nordvpn.com Open in urlscan Pro
104.16.208.203 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://m.serves.2fh.co/
Effective URL:
https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110
Submission: On December 04 via api (December 4th 2024, 12:20:04 pm UTC) from US — Scanned from CA

Summary HTTP 95 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 21 IPs in 4 countries across 17 domains to perform 95 HTTP transactions. The main IP is 104.16.208.203, located in and belongs to CLOUDFLARENET, US. The main domain is nordvpn.com. The Cisco Umbrella rank of the primary domain is 15830.
TLS certificate: Issued by GlobalSign GCC R6 AlphaSSL CA 2023 on September 25th 2024. Valid for: a year.

This is the only time nordvpn.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.232.31.180 172.232.31.180	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
2	69.16.230.227 69.16.230.227	32244 (LIQUIDWEB) (LIQUIDWEB)
1 2	139.177.202.97 139.177.202.97	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
1 1	2a01:4f8:2190... 2a01:4f8:2190:2664::	24940 (HETZNER-A...) (HETZNER-AS Hetzner Online GmbH)
1 2	2606:4700:303... 2606:4700:3034::6815:2953	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	88.99.112.2 88.99.112.2	24940 (HETZNER-A...) (HETZNER-AS Hetzner Online GmbH)
2	52.84.18.77 52.84.18.77	16509 (AMAZON-02) (AMAZON-02)
1 3	95.211.116.26 95.211.116.26	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.)
2	3.162.125.109 3.162.125.109	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4004:c08::66	15169 (GOOGLE) (GOOGLE)
2 2	35.227.211.136 35.227.211.136	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	34.95.127.121 34.95.127.121	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	23.21.51.144 23.21.51.144	14618 (AMAZON-AES) (AMAZON-AES)
1 46	104.16.208.203 104.16.208.203	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2606:4700::68... 2606:4700::6810:9b6f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2606:4700::68... 2606:4700::6810:9c6f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2607:f8b0:400... 2607:f8b0:4004:c17::61	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c17::9c	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4004:c1b::5e	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4004:c1d::6a	15169 (GOOGLE) (GOOGLE)
1	18.67.76.12 18.67.76.12	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4004:c1b::9c	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c21::9a	15169 (GOOGLE) (GOOGLE)
2	3.167.112.89 3.167.112.89	16509 (AMAZON-02) (AMAZON-02)
1 2	142.251.179.149 142.251.179.149	15169 (GOOGLE) (GOOGLE)
1	142.251.111.149 142.251.111.149	15169 (GOOGLE) (GOOGLE)
95	21

1 172.232.31.180 (Chicago, United States) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: anchor02.parklogic.com

m.serves.2fh.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.16.230.227 (United States)

ASN32244 (LIQUIDWEB, US)
PTR: lb05.parklogic.com

ww99.2fh.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 139.177.202.97 (Atlanta, United States) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: 139-177-202-97.ip.linodeusercontent.com

10549.sellsnow.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4f8:2190:2664:: (Germany) 1 redirects

ASN24940 (HETZNER-AS Hetzner Online GmbH, DE)

plorexdry.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3034::6815:2953 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

shopbuttler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.99.112.2 (Aachen, Germany) 1 redirects

ASN24940 (HETZNER-AS Hetzner Online GmbH, DE)
PTR: app1.yadore.com

api.yadore.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.84.18.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-18-77.ord53.r.cloudfront.net

api.kelkoogroup.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 95.211.116.26 (Netherlands) 1 redirects

ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL)
PTR: dc1-ecs-pub-mx-vip.kelkoo.com

ca-go.kelkoogroup.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.162.125.109 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-162-125-109.iad61.r.cloudfront.net

dd.kelkoogroup.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c08::66 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.211.136 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 136.211.227.35.bc.googleusercontent.com

nordvpn.sjv.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.95.127.121 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 121.127.95.34.bc.googleusercontent.com

www.ojrq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.21.51.144 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-21-51-144.compute-1.amazonaws.com

go.nordvpn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

46 104.16.208.203 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

visit.nordvpn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
nordvpn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.nordvpn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
web-api.nordvpn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.nordvpn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6810:9b6f (United States)

ASN13335 (CLOUDFLARENET, US)

s1.nordcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sb.nordcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6810:9c6f (United States)

ASN13335 (CLOUDFLARENET, US)

ic.nordcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4004:c17::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c17::9c (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c1b::5e (Washington, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c1d::6a (Washington, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.67.76.12 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-76-12.iad89.r.cloudfront.net

65674e4462251d1db03ec8a9.webloader.smooch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1b::9c (Washington, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c21::9a (Washington, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.167.112.89 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-167-112-89.iad55.r.cloudfront.net

cdn.smooch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.179.149 (Farmingdale, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: pd-in-f149.1e100.net

12123059.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.111.149 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f149.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
46	nordvpn.com 1 redirects visit.nordvpn.com — Cisco Umbrella Rank: 841927 nordvpn.com — Cisco Umbrella Rank: 15830 d.nordvpn.com — Cisco Umbrella Rank: 315069 web-api.nordvpn.com — Cisco Umbrella Rank: 544137 cm.nordvpn.com — Cisco Umbrella Rank: 342824	102 KB
16	nordcdn.com s1.nordcdn.com — Cisco Umbrella Rank: 138268 ic.nordcdn.com — Cisco Umbrella Rank: 417369 sb.nordcdn.com — Cisco Umbrella Rank: 213182	242 KB
8	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 135 googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 td.doubleclick.net — Cisco Umbrella Rank: 182 12123059.fls.doubleclick.net — Cisco Umbrella Rank: 415241 ad.doubleclick.net — Cisco Umbrella Rank: 145	6 KB
7	kelkoogroup.net 1 redirects api.kelkoogroup.net ca-go.kelkoogroup.net dd.kelkoogroup.net — Cisco Umbrella Rank: 296022	70 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	517 KB
3	smooch.io 65674e4462251d1db03ec8a9.webloader.smooch.io cdn.smooch.io — Cisco Umbrella Rank: 32684	6 KB
3	google.com www.google.com — Cisco Umbrella Rank: 3	128 B
3	google.ca www.google.ca — Cisco Umbrella Rank: 11557	191 B
3	2fh.co 1 redirects m.serves.2fh.co ww99.2fh.co	2 KB
2	sjv.io 2 redirects nordvpn.sjv.io	1 KB
2	shopbuttler.com 1 redirects shopbuttler.com	3 KB
2	sellsnow.site 1 redirects 10549.sellsnow.site	2 KB
1	nordvpn.net 1 redirects go.nordvpn.net — Cisco Umbrella Rank: 457400	2 KB
1	ojrq.net 1 redirects www.ojrq.net — Cisco Umbrella Rank: 5483	577 B
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	546 B
1	yadore.com 1 redirects api.yadore.com — Cisco Umbrella Rank: 636074	361 B
1	plorexdry.com 1 redirects plorexdry.com	257 B
95	17

	Domain	Requested by
27	nordvpn.com	api.kelkoogroup.net nordvpn.com ww99.2fh.co
12	d.nordvpn.com	s1.nordcdn.com
9	ic.nordcdn.com	nordvpn.com
6	www.googletagmanager.com	nordvpn.com www.googletagmanager.com
4	cm.nordvpn.com	www.googletagmanager.com nordvpn.com
4	s1.nordcdn.com	nordvpn.com
3	www.google.com	www.googletagmanager.com nordvpn.com
3	www.google.ca	nordvpn.com
3	sb.nordcdn.com	nordvpn.com
3	ca-go.kelkoogroup.net	1 redirects api.kelkoogroup.net
2	12123059.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	cdn.smooch.io	ww99.2fh.co cdn.smooch.io
2	td.doubleclick.net	www.googletagmanager.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	web-api.nordvpn.com	nordvpn.com
2	nordvpn.sjv.io	2 redirects
2	dd.kelkoogroup.net	api.kelkoogroup.net dd.kelkoogroup.net
2	api.kelkoogroup.net	shopbuttler.com api.kelkoogroup.net
2	shopbuttler.com	1 redirects ww99.2fh.co
2	10549.sellsnow.site	1 redirects ww99.2fh.co
2	ww99.2fh.co	ww99.2fh.co
1	ad.doubleclick.net
1	65674e4462251d1db03ec8a9.webloader.smooch.io	ww99.2fh.co
1	stats.g.doubleclick.net	www.googletagmanager.com
1	visit.nordvpn.com	1 redirects
1	go.nordvpn.net	1 redirects
1	www.ojrq.net	1 redirects
1	www.google-analytics.com	api.kelkoogroup.net
1	api.yadore.com	1 redirects
1	plorexdry.com	1 redirects
1	m.serves.2fh.co	1 redirects
95	31

This site contains links to these domains. Also see Links.

Domain
www.av-test.org
twitter.com
www.youtube.com
www.independent.co.uk
support.nordvpn.com
my.nordaccount.com

Subject Issuer	Validity	Valid
ww99.2fh.co R11	`2024-11-14` - `2025-02-12`	3 months	crt.sh
shopbuttler.com WE1	`2024-10-08` - `2025-01-06`	3 months	crt.sh
api.kelkoogroup.net Amazon RSA 2048 M02	`2024-11-18` - `2025-12-16`	a year	crt.sh
*.kelkoogroup.net Thawte TLS RSA CA G1	`2024-09-26` - `2025-10-10`	a year	crt.sh
dd.kelkoogroup.net E6	`2024-10-07` - `2025-01-05`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.nordvpn.com GlobalSign GCC R6 AlphaSSL CA 2023	`2024-09-25` - `2025-10-27`	a year	crt.sh
*.nordcdn.com GlobalSign GCC R6 AlphaSSL CA 2023	`2024-03-13` - `2025-04-14`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.google.ca WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.webloader.smooch.io Amazon RSA 2048 M02	`2024-07-06` - `2025-08-04`	a year	crt.sh
*.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
media.smooch.io Amazon RSA 2048 M02	`2024-07-06` - `2025-08-04`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110
Frame ID: 92A82548246A92001A5F4EE672EBA600
Requests: 87 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4c30/sw_iframe.html?origin=https%3A%2F%2Fnordvpn.com
Frame ID: E505235EFB0FE81AAF03DBB0810479D9
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/950534254?random=1733314798551&cv=11&fst=1733314798551&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4bk0z86894354za201zb6894354&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&ref=https%3A%2F%2Fapi.kelkoogroup.net%2F&hn=www.googleadservices.com&frm=0&tiba=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&npa=0&pscdl=noapi&auid=1843384359.1733314798&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: 1CE859265ADDBF78819F5B389F2EC6A4
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/386034582?random=1733314798891&cv=11&fst=1733314798891&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9166857486z86894354za201zb6894354&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&ref=https%3A%2F%2Fapi.kelkoogroup.net%2F&hn=www.googleadservices.com&frm=0&tiba=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&npa=0&pscdl=noapi&auid=1843384359.1733314798&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: AE42524E54F62F66A3E42061E4267360
Requests: 1 HTTP requests in this frame

Frame: https://12123059.fls.doubleclick.net/activityi;dc_pre=COyvtueMjooDFbUsiAkduoEpbA;src=12123059;type=retar0;cat=purea0;ord=2148763687479;npa=1;auiddc=1843384359.1733314798;ps=1;pcor=1333725950;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4bk0v9181811535z86894354za201zb6894354;gcs=G111;gcd=13t3t3t3t7l1;dma=0;tag_exp=101925629~102067555~102067808~102081485;epver=2;~oref=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110
Frame ID: 76F5FDE919D9392C75CAC0198AEF1A95
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NordVPN’s Cyber Monday deal | NordVPN

Page URL History Show full URLs

http://m.serves.2fh.co/ HTTP 307
https://m.serves.2fh.co/ HTTP 302
http://ww99.2fh.co/ HTTP 307
https://ww99.2fh.co/ Page URL
https://ww99.2fh.co/page/bouncy.php?&bpae=GbhGtDvntUx%2F9ZthsSpzGAYbynQSVxq%2BxlfoX3UMejKeaSES5T... Page URL
http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272... HTTP 307
https://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272... HTTP 307
http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272... Page URL
http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272... HTTP 302
https://plorexdry.com/r/b?s=9153177342&s3=apix34&rsid=289320952caa8a99308a2720682d72b3&d=https%3A%... HTTP 302
https://shopbuttler.com/visit/bf3?d=nordvpn.com&nid=14&subid1=9153177342&subid2=&subid3=apix34&url=h... HTTP 302
https://shopbuttler.com/visit?click=K29CSUpFNy9seklYL25SV0V1amFCT1lIaWU0SVVXeXMyejBsOHBITEV5Z3BKdUFo... Page URL
https://api.yadore.com/v2/r/deeplink?e=RjhTN3JhblRvdmZyU3FCbUhacTVsK1owMFVWY01ZeE9CSjNIY2RESVVucXA4... HTTP 302
https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-b... Page URL
https://ca-go.kelkoogroup.net/redirect?country=ca&k=612f7a9541cd6ea61eb554c0e4cff437473123ea2017595b43a3ff... HTTP 303
https://nordvpn.sjv.io/c/3600909/417838/7452?subId1=62A901JE8SSMNV35F4VQ9Q271E0WCB&u=https%3A%2F%2F... HTTP 302
https://www.ojrq.net/p/?return=https%3A%2F%2Fnordvpn.sjv.io%2Fc%2F3600909%2F417838%2F7452%3FsubId... HTTP 302
https://nordvpn.sjv.io/c/3600909/417838/7452?subId1=62A901JE8SSMNV35F4VQ9Q271E0WCB&u=https%3A%2F%2F... HTTP 301
https://go.nordvpn.net/aff_c?irgwc=1&aff_sub=3600909&offer_id=15&aff_id=8110&aff_sub2=xR1z78TU%3Axy... HTTP 302
https://visit.nordvpn.com/?offer_id=15&aff_id=8110&aff_transaction_id=102f6dc4ab13901a89420b01de982e&s... HTTP 302
https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off... Page URL

Detected technologies

Datadome (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

95
Requests

98 %
HTTPS

42 %
IPv6

17
Domains

31
Subdomains

21
IPs

4
Countries

1050 kB
Transfer

2638 kB
Size

44
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.av-test.org/fileadmin/pdf/reports/AV-TEST_NordVPN_Comparative_Test_Report_September_2020.pdf
Title: the full report

Search URL Search Domain Scan URL

URL: https://twitter.com/Alch3m1s7/status/1639579744550133760/?s=20
Title: A|ch3m1st @Alch3m1s7 @NordVPN the new meshnet is mind-blowingly amazing piece of tech 🚀, with unlimited bottomless use cases. God bless ya all! 🙌 12:47 PM · Mar 25, 2023

Search URL Search Domain Scan URL

URL: https://twitter.com/MrNathanCorliss/status/1636840377494933504/
Title: Nathan Corliss @MrNathanCorliss This is completely unsolicited praise, @NordVPN, is very helpful as an advertiser testing search ads, and as a work-anywhere person who needs to ensure I have a safe internet connection. Great value. So easy to use, I actually use it. Keep up the good work. 11:22 PM · Mar 17, 2023

Search URL Search Domain Scan URL

URL: https://twitter.com/PedroTheKiwi/status/1633502224721793024/
Title: Pedro @PedroTheKiwi I’ve been using NordVPN and their other products for the last 4 years. Absolutely outstanding product and service 10:25 AM · Mar 8, 2023

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch/?v=nVyuyXXwEws&t=114s
Title: Watch on YouTube

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch/?v=TXLUafBNjnc&t=215s
Title: Watch on YouTube

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch/?v=ev3GMJXKHSI&t=330s
Title: Watch on YouTube

Search URL Search Domain Scan URL

URL: https://www.independent.co.uk/advisor/vpn/nordvpn-review/
Title: Independent Advisor

Search URL Search Domain Scan URL

URL: https://support.nordvpn.com/hc/en-us
Title: Help Center

Search URL Search Domain Scan URL

URL: https://my.nordaccount.com/legal/terms-of-service/
Title: Terms of Service

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://m.serves.2fh.co/ HTTP 307
https://m.serves.2fh.co/ HTTP 302
http://ww99.2fh.co/ HTTP 307
https://ww99.2fh.co/ Page URL
https://ww99.2fh.co/page/bouncy.php?&bpae=GbhGtDvntUx%2F9ZthsSpzGAYbynQSVxq%2BxlfoX3UMejKeaSES5TbjYNBKhX9YS3qdwbqRjYVRJCN2YL98ghruGr5kG8dkhoKm1Xu5IdQYIwgkvIdG%2FgU7p6W3r1DhYK4v9XW1CLbzBuGJ%2Bpl8NeMd43EHrFKJGjnYbnmaFcU7ArPB3qFZrXZLNWHtIS4lPxYiSIjXlz21OHra3iZaQAqR4e3uO6UpHgdwrMUtUdO5DI1aCgzC1Hbmpb%2BYyvPwFVq8rC4RPTnrFfIw9Y2swn4j3wjLj5zUFYmbqsvJZjA3R76Y1udmtWCyuBBF78QeU7GQ2CIxqRrB7FIq%2FzrlLBrq8eOOd7oXMGNB1hQs%2FiAiVhh6SCnP6mFad%2FB%2FPU6le8Ghgg8WvfJJc78gFen6nJi8bjgYQT%2FajuMSM4ZYIZzaX%2BtsjJqZYr3l7IkLeeojBbIj0CO%2FGv5LHbvabg8NULomnA9OHrAKYdjmHb7Q8Y2uXBb%2BTc7I4QHoXUx2hGHfPi%2FnikFDf7dxGAx%2FaDlYzBgbJQemtdTVLMrJNvc0j90%3D&redirectType=js&inIframe=false&inPopUp=false Page URL
http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed HTTP 307
https://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed HTTP 307
http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed Page URL
http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg== HTTP 302
https://plorexdry.com/r/b?s=9153177342&s3=apix34&rsid=289320952caa8a99308a2720682d72b3&d=https%3A%2F%2F2fh.co HTTP 302
https://shopbuttler.com/visit/bf3?d=nordvpn.com&nid=14&subid1=9153177342&subid2=&subid3=apix34&url=https%3A%2F%2Fnordvpn.com&rtb_key=016f1a5ff221ac68d1767b7a978535a0&tsv=1733314791&shv=85f5ba02b5c32a90be7e89aa7c21a989 HTTP 302
https://shopbuttler.com/visit?click=K29CSUpFNy9seklYL25SV0V1amFCT1lIaWU0SVVXeXMyejBsOHBITEV5Z3BKdUFoN3AybWhJdU5SVUpVOEU1OE9mNnVFOWpPa0NBeTJ1Qk8xR3dxcXEybFdjbXR0MHdEb21VVVRaV2MwSWltbGVQVHJmeTgrRHhYczNmTFBIdVBzT29ZNEVkOXh5NnArbzRSREVCOWZFQzMzc2h4dmdEZHJXc2gvMVdGMUxmL3ZiUy9jRmUzYkNKMVRNTERTeEFKNzVuMFFLSFhoNnlwaW9Yd3F3ZG42Q283WE55QUVUTkRNc0d6Qm9HckZWY25RSUJ2VVQ2bkFKbW1ZTEdxOEJPbC9wZUFWeFlpVUY2RnlhMUZCUzJka3kvRnNJQUlPUVVhdFp1d2NtcThCUGNydy96TWZIL2dtWEtBTVVnQVR6aVJiUjJwdGY5ZUxMWFkzYVF3S3h2cnFqakJzWmNla1lYZHZZZHpZQStWdEdlUzUwSWh4aWc3REhBSWhkcENkRUtqUkVFWmhRVTNuR1FnU2tSbnd2WVNMUnd2cW9icEFZK2NLS1EwY3JEanVZZWQ0cnpzbjRaRWJmNEUxYmdka0l3UXNQQXR4aEREZEpmWC9WMFo2dmVhdlFBQTc2cktZTFhRL2dPalpqL2hBVllJVTAvTWRmVHF0anQ1RCtacUVubWZBdWh5eThFbjNYS3MyekM4QVVoZXA0RERqWWNOZnE2TTFlQ1FPblhvWlpnTCs3a3pMQy80am5UcFN2NUJLMkZMMXZvSWYrak1XOFVPSnJEY1dSUE5BcUF4K0tLeEV3WFBIcmNDN29XWllZam1iSGkyVVVaNElHT3VCSFJKYW9NTWp5U2hibVFiUG81VWsvL2x5ejVhVXc9PQ%3D%3D Page URL
https://api.yadore.com/v2/r/deeplink?e=RjhTN3JhblRvdmZyU3FCbUhacTVsK1owMFVWY01ZeE9CSjNIY2RESVVucXA4bEU2NWU0ZnRucGF0dDVaaVFZTUtQSWVyNnZWN0VOeVNqRkg4YjRGUUJ5TEVhZnN2bmFIWVcvZGlDWkdVWDFrMUZya2g1Z0IzVUlDS0tZUFgrbXA5bzNYbG9mS01xWW9sN000ay93eThzaGp1bWI3K2JuU1RGQVd4Z0orZmE2azBRY1pwTDVOMVgzZjFqWENyOFpvR0M2WHBvMHN0TWpvK3pDNzNxb2xyTlFRQVhHMUFZdWtac1cwSjhjNHhkV0JNSi96RGlCSC9nZlBlSUpTVXZxNg==&i=1KdiJq91X/cV0lav&placementId=bf3a71022960ec23dbebd001691e1843 HTTP 302
https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com Page URL
https://ca-go.kelkoogroup.net/redirect?country=ca&k=612f7a9541cd6ea61eb554c0e4cff437473123ea2017595b43a3ffed7276115685d16d6c6e9a76b0d24f98d4e50ce141f227b1eadaa10f898330a1751db83cc2630abaa7dbde3d7444858f2c5f77d276f818cacf1e2e3ca79be1c3aa9ece277a79f74478edc84490f95b426e7cfca31bdec0396ab0dbcb8792bea6e39560da34e22b1fc8f5e059eb40a688218e9c0809c14c60f9a4356c4cfb150a458522d7c0b6a277ada0a327ea92aa7218e8dd16714d70977d4e592c25b533dc2f8409fa90f32f7d8b687dc1359538d762c150fac211aa5025fe27ff57d7ba4542c8bc8a9815df13cf3bdba279dbba3e76acc6ce67fa9851c95c2c41557c1205312bf193f12e196f3a287cc6f9a6869975fcb69dcb576e858593f99a478a6d45a4e5fbaaa7e93efe52f9e8401073cc339755247d7649a6c6c0efcd8f96fcd1ff545e4996287449393598b38bb1af210fb01f8df3de4f1bf3e1678bb48f3d79adfd042888cf452a9bbae9309d7d03505b6956f1205f06eba1edabbc1beb&url=https%3A%2F%2Fnordvpn.sjv.io%2Fc%2F3600909%2F417838%2F7452%3FsubId1%3D62A901JE8SSMNV35F4VQ9Q271E0WCB%26u%3Dhttps%253A%252F%252Fnordvpn.com HTTP 303
https://nordvpn.sjv.io/c/3600909/417838/7452?subId1=62A901JE8SSMNV35F4VQ9Q271E0WCB&u=https%3A%2F%2Fnordvpn.com HTTP 302
https://www.ojrq.net/p/?return=https%3A%2F%2Fnordvpn.sjv.io%2Fc%2F3600909%2F417838%2F7452%3FsubId1%3D62A901JE8SSMNV35F4VQ9Q271E0WCB%26u%3Dhttps%253A%252F%252Fnordvpn.com%26level%3D1%26srcref%3Dhttps%253A%252F%252Fapi.kelkoogroup.net%252F&cid=7452&tpsync=yes&auth=582933e751afd24f HTTP 302
https://nordvpn.sjv.io/c/3600909/417838/7452?subId1=62A901JE8SSMNV35F4VQ9Q271E0WCB&u=https%3A%2F%2Fnordvpn.com&level=1&srcref=https%3A%2F%2Fapi.kelkoogroup.net%2F&brwsr=12453ef8-b23a-11ef-bd83-9fc2311b2f71&brwsrsig=0i32XVQvv1qrVEeXrLXosRvoV6pw4c HTTP 301
https://go.nordvpn.net/aff_c?irgwc=1&aff_sub=3600909&offer_id=15&aff_id=8110&aff_sub2=xR1z78TU%3AxyKTfzR62zwD29ZUkCVBlXPv0zVTo0&url_id=902 HTTP 302
https://visit.nordvpn.com/?offer_id=15&aff_id=8110&aff_transaction_id=102f6dc4ab13901a89420b01de982e&source=&params[ho_asub1]=3600909&url_id=533 HTTP 302
https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://m.serves.2fh.co/ HTTP 307
https://m.serves.2fh.co/ HTTP 302
http://ww99.2fh.co/ HTTP 307
https://ww99.2fh.co/

Request Chain 2

http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed HTTP 307
https://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed HTTP 307
http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed

Request Chain 3

http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg== HTTP 302
https://plorexdry.com/r/b?s=9153177342&s3=apix34&rsid=289320952caa8a99308a2720682d72b3&d=https%3A%2F%2F2fh.co HTTP 302
https://shopbuttler.com/visit/bf3?d=nordvpn.com&nid=14&subid1=9153177342&subid2=&subid3=apix34&url=https%3A%2F%2Fnordvpn.com&rtb_key=016f1a5ff221ac68d1767b7a978535a0&tsv=1733314791&shv=85f5ba02b5c32a90be7e89aa7c21a989 HTTP 302
https://shopbuttler.com/visit?click=K29CSUpFNy9seklYL25SV0V1amFCT1lIaWU0SVVXeXMyejBsOHBITEV5Z3BKdUFoN3AybWhJdU5SVUpVOEU1OE9mNnVFOWpPa0NBeTJ1Qk8xR3dxcXEybFdjbXR0MHdEb21VVVRaV2MwSWltbGVQVHJmeTgrRHhYczNmTFBIdVBzT29ZNEVkOXh5NnArbzRSREVCOWZFQzMzc2h4dmdEZHJXc2gvMVdGMUxmL3ZiUy9jRmUzYkNKMVRNTERTeEFKNzVuMFFLSFhoNnlwaW9Yd3F3ZG42Q283WE55QUVUTkRNc0d6Qm9HckZWY25RSUJ2VVQ2bkFKbW1ZTEdxOEJPbC9wZUFWeFlpVUY2RnlhMUZCUzJka3kvRnNJQUlPUVVhdFp1d2NtcThCUGNydy96TWZIL2dtWEtBTVVnQVR6aVJiUjJwdGY5ZUxMWFkzYVF3S3h2cnFqakJzWmNla1lYZHZZZHpZQStWdEdlUzUwSWh4aWc3REhBSWhkcENkRUtqUkVFWmhRVTNuR1FnU2tSbnd2WVNMUnd2cW9icEFZK2NLS1EwY3JEanVZZWQ0cnpzbjRaRWJmNEUxYmdka0l3UXNQQXR4aEREZEpmWC9WMFo2dmVhdlFBQTc2cktZTFhRL2dPalpqL2hBVllJVTAvTWRmVHF0anQ1RCtacUVubWZBdWh5eThFbjNYS3MyekM4QVVoZXA0RERqWWNOZnE2TTFlQ1FPblhvWlpnTCs3a3pMQy80am5UcFN2NUJLMkZMMXZvSWYrak1XOFVPSnJEY1dSUE5BcUF4K0tLeEV3WFBIcmNDN29XWllZam1iSGkyVVVaNElHT3VCSFJKYW9NTWp5U2hibVFiUG81VWsvL2x5ejVhVXc9PQ%3D%3D

Request Chain 4

https://api.yadore.com/v2/r/deeplink?e=RjhTN3JhblRvdmZyU3FCbUhacTVsK1owMFVWY01ZeE9CSjNIY2RESVVucXA4bEU2NWU0ZnRucGF0dDVaaVFZTUtQSWVyNnZWN0VOeVNqRkg4YjRGUUJ5TEVhZnN2bmFIWVcvZGlDWkdVWDFrMUZya2g1Z0IzVUlDS0tZUFgrbXA5bzNYbG9mS01xWW9sN000ay93eThzaGp1bWI3K2JuU1RGQVd4Z0orZmE2azBRY1pwTDVOMVgzZjFqWENyOFpvR0M2WHBvMHN0TWpvK3pDNzNxb2xyTlFRQVhHMUFZdWtac1cwSjhjNHhkV0JNSi96RGlCSC9nZlBlSUpTVXZxNg==&i=1KdiJq91X/cV0lav&placementId=bf3a71022960ec23dbebd001691e1843 HTTP 302
https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com

Request Chain 95

https://12123059.fls.doubleclick.net/activityi;src=12123059;type=retar0;cat=purea0;ord=2148763687479;npa=1;auiddc=1843384359.1733314798;ps=1;pcor=1333725950;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4bk0v9181811535z86894354za201zb6894354;gcs=G111;gcd=13t3t3t3t7l1;dma=0;tag_exp=101925629~102067555~102067808~102081485;epver=2;~oref=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110 HTTP 302
https://12123059.fls.doubleclick.net/activityi;dc_pre=COyvtueMjooDFbUsiAkduoEpbA;src=12123059;type=retar0;cat=purea0;ord=2148763687479;npa=1;auiddc=1843384359.1733314798;ps=1;pcor=1333725950;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4bk0v9181811535z86894354za201zb6894354;gcs=G111;gcd=13t3t3t3t7l1;dma=0;tag_exp=101925629~102067555~102067808~102081485;epver=2;~oref=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110

95 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
ww99.2fh.co/
Redirect Chain

http://m.serves.2fh.co/
https://m.serves.2fh.co/
http://ww99.2fh.co/
https://ww99.2fh.co/

2 KB
953 B

991ms
595ms

Document
text/html

69.16.230.227
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://ww99.2fh.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.230.227 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: lb05.parklogic.com
Software: /
Resource Hash: ff6a6561acd0662b535c9730241d7f98bbac7e06d61d52d541d3472bc856557d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html
date: Wed, 04 Dec 2024 12:19:47 GMT
pragma: no-cache

Redirect headers

Location: https://ww99.2fh.co/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 bouncy.php
ww99.2fh.co/page/ 1 KB
563 B 79ms
78ms Document
text/html 69.16.230.227
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://ww99.2fh.co/page/bouncy.php?&bpae=GbhGtDvntUx%2F9ZthsSpzGAYbynQSVxq%2BxlfoX3UMejKeaSES5TbjYNBKhX9YS3qdwbqRjYVRJCN2YL98ghruGr5kG8dkhoKm1Xu5IdQYIwgkvIdG%2FgU7p6W3r1DhYK4v9XW1CLbzBuGJ%2Bpl8NeMd43EHrFKJGjnYbnmaFcU7ArPB3qFZrXZLNWHtIS4lPxYiSIjXlz21OHra3iZaQAqR4e3uO6UpHgdwrMUtUdO5DI1aCgzC1Hbmpb%2BYyvPwFVq8rC4RPTnrFfIw9Y2swn4j3wjLj5zUFYmbqsvJZjA3R76Y1udmtWCyuBBF78QeU7GQ2CIxqRrB7FIq%2FzrlLBrq8eOOd7oXMGNB1hQs%2FiAiVhh6SCnP6mFad%2FB%2FPU6le8Ghgg8WvfJJc78gFen6nJi8bjgYQT%2FajuMSM4ZYIZzaX%2BtsjJqZYr3l7IkLeeojBbIj0CO%2FGv5LHbvabg8NULomnA9OHrAKYdjmHb7Q8Y2uXBb%2BTc7I4QHoXUx2hGHfPi%2FnikFDf7dxGAx%2FaDlYzBgbJQemtdTVLMrJNvc0j90%3D&redirectType=js&inIframe=false&inPopUp=false
Requested by: Host: ww99.2fh.co
URL: https://ww99.2fh.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.230.227 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: lb05.parklogic.com
Software: /
Resource Hash

Request headers

Referer: https://ww99.2fh.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html
date: Wed, 04 Dec 2024 12:19:47 GMT
pragma: no-cache

GET
H/1.1

200
OK

feed
10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/
Redirect Chain

http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed
https://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed
http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed

3 KB
2 KB

76ms
75ms

Document
text/html

139.177.202.97
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed
Requested by: Host: ww99.2fh.co
URL: https://ww99.2fh.co/page/bouncy.php?&bpae=GbhGtDvntUx%2F9ZthsSpzGAYbynQSVxq%2BxlfoX3UMejKeaSES5TbjYNBKhX9YS3qdwbqRjYVRJCN2YL98ghruGr5kG8dkhoKm1Xu5IdQYIwgkvIdG%2FgU7p6W3r1DhYK4v9XW1CLbzBuGJ%2Bpl8NeMd43EHrFKJGjnYbnmaFcU7ArPB3qFZrXZLNWHtIS4lPxYiSIjXlz21OHra3iZaQAqR4e3uO6UpHgdwrMUtUdO5DI1aCgzC1Hbmpb%2BYyvPwFVq8rC4RPTnrFfIw9Y2swn4j3wjLj5zUFYmbqsvJZjA3R76Y1udmtWCyuBBF78QeU7GQ2CIxqRrB7FIq%2FzrlLBrq8eOOd7oXMGNB1hQs%2FiAiVhh6SCnP6mFad%2FB%2FPU6le8Ghgg8WvfJJc78gFen6nJi8bjgYQT%2FajuMSM4ZYIZzaX%2BtsjJqZYr3l7IkLeeojBbIj0CO%2FGv5LHbvabg8NULomnA9OHrAKYdjmHb7Q8Y2uXBb%2BTc7I4QHoXUx2hGHfPi%2FnikFDf7dxGAx%2FaDlYzBgbJQemtdTVLMrJNvc0j90%3D&redirectType=js&inIframe=false&inPopUp=false
Protocol: HTTP/1.1
Server: 139.177.202.97 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 139-177-202-97.ip.linodeusercontent.com
Software: nginx/1.24.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://ww99.2fh.co/page/bouncy.php?&bpae=GbhGtDvntUx%2F9ZthsSpzGAYbynQSVxq%2BxlfoX3UMejKeaSES5TbjYNBKhX9YS3qdwbqRjYVRJCN2YL98ghruGr5kG8dkhoKm1Xu5IdQYIwgkvIdG%2FgU7p6W3r1DhYK4v9XW1CLbzBuGJ%2Bpl8NeMd43EHrFKJGjnYbnmaFcU7ArPB3qFZrXZLNWHtIS4lPxYiSIjXlz21OHra3iZaQAqR4e3uO6UpHgdwrMUtUdO5DI1aCgzC1Hbmpb%2BYyvPwFVq8rC4RPTnrFfIw9Y2swn4j3wjLj5zUFYmbqsvJZjA3R76Y1udmtWCyuBBF78QeU7GQ2CIxqRrB7FIq%2FzrlLBrq8eOOd7oXMGNB1hQs%2FiAiVhh6SCnP6mFad%2FB%2FPU6le8Ghgg8WvfJJc78gFen6nJi8bjgYQT%2FajuMSM4ZYIZzaX%2BtsjJqZYr3l7IkLeeojBbIj0CO%2FGv5LHbvabg8NULomnA9OHrAKYdjmHb7Q8Y2uXBb%2BTc7I4QHoXUx2hGHfPi%2FnikFDf7dxGAx%2FaDlYzBgbJQemtdTVLMrJNvc0j90%3D&redirectType=js&inIframe=false&inPopUp=false
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 04 Dec 2024 12:19:50 GMT
server: nginx/1.24.0 (Ubuntu)
transfer-encoding: chunked

Redirect headers

Location: http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed
Non-Authoritative-Reason: HttpsUpgrades

GET
H3

200

visit
shopbuttler.com/
Redirect Chain

http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==
https://plorexdry.com/r/b?s=9153177342&s3=apix34&rsid=289320952caa8a99308a2720682d72b3&d=https%3A%2F%2F2fh.co
https://shopbuttler.com/visit/bf3?d=nordvpn.com&nid=14&subid1=9153177342&subid2=&subid3=apix34&url=https%3A%2F%2Fnordvpn.com&rtb_key=016f1a5ff221ac68d1767b7a978535a0&tsv=1733314791&shv=85f5ba02b5c3...
https://shopbuttler.com/visit?click=K29CSUpFNy9seklYL25SV0V1amFCT1lIaWU0SVVXeXMyejBsOHBITEV5Z3BKdUFoN3AybWhJdU5SVUpVOEU1OE9mNnVFOWpPa0NBeTJ1Qk8xR3dxcXEybFdjbXR0MHdEb21VVVRaV2MwSWltbGVQVHJmeTgrRHhYc...

1 KB
1 KB

150ms
149ms

Document
text/html

2606:4700:3034::6815:2953
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://shopbuttler.com/visit?click=K29CSUpFNy9seklYL25SV0V1amFCT1lIaWU0SVVXeXMyejBsOHBITEV5Z3BKdUFoN3AybWhJdU5SVUpVOEU1OE9mNnVFOWpPa0NBeTJ1Qk8xR3dxcXEybFdjbXR0MHdEb21VVVRaV2MwSWltbGVQVHJmeTgrRHhYczNmTFBIdVBzT29ZNEVkOXh5NnArbzRSREVCOWZFQzMzc2h4dmdEZHJXc2gvMVdGMUxmL3ZiUy9jRmUzYkNKMVRNTERTeEFKNzVuMFFLSFhoNnlwaW9Yd3F3ZG42Q283WE55QUVUTkRNc0d6Qm9HckZWY25RSUJ2VVQ2bkFKbW1ZTEdxOEJPbC9wZUFWeFlpVUY2RnlhMUZCUzJka3kvRnNJQUlPUVVhdFp1d2NtcThCUGNydy96TWZIL2dtWEtBTVVnQVR6aVJiUjJwdGY5ZUxMWFkzYVF3S3h2cnFqakJzWmNla1lYZHZZZHpZQStWdEdlUzUwSWh4aWc3REhBSWhkcENkRUtqUkVFWmhRVTNuR1FnU2tSbnd2WVNMUnd2cW9icEFZK2NLS1EwY3JEanVZZWQ0cnpzbjRaRWJmNEUxYmdka0l3UXNQQXR4aEREZEpmWC9WMFo2dmVhdlFBQTc2cktZTFhRL2dPalpqL2hBVllJVTAvTWRmVHF0anQ1RCtacUVubWZBdWh5eThFbjNYS3MyekM4QVVoZXA0RERqWWNOZnE2TTFlQ1FPblhvWlpnTCs3a3pMQy80am5UcFN2NUJLMkZMMXZvSWYrak1XOFVPSnJEY1dSUE5BcUF4K0tLeEV3WFBIcmNDN29XWllZam1iSGkyVVVaNElHT3VCSFJKYW9NTWp5U2hibVFiUG81VWsvL2x5ejVhVXc9PQ%3D%3D
Requested by: Host: ww99.2fh.co
URL: https://ww99.2fh.co/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:2953 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: http://10549.sellsnow.site/match-10549/92437/190812651/1733314787/mf_b2f3c120-f794-4e99-b308-3dfc9d7272f3/YXBpeDM0LTJmaC5jb3xIMkVQVEo4U0cyMzVMUlpGMVpCUFNIV1Z8MTY0Mg==/feed
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf4ddc8aefa3-EWR
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Wed, 04 Dec 2024 12:19:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gUMIEjeShVCOSJ3U33tWaKgDudKuBeDGSwAZn7%2BwU1Tc6apXJ0JNwxkmpXFC%2FVFoVwToaJGRTxn2LLrq1dwqwwW9gmmILL9W%2BBJ%2FyiHZmtxgvzLs1pq4hy1Kj2i4AvuV9k2UHUGmu1FzbW2NlYs%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=44197&min_rtt=42956&rtt_var=3666&sent=20&recv=16&lost=0&retrans=0&sent_bytes=9767&recv_bytes=5893&delivery_rate=430&cwnd=12000&unsent_bytes=0&cid=47cc6b6717eed4d5&ts=755&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf4a4bbfefa3-EWR
content-type: text/html; charset=utf-8
date: Wed, 04 Dec 2024 12:19:52 GMT
location: https://shopbuttler.com/visit?click=K29CSUpFNy9seklYL25SV0V1amFCT1lIaWU0SVVXeXMyejBsOHBITEV5Z3BKdUFoN3AybWhJdU5SVUpVOEU1OE9mNnVFOWpPa0NBeTJ1Qk8xR3dxcXEybFdjbXR0MHdEb21VVVRaV2MwSWltbGVQVHJmeTgrRHhYczNmTFBIdVBzT29ZNEVkOXh5NnArbzRSREVCOWZFQzMzc2h4dmdEZHJXc2gvMVdGMUxmL3ZiUy9jRmUzYkNKMVRNTERTeEFKNzVuMFFLSFhoNnlwaW9Yd3F3ZG42Q283WE55QUVUTkRNc0d6Qm9HckZWY25RSUJ2VVQ2bkFKbW1ZTEdxOEJPbC9wZUFWeFlpVUY2RnlhMUZCUzJka3kvRnNJQUlPUVVhdFp1d2NtcThCUGNydy96TWZIL2dtWEtBTVVnQVR6aVJiUjJwdGY5ZUxMWFkzYVF3S3h2cnFqakJzWmNla1lYZHZZZHpZQStWdEdlUzUwSWh4aWc3REhBSWhkcENkRUtqUkVFWmhRVTNuR1FnU2tSbnd2WVNMUnd2cW9icEFZK2NLS1EwY3JEanVZZWQ0cnpzbjRaRWJmNEUxYmdka0l3UXNQQXR4aEREZEpmWC9WMFo2dmVhdlFBQTc2cktZTFhRL2dPalpqL2hBVllJVTAvTWRmVHF0anQ1RCtacUVubWZBdWh5eThFbjNYS3MyekM4QVVoZXA0RERqWWNOZnE2TTFlQ1FPblhvWlpnTCs3a3pMQy80am5UcFN2NUJLMkZMMXZvSWYrak1XOFVPSnJEY1dSUE5BcUF4K0tLeEV3WFBIcmNDN29XWllZam1iSGkyVVVaNElHT3VCSFJKYW9NTWp5U2hibVFiUG81VWsvL2x5ejVhVXc9PQ%3D%3D
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
referrer-policy: no-referrer
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6OFBUbQK0VzSE3c1ehsGWmncQ7GUsd3HhWYiytUFjblqsEzvP%2FHPsHMZf7Q86J9Os6PCnUQqK72K3q03xBWfkGAK0wJrKPZ3S4gKsVWrHaT5uIZtbRjLLuaCu2MKIz0KgKe0WeUbStLGin0DMJ0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=43295&min_rtt=42956&rtt_var=7047&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4175&recv_bytes=4557&delivery_rate=410&cwnd=12000&unsent_bytes=0&cid=47cc6b6717eed4d5&ts=601&x=1" cfExtPri cfHdrFlush;dur=0

GET
H2

200

link Show response
api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/
Redirect Chain

https://api.yadore.com/v2/r/deeplink?e=RjhTN3JhblRvdmZyU3FCbUhacTVsK1owMFVWY01ZeE9CSjNIY2RESVVucXA4bEU2NWU0ZnRucGF0dDVaaVFZTUtQSWVyNnZWN0VOeVNqRkg4YjRGUUJ5TEVhZnN2bmFIWVcvZGlDWkdVWDFrMUZya2g1Z0IzVU...
https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ced...

33 KB
34 KB

723ms
324ms

Document
text/html

52.84.18.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com

Requested by

Host: shopbuttler.com
URL: https://shopbuttler.com/visit?click=K29CSUpFNy9seklYL25SV0V1amFCT1lIaWU0SVVXeXMyejBsOHBITEV5Z3BKdUFoN3AybWhJdU5SVUpVOEU1OE9mNnVFOWpPa0NBeTJ1Qk8xR3dxcXEybFdjbXR0MHdEb21VVVRaV2MwSWltbGVQVHJmeTgrRHhYczNmTFBIdVBzT29ZNEVkOXh5NnArbzRSREVCOWZFQzMzc2h4dmdEZHJXc2gvMVdGMUxmL3ZiUy9jRmUzYkNKMVRNTERTeEFKNzVuMFFLSFhoNnlwaW9Yd3F3ZG42Q283WE55QUVUTkRNc0d6Qm9HckZWY25RSUJ2VVQ2bkFKbW1ZTEdxOEJPbC9wZUFWeFlpVUY2RnlhMUZCUzJka3kvRnNJQUlPUVVhdFp1d2NtcThCUGNydy96TWZIL2dtWEtBTVVnQVR6aVJiUjJwdGY5ZUxMWFkzYVF3S3h2cnFqakJzWmNla1lYZHZZZHpZQStWdEdlUzUwSWh4aWc3REhBSWhkcENkRUtqUkVFWmhRVTNuR1FnU2tSbnd2WVNMUnd2cW9icEFZK2NLS1EwY3JEanVZZWQ0cnpzbjRaRWJmNEUxYmdka0l3UXNQQXR4aEREZEpmWC9WMFo2dmVhdlFBQTc2cktZTFhRL2dPalpqL2hBVllJVTAvTWRmVHF0anQ1RCtacUVubWZBdWh5eThFbjNYS3MyekM4QVVoZXA0RERqWWNOZnE2TTFlQ1FPblhvWlpnTCs3a3pMQy80am5UcFN2NUJLMkZMMXZvSWYrak1XOFVPSnJEY1dSUE5BcUF4K0tLeEV3WFBIcmNDN29XWllZam1iSGkyVVVaNElHT3VCSFJKYW9NTWp5U2hibVFiUG81VWsvL2x5ejVhVXc9PQ%3D%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.18.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-18-77.ord53.r.cloudfront.net

Software

Resource Hash

39656b9b32d6520b8a7390daef9db51c60e286b19ede3127d7b908751b187565

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

Referer: https://shopbuttler.com/visit?click=K29CSUpFNy9seklYL25SV0V1amFCT1lIaWU0SVVXeXMyejBsOHBITEV5Z3BKdUFoN3AybWhJdU5SVUpVOEU1OE9mNnVFOWpPa0NBeTJ1Qk8xR3dxcXEybFdjbXR0MHdEb21VVVRaV2MwSWltbGVQVHJmeTgrRHhYczNmTFBIdVBzT29ZNEVkOXh5NnArbzRSREVCOWZFQzMzc2h4dmdEZHJXc2gvMVdGMUxmL3ZiUy9jRmUzYkNKMVRNTERTeEFKNzVuMFFLSFhoNnlwaW9Yd3F3ZG42Q283WE55QUVUTkRNc0d6Qm9HckZWY25RSUJ2VVQ2bkFKbW1ZTEdxOEJPbC9wZUFWeFlpVUY2RnlhMUZCUzJka3kvRnNJQUlPUVVhdFp1d2NtcThCUGNydy96TWZIL2dtWEtBTVVnQVR6aVJiUjJwdGY5ZUxMWFkzYVF3S3h2cnFqakJzWmNla1lYZHZZZHpZQStWdEdlUzUwSWh4aWc3REhBSWhkcENkRUtqUkVFWmhRVTNuR1FnU2tSbnd2WVNMUnd2cW9icEFZK2NLS1EwY3JEanVZZWQ0cnpzbjRaRWJmNEUxYmdka0l3UXNQQXR4aEREZEpmWC9WMFo2dmVhdlFBQTc2cktZTFhRL2dPalpqL2hBVllJVTAvTWRmVHF0anQ1RCtacUVubWZBdWh5eThFbjNYS3MyekM4QVVoZXA0RERqWWNOZnE2TTFlQ1FPblhvWlpnTCs3a3pMQy80am5UcFN2NUJLMkZMMXZvSWYrak1XOFVPSnJEY1dSUE5BcUF4K0tLeEV3WFBIcmNDN29XWllZam1iSGkyVVVaNElHT3VCSFJKYW9NTWp5U2hibVFiUG81VWsvL2x5ejVhVXc9PQ%3D%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
clickid: 107698111_1733314794135_36631665
content-length: 33322
content-type: text/html; charset=UTF-8
country: ca
date: Wed, 04 Dec 2024 12:19:53 GMT
leadid: 62A901JE8SSMNV35F4VQ9Q271E0WCB
referrer-policy: origin-when-cross-origin
request-time: PT0.058852687S
via: 1.1 72b39a2780dc291594c15dd795ced542.cloudfront.net (CloudFront)
x-amz-cf-id: WHUmV2_fJDg0SFatd8vSzkrjExQqbTuzjXVDG-T8okBEbuOYbCJYbA==
x-amz-cf-pop: ORD53-C2
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-datadome: protected
x-frame-options: ALLOWALL
x-gravitee-request-id: c8e3fa19-e95c-44b8-a3fa-19e95c94b8e7
x-gravitee-transaction-id: c8e3fa19-e95c-44b8-a3fa-19e95c94b8e7
x-permitted-cross-domain-policies: master-only
x-robots-tag: noindex,nofollow
x-xss-protection: 1; mode=block

Redirect headers

content-type: text/html; charset=UTF-8
date: Wed, 04 Dec 2024 12:19:53 GMT
location: https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com
referrer-policy: no-referrer
server: nginx
x-powered-by: PHP/8.3.14

GET
H/1.1 200
OK p.png
ca-go.kelkoogroup.net/assets/images/ 68 B
552 B 918ms
139ms Image
image/png 95.211.116.26
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ca-go.kelkoogroup.net/assets/images/p.png?country=ca&k=612f7a9541cd6ea61eb554c0e4cff437473123ea2017595b43a3ffed7276115685d16d6c6e9a76b0d24f98d4e50ce141f227b1eadaa10f898330a1751db83cc2630abaa7dbde3d7444858f2c5f77d276f818cacf1e2e3ca79be1c3aa9ece277a79f74478edc84490f95b426e7cfca31bdec0396ab0dbcb8792bea6e39560da34e22b1fc8f5e059eb40a688218e9c0809c14c60f9a4356c4cfb150a458522d7c0b6a277ada0a327ea92aa7218e8dd16714d70977d4e592c25b533dc2f8409fa90f32f7d8b687dc1359538d762c150fac211aa5025fe27ff57d7ba4542c8bc8a9815df13cf3bdba279dbba3e76acc6ce67fa9851c95c2c41557c1205312bf193f12e196f3a287cc6f9a6869975fcb69dcb576e858593f99a478a6d45a4e5fbaaa7e93efe52f9e8401073cc339755247d7649a6c6c0efcd8f96fcd1ff545e4996287449393598b38bb1af210fb01f8df3de4f1bf3e1678bb48f3d79adfd042888cf452a9bbae9309d7d03505b6956f1205f06eba1edabbc1beb

Requested by

Host: api.kelkoogroup.net
URL: https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

95.211.116.26 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),

Reverse DNS

dc1-ecs-pub-mx-vip.kelkoo.com

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://api.kelkoogroup.net/

Response headers

X-Robots-Tag: noindex,nofollow
Cache-Control: private, must-revalidate
leadId: 62A901JE8SSMNV35F4VQ9Q271E0WCB
Request-Time: PT0.002590539S
X-Permitted-Cross-Domain-Policies: master-only
Referrer-Policy: origin-when-cross-origin
clickId: 107698111_1733314794135_36631665
country: ca
X-Content-Type-Options: nosniff
Content-Length: 68
X-XSS-Protection: 1; mode=block
Date: Wed, 04 Dec 2024 12:19:54 GMT
Content-Type: image/png
X-Frame-Options: ALLOWALL

GET
H2 200 tags.js
dd.kelkoogroup.net/ 174 KB
34 KB 595ms
94ms Script
text/javascript 3.162.125.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dd.kelkoogroup.net/tags.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.162.125.109 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-162-125-109.iad61.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://api.kelkoogroup.net/

Response headers

content-encoding: br
x-amz-version-id: ZWDLLh67.zVx7mrHkjHuhJdpmyjM398_
etag: W/"b4f2edbea31dcec5c70f4f1bf574b162"
age: 821
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: n-bYdTgFMjHa3gwnKR5SMXCvAF027zV-p9PKGvMVbeeERoyblkP45w==
date: Wed, 04 Dec 2024 12:06:14 GMT
content-type: text/javascript
vary: accept-encoding, Origin
last-modified: Wed, 04 Dec 2024 08:57:20 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=3600, public
via: 1.1 6123d2a57c9fa3d5613bea69a7290ae0.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD61-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 204 collect
www.google-analytics.com/g/ 0
546 B 281ms
130ms Ping
text/plain 2607:f8b0:4004:c08::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-89D7J1QWD9&_p=725608448&sr=1600x1200&ul=en-ca&cid=205519710.1733314794&uid=a4c626f-193919cd297-40fb31&_fv=1&_s=1&dl=https%3A%2F%2Fapi.kelkoogroup.net%2Fpublisher%2Fshopping%2Fv2%2Flink-monetizer%2Flink%3Fcountry%3Dca%26id%3De4ef5dec-03eb-11eb-bf21-ba5ec25d7100%26merchantUrl%3Dhttps%253A%252F%252Fnordvpn.com%26custom1%3Dc273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa%26publisherSubId%3DfpaAbCWBDmMX%26publisherTrafficType%3Dpublishernetwork%26originReferer%3Dhttps%25253A%25252F%25252Fwww.yadore.com&dt=Redirecting%20to%20Nordvpn.com&dp=%2F%7C100545397%7C&sid=1733314794&sct=1&seg=1&en=page_view&_ss=1&ep.cd1=&ep.cd2=62A901JE8SSMNV35F4VQ9Q271E0WCB&ep.cd3=100545397&ep.cd4=a4c626f-193919cd297-40fb31&ep.cd5=&ep.cd6=%7C100545397%7C
Requested by: Host: api.kelkoogroup.net
URL: https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::66 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://api.kelkoogroup.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://api.kelkoogroup.net
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 04 Dec 2024 12:19:54 GMT
content-type: text/plain
server: Golfe2

GET
H2 404 ados.js
api.kelkoogroup.net/ 40 B
277 B 252ms
251ms XHR
text/plain 52.84.18.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.kelkoogroup.net/ados.js
Requested by: Host: api.kelkoogroup.net
URL: https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.18.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-18-77.ord53.r.cloudfront.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
sec-ch-device-memory: 8
Referer: https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com

Response headers

via: 1.1 72b39a2780dc291594c15dd795ced542.cloudfront.net (CloudFront)
x-cnection: close
x-cache: Error from cloudfront
content-length: 40
x-amz-cf-id: Fq2swnyy6kxV_e91S1Cdq9B_-mk-BgUsKwm3AGRM5XAwwQUPJFHE7g==
date: Wed, 04 Dec 2024 12:19:54 GMT
content-type: text/plain
x-amz-cf-pop: ORD53-C2

POST
H/1.1 200
OK fp
ca-go.kelkoogroup.net/ 0
0 603ms
244ms Ping
text/plain 95.211.116.26
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-go.kelkoogroup.net/fp?country=ca&k=612f7a9541cd6ea61eb554c0e4cff437473123ea2017595b43a3ffed7276115685d16d6c6e9a76b0d24f98d4e50ce141f227b1eadaa10f898330a1751db83cc2630abaa7dbde3d7444858f2c5f77d276f818cacf1e2e3ca79be1c3aa9ece277a79f74478edc84490f95b426e7cfca31bdec0396ab0dbcb8792bea6e39560da34e22b1fc8f5e059eb40a688218e9c0809c14c60f9a4356c4cfb150a458522d7c0b6a277ada0a327ea92aa7218e8dd16714d70977d4e592c25b533dc2f8409fa90f32f7d8b687dc1359538d762c150fac211aa5025fe27ff57d7ba4542c8bc8a9815df13cf3bdba279dbba3e76acc6ce67fa9851c95c2c41557c1205312bf193f12e196f3a287cc6f9a6869975fcb69dcb576e858593f99a478a6d45a4e5fbaaa7e93efe52f9e8401073cc339755247d7649a6c6c0efcd8f96fcd1ff545e4996287449393598b38bb1af210fb01f8df3de4f1bf3e1678bb48f3d79adfd042888cf452a9bbae9309d7d03505b6956f1205f06eba1edabbc1beb
Requested by: Host: api.kelkoogroup.net
URL: https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 95.211.116.26 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS: dc1-ecs-pub-mx-vip.kelkoo.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=utf-8
Referer: https://api.kelkoogroup.net/

Response headers

GET
H3

200

Primary Request / Show response
nordvpn.com/special/
Redirect Chain

https://ca-go.kelkoogroup.net/redirect?country=ca&k=612f7a9541cd6ea61eb554c0e4cff437473123ea2017595b43a3ffed7276115685d16d6c6e9a76b0d24f98d4e50ce141f227b1eadaa10f898330a1751db83cc2630abaa7dbde3d744...
https://nordvpn.sjv.io/c/3600909/417838/7452?subId1=62A901JE8SSMNV35F4VQ9Q271E0WCB&u=https%3A%2F%2Fnordvpn.com
https://www.ojrq.net/p/?return=https%3A%2F%2Fnordvpn.sjv.io%2Fc%2F3600909%2F417838%2F7452%3FsubId1%3D62A901JE8SSMNV35F4VQ9Q271E0WCB%26u%3Dhttps%253A%252F%252Fnordvpn.com%26level%3D1%26srcref%3Dhttp...
https://nordvpn.sjv.io/c/3600909/417838/7452?subId1=62A901JE8SSMNV35F4VQ9Q271E0WCB&u=https%3A%2F%2Fnordvpn.com&level=1&srcref=https%3A%2F%2Fapi.kelkoogroup.net%2F&brwsr=12453ef8-b23a-11ef-bd83-9fc2...
https://go.nordvpn.net/aff_c?irgwc=1&aff_sub=3600909&offer_id=15&aff_id=8110&aff_sub2=xR1z78TU%3AxyKTfzR62zwD29ZUkCVBlXPv0zVTo0&url_id=902
https://visit.nordvpn.com/?offer_id=15&aff_id=8110&aff_transaction_id=102f6dc4ab13901a89420b01de982e&source=&params[ho_asub1]=3600909&url_id=533
https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

158 KB
31 KB

802ms
755ms

Document
text/html

104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24809ad6e4f9c629ccffef8595c455ed8752369d99233e107ad5a8ba29376cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
cf-ray: 8ecbbf669b5aa22e-YYZ
content-encoding: br
content-type: text/html
date: Wed, 04 Dec 2024 12:19:57 GMT
last-modified: Mon, 02 Dec 2024 07:02:05 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf65bacaa22e-YYZ
content-length: 0
date: Wed, 04 Dec 2024 12:19:56 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
location: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload

GET 3ad71404-f453-4585-b50f-1161fc6aa8e3
https://api.kelkoogroup.net/ Frame 0
0

POST
H2 200 /
dd.kelkoogroup.net/js/ 236 B
648 B 328ms
117ms XHR
application/json 3.162.125.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dd.kelkoogroup.net/js/

Requested by

Host: dd.kelkoogroup.net
URL: https://dd.kelkoogroup.net/tags.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.162.125.109 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-162-125-109.iad61.r.cloudfront.net

Software

DataDome /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://api.kelkoogroup.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
x-content-type-options: nosniff
via: 1.1 c49971ad4f76a00082eb4f604c635cba.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 236
x-amz-cf-id: ygvV6Zc9QK4HVrXPYxSwgHReUWA_tjhsWF7BFvgwXaKNPoXMZJv0rw==
date: Wed, 04 Dec 2024 12:19:55 GMT
content-type: application/json;charset=utf-8
x-amz-cf-pop: IAD61-P3
server: DataDome

GET
H2 200 index.js Show response
s1.nordcdn.com/d/nordvpn/prod/ 17 KB
7 KB 264ms
77ms Script
application/javascript 2606:4700::6810:9b6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.nordcdn.com/d/nordvpn/prod/index.js?cu=https://d.nordvpn.com/1/cc&p=nordvpn&cv=nordvpn-main@0.156.1

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9b6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d73b9480d8d2debceaf26b4a3bff2b66f05b2f42075b84dda559de751d3fc16d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=604800
content-encoding: gzip
cf-cache-status: HIT
age: 7224
cf-ray: 8ecbbf6d0c6942cf-EWR
access-control-allow-origin: *
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Wed, 13 Nov 2024 10:30:30 GMT
vary: Accept-Encoding
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H2 200 init.js Show response
s1.nordcdn.com/d/consent/prod/ 4 KB
2 KB 260ms
73ms Script
application/javascript 2606:4700::6810:9b6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.nordcdn.com/d/consent/prod/init.js?isGdpr=false

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9b6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cac3b60c321f2493e73a2573f9fd876b71a9ecc7569732086e55ab501771762c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=604800
content-encoding: gzip
cf-cache-status: HIT
age: 7224
cf-ray: 8ecbbf6d0c6642cf-EWR
access-control-allow-origin: *
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 13:40:53 GMT
vary: Accept-Encoding
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H2 200 main.js Show response
s1.nordcdn.com/d/consent/prod/ 128 KB
32 KB 58ms
56ms Script
application/javascript 2606:4700::6810:9b6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.nordcdn.com/d/consent/prod/main.js

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9b6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b068a7dd37b25b5ec551ca3f58e033fb0fef3231cd9fb2065eb0f76fdb02d18

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=604800
content-encoding: gzip
cf-cache-status: HIT
age: 7224
cf-ray: 8ecbbf6d8d1b42cf-EWR
access-control-allow-origin: *
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 13:40:53 GMT
vary: Accept-Encoding
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H2 200 main.css
s1.nordcdn.com/d/consent/prod/ 8 KB
2 KB 257ms
71ms Stylesheet
text/css 2606:4700::6810:9b6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.nordcdn.com/d/consent/prod/main.css

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9b6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f615e21972aa9a35750b2fe6c754682924ed4d489b9a559740a651921a206ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=604800
content-encoding: gzip
cf-cache-status: HIT
age: 7224
cf-ray: 8ecbbf6d0c6342cf-EWR
access-control-allow-origin: *
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: text/css
last-modified: Tue, 03 Dec 2024 13:40:53 GMT
vary: Accept-Encoding
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H3 200 index.BWvR22S4.css
nordvpn.com/static/ 114 KB
19 KB 81ms
79ms Stylesheet
text/css 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/index.BWvR22S4.css

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3877b82b722930323b0e4b33b9e2284e44533c0f07b1dde2c5f7634c7828d78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-1c9af"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: text/css
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6bbeeba22e-YYZ
server: cloudflare

GET
H3 200 index.Cb-eI1RQ.css
nordvpn.com/static/ 6 KB
2 KB 83ms
82ms Stylesheet
text/css 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/index.Cb-eI1RQ.css

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d27b40c45db7b587c66c51d333f5c34e6cbf4afcf8074beec705f964c9f051ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-197c"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: text/css
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6bbeeda22e-YYZ
server: cloudflare

GET
H3 200 hoisted.Bc6WaZsC.js Show response
nordvpn.com/static/ 7 KB
3 KB 78ms
77ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/hoisted.Bc6WaZsC.js

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccea3081f7eb54a2ff1982aa42bafbf54104f847c51a553963fc63a4e81e55fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-1d0b"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6bbeeea22e-YYZ
server: cloudflare

GET
H2 200 tech-of-tomorrow.png
ic.nordcdn.com/v1/fr_auto,q_70/https://sb.nordcdn.com/m/718ca5b47ccc123a/original/ 5 KB
5 KB 193ms
190ms Image
image/avif 2606:4700::6810:9c6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ic.nordcdn.com/v1/fr_auto,q_70/https://sb.nordcdn.com/m/718ca5b47ccc123a/original/tech-of-tomorrow.png?X-Nord-Credential=T4PcHqfACi8Naxvulzf4IE8XT4oypRTi0blOOGwbK2A8L4fcPw52k3qkvbkYH&X-Nord-Signature=bswZZah%2F3Jo2v9OaS3tjuTa84K1sVekq1BUOMr6Rz6A%3D

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9c6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4e4b4b4e76670caf3e6a1ee668452a49c89c078283b628ff39c4d387ddee125

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

cf-cache-status: DYNAMIC
etag: "cfxsrN7gLul5cekYJVgJgIKuo1CvHN2RGDlYXWZjJbDQ"
age: 106008
cf-bgj: imgq:70,h2pri
cf-resized: internal=ok/d q=0 n=17+99 c=0+0 v=2024.10.6 l=5297 f=false
x-content-type-options: nosniff
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: image/avif
vary: Accept
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=172800
via: 1.1 fb0af42ddffb18e9ab1049ade53140f0.cloudfront.net (CloudFront)
cf-ray: 8ecbbf6d6f3d428b-EWR
access-control-allow-origin: *
content-length: 5297
server: cloudflare

GET
H2 200 threat-protection-secure-access-bubble-female-md.svg
ic.nordcdn.com/v1/https://sb.nordcdn.com/m/d642e7338b6a459/original/ 14 KB
6 KB 308ms
90ms Image
image/svg+xml 2606:4700::6810:9c6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ic.nordcdn.com/v1/https://sb.nordcdn.com/m/d642e7338b6a459/original/threat-protection-secure-access-bubble-female-md.svg

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9c6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

133d9660262505884ba3e7beb7b22543fdb3887633f59225c15ecb262f665e70

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
age: 106599
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: jprpEKccp8-s4GyxqsNXfcQGGOIqVwKMcPqPOHRcMboJ_asWHmcIIw==
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: image/svg+xml
content-disposition: inline
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-api-correlation-id: 5273b56c-46d7-26ca-209d-36f097289550
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 dc7aeefd8f9f1132c56cbdea9095671e.cloudfront.net (CloudFront)
cf-ray: 8ecbbf6d3f14428b-EWR
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P9
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 390 KB
127 KB 242ms
78ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LEXMJ1N516

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7cf5c5905070e199644d911dd8a59d7f795d25a113704c43f70dd5ed50772efe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 04 Dec 2024 12:19:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 129655
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 hoisted.Bo0buo5d.js Show response
nordvpn.com/static/ 16 KB
6 KB 78ms
78ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/hoisted.Bo0buo5d.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9716ecfff3a187485e4a048c95f0b12d98b08cabfff0159b68b3c5d0d83143c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/hoisted.Bc6WaZsC.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-4153"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d8828a22e-YYZ
server: cloudflare

GET
H3 200 sendEvent.B3j6r1eM.js Show response
nordvpn.com/static/ 2 KB
1 KB 89ms
88ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/sendEvent.B3j6r1eM.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

126007e297357c4fe92ad97186643ba9b532381fbd9cee1451fe9aa841d5e81f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/hoisted.Bc6WaZsC.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-794"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d8829a22e-YYZ
server: cloudflare

GET
H3 200 _sentry-release-injection-file.Rf9cmCsE.js Show response
nordvpn.com/static/ 492 B
562 B 94ms
92ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/_sentry-release-injection-file.Rf9cmCsE.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bf681dbb3f6e509e8fccef3f50d3aa1c531747562ecea5e98fa5af4e3fc2cc3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/hoisted.Bc6WaZsC.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-1ec"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d882ca22e-YYZ
server: cloudflare

GET
H3 200 sendTracyEvent.DzMfjJ5d.js Show response
nordvpn.com/static/ 3 KB
2 KB 87ms
85ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/sendTracyEvent.DzMfjJ5d.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3bb836000f6989cfeb160c51c122808fcca859be990a48e5fbb5e5b247132472

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/hoisted.Bc6WaZsC.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-a24"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d882da22e-YYZ
server: cloudflare

GET
H3 200 throttle.DhrNiG0-.js Show response
nordvpn.com/static/ 523 B
621 B 78ms
76ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/throttle.DhrNiG0-.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba3b9524c54ed2d1c6f5043ca30cfa85542c069ec08241969a0b08073c146fdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/hoisted.Bc6WaZsC.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-20b"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d882ea22e-YYZ
server: cloudflare

GET
H3 200 constants.-ggxla5h.js Show response
nordvpn.com/static/ 540 B
640 B 82ms
81ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/constants.-ggxla5h.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ce610b6b3e8f427d6c90800ddea2615243ca23406e8edd013124649f72dcfad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/hoisted.Bc6WaZsC.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-21c"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d8831a22e-YYZ
server: cloudflare

GET
H3 200 countdown.xJMMo6dd.js Show response
nordvpn.com/static/ 602 B
668 B 94ms
93ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/countdown.xJMMo6dd.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a625e85dcafc5cf540d05be714aef8716884388dfea3a6884cf1785d42659990

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/hoisted.Bc6WaZsC.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-25a"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d8832a22e-YYZ
server: cloudflare

GET
H3 200 getCookieValue.DCWFYzKd.js Show response
nordvpn.com/static/ 569 B
664 B 86ms
85ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/getCookieValue.DCWFYzKd.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3adcbf497d82735bcfe4dbee7a8f942382b4199f5506f4bc73f67f443d73ec99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/hoisted.Bc6WaZsC.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-239"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d8833a22e-YYZ
server: cloudflare

GET
H3 200 getExperiments.C5MnpM2g.js Show response
nordvpn.com/static/ 559 B
640 B 75ms
74ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/getExperiments.C5MnpM2g.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ebe41c8acf4bee30bf5b6632807dea3a8107d27064f71f5c9b0f94a79976f313

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/hoisted.Bc6WaZsC.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-22f"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d8835a22e-YYZ
server: cloudflare

GET
H3 200 Countdown.CO6W9GgW.js Show response
nordvpn.com/static/ 2 KB
1 KB 84ms
84ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/Countdown.CO6W9GgW.js

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe4cc4fc52330c5adf23489506400fbb0235444f71a5177ff5e18e0f4843e630

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-921"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d983ba22e-YYZ
server: cloudflare

GET
H3 200 client.GKlbLDlF.js Show response
nordvpn.com/static/ 1 KB
999 B 87ms
87ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/client.GKlbLDlF.js

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f13a52ac713b0456d9549a49cdef54225d0be9eb799e0211b128ff85e70adef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-4c7"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6d983ea22e-YYZ
server: cloudflare

GET
H2 200 sale-discount-center-2xl-cd.png
ic.nordcdn.com/v1/fr_auto,q_70/https://sb.nordcdn.com/m/784fa78a3b9216cf/original/ 63 KB
63 KB 305ms
302ms Image
image/webp 2606:4700::6810:9c6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ic.nordcdn.com/v1/fr_auto,q_70/https://sb.nordcdn.com/m/784fa78a3b9216cf/original/sale-discount-center-2xl-cd.png?X-Nord-Credential=T4PcHqfACi8Naxvulzf4IE8XT4oypRTi0blOOGwbK2A8L4fcPw52k3qkvbkYH&X-Nord-Signature=rNqJ1mRPhXlFDcTCI6i9WCC7lV4tnDJl8F87Ci3LOeU%3D

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9c6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7c0b48a5a0f3fbf188fb1f003a10a87e9c2582ce384bb049c95ec02a1bf0cb9

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

cf-cache-status: DYNAMIC
etag: "cfdfQd6wcOxspNissWvmEbVRKbCvHN2RGDlYXWZjJbDQ"
age: 107043
cf-bgj: imgq:71,h2pri
cf-resized: internal=ok/d q=0 n=28+214 c=0+0 v=2024.10.6 l=64424 f=false
warning: cf-images 299 "image too large for AVIF"
x-content-type-options: nosniff
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: image/webp
vary: Accept
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=172800
via: 1.1 39c8f49389b943e96c07c190a1225d32.cloudfront.net (CloudFront)
cf-ray: 8ecbbf6e6824428b-EWR
access-control-allow-origin: *
content-length: 64424
server: cloudflare

GET
H2 200 black-friday-center-placeholder.png
ic.nordcdn.com/v1/fr_auto,q_70/https://sb.nordcdn.com/m/4811bd72976490f6/original/ 694 B
921 B 294ms
292ms Image
image/avif 2606:4700::6810:9c6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ic.nordcdn.com/v1/fr_auto,q_70/https://sb.nordcdn.com/m/4811bd72976490f6/original/black-friday-center-placeholder.png?X-Nord-Credential=T4PcHqfACi8Naxvulzf4IE8XT4oypRTi0blOOGwbK2A8L4fcPw52k3qkvbkYH&X-Nord-Signature=eTngl%2F54QTX5P3CI7bXo7PS9T%2BgHyjTrMIe91oWekNs%3D

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9c6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e62604c350cd9d4a810c70c4ec22e51fbd3fb3d0cca33290f111d99ab7204d63

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

cf-cache-status: DYNAMIC
etag: "cf-Byt5HJvEXzicRnGnXxWRBiHCvHN2RGDlYXWZjJbDQ"
age: 111507
cf-bgj: imgq:70,h2pri
cf-resized: internal=ok/d q=0 n=29+135 c=0+0 v=2024.10.6 l=694 f=false
x-content-type-options: nosniff
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: image/avif
vary: Accept
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=172800
via: 1.1 4711aa73622dbb1ab88c1c6e2c4cf732.cloudfront.net (CloudFront)
cf-ray: 8ecbbf6ed87d428b-EWR
access-control-allow-origin: *
content-length: 694
server: cloudflare

GET
H2 200 nordvpn-default.svg
ic.nordcdn.com/v1/https://sb.nordcdn.com/m/1431cb1f1a5ca2c9/original/ 2 KB
1 KB 69ms
69ms Image
image/svg+xml 2606:4700::6810:9c6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ic.nordcdn.com/v1/https://sb.nordcdn.com/m/1431cb1f1a5ca2c9/original/nordvpn-default.svg

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9c6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75f28438681332b67561059131289f90d029016eec52cb8fc0f2a5b37ab7d08c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
age: 20398
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: UDjIEaLVbgzezT0tmTu6Kmd-vmikQ_0OSEd5HpMjMQmZb5oJQLDYxQ==
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: image/svg+xml
content-disposition: inline
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-api-correlation-id: 72db05b2-e3e7-f2e5-8e7f-b4cabda77e19
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3e31445c00bbce77f755b563c056d44.cloudfront.net (CloudFront)
cf-ray: 8ecbbf711a9e428b-EWR
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P9
server: cloudflare

GET
H2 200 table-expressvpn-logo.svg
ic.nordcdn.com/v1/https://sb.nordcdn.com/m/6a6a63c28e036c45/original/ 5 KB
2 KB 91ms
91ms Image
image/svg+xml 2606:4700::6810:9c6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ic.nordcdn.com/v1/https://sb.nordcdn.com/m/6a6a63c28e036c45/original/table-expressvpn-logo.svg

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9c6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71867ba089cf906c39bb6a75c67ee28a3f833ec3d4bb70d8e7208a47269286e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
age: 109881
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: -LbDu5vk6Zhc_MZRiMXHOt-NHdBwktYwsZXZcCmYmrxAIqqWGHhMvA==
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: image/svg+xml
content-disposition: inline
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-api-correlation-id: 24fe8ead-2560-4f1f-c666-8ec70287438c
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 4711aa73622dbb1ab88c1c6e2c4cf732.cloudfront.net (CloudFront)
cf-ray: 8ecbbf713ab5428b-EWR
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P9
server: cloudflare

GET
H2 200 table-privatevpn-logo.svg
ic.nordcdn.com/v1/https://sb.nordcdn.com/m/5581e5a9bfc2b47a/original/ 12 KB
5 KB 83ms
82ms Image
image/svg+xml 2606:4700::6810:9c6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ic.nordcdn.com/v1/https://sb.nordcdn.com/m/5581e5a9bfc2b47a/original/table-privatevpn-logo.svg

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9c6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

38ab263da7c8192b85ca90d0985f8845920ab04668a88fdcdc31d5a42176c3da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
age: 13708
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: Mi-YkawE-t_rkobNqnfjBCXVfGQL8Hd34fem2Wsba8VxmAifm0iXeA==
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: image/svg+xml
content-disposition: inline
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-api-correlation-id: 59f015d8-3a70-ee24-ced2-623373aef2c1
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 7e05050d5b982a3c10f24a3f84107440.cloudfront.net (CloudFront)
cf-ray: 8ecbbf715ad2428b-EWR
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P9
server: cloudflare

GET
H2 200 table-protonvpn-logo.svg
ic.nordcdn.com/v1/https://sb.nordcdn.com/m/181e90885a5e30d7/original/ 6 KB
3 KB 82ms
81ms Image
image/svg+xml 2606:4700::6810:9c6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ic.nordcdn.com/v1/https://sb.nordcdn.com/m/181e90885a5e30d7/original/table-protonvpn-logo.svg

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9c6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d392f9691ae4316fa5b8f7fbe9fa46f46d5854472cfc87ec4c265d348f47b78

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
age: 106549
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: tS_ReAttkEbSMLBXH_Prbth2zC_Nh7jMy6XilvBG7pWRQ-3TZWDbeA==
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: image/svg+xml
content-disposition: inline
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-api-correlation-id: 39fb6801-99c6-0f35-9a7d-60dabfb6e02b
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e770ad1d5cbd97118591a2a170c4e66c.cloudfront.net (CloudFront)
cf-ray: 8ecbbf715ad3428b-EWR
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P9
server: cloudflare

GET
H2 200 table-purevpn-logo.svg
ic.nordcdn.com/v1/https://sb.nordcdn.com/m/30228f737077932d/original/ 9 KB
4 KB 78ms
78ms Image
image/svg+xml 2606:4700::6810:9c6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ic.nordcdn.com/v1/https://sb.nordcdn.com/m/30228f737077932d/original/table-purevpn-logo.svg

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9c6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8e24310b0e306003276b69c77726f8c30d61ab75bc1cac841e36e999c43bb0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
age: 106550
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: roFM1UgtmhO3idUBfK9tJbdRH7WcivoZqh_ZZCENx806xyVbsL1N3g==
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: image/svg+xml
content-disposition: inline
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-api-correlation-id: da1d5189-0b32-6a69-d27a-b2b8b591109f
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 dc7aeefd8f9f1132c56cbdea9095671e.cloudfront.net (CloudFront)
cf-ray: 8ecbbf715ad4428b-EWR
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P9
server: cloudflare

GET
H3 200 StatusBox.DBzSjiXD.js Show response
nordvpn.com/static/ 7 KB
3 KB 71ms
71ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/StatusBox.DBzSjiXD.js

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6db2bd3b49f2ac926b33500b0491caba8e2b35c0a2456068c5ebfea96bc50c34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-1a44"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6de87da22e-YYZ
server: cloudflare

GET
H3 200 TabsProvider.CTkUARwY.js Show response
nordvpn.com/static/ 2 KB
1 KB 77ms
77ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/TabsProvider.CTkUARwY.js

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8a938f9dae084bc34cbd7a134dcb30f4163bc13230e6ab2a808f08df1428523

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-80e"
age: 104121
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6df881a22e-YYZ
server: cloudflare

GET
H3 200 web.XijDTL91.js Show response
nordvpn.com/static/ 22 KB
9 KB 76ms
76ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/web.XijDTL91.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83b017bb584a673095864665dab48414845b493d2e6b8c5408146c24f5c4c2a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/Countdown.CO6W9GgW.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-565c"
age: 104120
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6e78e0a22e-YYZ
server: cloudflare

OPTIONS
H3 204 cc
d.nordvpn.com/1/ Frame 0
0 129ms
82ms Preflight 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nordvpn.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: https://nordvpn.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf71dfd03700-YYZ
content-length: 0
date: Wed, 04 Dec 2024 12:19:58 GMT
priority: u=4,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload

GET
H2 200 en-woff2 Show response
sb.nordcdn.com/m/1f322001e9afbdc5/original/ 139 KB
106 KB 322ms
89ms XHR
text/css 2606:4700::6810:9b6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sb.nordcdn.com/m/1f322001e9afbdc5/original/en-woff2

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/static/hoisted.Bo0buo5d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9b6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1470fbce81226e1cf7776b3c45e31fb4cb8d7bf11a1e8c00881b1dcd3c151d37

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
age: 149311
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: V7E-IDsOyYPFLsi8K1OeyvwhC23M8urkCP00BmUFOIlZ1RQQPR64ZA==
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: text/css
content-disposition: attachment;filename="en-woff2.css"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-api-correlation-id: a701b5fc-406f-d501-4eed-ab8262becda1
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 495a6ea9a073f54a4cfe961944b955c2.cloudfront.net (CloudFront)
cf-ray: 8ecbbf7029d6439c-EWR
permissions-policy: camera=(), geolocation=(), microphone=()
accept-ranges: bytes
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P9
server: cloudflare

POST
H3 202 cc
d.nordvpn.com/1/ 0
369 B 109ms
107ms Ping
text/plain 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Requested by

Host: s1.nordcdn.com
URL: https://s1.nordcdn.com/d/nordvpn/prod/index.js?cu=https://d.nordvpn.com/1/cc&p=nordvpn&cv=nordvpn-main@0.156.1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-id: fbe66c3a536323486201a5c62b36de25
access-control-max-age: 600
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
cf-ray: 8ecbbf74b946ac69-YYZ
access-control-allow-origin: https://nordvpn.com
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:58 GMT
server: cloudflare
priority: u=4,i
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization

GET
H3 200 getUserConnectionData.DZSbsyEA.js Show response
nordvpn.com/static/ 583 B
654 B 72ms
71ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/getUserConnectionData.DZSbsyEA.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

616c2cf1d800272ca2b16ff599be6caabac352d7b314f4f8ef70d93df289ce6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/StatusBox.DBzSjiXD.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-247"
age: 104120
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6e88eca22e-YYZ
server: cloudflare

GET
H3 200 BPP2V2OU.CX96LJgz.js Show response
nordvpn.com/static/ 7 KB
3 KB 74ms
72ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/BPP2V2OU.CX96LJgz.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef68a4c769d924b2adeef0320397c2a9440d7925e6a995c5eabd9a846f23c3ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/StatusBox.DBzSjiXD.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-1b54"
age: 104120
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6e88efa22e-YYZ
server: cloudflare

GET
H3 200 constants.dCfbvkrQ.js Show response
nordvpn.com/static/ 824 B
695 B 71ms
70ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/constants.dCfbvkrQ.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

801a30988e4d3e66a4cf1177739901bf3c25311aec4a10cb90ecd2b6e0d535a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/TabsProvider.CTkUARwY.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-338"
age: 104120
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6e88f2a22e-YYZ
server: cloudflare

GET
H3 200 StatusBar.o5rrS3hN.js Show response
nordvpn.com/static/ 3 KB
2 KB 71ms
71ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/StatusBar.o5rrS3hN.js

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

498caf46dd9f0fb9556ee364b2faf366fad8d5d1ff123e478db9f7b79a23b946

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-dcf"
age: 104120
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6e88f3a22e-YYZ
server: cloudflare

GET
H3 200 Link.Dv3DNw2Q.js Show response
nordvpn.com/static/ 3 KB
2 KB 73ms
72ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/Link.Dv3DNw2Q.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

447076958c0d6f9ad13677ae5720e539fc71f1ca18e55eff2e24950ed241fd11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/StatusBar.o5rrS3hN.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-d50"
age: 104120
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6f093fa22e-YYZ
server: cloudflare

GET
H3 200 Text.BSVeZLI0.js Show response
nordvpn.com/static/ 1 KB
924 B 109ms
107ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/Text.BSVeZLI0.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad9204173dbcc636d15481b3f1419d0b11094b0f7727a749394de34e332b683f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/StatusBar.o5rrS3hN.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-5cd"
age: 104120
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6f0941a22e-YYZ
server: cloudflare

GET
H3 200 Tooltip.Cxcwr2mG.js Show response
nordvpn.com/static/ 2 KB
1 KB 81ms
80ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/Tooltip.Cxcwr2mG.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89b8f4a649944c30e0f2d128eb610458bcb5cb16561eaa663bc3a36e489c932c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/StatusBar.o5rrS3hN.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-93d"
age: 104120
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6f0942a22e-YYZ
server: cloudflare

GET
H3 200 buildGAExtraAttributes.CI2fqKmq.js Show response
nordvpn.com/static/ 1 KB
1 KB 69ms
68ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/buildGAExtraAttributes.CI2fqKmq.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd15720ff315cd5b9f9a5f24020cbdb3ab9a3c2f6b5a9a17ca177efe26bf62de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/StatusBar.o5rrS3hN.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-5fd"
age: 104120
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6f0944a22e-YYZ
server: cloudflare

GET
H3 200 utils.CxDDLTxM.js Show response
nordvpn.com/static/ 1 KB
875 B 77ms
76ms Script
application/javascript 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nordvpn.com/static/utils.CxDDLTxM.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7f1d23a3fe2b6289b7b1bfeb088a055a0f2e509c8623be1de1ace030703beb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer: https://nordvpn.com/static/StatusBar.o5rrS3hN.js

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"674eb051-462"
age: 104120
expires: Sun, 08 Jun 2025 12:19:57 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:57 GMT
content-type: application/javascript
last-modified: Tue, 03 Dec 2024 07:16:33 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=16070400
cf-ray: 8ecbbf6f0946a22e-YYZ
server: cloudflare

GET
H3 200 info Show response
web-api.nordvpn.com/v1/ips/ 241 B
923 B 306ms
84ms Fetch
application/json 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://web-api.nordvpn.com/v1/ips/info

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/static/getUserConnectionData.DZSbsyEA.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c2bb2372e08623bbd09c91c41be71a2d9d2ffa73aa8b18aeccdc937c017ea0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

access-control-max-age: 1728000
access-control-expose-headers: *
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-credentials: true
cf-ray: 8ecbbf707ed33700-YYZ
access-control-allow-origin: https://nordvpn.com
content-length: 193
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 354 KB
119 KB 70ms
70ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WX5CH8

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8454f71d2a59768c37cb0c1e9a5bc8a52ea095c859e8160bedf9cfef4b9afcc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Wed, 04 Dec 2024 12:19:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 04 Dec 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 121552
x-xss-protection: 0
server: Google Tag Manager

POST
H3 202 cc
d.nordvpn.com/1/ 0
369 B 99ms
97ms Ping
text/plain 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Requested by

Host: s1.nordcdn.com
URL: https://s1.nordcdn.com/d/nordvpn/prod/index.js?cu=https://d.nordvpn.com/1/cc&p=nordvpn&cv=nordvpn-main@0.156.1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-id: d8db0a92e91ae0c7dc46f739389ff190
access-control-max-age: 600
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
cf-ray: 8ecbbf74b947ac69-YYZ
access-control-allow-origin: https://nordvpn.com
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:58 GMT
server: cloudflare
priority: u=4,i
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization

POST
H3 202 cc
d.nordvpn.com/1/ 0
405 B 277ms
105ms Ping
text/plain 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Requested by

Host: s1.nordcdn.com
URL: https://s1.nordcdn.com/d/nordvpn/prod/index.js?cu=https://d.nordvpn.com/1/cc&p=nordvpn&cv=nordvpn-main@0.156.1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-id: dc2a8d4ec4ba937155a37acf209c2d9c
access-control-max-age: 600
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
cf-ray: 8ecbbf736839ac69-YYZ
access-control-allow-origin: https://nordvpn.com
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:58 GMT
server: cloudflare
priority: u=4,i
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization

POST
H3 202 cc
d.nordvpn.com/1/ 0
369 B 317ms
141ms Ping
text/plain 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Requested by

Host: s1.nordcdn.com
URL: https://s1.nordcdn.com/d/nordvpn/prod/index.js?cu=https://d.nordvpn.com/1/cc&p=nordvpn&cv=nordvpn-main@0.156.1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-id: ef5d295e3008b063bb36b979c92ef4d9
access-control-max-age: 600
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
cf-ray: 8ecbbf736835ac69-YYZ
access-control-allow-origin: https://nordvpn.com
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:58 GMT
server: cloudflare
priority: u=4,i
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization

POST
H3 202 cc
d.nordvpn.com/1/ 0
369 B 282ms
107ms Ping
text/plain 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Requested by

Host: s1.nordcdn.com
URL: https://s1.nordcdn.com/d/nordvpn/prod/index.js?cu=https://d.nordvpn.com/1/cc&p=nordvpn&cv=nordvpn-main@0.156.1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-id: 556627597697116e06ed15ecdab9c79f
access-control-max-age: 600
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
cf-ray: 8ecbbf736838ac69-YYZ
access-control-allow-origin: https://nordvpn.com
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:58 GMT
server: cloudflare
priority: u=4,i
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization

OPTIONS
H3 204 cc
d.nordvpn.com/1/ Frame 0
0 155ms
109ms Preflight 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nordvpn.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: https://nordvpn.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf71dfd13700-YYZ
content-length: 0
date: Wed, 04 Dec 2024 12:19:58 GMT
priority: u=4,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload

OPTIONS
H3 204 cc
d.nordvpn.com/1/ Frame 0
0 114ms
75ms Preflight 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nordvpn.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: https://nordvpn.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf71dfd23700-YYZ
content-length: 0
date: Wed, 04 Dec 2024 12:19:58 GMT
priority: u=4,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload

OPTIONS
H3 204 cc
d.nordvpn.com/1/ Frame 0
0 89ms
72ms Preflight 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nordvpn.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: https://nordvpn.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf71dfd33700-YYZ
content-length: 0
date: Wed, 04 Dec 2024 12:19:58 GMT
priority: u=4,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload

OPTIONS
H3 204 cc
d.nordvpn.com/1/ Frame 0
0 85ms
74ms Preflight 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nordvpn.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: https://nordvpn.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf71dfce3700-YYZ
content-length: 0
date: Wed, 04 Dec 2024 12:19:58 GMT
priority: u=4,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload

POST
H3 200 collect
cm.nordvpn.com/g/ 0
0 190ms
147ms Fetch 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.nordvpn.com/g/collect?v=2&tid=G-LEXMJ1N516&gtm=45je4bk0v874252800za200&_p=1733314797989&_gaz=1&gcs=G111&gcd=13t3t3t3t7l1&npa=1&dma=0&tag_exp=101925629~102067555~102067808~102081485&cid=388292548.1733314798&ul=en-ca&sr=1600x1200&_fplc=0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1733314798&sct=1&seg=0&dl=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&dr=https%3A%2F%2Fapi.kelkoogroup.net%2F&dt=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&en=scroll&_fv=1&_nsi=1&_ss=2&_ee=1&ep.consent_ver=v2global&ep.cf_country=CA&ep.product=nordvpn&ep.version=nordvpn-main%400.156.1&ep.page_lang=EN&ep.section_id=00&ep.section_name=Header&tfd=3217

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LEXMJ1N516

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf705a2da22e-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Wed, 04 Dec 2024 12:19:58 GMT
server: cloudflare
priority: u=1,i

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
542 B 303ms
128ms Ping
text/plain 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-LEXMJ1N516&cid=388292548.1733314798&gtm=45je4bk0v874252800za200&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t7l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LEXMJ1N516
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://nordvpn.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 570ms
443ms Image
image/gif 2607:f8b0:4004:c1b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-LEXMJ1N516&cid=388292548.1733314798&gtm=45je4bk0v874252800za200&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t7l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485&tag_exp=101925629~102067555~102067808~102081485&z=1314204521

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 04 Dec 2024 12:19:58 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 info Show response
web-api.nordvpn.com/v1/ips/ 241 B
888 B 212ms
86ms Fetch
application/json 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://web-api.nordvpn.com/v1/ips/info

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/static/getUserConnectionData.DZSbsyEA.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c2bb2372e08623bbd09c91c41be71a2d9d2ffa73aa8b18aeccdc937c017ea0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

access-control-max-age: 1728000
access-control-expose-headers: *
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-credentials: true
cf-ray: 8ecbbf710f393700-YYZ
access-control-allow-origin: https://nordvpn.com
content-length: 193
server: cloudflare

GET
DATA 200
OK truncated
/ 36 KB
36 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d23cbff70dd4a68416bff0bb406a57ddfb40dbce28e2eb9baa9957d2a841c1a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 33 KB
33 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9cd46bd882ff69696adb5cf7d4efba4fde6068e5265a58c019c1574751087a62

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 36 KB
36 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 428cf1a8dc0d1063a7576688d547bf7ebc70aee941fc033c659173da0d4293e4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://nordvpn.com
Referer

Response headers

Content-Type: font/woff2

POST
H3 202 cc
d.nordvpn.com/1/ 0
369 B 105ms
103ms Ping
text/plain 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Requested by

Host: s1.nordcdn.com
URL: https://s1.nordcdn.com/d/nordvpn/prod/index.js?cu=https://d.nordvpn.com/1/cc&p=nordvpn&cv=nordvpn-main@0.156.1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-id: 23ee9d494ad3061a8caa84b5666b22fc
access-control-max-age: 600
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
cf-ray: 8ecbbf74b94bac69-YYZ
access-control-allow-origin: https://nordvpn.com
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Wed, 04 Dec 2024 12:19:58 GMT
server: cloudflare
priority: u=4,i
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization

OPTIONS
H3 204 cc
d.nordvpn.com/1/ Frame 0
0 74ms
73ms Preflight 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d.nordvpn.com/1/cc

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nordvpn.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: https://nordvpn.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf7228023700-YYZ
content-length: 0
date: Wed, 04 Dec 2024 12:19:58 GMT
priority: u=4,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload

POST
H3 200 collect
www.google.com/ccm/ 0
0 308ms
73ms Ping
text/plain 2607:f8b0:4004:c1d::6a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dr=api.kelkoogroup.net&dl=https%3A%2F%2Fnordvpn.com%2Fspecial%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1123236023.1733314798&auid=1843384359.1733314798&npa=0&gtm=45He4bk0v6894354za200&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&tft=1733314798445&tfd=3586&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WX5CH8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c1d::6a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 248 KB
89 KB 71ms
71ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-950534254&l=dataLayer&cx=c&gtm=45He4bk0v6894354za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WX5CH8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a35faebbe004de158817c4bb87a03cb954b9bdfbdae6df5bbed21a0c3ebe3358

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Wed, 04 Dec 2024 12:19:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 04 Dec 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90893
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 290 KB
99 KB 71ms
70ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-386034582&l=dataLayer&cx=c&gtm=45He4bk0v6894354za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WX5CH8

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1aed81ea72182da0afa47c5a2ef96f197b4eb49f57d2187cea4bad5ee1b16299

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Wed, 04 Dec 2024 12:19:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 04 Dec 2024 12:19:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 04 Dec 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 101258
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 / Show response
65674e4462251d1db03ec8a9.webloader.smooch.io/ 153 B
672 B 359ms
92ms XHR
application/json 18.67.76.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://65674e4462251d1db03ec8a9.webloader.smooch.io/
Requested by: Host: ww99.2fh.co
URL: https://ww99.2fh.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.76.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-76-12.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d3ccc30982ea9939ed0cb399402b51ab39982dbf3f82a2e51da3ec6f8a3abd7b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

access-control-max-age: 3000
etag: "5327d01bb85b82adbfa4f22da2672848"
age: 64
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: ttMQOeCT7qNjocXvcjCTjv3CzdqrdEfi3vDQdNE_FfiMpFUoNcVCJA==
date: Wed, 04 Dec 2024 12:18:55 GMT
content-type: application/json
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
last-modified: Tue, 26 Nov 2024 15:00:40 GMT
cache-control: max-age=300, public
via: 1.1 68d323cfd4a0f1ae252f92c083654190.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 153
x-amz-cf-pop: IAD89-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 collect
cm.nordvpn.com/ 0
779 B 114ms
112ms Image
text/plain 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.nordvpn.com/collect?ev=pv&pu=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&pp=%2Fspecial%2F&pr=https%3A%2F%2Fapi.kelkoogroup.net%2F&pt=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&dc=desktop&gtmcb=383825190

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf741dcba22e-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Wed, 04 Dec 2024 12:19:58 GMT
server: cloudflare
priority: u=3,i

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4c30/ Frame E505 0
0 230ms
69ms Document
text/html 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4c30/sw_iframe.html?origin=https%3A%2F%2Fnordvpn.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WX5CH8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 30303
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Wed, 04 Dec 2024 03:54:55 GMT
expires: Thu, 04 Dec 2025 03:54:55 GMT
last-modified: Tue, 03 Dec 2024 10:18:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 collect
cm.nordvpn.com/g/ 0
0 207ms
206ms Fetch 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.nordvpn.com/g/collect?v=2&tid=G-LEXMJ1N516&gtm=45je4bk0v874252800za200&_p=1733314797989&gcs=G111&gcd=13t3t3t3t7l1&npa=1&dma=0&tag_exp=101925629~102067555~102067808~102081485&cid=388292548.1733314798&ul=en-ca&sr=1600x1200&_fplc=0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&sid=1733314798&sct=1&seg=0&dl=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&dr=https%3A%2F%2Fapi.kelkoogroup.net%2F&dt=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&_s=2&tfd=3630

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LEXMJ1N516

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf72ac6ca22e-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Wed, 04 Dec 2024 12:19:58 GMT
server: cloudflare
priority: u=1,i

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/950534254/ 6 KB
2 KB 345ms
78ms Script
text/javascript 2607:f8b0:4004:c1b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950534254/?random=1733314798551&cv=11&fst=1733314798551&bg=ffffff&guid=ON&async=1&gtm=45be4bk0z86894354za201zb6894354&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&ref=https%3A%2F%2Fapi.kelkoogroup.net%2F&hn=www.googleadservices.com&frm=0&tiba=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&npa=0&pscdl=noapi&auid=1843384359.1733314798&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-950534254&l=dataLayer&cx=c&gtm=45He4bk0v6894354za200

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d7595e3aa753d0bf24a8651de5ccf172fec6e60e1c330f609ade7ba283a9edd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2421
date: Wed, 04 Dec 2024 12:19:59 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 950534254
td.doubleclick.net/td/rul/ Frame 1CE8 0
0 273ms
128ms Document
text/html 2607:f8b0:4004:c21::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/950534254?random=1733314798551&cv=11&fst=1733314798551&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4bk0z86894354za201zb6894354&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&ref=https%3A%2F%2Fapi.kelkoogroup.net%2F&hn=www.googleadservices.com&frm=0&tiba=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&npa=0&pscdl=noapi&auid=1843384359.1733314798&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-950534254&l=dataLayer&cx=c&gtm=45He4bk0v6894354za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nordvpn.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Dec 2024 12:19:58 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 smooch.5.7.0.min.js Show response
cdn.smooch.io/ 8 KB
4 KB 359ms
82ms Script
application/javascript 3.167.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.smooch.io/smooch.5.7.0.min.js

Requested by

Host: ww99.2fh.co
URL: https://ww99.2fh.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.167.112.89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-167-112-89.iad55.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

a8c621ca3fca90b6922fd317f4969bb90437e8b1b2a270dc44181f0bb06525dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: gzip
x-amz-version-id: XTglwsJ9zzqHCRgs8eGpJaqmA8ZGi73F
etag: W/"8bee10ef09c088e6f735d283f40d53e0"
age: 681560
x-cache: Hit from cloudfront
x-amz-cf-id: -zQygIEHyeHfOQ50TSdTnMZAQ_-YybVhv9Pt26FMzd1_bbLGFAByiw==
date: Tue, 26 Nov 2024 15:00:40 GMT
content-type: application/javascript
vary: accept-encoding
last-modified: Tue, 26 Nov 2024 15:00:38 GMT
strict-transport-security: max-age=300
x-amz-replication-status: PENDING
cache-control: max-age=630720000, public
via: 1.1 31467e378930bcac2417aea59659f7e6.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/386034582/ 6 KB
2 KB 172ms
80ms Script
text/javascript 2607:f8b0:4004:c1b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/386034582/?random=1733314798891&cv=11&fst=1733314798891&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9166857486z86894354za201zb6894354&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&ref=https%3A%2F%2Fapi.kelkoogroup.net%2F&hn=www.googleadservices.com&frm=0&tiba=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&npa=0&pscdl=noapi&auid=1843384359.1733314798&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-386034582&l=dataLayer&cx=c&gtm=45He4bk0v6894354za200

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

299f553fb82dd334a7b0c759ae7d87ad2bfd64f4d499494e8d68795bfb7d061c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2447
date: Wed, 04 Dec 2024 12:19:59 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 386034582
td.doubleclick.net/td/rul/ Frame AE42 0
0 66ms
65ms Document
text/html 2607:f8b0:4004:c21::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/386034582?random=1733314798891&cv=11&fst=1733314798891&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9166857486z86894354za201zb6894354&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&ref=https%3A%2F%2Fapi.kelkoogroup.net%2F&hn=www.googleadservices.com&frm=0&tiba=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&npa=0&pscdl=noapi&auid=1843384359.1733314798&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-386034582&l=dataLayer&cx=c&gtm=45He4bk0v6894354za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nordvpn.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 1159
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Dec 2024 12:19:59 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 /
www.google.com/pagead/1p-user-list/950534254/ 42 B
64 B 63ms
62ms Image
image/gif 2607:f8b0:4004:c1d::6a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/950534254/?random=1733314798551&cv=11&fst=1733313600000&bg=ffffff&guid=ON&async=1&gtm=45be4bk0z86894354za201zb6894354&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&ref=https%3A%2F%2Fapi.kelkoogroup.net%2F&hn=www.googleadservices.com&frm=0&tiba=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&npa=0&pscdl=noapi&auid=1843384359.1733314798&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dLPgXFkL5H-vBSfQ38byhymBXzoFd7w&random=1713457886&rmt_tld=0&ipr=y

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::6a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 04 Dec 2024 12:19:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.ca/pagead/1p-user-list/950534254/ 42 B
64 B 67ms
67ms Image
image/gif 2607:f8b0:4004:c1b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/950534254/?random=1733314798551&cv=11&fst=1733313600000&bg=ffffff&guid=ON&async=1&gtm=45be4bk0z86894354za201zb6894354&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&ref=https%3A%2F%2Fapi.kelkoogroup.net%2F&hn=www.googleadservices.com&frm=0&tiba=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&npa=0&pscdl=noapi&auid=1843384359.1733314798&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dLPgXFkL5H-vBSfQ38byhymBXzoFd7w&random=1713457886&rmt_tld=1&ipr=y

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 04 Dec 2024 12:19:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/386034582/ 42 B
64 B 64ms
63ms Image
image/gif 2607:f8b0:4004:c1d::6a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/386034582/?random=1733314798891&cv=11&fst=1733313600000&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9166857486z86894354za201zb6894354&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&ref=https%3A%2F%2Fapi.kelkoogroup.net%2F&hn=www.googleadservices.com&frm=0&tiba=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&npa=0&pscdl=noapi&auid=1843384359.1733314798&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQCa7L7d9dyK_BlkL6R0Z8YidmVPr5GSIdH1b98O39vxPTdzig75JC78&random=2608238412&rmt_tld=0&ipr=y

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::6a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 04 Dec 2024 12:19:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.ca/pagead/1p-user-list/386034582/ 42 B
64 B 65ms
64ms Image
image/gif 2607:f8b0:4004:c1b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/386034582/?random=1733314798891&cv=11&fst=1733313600000&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9166857486z86894354za201zb6894354&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&ref=https%3A%2F%2Fapi.kelkoogroup.net%2F&hn=www.googleadservices.com&frm=0&tiba=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&npa=0&pscdl=noapi&auid=1843384359.1733314798&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQCa7L7d9dyK_BlkL6R0Z8YidmVPr5GSIdH1b98O39vxPTdzig75JC78&random=2608238412&rmt_tld=1&ipr=y

Requested by

Host: nordvpn.com
URL: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=3600909&utm_campaign=off15&utm_source=aff8110

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 04 Dec 2024 12:19:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 smooch.5.7.0.css
cdn.smooch.io/ 4 KB
1 KB 96ms
96ms Stylesheet
text/css 3.167.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.smooch.io/smooch.5.7.0.css

Requested by

Host: cdn.smooch.io
URL: https://cdn.smooch.io/smooch.5.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.167.112.89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-167-112-89.iad55.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

4d82338cc53421f1277ced22892b56e64d0cefde2ceaf8d7a3d9cabffb7baab0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: gzip
x-amz-version-id: Rb9a9lDagKSLHwWKNpdPTqLlEY5ivsbo
etag: W/"9096609e9d7ffb1059e5ddba527fb8c2"
age: 681560
x-cache: Hit from cloudfront
x-amz-cf-id: mk3lPJfNsn1kVQ5LHrrrPIQz5WJo-A-dmibgrU3jG0_Zedr5Zdog4w==
date: Tue, 26 Nov 2024 15:00:40 GMT
content-type: text/css
vary: accept-encoding
last-modified: Tue, 26 Nov 2024 15:00:38 GMT
strict-transport-security: max-age=300
x-amz-replication-status: PENDING
cache-control: max-age=630720000, public
via: 1.1 31467e378930bcac2417aea59659f7e6.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H3 200 collect
cm.nordvpn.com/g/ 0
0 132ms
131ms Fetch 104.16.208.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.nordvpn.com/g/collect?v=2&tid=G-LEXMJ1N516&gtm=45je4bk0v874252800z86894354za200&_p=1733314797989&gcs=G111&gcd=13t3t3t3t7l1&npa=1&dma=0&tag_exp=101925629~102067555~102067808~102081485&cid=388292548.1733314798&ul=en-ca&sr=1600x1200&_fplc=0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=3&sid=1733314798&sct=1&seg=0&dl=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110&dr=https%3A%2F%2Fapi.kelkoogroup.net%2F&dt=NordVPN%E2%80%99s%20Cyber%20Monday%20deal%20%7C%20NordVPN&en=consent_status&ep.consent_ver=v2global&ep.cf_country=CA&ep.consent_status=accepted&ep.consent_settings=ES_FU_AN_AD_ADUD_ADPE&ep.placement=cookie_consent&_et=121&tfd=4446

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LEXMJ1N516

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.208.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
cf-ray: 8ecbbf77ba64a22e-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Wed, 04 Dec 2024 12:19:59 GMT
server: cloudflare
priority: u=1,i

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 231 KB
82 KB 72ms
72ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-12123059&l=dataLayer&cx=c&gtm=45He4bk0v6894354za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WX5CH8

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dae1c164549e68d3b5096e006ada108cf6e817a48a8b10c68e0865be649dc857

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Wed, 04 Dec 2024 12:19:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 04 Dec 2024 12:19:59 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 04 Dec 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 84418
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 favicon-32x32.png
sb.nordcdn.com/m/263daefeb45d3880/original/ 601 B
1 KB 56ms
55ms Other
image/png 2606:4700::6810:9b6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sb.nordcdn.com/m/263daefeb45d3880/original/favicon-32x32.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9b6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed81053eb4b9f090fa93d5c381f581d684e4a539e9a7ee5680930883939bc1d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

cf-cache-status: DYNAMIC
age: 125033
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: w6f9Gr_S5lrcj7AEVWaprIgpDN6HXCGsunCyjtByDGmnN2kQJ8N_xg==
date: Wed, 04 Dec 2024 12:19:59 GMT
content-type: image/png
content-disposition: inline;filename="favicon-32x32.png"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-api-correlation-id: 24b10c1a-c59a-6f8c-ba9d-d9db1452a5f6
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 10ba2918c339c40dc987fef4e0ca1954.cloudfront.net (CloudFront)
cf-ray: 8ecbbf77d96742cf-EWR
permissions-policy: camera=(), geolocation=(), microphone=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 601
x-amz-cf-pop: JFK50-P9
server: cloudflare

GET
H2 200 favicon-32x32.ico
sb.nordcdn.com/m/c2970e7f852deac/original/ 4 KB
661 B 60ms
60ms Other
image/x-icon 2606:4700::6810:9b6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sb.nordcdn.com/m/c2970e7f852deac/original/favicon-32x32.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9b6f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf501d080fa31608ed7ae99d934acab7bc42082695711bd09032e3a1bd51aae6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
age: 135396
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: 7NCamCQaHDOl_Jjn0sE4fUdbPiVG-SH6zT0fkH3bX1DnhlsAJZmsPg==
date: Wed, 04 Dec 2024 12:19:59 GMT
content-type: image/x-icon
content-disposition: attachment;filename="favicon-32x32.ico"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-api-correlation-id: eb20191e-8b0d-d3ef-5e25-4b247d4cee2b
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 10ba2918c339c40dc987fef4e0ca1954.cloudfront.net (CloudFront)
cf-ray: 8ecbbf7849d342cf-EWR
permissions-policy: camera=(), geolocation=(), microphone=()
accept-ranges: bytes
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P9
server: cloudflare

GET
H2

200

activityi;dc_pre=COyvtueMjooDFbUsiAkduoEpbA;src=12123059;type=retar0;cat=purea0;ord=2148763687479;npa=1;auiddc=1843384359.1733314798;ps=1;pcor=1333725950;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw...
12123059.fls.doubleclick.net/ Frame 76F5
Redirect Chain

https://12123059.fls.doubleclick.net/activityi;src=12123059;type=retar0;cat=purea0;ord=2148763687479;npa=1;auiddc=1843384359.1733314798;ps=1;pcor=1333725950;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;...
https://12123059.fls.doubleclick.net/activityi;dc_pre=COyvtueMjooDFbUsiAkduoEpbA;src=12123059;type=retar0;cat=purea0;ord=2148763687479;npa=1;auiddc=1843384359.1733314798;ps=1;pcor=1333725950;uaa=;u...

0
0

101ms
100ms

Document
text/html

142.251.179.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12123059.fls.doubleclick.net/activityi;dc_pre=COyvtueMjooDFbUsiAkduoEpbA;src=12123059;type=retar0;cat=purea0;ord=2148763687479;npa=1;auiddc=1843384359.1733314798;ps=1;pcor=1333725950;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4bk0v9181811535z86894354za201zb6894354;gcs=G111;gcd=13t3t3t3t7l1;dma=0;tag_exp=101925629~102067555~102067808~102081485;epver=2;~oref=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-12123059&l=dataLayer&cx=c&gtm=45He4bk0v6894354za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.179.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f149.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nordvpn.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 737
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Dec 2024 12:20:00 GMT
expires: Wed, 04 Dec 2024 12:20:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Dec 2024 12:19:59 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12123059.fls.doubleclick.net/activityi;dc_pre=COyvtueMjooDFbUsiAkduoEpbA;src=12123059;type=retar0;cat=purea0;ord=2148763687479;npa=1;auiddc=1843384359.1733314798;ps=1;pcor=1333725950;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4bk0v9181811535z86894354za201zb6894354;gcs=G111;gcd=13t3t3t3t7l1;dma=0;tag_exp=101925629~102067555~102067808~102081485;epver=2;~oref=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;register_conversion=1;src=12123059;type=retar0;cat=purea0;ord=2148763687479;npa=1;auiddc=1843384359.1733314798;ps=1;pcor=1333725950;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noap...
ad.doubleclick.net/ 0
22 B 287ms
68ms Image
image/png 142.251.111.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=12123059;type=retar0;cat=purea0;ord=2148763687479;npa=1;auiddc=1843384359.1733314798;ps=1;pcor=1333725950;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4bk0v9181811535z86894354za201zb6894354;gcs=G111;gcd=13t3t3t3t7l1;dma=0;tag_exp=101925629~102067555~102067808~102081485;epver=2;~oref=https%3A%2F%2Fnordvpn.com%2Fspecial%2F%3Futm_medium%3Daffiliate%26utm_term%3D%26utm_content%3D3600909%26utm_campaign%3Doff15%26utm_source%3Daff8110?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f149.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nordvpn.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 04 Dec 2024 12:19:59 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"12962687114981704324"}],"aggregatable_trigger_data":[{"filters":[{"14":["12849875"]}],"key_piece":"0xffb3976ba5ce482a","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x1205069b4b347821","not_filters":{"14":["12849875"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.gcp.privacysandboxservices.com","debug_key":"630761852913686051","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"12962687114981704324","filters":[{"14":["12849875"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"12962687114981704324","filters":[{"14":["12849875"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"12962687114981704324","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"12962687114981704324","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["12123059"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: api.kelkoogroup.net
URL: blob:https://api.kelkoogroup.net/3ad71404-f453-4585-b50f-1161fc6aa8e3

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

44 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.kelkoogroup.net/	1970-01-21 10:14:10	Name: kelkooID Value: a4c626f-193919cd297-40fb31
.kelkoogroup.net/	1970-01-21 10:06:58	Name: datadome Value: awmhlwQXQQVkkUtXmVWVM_7U8Wt9ghiYVTErzOOxWqOo3TINJ0_Aukj1cFKXS63EHyW3knt2QBWECjCVeE3RGDwyEFT_cbIglwQO47j6859EYySlUJCKUcN20_2rAFBd
.ojrq.net/	1970-01-21 11:04:34	Name: brwsr Value: 12453ef8-b23a-11ef-bd83-9fc2311b2f71
.sjv.io/	1970-01-21 11:04:34	Name: brwsr Value: 12453ef8-b23a-11ef-bd83-9fc2311b2f71
nordvpn.sjv.io/	1970-01-21 05:47:46	Name: irld Value: LRLl2nXzbC0im3Bh1nAXYQQM0UvEwP%3A2TPwn1RC62ewx6XX5h
go.nordvpn.net/	1970-01-21 01:30:01	Name: aff_ran_url_15 Value: 902
go.nordvpn.net/	1970-01-21 11:04:34	Name: enc_aff_session_15 Value: ENC03d5fc08bf98fb28d7e498f49a099e03b2cb21a4211c944d5dbf1827ad6303df647912fe780f951e8569088fd11d05562be5da53d547746f72602d2e466fca494179ebe0476055fb613c1aa0e9bf240a03758df68f89a3d7326d69d5f9acf76cd6d1a9f4118dc2068d8d8e4404a3a8166f03048fb2487a7e3987ea58c4d7f52134572e7e6949de807e79c18f5eb3b5957341c5d27a5e409b0ed0efac8a93723c8c4e785497e0b7ec9fed5168216dd765123ea1297cc9bcefc6ac7b1eca8f5407c3482c88a6ea2efdde6d025f2ae2b688593578ddf7b7c2fb1465fe5f8a52d9f56800db0535
go.nordvpn.net/	1970-01-21 11:04:34	Name: ho_mob Value: eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMzEiLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggWDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBMaWtlIEdlY2tvKSBDaHJvbWUvMTMxLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJhY2NlcHRfbGFuZ3VhZ2UiOiJlbi1DQSxlbjtxPTAuOSIsImNvbm5lY3Rpb25fc3BlZWQiOiJ4ZHNsIn0=
.nordvpn.com/	1970-01-21 02:11:46	Name: aff_id Value: 8110
.nordvpn.com/	1970-01-21 02:11:46	Name: aff_transaction_id Value: 102f6dc4ab13901a89420b01de982e
.nordvpn.com/	1970-01-21 02:11:46	Name: nordvpn_aff_id Value: 8110
.nordvpn.com/	1970-01-21 02:11:46	Name: nordvpn_aff_transaction_id Value: 102f6dc4ab13901a89420b01de982e
.nordvpn.com/	1970-01-21 01:28:36	Name: __cf_bm Value: NQNSA426By_wkiJ1EkuGMZ6coJOX41DQOsV_GNoOqDM-1733314796-1.0.1.1-OZPJEp0mdYbr5C0jRi5MyIQl_Y8q05bfLGP992pCkkbPRODOQxTTcLoPpN0UbwBdB2Czlwx3U2YB087N4iki7PXMX2l5J1t.i3aA.iqxjMI
.nordvpn.com/	1970-01-21 10:14:10	Name: locale Value: en
.nordvpn.com/	1970-01-21 11:04:34	Name: nc Value: 1733349561262
.nordvpn.com/	1970-01-21 11:04:34	Name: nci Value: 28
.nordvpn.com/	1970-01-21 11:04:34	Name: consent Value: accepted%2CES_FU_AN_AD_ADUD_ADPE
.nordvpn.com/	1970-01-21 02:11:46	Name: at Value: a
.nordvpn.com/	1970-01-21 11:04:34	Name: nv_tri Value: TC_7708349332207343_1733314797663
.nordcdn.com/	1970-01-21 01:28:36	Name: __cf_bm Value: JBGzDfBeRzS1OBgoUV8LMY13zHiyZKsCV318XK3.v80-1733314797-1.0.1.1-2VxlMvWL6Q2coobeYNDLHrRXfGVUbzG0eeThS15QrZ2t1xlrGLNzjMart8csirOJtJYjKYdyyt5TztSfo4kgCw
.nordvpn.com/	1970-01-21 11:04:34	Name: _ga Value: GA1.1.388292548.1733314798
.nordvpn.com/	1970-01-21 01:38:39	Name: font-css-en Value: true
.nordvpn.com/	1970-01-21 11:04:34	Name: nv_trs Value: 1733314797664_1733314798363_1_6
.nordvpn.com/	1970-01-21 03:38:10	Name: _gcl_au Value: 1.1.1843384359.1733314798
.nordvpn.com/	1970-01-21 03:38:10	Name: _uetvid Value: 40t115uzoavs519wd8kvrco0bg4q3g14
.nordvpn.com/	1970-01-21 01:30:01	Name: _uetsid Value: 40t1d8kvoavs519wrco0bg4q3g1415uz
.nordvpn.com/	1970-01-21 03:38:10	Name: _chmsc Value: %2640t1d8kvoavs519wrco0bg4q3g1415uz%2640t115uzoavs519wd8kvrco0bg4q3g14
.nordvpn.com/	1970-01-21 02:11:44	Name: _adal Value: %7B%22et%22%3A1733314798795%2C%22so%22%3A%22api.kelkoogroup.net%22%2C%22me%22%3A%22referral%22%2C%22ca%22%3A%22referral%22%2C%22co%22%3A%22https%3A%2F%2Fapi.kelkoogroup.net%2F%22%2C%22ke%22%3A%22(not%20set)%22%2C%22cg%22%3A%22Referral%22%2C%22sid%22%3A%225slox41r-okc4-5vod-iof0-kiei7lpok9h0%22%2C%22duid%22%3A%22tlv55slk-sb1q-tb5o-ujqk-llgyf12qmrqi%22%7D
.doubleclick.net/	1970-01-21 11:04:34	Name: IDE Value: AHWqTUmOy_C6MJo8eIyJyjZGlG-beHgtiqlex4VMZq_AqzT4ZaTvHLcvUDGVK0Sh
.nordvpn.com/	1970-01-21 11:04:34	Name: _ga_LEXMJ1N516 Value: GS1.1.1733314798.1.1.1733314799.59.0.0
.nordvpn.com/	1970-01-21 05:50:39	Name: FirstSession Value: source%3Daff8110%26campaign%3Doff15%26medium%3Daffiliate%26term%3D%26content%3D3600909%26hostname%3Dnordvpn.com%26date%3D20241204%26query%3Dnull
.nordvpn.com/	1970-01-21 05:50:39	Name: CurrentSession Value: source%3Daff8110%26campaign%3Doff15%26medium%3Daffiliate%26term%3D%26content%3D3600909%26hostname%3Dnordvpn.com%26date%3D20241204%26query%3Dnull
.doubleclick.net/	1970-01-21 02:11:46	Name: ar_debug Value: 1
.doubleclick.net/	1970-01-21 05:47:46	Name: receive-cookie-deprecation Value: 1
.adsrvr.org/	1970-01-21 10:14:10	Name: TDID Value: d6ef3ff2-86e5-41bb-8f35-34f92ac0cec1
.adnxs.com/	1970-01-21 11:04:34	Name: receive-cookie-deprecation Value: 1
.casalemedia.com/	1970-01-21 10:14:10	Name: CMID Value: Z1BI8dHM54oAAD6XAq4kRwAA
.casalemedia.com/	1970-01-21 03:38:10	Name: CMPS Value: 1447
.casalemedia.com/	1970-01-21 03:38:10	Name: CMPRO Value: 1447
.rubiconproject.com/	1970-01-21 10:14:10	Name: audit_p Value: 1\|y5DN4my9gmnFXjWud2a41Gj4WhkVFasC6mA5DbOPdzgQ1nTWsk2hDYv/T0yI5HyZzcHKuYvdKBowHTRO1/p4iHX0qfg68IpFQAPcN3ARK86Za8L6cdth83L6uVV7dsRs9YzXywfQ0hYL0459xER8Fo+FBra//4nfXPMR5zlE8G/REvsM2ra73MRmS8gGs6ylTlon0IrnE1p4+byUJuUHKNl4Am3SUH3rwETMVR8lnVPictVKI3nW/ZSmfFa9k+2RfCCm1vF3Tgn8ih/oL8+08tuVaVkDFDbShAUs62yL6R/QD5U7tEfUTQ==
.rubiconproject.com/	1970-01-21 10:14:10	Name: khaos Value: M49UVO7D-1L-EJ0C
.rubiconproject.com/	1970-01-21 10:14:10	Name: khaos_p Value: M49UVO7D-1L-EJ0C
.rubiconproject.com/	1970-01-21 10:14:10	Name: audit Value: 1\|y5DN4my9gmnFXjWud2a41Gj4WhkVFasC6mA5DbOPdzgQ1nTWsk2hDYv/T0yI5HyZzcHKuYvdKBowHTRO1/p4iHX0qfg68IpFQAPcN3ARK86Za8L6cdth83L6uVV7dsRs9YzXywfQ0hYL0459xER8Fo+FBra//4nfXPMR5zlE8G/REvsM2ra73MRmS8gGs6ylTlon0IrnE1p4+byUJuUHKNl4Am3SUH3rwETMVR8lnVPictVKI3nW/ZSmfFa9k+2RfCCm1vF3Tgn8ih/oL8+08tuVaVkDFDbShAUs62yL6R/QD5U7tEfUTQ==
.adsrvr.org/	1970-01-21 10:14:10	Name: TDCPM Value: CAESFwoIYXBwbmV4dXMSCwj-iLa5xue-PRAFEhYKB3J1Ymljb24SCwiMi5adgJrKPRAFEhUKBmdvb2dsZRILCLSbgqOAmso9EAUSFQoGY2FzYWxlEgsImM6WnYCayj0QBRgFIAEoAzILCPjimMqWmso9EAVCDyINCAESCQoFdGllcjIQAVoHY3lmcG10c2AB

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.kelkoogroup.net/publisher/shopping/v2/link-monetizer/link?country=ca&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fnordvpn.com&custom1=c273596042e5600da783f216c18ceda397de3984c7f3b9d4523b9c06c8ae5aaa&publisherSubId=fpaAbCWBDmMX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com(Line 28) Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10549.sellsnow.site
12123059.fls.doubleclick.net
65674e4462251d1db03ec8a9.webloader.smooch.io
ad.doubleclick.net
api.kelkoogroup.net
api.yadore.com
ca-go.kelkoogroup.net
cdn.smooch.io
cm.nordvpn.com
d.nordvpn.com
dd.kelkoogroup.net
go.nordvpn.net
googleads.g.doubleclick.net
ic.nordcdn.com
m.serves.2fh.co
nordvpn.com
nordvpn.sjv.io
plorexdry.com
s1.nordcdn.com
sb.nordcdn.com
shopbuttler.com
stats.g.doubleclick.net
td.doubleclick.net
visit.nordvpn.com
web-api.nordvpn.com
ww99.2fh.co
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.ojrq.net
api.kelkoogroup.net
104.16.208.203
139.177.202.97
142.251.111.149
142.251.179.149
172.232.31.180
18.67.76.12
23.21.51.144
2606:4700:3034::6815:2953
2606:4700::6810:9b6f
2606:4700::6810:9c6f
2607:f8b0:4004:c08::66
2607:f8b0:4004:c17::61
2607:f8b0:4004:c17::9c
2607:f8b0:4004:c1b::5e
2607:f8b0:4004:c1b::9c
2607:f8b0:4004:c1d::6a
2607:f8b0:4004:c21::9a
2a01:4f8:2190:2664::
3.162.125.109
3.167.112.89
34.95.127.121
35.227.211.136
52.84.18.77
69.16.230.227
88.99.112.2
95.211.116.26
126007e297357c4fe92ad97186643ba9b532381fbd9cee1451fe9aa841d5e81f
133d9660262505884ba3e7beb7b22543fdb3887633f59225c15ecb262f665e70
1470fbce81226e1cf7776b3c45e31fb4cb8d7bf11a1e8c00881b1dcd3c151d37
1aed81ea72182da0afa47c5a2ef96f197b4eb49f57d2187cea4bad5ee1b16299
1b068a7dd37b25b5ec551ca3f58e033fb0fef3231cd9fb2065eb0f76fdb02d18
1bf681dbb3f6e509e8fccef3f50d3aa1c531747562ecea5e98fa5af4e3fc2cc3
24809ad6e4f9c629ccffef8595c455ed8752369d99233e107ad5a8ba29376cf6
299f553fb82dd334a7b0c759ae7d87ad2bfd64f4d499494e8d68795bfb7d061c
38ab263da7c8192b85ca90d0985f8845920ab04668a88fdcdc31d5a42176c3da
39656b9b32d6520b8a7390daef9db51c60e286b19ede3127d7b908751b187565
3adcbf497d82735bcfe4dbee7a8f942382b4199f5506f4bc73f67f443d73ec99
3bb836000f6989cfeb160c51c122808fcca859be990a48e5fbb5e5b247132472
428cf1a8dc0d1063a7576688d547bf7ebc70aee941fc033c659173da0d4293e4
447076958c0d6f9ad13677ae5720e539fc71f1ca18e55eff2e24950ed241fd11
498caf46dd9f0fb9556ee364b2faf366fad8d5d1ff123e478db9f7b79a23b946
4d392f9691ae4316fa5b8f7fbe9fa46f46d5854472cfc87ec4c265d348f47b78
4d82338cc53421f1277ced22892b56e64d0cefde2ceaf8d7a3d9cabffb7baab0
4f615e21972aa9a35750b2fe6c754682924ed4d489b9a559740a651921a206ba
616c2cf1d800272ca2b16ff599be6caabac352d7b314f4f8ef70d93df289ce6b
6c2bb2372e08623bbd09c91c41be71a2d9d2ffa73aa8b18aeccdc937c017ea0a
6db2bd3b49f2ac926b33500b0491caba8e2b35c0a2456068c5ebfea96bc50c34
71867ba089cf906c39bb6a75c67ee28a3f833ec3d4bb70d8e7208a47269286e7
75f28438681332b67561059131289f90d029016eec52cb8fc0f2a5b37ab7d08c
7cf5c5905070e199644d911dd8a59d7f795d25a113704c43f70dd5ed50772efe
801a30988e4d3e66a4cf1177739901bf3c25311aec4a10cb90ecd2b6e0d535a6
83b017bb584a673095864665dab48414845b493d2e6b8c5408146c24f5c4c2a6
8454f71d2a59768c37cb0c1e9a5bc8a52ea095c859e8160bedf9cfef4b9afcc9
89b8f4a649944c30e0f2d128eb610458bcb5cb16561eaa663bc3a36e489c932c
8ce610b6b3e8f427d6c90800ddea2615243ca23406e8edd013124649f72dcfad
9cd46bd882ff69696adb5cf7d4efba4fde6068e5265a58c019c1574751087a62
a35faebbe004de158817c4bb87a03cb954b9bdfbdae6df5bbed21a0c3ebe3358
a625e85dcafc5cf540d05be714aef8716884388dfea3a6884cf1785d42659990
a8c621ca3fca90b6922fd317f4969bb90437e8b1b2a270dc44181f0bb06525dc
ad9204173dbcc636d15481b3f1419d0b11094b0f7727a749394de34e332b683f
b3877b82b722930323b0e4b33b9e2284e44533c0f07b1dde2c5f7634c7828d78
b4e4b4b4e76670caf3e6a1ee668452a49c89c078283b628ff39c4d387ddee125
b8a938f9dae084bc34cbd7a134dcb30f4163bc13230e6ab2a808f08df1428523
ba3b9524c54ed2d1c6f5043ca30cfa85542c069ec08241969a0b08073c146fdc
bd15720ff315cd5b9f9a5f24020cbdb3ab9a3c2f6b5a9a17ca177efe26bf62de
bf501d080fa31608ed7ae99d934acab7bc42082695711bd09032e3a1bd51aae6
c7c0b48a5a0f3fbf188fb1f003a10a87e9c2582ce384bb049c95ec02a1bf0cb9
c8e24310b0e306003276b69c77726f8c30d61ab75bc1cac841e36e999c43bb0f
cac3b60c321f2493e73a2573f9fd876b71a9ecc7569732086e55ab501771762c
ccea3081f7eb54a2ff1982aa42bafbf54104f847c51a553963fc63a4e81e55fd
d23cbff70dd4a68416bff0bb406a57ddfb40dbce28e2eb9baa9957d2a841c1a6
d27b40c45db7b587c66c51d333f5c34e6cbf4afcf8074beec705f964c9f051ad
d3ccc30982ea9939ed0cb399402b51ab39982dbf3f82a2e51da3ec6f8a3abd7b
d73b9480d8d2debceaf26b4a3bff2b66f05b2f42075b84dda559de751d3fc16d
d7595e3aa753d0bf24a8651de5ccf172fec6e60e1c330f609ade7ba283a9edd3
d7f1d23a3fe2b6289b7b1bfeb088a055a0f2e509c8623be1de1ace030703beb8
dae1c164549e68d3b5096e006ada108cf6e817a48a8b10c68e0865be649dc857
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e62604c350cd9d4a810c70c4ec22e51fbd3fb3d0cca33290f111d99ab7204d63
e9716ecfff3a187485e4a048c95f0b12d98b08cabfff0159b68b3c5d0d83143c
ebe41c8acf4bee30bf5b6632807dea3a8107d27064f71f5c9b0f94a79976f313
ed81053eb4b9f090fa93d5c381f581d684e4a539e9a7ee5680930883939bc1d7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef68a4c769d924b2adeef0320397c2a9440d7925e6a995c5eabd9a846f23c3ee
f13a52ac713b0456d9549a49cdef54225d0be9eb799e0211b128ff85e70adef5
fe4cc4fc52330c5adf23489506400fbb0235444f71a5177ff5e18e0f4843e630
ff6a6561acd0662b535c9730241d7f98bbac7e06d61d52d541d3472bc856557d

nordvpn.com Open in urlscan Pro 104.16.208.203 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

95 Requests

98 %HTTPS

42 %IPv6

17 Domains

31 Subdomains

21 IPs

4 Countries

1050 kBTransfer

2638 kBSize

44 Cookies

10 Outgoing links

Page URL History

Redirected requests

95 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

nordvpn.com Open in urlscan Pro
104.16.208.203 Public Scan

Screenshot
Live screenshot

Full Image

95
Requests

98 %
HTTPS

42 %
IPv6

17
Domains

31
Subdomains

21
IPs

4
Countries

1050 kB
Transfer

2638 kB
Size

44
Cookies

95 HTTP transactions
3 data transactions