ Frame 0B05 81 B
536 B 278ms
92ms XHR
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/pHNdqEDra13C1zpv?c1421c6aaed1d29e=CKN5ShrLTPm1AlcAxFJ5SXeQX6JuSLQL1zn22cUwe4KZvBJ7Q5rwpv6T-dqK5DKrfqsRe_JhPn470UoMYIi7k8KMcGendyn-Cp8HvqGNbxukWO7Gsr9VN9r58xZp6FZy7FDrmJvcMqJ5pnTQbjpTjUyRaKMRiV1ks0I4gbZNwYeztBUjkKz_xkjOZdqs97kTj_KfNwOupl9o5txXGAMCS_t-uys&jb=3d35242662736577354e63667f782c62796d35436464726d6164253a3833302462736a7535496072656d65266271603d4b68786d65672f3a3a313830

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Accept: */*, w2txo5aa/0af366a4828f254fl2vux0nbl2jlndnlogi3ntq2mtayy2u3mti5mjm0zde0
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=31536000
Cache-Control: private, must-revalidate, max-age=0
Etag: 3a310a35b54c4ecd814dec63466c75f9
Connection: Keep-Alive
Expires: Tue, 25 Dec 2029 06:39:39 GMT
Access-Control-Allow-Origin: https://www.elfcosmetics.com
Content-Length: 81
Keep-Alive: timeout=2, max=100
Date: Thu, 26 Dec 2024 06:39:39 GMT
Last-Modified: Thu, 26 Dec 2024 06:39:39 GMT
Content-Type: image/png
Server: Apache

GET
H/1.1 200
OK YqL-KJS6upuIzBqS
imgs.signifyd.com/ Frame B774 0
0 277ms
95ms Document
text/html 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/YqL-KJS6upuIzBqS?84ba156944aa6848=1UaqbvQbBMy1UkJoxxFgMEeEVmZ4RQ4L5YC3zzksHrWxbvi0eDZbx8XhFiuqMQtr_hO1QFje1xVJrVdJJVZR3Czuc2ozVvr2MsZnSJXjeZQZUNH-fxbnYFbH3wg83MWq5SvDTAKOq51yIfsemdbK9Q46f0hQWKaVj_OE9nasSn18HWatkZaRRtk0k4Oj0zRPYxbm_faZIUpDigZk9mNk5Qo1kSFJ6A

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Thu, 26 Dec 2024 06:39:39 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=100
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK k9Wk7jNHvn8YR0c5 Show response
imgs.signifyd.com/ Frame 0B05 0
398 B 94ms
93ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 0
Keep-Alive: timeout=2, max=98
Date: Thu, 26 Dec 2024 06:39:39 GMT
X-XSS-Protection: 1; mode=block
Content-Type: text/javascript
Server: Apache

GET
H/1.1 200
OK UJUtvymlfYkeW_yk Show response
imgs.signifyd.com/ Frame 0B05 134 B
655 B 111ms
92ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/UJUtvymlfYkeW_yk?271eb67c75f954fd=6xw5RR7JgsQLMTkxMK6VIBhMmRqYyWKF4mGQAXOnIRg8N3Dy50TdgJ0HsjvA5eYFTYQn9Z90LBOOQSeEg88iqbtf650AC0OOmGIGXh9NBBqf2BdGeTcrXbZ-40BO43Nm-ifT93l6X1ZjvBYrpj8VhXYhRO7j4BTa

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

1a2fa3bab76fb77874e053e06119b73c49dc48483fd1b09f0ad72764fba34c0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=99
Date: Thu, 26 Dec 2024 06:39:39 GMT
X-XSS-Protection: 1; mode=block
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
Server: Apache

GET
H/1.1 200
OK wiZXrgsrdGlDFAX8
h.online-metrix.net/ Frame 8E94 0
0 285ms
95ms Document
text/html 192.225.158.1
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/wiZXrgsrdGlDFAX8?b2f9ba5cb94a20f4=8j4a8H0xXPGv_zSF8Wzob4X9AWzoKQnhTh41QVIUUxCBAarDBi01bAFwAYzB28BfhEIU51hBGOeqwg9FCKymGC2lGfS8lCNly31O2_W1ikGA0nLNMScVCdG4WJ2DwYH5douvMo33brt8PL5tog4q-5C4xqVpes6iIXaKQkVn3hVrauCaux9m6VbTPgtVP7cKqfYDkEmOBn8oI3f7VZAaPFHvbw75H5Q

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.158.1 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Thu, 26 Dec 2024 06:39:39 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=100
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 0JStZepP8Yr6D_Uu
imgs.signifyd.com/ Frame 5ADD 0
0 280ms
95ms Document
text/html 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/0JStZepP8Yr6D_Uu?d0d260a0599449e0=LHY9B7qM1r2lr5cXgicpVrSCg6XEOEPuhBmgDRXcHOjuRo0myUUZcqjUYkzxfnlpPbvWfO4Gq8_57Fo1zxsX5DncXH-S1z5faJZKShSWx_2bdVI32Ifwj1L4DbPV_4BqWYVAqaHNxjrMzRzdt12ys_7U_r11VQLgi5wD2crOTsyUYeJQXrQjQZqmYWky6XJx61QufIbVf-Me_W8yospcI2Kif6MAO5s

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.elfcosmetics.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Thu, 26 Dec 2024 06:39:39 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=100
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK o-3oYDGu77_he9C2 Show response
h64.online-metrix.net/ Frame 0B05 0
399 B 584ms
93ms Script
text/javascript 192.225.158.1
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h64.online-metrix.net/o-3oYDGu77_he9C2?43807feda58a724c=kWRj1-Lla3kFM5r6DqZ2WRzbA1UJzu0uYyXKcj-s7e0EX7wuLp5c_1IcNQ1vfHtsLE0kblM8Az5q9ZRozJFSVbYlTCF0_AaXixyTnGs7Tbh8buQZEUsfpViOt9lgPmEST6rdXW74wY3Yp3kVEKYaUCYzFTgJh0KR0Jzo1cBS5OY

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.158.1 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 0
Keep-Alive: timeout=2, max=100
Date: Thu, 26 Dec 2024 06:39:39 GMT
X-XSS-Protection: 1; mode=block
Content-Type: text/javascript
Server: Apache

GET
H/1.1 204
204 k9Wk7jNHvn8YR0c5 Show response
imgs.signifyd.com/ Frame 0B05 0
218 B 233ms
220ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/k9Wk7jNHvn8YR0c5?b1677a4224e47ba0=dQGVLKjEXwOy5zu5qSA1RM9mPJexOK9dUvRKPv8J95FB5g7w0ovMneiCogjY56MRBjFD66MD2QfWDbJckBdNefIrymro4qDnfdL54VarlS1IHX62C9u6JkCWC3SquPXaClLwDSwRQMwxOLqcMTWN6NPBnMdUgGhyqgnLjQ&ja=3a3231372e26693f253632382c7a373e3a246e3f3b363032703132383824616435313e30387239323a302673707b3f32387838322e667a7a373126393c32382e3b32303224313638382e3130383024313e3a382c3b32303024333430382c3b303037263a3a2c38382c6f7c3f38376637396433393c3b65346a663a3031683e36686433383f6032616e3369362e6f64353826796b6e3f3a362c6c683f607474787b2733432d324e253a4c7f777d2e656c6e616d7365657e6b6b71246b656d2f3a4c67665d494125304e656c6e25616f7165657c696b276b72636d696e696e7126786c37372e7262356f383a3a6e6469373f35313b3b66346d6a67383b31336d623c6b3139383930642e6a6a3d6d376c373e343f696862386d6c613c643d3436343f3661693d6139343d396b362e607b6f37416e647a6d6b642d323a333824607b683d4960786d65672f3230333a3826627b6d753f44696675702c627368753d4360706d6d6d26646a6b3f3e302c6e6e65373a2e6c6774703f382674726c3f416f6d726163692f3a465c616e63677774657a2667637c6a78353e303a3b6e336b30686563323a65366b6b37363238383a616c3b3d353e3031666c36373830313e336c346f696b323e6c693b3c636c6264353a33313b393b36632e647a3d607e7c70792533412d3044253a467d757f2c6f646c63657b67677c6b69732e61676d253a4e676e5d4b412d324e6f646627636f73656776696b2d6970616f63666b6c792e7a3f786e7f67696c57666c697b6a25374d66696c7b6f297066756769665d7569666465757b5d676d6e696b577a6e697b6f7225374d6661647b67217264756f69665569646562655f6961706f6a617e273d476c6966736f297a6e7d65636e5f737d6963637c6b6d672d354d6669667b652b706c756f6b6c5f7b68656163756b7e6f253f4d6c6364716f21706e7d6769665770656364706461716f7a253f45666164716721786c7f65616c557e6663557866637167782535476e616c7b6d23706e7d67616e576e6d766b6c76722d374766696c79672972667d6d69645779746f5d7c6965756d72253d4d64616e7b652970647f6f69645f6a617e6327354d666b6e7b672c6f665f69357d676a65665765604f4c253a38332e322d323828477a6d6e4d4c2532384751253a30382c3827383849687867676b7d6f235765604f4c253a38454c5144253a304d592d323a312e302d30322847706f6c4f4e2f3a3a45592d38324f4e594c25303845532d3a32312c38253a304b627a6f6769756d2155676243697e556d6041617e2538385d676a4546414e4544455f616671746366636d64576b7a726b7973253b402732384552565760666d64645565636c6563722533402d32304d50565f616469785f6b656674786f6c253b40273238455256576165646572556a7f646e67785f686364665f6e646d61762d334a253a3a4d585e5f646578766a5f6b6c6b6f7827394a2f323a4d52565764666f617657626c6d666625314a253a304d525c5f6c726167576667707c682f314a2738384f585e577a6d647b6d6f6e5d6766667b6d765f61646165702d394a25383045585c5d716869646f7057766f707e75786d556e67662f3342273a3045505c5d746770747d726d556b6f677072657b716b6f665f68727c612f3b482538384f5a5c5d7e6578767d7265576b6d6d727a657b736165665f786774632d3140253a304f5a5c5d7e6d72747f7a6f5d6e6b6674657057616e617b6d7470677061632d394a25383045585c5d766570747f706d5d67617872657a5561646367705f76675f656c6f6725314a253a304d525c5f795247422d3140253a3045475b5d6f646f6d6f667e5d616c6e65785d7d696e7c2d3142273a3047455b556e62655f726566666772576d637265637a2d39422f3a3a4d4d51557374636664617a6c5d64677a697e617c637e65792533422d30324f4d5355766d7a7e7d7865556e666d69762f3342273a304f4d5b5d746770747d726d556e6c6561745f646b6c6569722f314a273838454559577e6770767f72655d60616c6e57646c6d69742d334a2f3a304545535f7c677a747d726f5d6063666e556666676b76576e636e65637a25334a2d30304d4d5357766d787c65725f61727a637b5f676260676b762f3b482538385d474a45465f636d646f72576a7766646d725766646569742f3342253a3255454a47465d6b6d67787865797b6f6657766f7874777a655f697b7663273b422d32385d4d424d4c5f63676f72726d7379676c5d7e6d72747f7a6f5d6d76692533402d32305f4d40474e5763676d78786d737965645f7c677a747d726f5d6d7669392f33482d38325f4748474c5d6b6f6d787a6773716d6457746d727c7578655f733b7661253b422f3038554f4a4d4c556b656f78706f7373676c5f746d707675706d5f7b337c695773786762253b40273238574f404f4e556c6f627f6f55706d6c6e6572677a5f69666e6d25314a253a305f4f4a47465f64656a77655f7b686b666d70792d39422f3a3a554d404d4c5f666d7074605776657a7c757a652d394a25383057454a454e5f6c726b7557607f6e6c65787b2f314a27383057474a474c57646d73675763676e7c6f70742f3342253a3255454a47465d6577667c635f6e7a6b752d31482532325f45424f445d706d64796f6f6655656f6e6531362e656e5f603d32346e3169303e61323f3b603c3a6f61643a3c3639696c3661356a356b3638326a386b643535393424776f6c7c3f416c7e6d66253838436c6b2c2c77676e7a3d49667c676c273a30417261792d323a4f706566454e253a304f6c6f6b646d2c63696c3733&jb=393736266471374f6778636466612f3a4c3726322f32302a44696e7d702733402d323841666e7a6f63642532383332253b422f303849232d38304b787a6e6d556f624b6b7c25324e3d31372c3b362d32382243485e4d4c253a412732386c63696d2738384d656963652b2d303a436870676d652d3a443130302e382e3e3c3933243838253a324f6f6a6966672d303a5b6b666b7a63273a443f33372c3b36

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=31536000
Keep-Alive: timeout=2, max=99
Date: Thu, 26 Dec 2024 06:39:39 GMT
Content-Type: text/javascript;charset=UTF-8
Server: Apache
Connection: Keep-Alive

GET
H/1.1 200
OK j3L-83pIfBN-Zrkt
w2txo5aakss3lxghkazm2w7oxivdqz2anmefrjsc0af366a4828f254fsac.d.aa.online-metrix.net/ Frame 0B05 81 B
438 B 441ms
91ms Image
image/png 192.225.158.3
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://w2txo5aakss3lxghkazm2w7oxivdqz2anmefrjsc0af366a4828f254fsac.d.aa.online-metrix.net/j3L-83pIfBN-Zrkt?a580501804907240=mY7oFXC5R6WAZ0f7Mx0WdMRJhvOc_5IN7Zn13YMSHh5TFb1RhCJDEZ6aaw2pl6sboariXFsjFgJYjavws5mI-XsuGXK2C3ycVmPhaCO8yw-s3uVPTlV7niJIq71etBPr6rtitrEVpCLHrdb2E1_oVV_wEcGc-Clnc8lLlwoRs6NH6NQ

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.158.3 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: close
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 81
Date: Thu, 26 Dec 2024 06:39:39 GMT
X-XSS-Protection: 1; mode=block
Content-Type: image/png
Server: Apache

GET
H/1.1 204
204 mBpIIJq1ge502DVG Show response
imgs.signifyd.com/ Frame 0B05 0
218 B 94ms
93ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/mBpIIJq1ge502DVG?59a158f595bad1e6=jsAU1savoAWTsbmwPuTmzV3NUN8iBoLXduLRhxqac7gYZJFBna037-tcbTDiRluF3fkd3R0ue31C19Vdb_ABuiO1Bq6do7yZ57ZG0TIT5zMkQBIV-yWQRb-y93pJGtKcN2AxAUXXeW1kxHn8ZOOO-Hgdy4_mXNnSA_2Fvu1BO0H3e1oquoRrF0C9JkmXiR6qSwTSbx7gjixUWoioLHD7wm8xF7RUFg&jac=1&je=3036242665656e6a352a392d38433b2d38413b27384363323e35663e3f3166666c6239373b6b3b35386461653f32613030353c636b366b6d32383331686338616963663b3e3164316a35393731626d373a386965683429

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=31536000
Keep-Alive: timeout=2, max=97
Date: Thu, 26 Dec 2024 06:39:39 GMT
Content-Type: text/javascript;charset=UTF-8
Server: Apache
Connection: Keep-Alive

GET
H/1.1 204
204 kjtvzt8YnjxU38w1
imgs.signifyd.com/ Frame 0B05 0
400 B 95ms
94ms Image
image/png 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/kjtvzt8YnjxU38w1?7ac6becc3e5e81d1=xzw8lEvnIEh052H7RopX7rRNun2HD-XDtXD-fna82kStdsEpEsrJ8exJCgc0runYu5fWIAeZQ_Jjv_XEKuqHGIA0tdv6jiFB3wV4dgWfFpnV6RNrZV1k5LMdsiLpXkdddtQ64V9_uZoQz7mNCoZYEUtZW9qmNpUvyyAZyVBGhiE2VMjBLGOCdQzmxxAhb4lcDnPgFlhYnU8sebTKyAS9pyKcc3iKVw&jf=3c3336267b696e5d7a6c6e357e6478577e7a5c7a4f6c78615e56483b3f4c35652e736164576e69746f3d31373b3733393d313d3b2e71636c557473786f3f7f67683a65616c73612e7b6b645d6365713d3b3a3d3939303133383432373a6132343c3a696d39643a3a3a3338343a383263303634306b67336638333831383d38333e3230303836323431363d613c3b3c316866686d3f676d616c6565313d33623f303038353e323c393f396a356b62663069636731383869603b33323f68386c6d383a6e373f35363b6a63393d6a643832383930356e3231376f3531376c63343038666f606c363c306b30683a6e333b673b3464333d61383d6c6035306d396e366d686b666f66267361665d736167373138363e3838323a3c38643a36386638326a653130386434323f636b666d3a3c303f6264643e6036353a626934306668393f373d3d386039676e653832303963386b64643b3b663c303a3838343c6633646d6331393e383a356d3232696f3932303a346e606c3762303165383b3937343a6c6639306a393d356c6664303c30333569396e353036336a3d35322e796b6e703730

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=98
Date: Thu, 26 Dec 2024 06:39:39 GMT
X-XSS-Protection: 1; mode=block
Content-Type: image/png;charset=UTF-8
Server: Apache

GET
H/1.1 200
OK k9Wk7jNHvn8YR0c5 Show response
imgs.signifyd.com/ Frame 0B05 0
398 B 93ms
93ms Script
text/javascript 192.225.157.157
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

192.225.157.157 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer: https://www.elfcosmetics.com/

Response headers

Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 0
Keep-Alive: timeout=2, max=97
Date: Thu, 26 Dec 2024 06:39:39 GMT
X-XSS-Protection: 1; mode=block
Content-Type: text/javascript
Server: Apache

POST
H3 200 collect Show response
sgtm.elfcosmetics.com/g/ 443 B
462 B 186ms
184ms Fetch
text/plain 34.49.124.132
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.elfcosmetics.com/g/collect?v=2&tid=G-5D80LRC85N&gtm=45je4cc1v9125640115z8896608294za200zb896608294&gcs=G111&gcd=13v3v3v3u5l1&npa=1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=606766695.1735195175&ecid=1206783689&ul=en-ca&sr=1600x1200&ir=1&ur=CA-QC&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=MA&sst.rnd=700349826.1735195174&sst.etld=google.ca&sst.adr=1&sst.ude=0&_s=4&sid=1735195174&sct=1&seg=1&dl=https%3A%2F%2Fwww.elfcosmetics.com%2Fen_CA%2Felf-cosmetic-criminals&dt=Cosmetic%20Criminals%20%7C%20e.l.f.%20Cosmetics&tfd=12396&richsstsse

Requested by

Host: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/1a8bfa042c9c5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.49.124.132 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

811b70f3b6d041899d901157b9f26a570698c6229f567454eaf30c903fa46c30

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.elfcosmetics.com/

Response headers

cache-control: no-cache
x-accel-buffering: no
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
access-control-allow-origin: https://www.elfcosmetics.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 06:39:42 GMT
content-type: text/plain
server: Google Frontend

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 98ms
97ms Image
image/gif 74.125.192.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=0&npa=1&gcs=G111&gcd=13v3v3v3u5l1&tid=G-5D80LRC85N&cid=zTHN0a%2BnjFn3SDdbEvTyEYd%2F3M2wxXGeGE674yNPDHs%3D.1735195175&gtm=45j91e4c50v9125640115z8896608294z99175401888za200zb896608294&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=159227366

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.192.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS